I have an OpenID with MyOpenID, and I have a URL on my own domain to delegate to this MyOpenID, i.e. just a page containing

<link rel="openid.server" href="http://www.myopenid.com/server">
<link rel="openid.delegate" href="http://mysecretidentity.myopenid.com">

My own URL is my primary OpenID on the Trilogy; this has been working fine for ages. But as of just now, I'm not able to login to any of M+SOFU, receiving a "connection was reset before completed" when trying to retrieve the page from http://[site].com/users/authenticate/ after returning from myopenid.com.

Logging in with the (undelegated) MyOpenID works.

Logging in to Bitbucket with the delegated Id also works, suggesting this is a SOFU problem.

The standards (different browser, clear cookies, etc.) didn't help.


Unfortunately, when we upgraded from DotNetOpenID to DotNetOpenAuth, it added some security features that break delegation for some users, because they make the return URLs so absurdly long that they're rejected.

Andrew is aware of the issue and hopefully working on some config switches so we can turn this off.

When your users can't even log on, that is the ultimate in "security".. :)

edit: this should be fixed now, we are using the latest DotNetOpenAuth with this setting:

<!-- turns off extra unwanted security features which produce VERY long URLs -->
      <security protectDownlevelReplayAttacks="false" />
  • That's "Andrew" as in ...? – balpha Mar 16 '10 at 9:29
  • 2
    @balpha: probably as in "Andrew ARNOTT" (blog.nerdbank.net). see his ohloh profile (ohloh.net/accounts/aarnott). He manages the DotNetOpenAuth project. – VonC Mar 16 '10 at 11:58
  • @VonC: That looks about right, thanks. – balpha Mar 16 '10 at 13:13
  • I cannot login to SO, even after trying Andrew's suggestion – juan Mar 22 '10 at 18:13

As Jeff said, a new release will go out shortly that will resolve the issue. But you would do well to update your HTML snippet, which would not only avoid the problem now, but make you more secure at the same time.

<link rel="openid2.provider" href="http://www.myopenid.com/server">
<link rel="openid2.local_id" href="http://mysecretidentity.myopenid.com">
  • Thanks a lot, Andrew. I did that, and it works like a charm. – balpha Mar 18 '10 at 6:19
  • could i use both openid.server/openid.delegate as well as openid2.provider/openid2.local_id? or do i need to pick one? – Kip Mar 21 '10 at 19:19
  • They certainly may both be present. RPs that support 2.0 will ignore the 1.1 tags when 2.0 tags are present. – Andrew Arnott Mar 21 '10 at 22:12
  • I've added this code to my site and I still can't log into SO. It works on Meta, though. – scribu Mar 21 '10 at 22:54
  • I still cannot login neither – juan Mar 22 '10 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .