ansaurus

Question

OpenID "Unsolicited assertions are not allowed from 1.0 OpenID Providers" error

Answer 1

A:

"unsolicited assertion" means that your application thinks AOL sent someone over with an id_res message without your application ever doing a checkid_setup for that identifier. I'll leave it to Andrew to say how DotNetOpenAuth deals with that or AOL.

('cuz it works in Python.)

keturn 2010-01-29 23:57:26

Answer 2

+1 A:

I believe what's going on here is that the OpenIdRelyingParty instance you use to create the authentication request is in stateless ("dumb") mode. That is, you pass null to its constructor, or you set Stateless="true" on one of the ASP.NET controls. But when the authentication response comes back, you process that response with an OpenIdRelyingParty instance that was created in stateful mode (you didn't pass null explicitly to its constructor).

This results in an incompatibility in the authentication response. The request is created with a lower level of security because the state required for that extra security is not available. But when the authentication response comes back, state is available so the security requirements are higher, and the response to the lower-level request is rejected.

It's a good idea to just create one OpenIdRelyingParty instance, store it in a static field somewhere, and then use it for all your logins. It's thread-safe and specifically designed for this. It will help you avoid this kind of problem in the future, and be a bit more performant as well.

By the way, I also expect you are explicitly setting SecuritySettings.MinimumRequiredOpenIdVersion = ProtocolVersion.V10 on the OpenIdRelyingParty instance after creating it, or else I don't think that stateless mode would have permitted working with AOL. Stateless mode RP at your site and OpenID 1.1 Providers are a low-security combination that DotNetOpenAuth defaults to disallowing because the protocol is vulnerable to replay attacks. Just so you know what you're overriding there (if you are in fact doing that).

(Wow. That was a lot of digging in the logs...)

Andrew Arnott 2010-02-02 05:01:11

You were right - I was using separate OpenIdRelyingParty instances to initiate and complete the login process, and one of them was not passing null in the constructor. I was operating under the assumption that a class that implements IDisposable should be disposed, so it's good to hear that it's safe to instantiate one static instance. I was using stateless because I was planning for a load-balanced environment - would you recommend implementing an IRelyingPartyApplicationStore in order to achieve safety from attacks with AOL and other OpenID 1.1 providers?

David 2010-02-02 15:34:25

I always recommend a state store if you can implement it. Otherwise, I'd leave OpenID 1.1 OP support at its stateless default of off. AOL ought to be about done with their 2.0 OP launch pretty soon here anyway.

Andrew Arnott 2010-02-03 00:01:58

ansaurus

tags:

views:

answers:

OpenID "Unsolicited assertions are not allowed from 1.0 OpenID Providers" error

related questions