Log in to Plone 3.1-rc1 fails, using Yahoo OpenID: Endpoint mismatch: local_id mismatch

[grahamperrin]

Symptoms

1. at the OpenID login prompt of a Plone site
   • in this case,  http://centrim.mis.brighton.ac.uk/login_form
2. enter a Yahoo OpenID
3. accept the Yahoo prompt to Let Me In
4. user is redirected to the home page of the Plone site
   • but not logged in.

Environments

Server

• Plone 3.1-rc1
  
• OpenID Authentication Support 1.1

User 1 (Graham Perrin)

• Mac OS X 10.5.2 with British English preferred
• Firefox 2.0.0.14
• Yahoo OpenID URL available on request
  • two variants for the one user
    • neither variant worked with the Plone site.

User 2 (different person, different computer)

• Mac OS X 10.5.2 with Italian preferred
• Safari presenting English
• Firefox 2.0.0.14 presenting Italian
  • presumably from  http://www.mozilla.com/products/download.html?product=firefox-2.0.0.14&os=osx&lang=it
  • presumably with Italiano (it) preferred within Firefox
• Yahoo OpenID URL available on request.

Internet connections

At the time of reporting:

• both users connected to the Internet at University of Sussex
  • transparent proxy in effect.

[grahamperrin]

Expected  https://me.yahoo.com/username, got  https://me.yahoo.com/username#e40b3

Experimenting with a different site, running instance in foreground, attempting my Yahoo OpenID at  http://localhost:8080/Plone/login_form results in the following:

Mismatched pre-discovered session data. Claimed ID in session=https://me.yahoo.com/username, in assertion=https://me.yahoo.com/username#e40b3
Performing discovery on https://me.yahoo.com/username#e40b3
Discovery verification failure for https://me.yahoo.com/username#e40b3
 * Endpoint mismatch: local_id mismatch. Expected https://me.yahoo.com/username, got https://me.yahoo.com/username#e40b3
2008-04-21 16:20:39 INFO PluggableAuthService OpenId Authentication for https://me.yahoo.com/username failed: No matching endpoint found after discovering https://me.yahoo.com/username#e40b3

(My user name obscured above.)

[davisagli]

This is due to improper handling (in python-openid 2.0.1 which ships with current versions of plone.openid) of the extra URL fragment that yahoo tacks on so they can recycle identifiers (see  http://developer.yahoo.com/openid/faq.html).

I'm updating plone.openid to use python-openid 2.2.1, which seems to take care of this issue.

[davisagli]

(In [22159]) updated to use latest python-openid, in order to fix bug in handling of yahoo and other providers which rewrite the claimed identity URL. fixes #8051. also fixed a bug where you could not log in via OpenID, immediately log out, and then immediately log back in.

[grahamperrin]

Thanks!

[grahamperrin]

I have upgraded/migrated my buildout-based installation from 3.1.2 to 3.1.5.1. Fix confirmed. Thanks again.