What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

Steam now supports using an account as an OpenID. However this doesn't work on any Stack site.

For example, I try to log into Area51 just to try out the Steam OpenID in practice. Here's the error returned:

Unable to log in with your OpenID provider:

The OpenID Provider issued an assertion for an Identifier whose discovery information did not match. Assertion endpoint info: ClaimedIdentifier: http://steamcommunity.com/openid/id/76561197999083260 ProviderLocalIdentifier: http://steamcommunity.com/openid/id/76561197999083260 ProviderEndpoint: https://steamcommunity.com/openid/login OpenID version: 2.0 Service Type URIs: Discovered endpoint info: [{ ClaimedIdentifier: http://specs.openid.net/auth/2.0/identifier_select ProviderLocalIdentifier: http://specs.openid.net/auth/2.0/identifier_select ProviderEndpoint: https://steamcommunity.com/openid/login OpenID version: 2.0 Service Type URIs: http://specs.openid.net/auth/2.0/server },]

share|improve this question
2  
+1 Repro'd this on SuperUser, although this is most likely an issue with Steam, and not with the SO network. –  Jon Seigel Jul 4 '10 at 17:34
16  
Note that if this is fixed, it could be a good idea to add it to the default providers for the gaming site, when it will go out of beta. –  Gnoupi Jul 4 '10 at 19:43
    
Does this work on odata.stackoverflow.com? I think we may be running a slightly later version of the open id comp there –  waffles Jul 5 '10 at 4:12
    
@waffles: I tried it on there. All it does is go back to the login page without actually logging in (putting in the Steam OpenID URL again takes me to a Steam page where I am logged in). So I'm guessing that there is an error, but it's not being reported. Also, even for me to get that far, I had to disable NoScript's XSS stuff, which I didn't have to do on SuperUser. –  Jon Seigel Jul 5 '10 at 4:25

2 Answers 2

up vote 7 down vote accepted

SteamCommunity.com has a buggy OpenID Provider. Specifically, as we can see from Jonathon's question:

Assertion endpoint info: 
    ClaimedIdentifier: http://steamcommunity.com/openid/id/76561197999083260 
    ProviderLocalIdentifier: http://steamcommunity.com/openid/id/76561197999083260 
    ProviderEndpoint: https://steamcommunity.com/openid/login 
    OpenID version: 2.0 
    Service Type URIs: 
Discovered endpoint info: 
    ClaimedIdentifier: http://specs.openid.net/auth/2.0/identifier_select 
    ProviderLocalIdentifier: http://specs.openid.net/auth/2.0/identifier_select
    ProviderEndpoint: https://steamcommunity.com/openid/login 
    OpenID version: 2.0 
    Service Type URIs: http://specs.openid.net/auth/2.0/server

The Provider is issuing identifiers to their users that are OP Identifiers instead of Claimed Identifiers. Any relying party that accepts Steam OpenIDs are buggy and likely have alarming security holes since they are not verifying assertions properly.

I have reported this to Steam.

Technical details

The identifiers they are issuing have XRDS documents that think they can be both OP Identifiers and Claimed Identifiers:

<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS xmlns:xrds="xri://$xrds" xmlns="xri://$xrd*($v*2.0)">
    <XRD>
        <Service priority="0">
            <Type>http://specs.openid.net/auth/2.0/server</Type>    
            <URI>https://steamcommunity.com/openid/login</URI>
        </Service>
        <Service priority="10">
            <Type>http://specs.openid.net/auth/2.0/signon</Type>
            <URI>https://steamcommunity.com/openid/login</URI>
        </Service>

    </XRD>
</xrds:XRDS>

But this is specifically broken by the OpenID 2.0 spec, section 7.3.2.2:

Once the Relying Party has obtained an XRDS document, it MUST first search the document (following the rules described in [XRI_Resolution_2.0]) for an OP Identifier Element. If none is found, the RP will search for a Claimed Identifier Element.

and by section 11.2:

If the Claimed Identifier is included in the assertion, it MUST have been discovered by the Relying Party and the information in the assertion MUST be present in the discovered information. The Claimed Identifier MUST NOT be an OP Identifier.

share|improve this answer
    
For information, your Steam support ticket is private, we don't have permission to view it, but thank you for reporting it. –  Gnoupi Jul 5 '10 at 13:56
3  
This should be fixed now. I am able to add my Steam account as an OpenID provider on StackOverflow.com. –  Joe Ludwig Jul 7 '10 at 2:23
1  
@joe: no repro, it fails with error "Invalid claimed_id or identity (Contact: , Reference: )" –  badp Jul 15 '10 at 22:22
    
It's working fine for me (just used it to log in and post this comment.) Is the failure case possibly browser-specific? –  Joe Ludwig Jul 25 '10 at 15:00
    
I imagine they've fixed it then. :) It's not browser-specific. –  Andrew Arnott Jul 25 '10 at 17:13
    
I had the same error with myOpenID. I tried several times (I had to delete cookies each time) with no luck and then it worked. The first thing I did after logging in to SO was to change the alternative openid from myOpenID to Google (both of my openids were myOpenIDs). –  Piotr Dobrogost Aug 4 '11 at 18:48
    
It works now when I use Steam with DotNotOpenAuth; the only issue is the claim ID comes back non-HTTPS, so DNOA denies it if you have requireSsl. However, you can workaround it by specifically detecting the Steam Claim ID and temporarily disable requireSsl for the request, though it's super hacky. –  subkamran Jun 8 at 4:33

Interesting. Can you try here:

http://test-id.org/OP/Sreg.aspx

and email the logs?

share|improve this answer
    
I tried this and got the same error as in the question. So this is definitely an issue with Steam. –  Jon Seigel Jul 5 '10 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .