406 "Not Acceptable" error when using JanRain OpenID Library with Google

Question

Hello everybody,

I am using the latest Janrain openid library example and the discovery process seems to work well with Yahoo, myopenid.com and others...

But I am stuck with Google endpoint (https semicolon //www.google.com/accounts/o8/id). Consumer.php just returns a 406 apache error, before I am redirected to google's page.

All my installation is available here : http://www.coplango.com/vendor/openid/examples/

• Click on consumer to try the consumer example, but discovery.php fails the same way,proving it happens during discovery...
• You can also check detect.php to check my installation - The HTTP fetching test fails with a 503 because it tries to reach an address which returns a 503. Rest is fine.

I supposed it was down to php-yadis specifying Accept: application/xrds+xml header but I checked the code and other types are also accepted such text/html and application/xhtml+xml...

Anyone came accross this ?

Any clue ?

Thank you very much !!!

Answer 1

running the consumer example at my machine, i get the following error:

Got no response code when fetching https://www.google.com/accounts/o8/id
CURL error (60): SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

this means curl fails verifying google's https server certificate. you can workaround this by either providing curl with CA certificates to verify google's certificate via CURLOPT_CAINFO/CURLOPT_CAPATH, or - easier - stop validating the cert via CURLOPT_SSL_VERIFYPEER. the following change in Auth/Yadis/ParanoidHTTPFetcher.php accomplishes latter for me:

--- ParanoidHTTPFetcher.php.orig        2009-04-22 02:31:20.000000000 +0800
+++ ParanoidHTTPFetcher.php     2009-09-30 22:35:24.093750000 +0800
@@ -127,6 +127,9 @@
                         Auth_OpenID_USER_AGENT.' '.$curl_user_agent);
             curl_setopt($c, CURLOPT_TIMEOUT, $off);
             curl_setopt($c, CURLOPT_URL, $url);
+
+            // don't verify server cert
+            curl_setopt($c, CURLOPT_SSL_VERIFYPEER, FALSE);

             curl_exec($c);

of course, your curl installation must also support ssl - check your phpinfo(). also, if CURLOPT_SSL_VERIFYPEER is disabled, CURLOPT_SSL_VERIFYHOST may also need to be TRUE or FALSE.

see also http://www.openrest.eu/docs/openid-not-completely-enabled-for-google.php (via the Related http://stackoverflow.com/questions/818063/why-doesnt-google-openid-provider-work-with-php-openid-on-my-server).

Answer 2

Ok,

I have investigated further and it seems to be down to my provider, who returns a 406 error if any string containing the death word "/id" is passed as GET parameter. Took me days to figure out it was not down to openid !!

For info I am using PlanetHoster, if anyone else ever comes accross this. I have sent them a ticket request and waiting for their answer.