The BADC CEDA OpenID Provider fails to authenticate properly with the 1.3 Gateway. The problem appears to be due to attributes being requested as "openid.ax.required"
Email description follows. Logging output is below as comment.
Stephen and Luca have found a problem testing the new Gateway release with
the CEDA OpenID Provider. I've looked in the logs on our side and the
Provider is failing during the Attribute Exchange stage. Luca has also
passed on a copy of the corresponding Gateway log - see below ...
It looks like the Gateway is requesting multiple aliases to the same
parameter name e.g.
http://axschema.org/namePerson/first
http://openid.net/schema/namePerson/first
http://schema.openid.net/contact/firstname
Has the Gateway changed the way that it does AX for this release?
It maybe you want to cover the possibility that a Provider supports one or
other of the namespaces. However, the parameters seem to be all marked as
'required'. This implies to me that the OpenID Provider is required to
return values for all of them
(http://openid.net/specs/openid-attribute-exchange-1_0.html). This
doesn't make much sense if three different namespaces are set for the same
parameter name.
Is is it possible to alter the configuration of the Gateway so that it
requests these without the 'required' flag?
Email description follows. Logging output is below as comment.
Stephen and Luca have found a problem testing the new Gateway release with
the CEDA OpenID Provider. I've looked in the logs on our side and the
Provider is failing during the Attribute Exchange stage. Luca has also
passed on a copy of the corresponding Gateway log - see below ...
It looks like the Gateway is requesting multiple aliases to the same
parameter name e.g.
http://axschema.org/namePerson/first
http://openid.net/schema/namePerson/first
http://schema.openid.net/contact/firstname
Has the Gateway changed the way that it does AX for this release?
It maybe you want to cover the possibility that a Provider supports one or
other of the namespaces. However, the parameters seem to be all marked as
'required'. This implies to me that the OpenID Provider is required to
return values for all of them
(http://openid.net/specs/openid-attribute-exchange-1_0.html). This
doesn't make much sense if three different namespaces are set for the same
parameter name.
Is is it possible to alter the configuration of the Gateway so that it
requests these without the 'required' flag?