ugh, yes every provider should support check_authentication.<div><br><br><div class="gmail_quote">On Thu, Aug 26, 2010 at 10:11 PM, Yitzchak Scott-Thoennes <span dir="ltr"><<a href="mailto:sthoenna@gmail.com">sthoenna@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">In the OpenID Authentication 2.0 spec, the Relying Party is obligated<br>
to use direct verification to check the signature when it does not have<br>
the association stored.<br>
<br>
But is an OP required to support check_authentication?<br>
<br>
There are certain providers that appear to not support it, always<br>
returning a failure.<br>
<br>
There are other providers that include mode as a signed attribute,<br>
and so reject the check_authentication as having an invalid signature<br>
(since the mode has changed).<br>
<br>
Can someone familiar with this comment, please?<br>
_______________________________________________<br>
specs mailing list<br>
<a href="mailto:specs@lists.openid.net">specs@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs</a><br>
</blockquote></div><br></div>