wordpress.com openid endpoint does not sign SReg attributes

• 

  chasemerick · Member · Apr 6, 2012 at 11:32 am

  • Copy link
  • Add topic to favorites

  Using the latest release of openid4java, attempting to retrieve SReg attributes from a wordpress.com OpenId endpoint always fails, because wordpress.com is not signing those attributes as required (or, strongly recommended?) by the spec.

  The exception message is:

  org.openid4java.message.MessageException: 0x100: Namespace declaration for extension http://openid.net/sreg/1.0 MUST be signed

  This issue appears to be shared by Atlassian’s Crowd, gerrit, and Paypal:

  https://jira.atlassian.com/browse/CWD-2707
  http://code.google.com/p/gerrit/issues/detail?id=1010
  http://code.google.com/p/openid4java/issues/detail?id=169

  Note that Google, Yahoo, and AOL all work properly with the same codebase; presumably, they are signing the attributes returned in the OpenID RP response. Until this is resolved, users of third-party sites that use openid4java that attempt to retrieve user attributes (email, name, etc) from wordpress.com will not be able to do so (the

  Cheers,

  – Chas
  Blog url: http://chasemerick.wordpress.com/

• 

  staff-blorbo · Staff · Apr 6, 2012 at 6:51 pm

  • Copy link

  Thanks for letting us know. I assume you’re using http://chasemerick.wordpress.com/ as your OpenID, is that correct?

• 

  chasemerick · Member · Apr 16, 2012 at 12:11 pm

  • Copy link

  Yes, that’s what I’d been using for testing (that, or http://cemerick.com, which may resolve to the same OpenID identity).

• 

  staff-blorbo · Staff · Apr 16, 2012 at 9:15 pm

  • Copy link

  Hm, that may very well be the problem.

  Does it work for you if you temporarily set the primary domain back to chasemerick.wordpress.com via Store -> Domains in your blog’s Dashboard?

• 

  chasemerick · Member · Apr 17, 2012 at 1:54 am

  • Copy link

  No. To avoid changing any settings for the live site, I tested with another wordpress.com site that has no custom domains associated with it. I get the same error, with the result that no extended attributes are accepted by the openid4java workflow.

  Good idea though!

• 

  staff-blorbo · Staff · Apr 17, 2012 at 6:30 pm

  • Copy link

  The WordPress blog used as an OpenID would have to be the same as your username, so chasemerick.wordpress.com is the only one that would work in this case.

  Would you be able to test that for just a quick second?

• 

  chasemerick · Member · Apr 17, 2012 at 7:03 pm

  • Copy link

  Nope, chasemerick.wordpress.com doesn’t work either (after taking cemerick.com off as the primary domain).

• 

  staff-blorbo · Staff · Apr 17, 2012 at 8:56 pm

  • Copy link

  Hm, that’s no good. Thanks for checking that for us, and we’ll look into this.