Non unique authnames with google openid endpoint [#548152]

On trying the google openid on our Drupal 5.7 site recently (which uses openId 5.x-1.1), we found that the google openid's authname was not unique. This was not the case earlier. Currently we get the non-unique authname 'http://www.google.com/accounts/o8/id' . Has google made any changes which would cause this? Is this a temporary glitch on google's side? Has anyone faced a similar issue before or is facing one currently?

Comments

Comment #1

gingerjoos commented 13 August 2009 at 11:54

Version:

5.x-1.2

» 5.x-1.1

Comment #2

gingerjoos commented 14 August 2009 at 06:47

On investigation it seems that Google has a slightly different spec as far as the claimed id is concerned. It requires this value to be set to http://specs.openid.net/auth/2.0/identifier_select . Details are available in the docs ( http://code.google.com/apis/accounts/docs/OpenID.html#Parameters ) . The fix was to check if the endpoint is a google endpoint and only then set the claimed_id in openid_begin to this value. This should be done after the discovery is done ( by openid_discovery() function ). This value is then set in the session variable and a unique authname is received at the end of authentication