[OpenID] Trying to verify that my OpenID is valid

[Andrew Arnott]

Hi Dan,
Here's what I see on your OpenID...

   1. If an HTTP request comes in with Accept-Types that includes XRDS, you
   return the XRDS doc immediately rather than the HTML doc.  That's fine, but
   the content-type of your HTTP response is still text/html when it should
   be application/xrds+xml when you do this.  This is alone enough to break
   some/most RPs because they aren't expecting an XRDS document directly unless
   you fix the content-type.
   2. The XRDS document itself has the wrong XML namespace.  It should
   be xri://$xrds but you have xri://\\$xrds.  That's also enough alone to
   throw off RPs.
   3. Finally, you could be using HTML tags for discovery in order for RPs
   to recover from these discovery failures, but there aren't any.

Now, it may very well be that all these failings are due to the
library/extension that you're using and not directly your fault.  In which
case, please file bugs against the owner of the code you're using.
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - Voltaire


On Tue, Jan 13, 2009 at 4:47 PM, Dan Lyke <danlyke at flutterby.com> wrote:

> So I decided to try to drag my OpenID identity back out of the dusty
> recesses. I have a MediaWiki server, so I made sure I had Evan
> Prodromou's most recent MediaWiki extension, and typed "openid test"
> into Google.
>
> First response is:
>
> http://openidenabled.com/resources/openid-test/
>
> which I try, entering http://www.flutterby.net/User:DanLyke, and I get
>
>   Failed to discover any OpenID service.
>
> Okay, wget my URL, look in the headers, sure enough there's a
>
>   <meta http-equiv="X-XRDS-Location"
>   content="http://www.flutterby.net/Special:OpenIDXRDS/DanLyke" />
>
> Some further digging around reveals that, indeed, that document appears
> to be valid. So, strike "openidenabled.com" off my list of valid OpenID
> verifiers.
>
> Next  hit is a Google Code project, next one down is openidenabled.net,
> which says "Coming Soon".
>
> Third hit is
> http://winged.info/projects/news/plugins/openid/index.php?secret
>
> which gives me an internal parsing error.
>
> Okay, go to openid.com, find domain squatters, go to openid.net, and
> discover... oh, look, I can get an OpenID URL, but I still can't find a
> bloody OpenID consumer!
>
> I'm frustrated. When I last participated in the OpenID mailing list it
> was disintegrating into a whole bunch of features and technologies that
> I just didn't care about, but I figured leave it alone and let the dust
> settle and maybe something good would come out of it. Now I discover
> that bit-rot has set in and OpenID is either moribund or dead.
>
> What's happening here? And can I use OpenID yet, or is it still a
> far-off technology?
>
> Dan
> _______________________________________________
> general mailing list
> general at openid.net
> http://openid.net/mailman/listinfo/general
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-general/attachments/20090113/7112df03/attachment-0002.htm>