| Subject: | The parameters for a direct request to the OP in case of negative response from OP. |
Hello authors
I'm kazumi.Hayakawa ,a web engineer japan.
I report the possibility of a bug in Consumer.pm.
Below is in the specs of OpenID 2.0.
11.4.2.1. Request Parameters
Exact copies of all fields from the authentication response, except
for "openid.mode".
But current Consumer.pm targets openid.signed field that OP sent.
(see to 846 line from 815 line of Consumer.pm ver. 1.03.)
Therefore openid.ns which is required item isn't sometimes included in
a request in my case.
Please see bellow.
I can see that the library of java and php copies all fields.
#### VerifyRequest.java (Ver. 0.9.5.593) ####
private static ParameterList convertAuthSuccessParams(AuthSuccess
authResp)
{
ParameterList params = new
ParameterList(authResp.getParameterMap());
params.set(new Parameter("openid.mode", MODE_CHKAUTH));
return params;
}
########################
#### Consumer.php (Ver. 2.2.2) ####
function _createCheckAuthRequest($message)
{
$signed = $message->getArg(Auth_OpenID_OPENID_NS, 'signed');
if ($signed) {
foreach (explode(',', $signed) as $k) {
$value = $message->getAliasedArg($k);
if ($value === null) {
return null;
}
}
}
$ca_message = $message->copy();
$ca_message->setArg(Auth_OpenID_OPENID_NS, 'mode',
'check_authentication');
return $ca_message;
}
###################
Please confirm and fix if this is problem.
Distribution name
Net-OpenID-Consumer-1.03
Perl version
$ perl -v
This is perl, v5.8.8 built for i386-linux-thread-multi
Copyright 1987-2006, Larry Wall
Perl may be copied only under the terms of either the Artistic License
or the
GNU General Public License, which may be found in the Perl 5 source
kit.
Complete documentation for Perl, including FAQ lists, should be found
on
this system using "man perl" or "perldoc perl". If you have access to
the
Internet, point your browser at http://www.perl.org/, the Perl Home
Page.
$
OS version
$ uname -a
Linux c0093i0.cus.y3c.agilit-hosting.com 2.6.18-128.el5PAE #1 SMP Wed
Dec 17 12:02:33 EST 2008 i686 i686 i386 GNU/Linux
$
Thank you.