After having created a custom SSO system for my company, I decided to take it for a spin and see how compliant it is. The interop testing at http://test-id.org for attribute exchange passed, so I then tried to create a new SO account with it.
The account was created successfully, the name was set properly but the email address didn't get used (it didn't show up on my profile page).
When SO makes the
checkid_setup call, it asks for both name and email (using both
[ns.alias3] => http://openid.net/srv/ax/1.0 [alias3.if_available] => alias1,alias2,alias3,alias4 [alias3.mode] => fetch_request [alias3.type.alias1] => http://schema.openid.net/namePerson [alias3.count.alias1] => 1 [alias3.type.alias2] => http://schema.openid.net/contact/email [alias3.count.alias2] => 1 [alias3.type.alias3] => http://axschema.org/namePerson [alias3.count.alias3] => 1 [alias3.type.alias4] => http://axschema.org/contact/email [alias3.count.alias4] => 1
In response to that request my server sends the following back:
[ns.ax] => http://openid.net/srv/ax/1.0 [ax.mode] => fetch_response [ax.type.alias1] => http://schema.openid.net/namePerson [ax.count.alias1] => 1 [ax.value.alias1.1] => Jack [ax.type.alias2] => http://schema.openid.net/contact/email [ax.count.alias2] => 1 [ax.value.alias2.1] => firstname.lastname@example.org
My server chooses to recognize only the
openid types, so the
axschema types are omitted from the response. All above fields are signed and I'm pretty sure the email address has not been used before to create an SO account.
My question is: based on the above, is there anything that should be done in another way?