diff --git modules/openid/openid.api.php modules/openid/openid.api.php index 11faa71..3fad4c7 100644 --- modules/openid/openid.api.php +++ modules/openid/openid.api.php @@ -52,6 +52,12 @@ function hook_openid_response($response, $account) { * parameter, the claimed identifier. They have to return an array of services, * in the same form returned by openid_discover(). * + * The claimed identifier parameter should be passed by reference to the + * callback, because claimed id could be changed during discovery process. + * According to Openid specifications relying party must handle the two + * following HTTP redirects and the final URL must be used by the relying party + * as the claimed id. See http://drupal.org/node/575810 for more information. + * * The first discovery method that succeed (return at least one services) will * stop the discovery process. * diff --git modules/openid/openid.module modules/openid/openid.module index 7673de8..ae3d074 100644 --- modules/openid/openid.module +++ modules/openid/openid.module @@ -379,7 +379,7 @@ function openid_complete($response = array()) { * @return Array of services discovered (including OpenID version, endpoint * URI, etc). */ -function openid_discovery($claimed_id) { +function openid_discovery(&$claimed_id) { module_load_include('inc', 'openid'); $methods = module_invoke_all('openid_discovery_method_info'); @@ -418,7 +418,7 @@ function openid_openid_discovery_method_info() { * @see http://openid.net/specs/openid-authentication-2_0.html#discovery * @see hook_openid_discovery_method_info() */ -function _openid_xri_discovery($claimed_id) { +function _openid_xri_discovery(&$claimed_id) { if (_openid_is_xri($claimed_id)) { // Resolve XRI using a proxy resolver (Extensible Resource Identifier (XRI) // Resolution Version 2.0, section 11.2 and 14.3). @@ -444,7 +444,7 @@ function _openid_xri_discovery($claimed_id) { * @see http://openid.net/specs/openid-authentication-2_0.html#discovery * @see hook_openid_discovery_method_info() */ -function _openid_xrds_discovery($claimed_id) { +function _openid_xrds_discovery(&$claimed_id) { $services = array(); $xrds_url = $claimed_id; @@ -455,6 +455,15 @@ function _openid_xrds_discovery($claimed_id) { $result = drupal_http_request($xrds_url, array('headers' => $headers)); if (!isset($result->error)) { + + // Replace user entered claimed_id if we got redirect: + // 301 "Moved Permanently", 302 "Found", 303 "See Other" + // Fixes http://drupal.org/node/575810 OpenID discovery spec violation. + // TODO: should we take in account 307 "Temporary Redirect"? + if (!empty($result->redirect_code) && in_array($result->redirect_code, array(301, 302, 303, 307)) && !empty($result->redirect_url)) { + $claimed_id = $result->redirect_url; + } + if (isset($result->headers['content-type']) && preg_match("/application\/xrds\+xml/", $result->headers['content-type'])) { // Parse XML document to find URL $services = _openid_xrds_parse($result->data);