Janrain's PHP-OpenID and Google/Yahoo

Question

I'm using Janrain's PHP-OpenID 2.1.3, and I've managed to get it working with all the providers I have tried except for Google and Yahoo. The major difference here seems to be that Google and Yahoo, unlike most other providers, don't use a user-specific URL, but rather have the user discovery framework all on their end - which throws the default Janrain framework for a loop then it tries to begin the auth request.

From what I've seen it looks like it's probably the YADIS discovery that is throwing the error, which should be able to be bypassed since the discovery is on Google or Yahoo's end, but I'm not sure. This is all a big informal learning experience for me, and I haven't had any luck finding documentation that can help me on this one. Any tips would be greatly appreciated.

Edit: the specific problem I am having is that when the begin() function is called for the Google or Yahoo URL, I get a null return. This function is found in Auth/OpenID/Consumer.php for reference.

Answer 1

This library should work with Yahoo and Google just fine. You can see the online demo for this library and try it out yourself using "yahoo.com" or "https://www.google.com/accounts/o8/id" to test it out against these two OPs.

Google has along identifier to type in because they're still in beta and haven't pushed their OP Identifier to be just "google.com" yet.

Answer 2

I downloaded the latest libraries and I get the same failed results when using Yahoo!. I did not try Google.

If I try to use http://www.yahoo.com I get an error saying authorization failed, but it returns my correct me.yahoo.com url. If I try to login using my me.yahoo.com url then I get an error saying to enter a valid OpenID url.

Answer 3

Another potential difference is that Google and Yahoo use HTTPS and if your PHP or SSL installation is misconfigured (perhaps missing CA certs) then your OpenID code will fail to establish an association or complete the check_authentication call.

But without error messages or logs, I can't really tell what type of failure you're looking at.

Answer 4

Are you using the example RP? Can I suggest you submit a detailed bug at http://trac.openidenabled.com/trac/newticket?project=php-openid or a detailed enquiry via the mailing list.

The immediate_mode support indeed does work the libraries if implemented correctly. I (and others) would also be happy to help you on the OpenID IRC channel irc.reenode.net in #openid. My nickname is flaccid.

Answer 5

I agree on the certificate part - for me installing the ca-certificates package (on debian like systems: apt-get install ca-certificates ) and a webserver restart solved the google/yahoo issue. Not my idea, but instead suggested on stackoverflow :-)

Answer 6

It's because you don't have curl support enabled enabled in php. Without this, it can't get https content. At least, that's what I discovered. When I tried to get yahoo or google, it failed with an error message "Authentication error; not a valid OpenID," but when I enable php_curl, it works properly.

Answer 7

Make sure your server has curl with https protocol enabled. This solved it for me.

see this thread.

Here is a quick script to test it out. Upload on your server then acccess it via your browser.

<?php
error_reporting(E_ALL);
// create curl resource
$myurl = 'https://&lt;YOURACCOUNT&gt;.myopenid.com';
$curl_handle=curl_init();
curl_setopt($curl_handle,CURLOPT_URL, $myurl);
curl_setopt($curl_handle,CURLOPT_CONNECTTIMEOUT,2);
curl_setopt($curl_handle,CURLOPT_RETURNTRANSFER,1);
$buffer = curl_exec($curl_handle);


if (empty($buffer))
{
    print "Sorry, cannot access $myurl .<p>". curl_error($curl_handle);
}
else
{
    print $buffer;
}

curl_close($curl_handle);


?>

If it returns " Protocol https not supported or disabled in libcurl" then you know what to do.

I tried it using my gmail account and it works but it leads to a 301 permanent rediret, which makes sense.

Answer 8

Ok, I finally got to fix the library... I explained everything here (you can also download the php-openid library after my changes).

I needed to do what Paul Tarjan suggested but, also, I needed to modify the Auth_OpenID_detectMathLibrary and add the static keyword to a lot of functions. After that It seems to work perfectly although it is not an ideal solution... I think that someone should rewrite the whole library in PHP 5...

Answer 9

do we need ssl enabled site for google openid?

Answer 10

I had the same problem on Windows XP. Fixed by activating curl extension. To do this uncomment in php.ini the line

extension=php_curl.dll

by removing the ; in front of it if any. Restart apache.

Also on windows to work properly you need to define Auth_OpenID_RAND_SOURCE as null since in windows you don't have a random source. You can do this by adding the line

define('Auth_OpenID_RAND_SOURCE', null);

in CryptUtil.php before the first code line

if(!defined('Auth_OpenID_RAND_SOURCE')){

Even if the curl is not enabled the API should work by using instead the Auth_Yadis_PlainHTTPFetcher to communicat via HTTP. In the case of Google and Yahoo you need https, so it only works if open_ssl is enabled (Auth_Yadis_PlainHTTPFetcher::supportsSSL must return true).