Index: modules/openid/openid.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/openid/openid.module,v
retrieving revision 1.19.2.11
diff -u -9 -p -r1.19.2.11 openid.module
--- modules/openid/openid.module	11 Aug 2010 20:35:48 -0000	1.19.2.11
+++ modules/openid/openid.module	23 Nov 2010 23:17:20 -0000
@@ -234,24 +234,30 @@ function openid_complete($response = arr
     $claimed_id = $_SESSION['openid']['claimed_id'];
     unset($_SESSION['openid']['service']);
     unset($_SESSION['openid']['claimed_id']);
     if (isset($response['openid.mode'])) {
       if ($response['openid.mode'] == 'cancel') {
         $response['status'] = 'cancel';
       }
       else {
         if (openid_verify_assertion($service, $response)) {
-          // If the returned claimed_id is different from the session claimed_id,
-          // then we need to do discovery and make sure the op_endpoint matches.
-          if ($service['version'] == 2 && $response['openid.claimed_id'] != $claimed_id) {
-            $disco = openid_discovery($response['openid.claimed_id']);
-            if ($disco[0]['uri'] != $service['uri']) {
-              return $response;
+          if ($service['version'] == 2) {
+            // OpenID Authentication, section 11.2:
+            // If the returned Claimed Identifier is different from the one sent
+            // to the OpenID Provider, we need to do discovery on the returned
+            // identififer to make sure that the provider is authorized to
+            // respond on behalf of this.
+            $response['openid.claimed_id'] = _openid_normalize($response['openid.claimed_id']);
+            if ($response['openid.claimed_id'] != $claimed_id) {
+              $disco = openid_discovery($response['openid.claimed_id']);
+              if ($disco[0]['uri'] != $service['uri']) {
+                return $response;
+              }
             }
           }
           else {
             $response['openid.claimed_id'] = $claimed_id;
           }
           // Verify that openid.return_to matches the current URL (see OpenID
           // Authentication 2.0, section 11.1).
           // While OpenID Authentication 1.1, section 4.3 does not mandate
           // return_to verification, the received return_to should still