? modules/openid/translations
Index: modules/openid/openid.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/openid/openid.module,v
retrieving revision 1.19.2.9
diff -u -9 -p -r1.19.2.9 openid.module
--- modules/openid/openid.module	7 Dec 2009 12:52:22 -0000	1.19.2.9
+++ modules/openid/openid.module	6 Apr 2010 19:21:44 -0000
@@ -233,24 +233,30 @@ function openid_complete($response = arr
     $claimed_id = $_SESSION['openid']['claimed_id'];
     unset($_SESSION['openid']['service']);
     unset($_SESSION['openid']['claimed_id']);
     if (isset($response['openid.mode'])) {
       if ($response['openid.mode'] == 'cancel') {
         $response['status'] = 'cancel';
       }
       else {
         if (openid_verify_assertion($service['uri'], $response)) {
-          // If the returned claimed_id is different from the session claimed_id,
-          // then we need to do discovery and make sure the op_endpoint matches.
-          if ($service['version'] == 2 && $response['openid.claimed_id'] != $claimed_id) {
-            $disco = openid_discovery($response['openid.claimed_id']);
-            if ($disco[0]['uri'] != $service['uri']) {
-              return $response;
+          if ($service['version'] == 2) {
+            // OpenID Authentication, section 11.2:
+            // If the returned Claimed Identifier is different from the one sent
+            // to the OpenID Provider, we need to do discovery on the returned
+            // identififer to make sure that the provider is authorized to
+            // respond on behalf of this.
+            $response['openid.claimed_id'] = _openid_normalize($response['openid.claimed_id']);
+            if ($response['openid.claimed_id'] != $claimed_id) {
+              $disco = openid_discovery($response['openid.claimed_id']);
+              if ($disco[0]['uri'] != $service['uri']) {
+                return $response;
+              }
             }
           }
           else {
             $response['openid.claimed_id'] = $claimed_id;
           }
           $response['status'] = 'success';
         }
       }
     }