12

Steam now supports using an account as an OpenID. However this doesn't work on any Stack site.

For example, I try to log into Area51 just to try out the Steam OpenID in practice. Here's the error returned:

Unable to log in with your OpenID provider:

The OpenID Provider issued an assertion for an Identifier whose discovery information did not match. Assertion endpoint info: ClaimedIdentifier: http://steamcommunity.com/openid/id/76561197999083260 ProviderLocalIdentifier: http://steamcommunity.com/openid/id/76561197999083260 ProviderEndpoint: https://steamcommunity.com/openid/login OpenID version: 2.0 Service Type URIs: Discovered endpoint info: [{ ClaimedIdentifier: http://specs.openid.net/auth/2.0/identifier_select ProviderLocalIdentifier: http://specs.openid.net/auth/2.0/identifier_select ProviderEndpoint: https://steamcommunity.com/openid/login OpenID version: 2.0 Service Type URIs: http://specs.openid.net/auth/2.0/server },]

Improve this question
4
  • 2
    +1 Repro'd this on SuperUser, although this is most likely an issue with Steam, and not with the SO network.
    – Jon Seigel
    Jul 4, 2010 at 17:34
  • 16
    Note that if this is fixed, it could be a good idea to add it to the default providers for the gaming site, when it will go out of beta.
    – Gnoupi
    Jul 4, 2010 at 19:43
  • Does this work on odata.stackoverflow.com? I think we may be running a slightly later version of the open id comp there
    – waffles
    Jul 5, 2010 at 4:12
  • @waffles: I tried it on there. All it does is go back to the login page without actually logging in (putting in the Steam OpenID URL again takes me to a Steam page where I am logged in). So I'm guessing that there is an error, but it's not being reported. Also, even for me to get that far, I had to disable NoScript's XSS stuff, which I didn't have to do on SuperUser.
    – Jon Seigel
    Jul 5, 2010 at 4:25

2 Answers 2

Reset to default
7

SteamCommunity.com has a buggy OpenID Provider. Specifically, as we can see from Jonathon's question:

Assertion endpoint info: 
    ClaimedIdentifier: http://steamcommunity.com/openid/id/76561197999083260 
    ProviderLocalIdentifier: http://steamcommunity.com/openid/id/76561197999083260 
    ProviderEndpoint: https://steamcommunity.com/openid/login 
    OpenID version: 2.0 
    Service Type URIs: 
Discovered endpoint info: 
    ClaimedIdentifier: http://specs.openid.net/auth/2.0/identifier_select 
    ProviderLocalIdentifier: http://specs.openid.net/auth/2.0/identifier_select
    ProviderEndpoint: https://steamcommunity.com/openid/login 
    OpenID version: 2.0 
    Service Type URIs: http://specs.openid.net/auth/2.0/server

The Provider is issuing identifiers to their users that are OP Identifiers instead of Claimed Identifiers. Any relying party that accepts Steam OpenIDs are buggy and likely have alarming security holes since they are not verifying assertions properly.

I have reported this to Steam.

Technical details

The identifiers they are issuing have XRDS documents that think they can be both OP Identifiers and Claimed Identifiers:

<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS xmlns:xrds="xri://$xrds" xmlns="xri://$xrd*($v*2.0)">
    <XRD>
        <Service priority="0">
            <Type>http://specs.openid.net/auth/2.0/server</Type>    
            <URI>https://steamcommunity.com/openid/login</URI>
        </Service>
        <Service priority="10">
            <Type>http://specs.openid.net/auth/2.0/signon</Type>
            <URI>https://steamcommunity.com/openid/login</URI>
        </Service>

    </XRD>
</xrds:XRDS>

But this is specifically broken by the OpenID 2.0 spec, section 7.3.2.2:

Once the Relying Party has obtained an XRDS document, it MUST first search the document (following the rules described in [XRI_Resolution_2.0]) for an OP Identifier Element. If none is found, the RP will search for a Claimed Identifier Element.

and by section 11.2:

If the Claimed Identifier is included in the assertion, it MUST have been discovered by the Relying Party and the information in the assertion MUST be present in the discovered information. The Claimed Identifier MUST NOT be an OP Identifier.

Improve this answer
7
  • For information, your Steam support ticket is private, we don't have permission to view it, but thank you for reporting it.
    – Gnoupi
    Jul 5, 2010 at 13:56
  • 3
    This should be fixed now. I am able to add my Steam account as an OpenID provider on StackOverflow.com.
    – Joe Ludwig
    Jul 7, 2010 at 2:23
  • 1
    @joe: no repro, it fails with error "Invalid claimed_id or identity (Contact: , Reference: )"
    – badp
    Jul 15, 2010 at 22:22
  • It's working fine for me (just used it to log in and post this comment.) Is the failure case possibly browser-specific?
    – Joe Ludwig
    Jul 25, 2010 at 15:00
  • I imagine they've fixed it then. :) It's not browser-specific.
    – Andrew Arnott
    Jul 25, 2010 at 17:13
  • I had the same error with myOpenID. I tried several times (I had to delete cookies each time) with no luck and then it worked. The first thing I did after logging in to SO was to change the alternative openid from myOpenID to Google (both of my openids were myOpenIDs).
    – Piotr Dobrogost
    Aug 4, 2011 at 18:48
  • It works now when I use Steam with DotNotOpenAuth; the only issue is the claim ID comes back non-HTTPS, so DNOA denies it if you have requireSsl. However, you can workaround it by specifically detecting the Steam Claim ID and temporarily disable requireSsl for the request, though it's super hacky.
    – kamranicus
    Jun 8, 2014 at 4:33
0

Interesting. Can you try here:

http://test-id.org/OP/Sreg.aspx

and email the logs?

Improve this answer
1
  • I tried this and got the same error as in the question. So this is definitely an issue with Steam.
    – Jon Seigel
    Jul 5, 2010 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .