What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

I have been trying to set up an OpenID provider on my server which integrates with LDAP. I found Community-ID (http://source.keyboard-monkeys.org/projects/show/communityid) which seems to do exactly what I want with the exception that it does not work with the stackoverflow website. Whenever I try and log in to stackoverflow, I enter the identity URL, get taken to my servers login page, then redirected back to stackoverflow at which point I am presented with:

Unable to log in with your OpenID provider:
Unexpected HTTP status code 500 InternalServerError received in direct response.

The problem is easy to reproduce with the public community-id provider: http://www.community-id.org/. The only other site I have tested it with is slashdot which works fine. I have filed a bug with the community-id team but based on some testing I did at (http://test-id.net) I think the problem is that the community-id provider is not "sending properly formatted error responses to invalid direct request messages" (from test (http://test-id.net/OP/DirectMessageErrors.aspx)) as the error message is the same. Logs have not been very helpful (apache error/access, community id logs, etc) and I obviously cannot see the stackoverflow server logs.

I am not sure who's bug this is, community-id's or stackoverflow's. Has anybody seen anything similar before? Any suggestions for an alternate OpenID provider which supports an LDAP backend?

share|improve this question

migrated from stackoverflow.com Jun 7 '10 at 14:46

This question came from our site for professional and enthusiast programmers.

add comment

1 Answer

I just checked out community-id.org. Their site doesn't get much confidence from me. They fail at least one security test on test-id.org and they take new user registration passwords in cleartext HTTP instead of HTTPS.

Their HTTP server also can't handle HTTP/1.1 POST requests that include a 417 Expect Continue header, which is what causes some RPs such as StackOverflow to fail while logging in a community-id.org user. As it turns out, StackOverflow's OpenID library automatically "recovers" from this particular 417 failure by marking down to skip that header in the future. It only lasts for a little while though. What this means for you is that if you choose to continue using community-id.org, and stackoverflow gives an error when logging in, try again immediately and it should work.

share|improve this answer
add comment

You must log in to answer this question.