What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

I have an OpenID with MyOpenID, and I have a URL on my own domain to delegate to this MyOpenID, i.e. just a page containing

<html><head>
<link rel="openid.server" href="http://www.myopenid.com/server">
<link rel="openid.delegate" href="http://mysecretidentity.myopenid.com">
</head><body></body></html>

My own URL is my primary OpenID on the Trilogy; this has been working fine for ages. But as of just now, I'm not able to login to any of M+SOFU, receiving a "connection was reset before completed" when trying to retrieve the page from http://[site].com/users/authenticate/ after returning from myopenid.com.

Logging in with the (undelegated) MyOpenID works.

Logging in to Bitbucket with the delegated Id also works, suggesting this is a SOFU problem.

The standards (different browser, clear cookies, etc.) didn't help.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Unfortunately, when we upgraded from DotNetOpenID to DotNetOpenAuth, it added some security features that break delegation for some users, because they make the return URLs so absurdly long that they're rejected.

Andrew is aware of the issue and hopefully working on some config switches so we can turn this off.

When your users can't even log on, that is the ultimate in "security".. :)

edit: this should be fixed now, we are using the latest DotNetOpenAuth with this setting:

<!-- turns off extra unwanted security features which produce VERY long URLs -->
<dotNetOpenAuth>
  <openid>
    <relyingParty>
      <security protectDownlevelReplayAttacks="false" />
    </relyingParty>
  </openid>
</dotNetOpenAuth>
share|improve this answer
    
That's "Andrew" as in ...? –  balpha Mar 16 '10 at 9:29
2  
@balpha: probably as in "Andrew ARNOTT" (blog.nerdbank.net). see his ohloh profile (ohloh.net/accounts/aarnott). He manages the DotNetOpenAuth project. –  VonC Mar 16 '10 at 11:58
    
@VonC: That looks about right, thanks. –  balpha Mar 16 '10 at 13:13
    
I cannot login to SO, even after trying Andrew's suggestion –  jmfsg Mar 22 '10 at 18:13

As Jeff said, a new release will go out shortly that will resolve the issue. But you would do well to update your HTML snippet, which would not only avoid the problem now, but make you more secure at the same time.

<html><head>
<link rel="openid2.provider" href="http://www.myopenid.com/server">
<link rel="openid2.local_id" href="http://mysecretidentity.myopenid.com">
</head><body></body></html>
share|improve this answer
    
Thanks a lot, Andrew. I did that, and it works like a charm. –  balpha Mar 18 '10 at 6:19
    
could i use both openid.server/openid.delegate as well as openid2.provider/openid2.local_id? or do i need to pick one? –  Kip Mar 21 '10 at 19:19
    
They certainly may both be present. RPs that support 2.0 will ignore the 1.1 tags when 2.0 tags are present. –  Andrew Arnott Mar 21 '10 at 22:12
    
I've added this code to my site and I still can't log into SO. It works on Meta, though. –  scribu Mar 21 '10 at 22:54
    
I still cannot login neither –  jmfsg Mar 22 '10 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .