IRC Log for #openid on 2006-12-21
Timestamps are in UTC.
- [00:26:41] * shigeta (n=shigeta@124x32x114x226.ap124.ftth.ucom.ne.jp) has joined #openid
- [00:30:00] <Cody`macbook>
cygnus: You don't happen to be around at all do you?
- [00:30:26] * xlarrydrebes (n=xlarrydr@c-71-236-228-127.hsd1.or.comcast.net) has joined #openid
- [00:30:26] <jibot>
xlarrydrebes is yet another Janrain idler.
- [00:30:44] <cygnus>
Cody`macbook: I might be around if the price is right.
- [00:30:49] <Cody`macbook>
hehe
- [00:31:33] <cygnus>
what's up?
- [00:31:34] <Cody`macbook>
I just have to ask. Why the use of $this->connection->query(sprintf("DELETE FROM %s", $this->associations_table_name));
- [00:31:41] <Cody`macbook>
Why not just concat the string on?
- [00:31:56] <Cody`macbook>
Working on my db layer's adaption and saw that
- [00:32:11] <cygnus>
because that can, in certain situations, lead to an SQL injection vulnerability
- [00:32:17] <cygnus>
actually
- [00:32:20] <cygnus>
it doesn't matter in this case.
- [00:32:30] <cygnus>
it's assumed that the table name is secure.
- [00:32:43] <Cody`macbook>
yeah but mysqli and pear::db both provide interfaces to mysqli(mysql)_real_escape_string()
- [00:32:44] <cygnus>
(if it isn't, then a software developer messed it up.)
- [00:32:55] * cygnus nods, but in this case you *don't* want to escape it
- [00:32:59] <cygnus>
because then you'd have an invalid query.
- [00:33:01] <Cody`macbook>
exactly
- [00:33:12] <cygnus>
but why it's sprintf() instead of $str . $str, I can't tell you.
- [00:33:15] <cygnus>
probably just convention used at the time.
- [00:33:33] <Cody`macbook>
yeah it makes no real sense
- [00:33:38] <cygnus>
well, it doesn't matter either way. :)
- [00:33:45] <Cody`macbook>
I mean it would in something like C and possibly other languages, but not in PHP lol
- [00:33:53] <Cody`macbook>
glad I wasn't missing something
- [00:34:43] <Cody`macbook>
actually the only way that could even get tampered with is if someone got write access to the files
- [00:34:48] <cygnus>
yeah.
- [00:34:54] <cygnus>
in which case you have MUCH bigger problems.
- [00:35:19] <Cody`macbook>
for sure
- [00:35:26] * Cody`macbook turns it into concatenation
- [00:35:41] <cygnus>
Cody`macbook: what's your database layer for?
- [00:35:51] <Cody`macbook>
mysqli
- [00:36:01] <Cody`macbook>
I may do it in prepared statements for the openid stuff though
- [00:36:05] <Cody`macbook>
since that's going to be called a lot
- [00:36:41] <cygnus>
relative to whatever your site is probably doing, no, it will not be called that much
- [00:37:16] <Cody`macbook>
True
- [00:37:18] <cygnus>
and for the queries needed for openid association data and nonces, prepared queries will not buy you very much
- [00:37:36] <Cody`macbook>
forgot I can store the some of the stuff in the session info as well
- [00:38:01] <cygnus>
true, but if you're implementing a database interface similar to the ones in the PHP openid library, you should not put any of that in the session, FYI.
- [00:38:27] <Cody`macbook>
yeah, I haven't looked all that's in it yet. I just want to get it adapted to mess around with before I adapt it to the main source tree
- [00:39:22] <cygnus>
alright. it's worth pointing out that you shouldn't really need to implement a mysqli layer unless PEAR doesn't implement mysqli support, since our library expects a PEAR database connection interface.
- [00:39:39] <cygnus>
or unless you don't want to (or can't) run PEAR, too.
- [00:40:41] <Cody`macbook>
I don't want to run pear::db
- [00:40:46] <Cody`macbook>
that's the only reason I'm doing the db layer
- [00:40:52] <Cody`macbook>
site has enough dependencies as it is
- [00:41:04] <Cody`macbook>
including 3 pecl extensions
- [00:46:52] * PatF (i=pfelsted@nat/novell/x-23be22d468364bd6) has left #openid
- [01:10:36] * cygnus (n=cygnus@198.145.244.134) Quit ("Download Gaim: http://gaim.sourceforge.net/")
- [01:14:12] * SamRose (n=SamRose@c-71-197-25-180.hsd1.mi.comcast.net) has joined #openid
- [01:14:12] <jibot>
SamRose is found at http://smartmobs.com, http://communitywiki.org, http://blog.p2pfoundation.com, http://barcampbank.com, and http://cooperationcommons.com
- [01:22:49] * tnarg (n=grant@c-71-236-228-127.hsd1.or.comcast.net) Quit ("Leaving")
- [01:55:24] * j3h (n=j3h@c-71-236-228-127.hsd1.or.comcast.net) Quit (Read error: 113 (No route to host))
- [02:10:34] * daleolds (i=daleolds@nat/novell/x-7fe634c783b7ac61) has left #openid
- [02:20:50] * brianellin (n=brianell@c-71-236-228-127.hsd1.or.comcast.net) Quit ("This computer has gone to sleep")
- [02:43:51] * SamRose (n=SamRose@c-71-197-25-180.hsd1.mi.comcast.net) Quit ()
- [03:13:16] * xlarrydrebes (n=xlarrydr@c-71-236-228-127.hsd1.or.comcast.net) Quit ("The computer fell asleep")
- [03:13:55] * xlarrydrebes (n=xlarrydr@c-71-236-228-127.hsd1.or.comcast.net) has joined #openid
- [03:14:00] * xlarrydrebes (n=xlarrydr@c-71-236-228-127.hsd1.or.comcast.net) Quit (Remote closed the connection)
- [03:28:54] <Cody`macbook>
and I got everything adapted and working on the consumer example. Let's try my site :x
- [03:45:57] * j3h (n=j3h@c-24-21-174-195.hsd1.mn.comcast.net) has joined #openid
- [05:01:17] * brianellin (n=brianell@c-24-22-69-155.hsd1.mn.comcast.net) has joined #openid
- [05:19:52] * cote (n=cote@adsl-71-145-199-186.dsl.austtx.sbcglobal.net) Quit ()
- [06:44:58] * DJCapelis (n=DJCapeli@blender/coder/DJCapelis) Quit ("This is a highly customized quit message.")
- [06:45:19] * DJCapelis (n=DJCapeli@blender/coder/DJCapelis) has joined #openid
- [10:01:14] * brianellin (n=brianell@c-24-22-69-155.hsd1.mn.comcast.net) Quit ("This computer has gone to sleep")
- [11:04:28] * shigeta (n=shigeta@124x32x114x226.ap124.ftth.ucom.ne.jp) Quit ("Leaving...")
- [13:05:00] * SamRose (n=chatzill@brick.voyager.net) has joined #openid
- [13:23:17] * shigeta (n=shigeta@137.147.210.220.dy.bbexcite.jp) has joined #openid
- [14:00:52] * terrell (n=terrell@207.7.107.15) has left #openid
- [14:56:46] * cote (n=cote@adsl-71-145-199-186.dsl.austtx.sbcglobal.net) has joined #openid
- [15:01:30] * cote (n=cote@adsl-71-145-199-186.dsl.austtx.sbcglobal.net) Quit (Client Quit)
- [15:14:05] * terrell (n=terrell@207.7.107.15) has joined #openid
- [16:39:48] * j3h (n=j3h@c-24-21-174-195.hsd1.mn.comcast.net) Quit (Read error: 110 (Connection timed out))
- [16:57:22] * shigeta (n=shigeta@137.147.210.220.dy.bbexcite.jp) Quit ("Leaving...")
- [17:35:54] * xlarrydrebes (n=xlarrydr@c-71-236-228-127.hsd1.or.comcast.net) has joined #openid
- [17:35:54] <jibot>
xlarrydrebes is yet another Janrain idler.
- [17:41:52] * j3h (n=j3h@c-71-236-228-127.hsd1.or.comcast.net) has joined #openid
- [17:42:30] * j3h (n=j3h@c-71-236-228-127.hsd1.or.comcast.net) has left #openid
- [17:43:21] * j3h (n=j3h@c-71-236-228-127.hsd1.or.comcast.net) has joined #openid
- [17:48:18] * PatF (n=pfelsted@c-24-10-171-227.hsd1.ut.comcast.net) has joined #openid
- [17:51:55] * cygnus (n=cygnus@198.145.244.134) has joined #openid
- [17:51:55] <jibot>
cygnus is WorkerBee(name="Jonathan Daugherty", company="JanRain, Inc.")
- [18:03:54] * terrell (n=terrell@207.7.107.15) has left #openid
- [18:03:57] * terrell (n=terrell@207.7.107.15) has joined #openid
- [18:17:37] * brianellin (n=brianell@c-71-236-228-127.hsd1.or.comcast.net) has joined #openid
- [18:44:05] * brianellin (n=brianell@c-71-236-228-127.hsd1.or.comcast.net) Quit ("Leaving")
- [18:52:38] * cote (n=cote@adsl-71-145-199-186.dsl.austtx.sbcglobal.net) has joined #openid
- [18:55:54] * sanedragon (n=sanedrag@c-71-236-228-127.hsd1.or.comcast.net) Quit (Read error: 104 (Connection reset by peer))
- [18:57:19] * c0nsumer (n=c0nsumer@rowla.nuxx.net) has joined #openid
- [19:01:39] <c0nsumer>
could someone help me figure something out? when using the openidenabled.com server test, http://nuxx.net:80/openid.php and http://nuxx.net/openid.php both pass the 'Successful checkid_setup' test. however, if I point the test directly at 'nuxx.net' and allow the openid.server and openid.delegate entries to provide the url, the test fails. any ideas why?
- [19:11:12] <cygnus>
because openid.server and openid.delegate aren't used to indicate server information
- [19:12:57] <c0nsumer>
hmm. then when the tool says "OpenID links found at" and lists the default document for the site, where did it look to know to reference that file?
- [19:13:04] <c0nsumer>
Association works, but checkid_setup doesn't.
- [19:15:13] <c0nsumer>
also, per section 3.1 here it does: http://openid.net/specs/openid-authentication-1_1.html#anchor4
- [19:15:28] <c0nsumer>
unless i'm reading it wrong?
- [19:16:06] <cygnus>
c0nsumer: your server URL is not an openid, so don't enter that as the testing URL
- [19:16:18] <cygnus>
it found LINK tags at the URL, but they don't belong there
- [19:16:27] <cygnus>
it needs to be an OpenID URL
- [19:17:08] <c0nsumer>
hmm, i think i'm a bit confused.
- [19:17:33] <cygnus>
the URL you should give to the server tester is not your server URL (http://nuxx.net/openid.php) but an OpenID (like cygnus.myopenid.com).
- [19:17:43] <cygnus>
it does "openid discovery" on the URL to figure out what its server is.
- [19:18:28] <cygnus>
in your case, the openid.delegate at nuxx.net/wik/Main_Page probably incorrect.
- [19:18:34] <c0nsumer>
am i correct in thinking that if i provide the tester 'nuxx.net' as the openid, it looks in the header of the default document for openid.server and openid.delegate?
- [19:18:36] <cygnus>
it's your server URL, but it should be the URL by which your server knows yo.
- [19:18:37] <cygnus>
you, even.
- [19:18:42] <cygnus>
yeah.
- [19:18:43] <c0nsumer>
hrm
- [19:19:01] <c0nsumer>
i think i understand.
- [19:19:11] <c0nsumer>
let me try something...
- [19:19:20] <c0nsumer>
thank you. :)
- [19:19:26] * mmell (n=mmell@adsl-75-35-154-20.dsl.pltn13.sbcglobal.net) has left #openid
- [19:19:28] <cygnus>
good luck
- [19:22:43] <c0nsumer>
hmm, so would openid.associate typically just be something like 'nuxx.net'?
- [19:25:14] <cygnus>
openid.delegate should be a URL that your server knows you by. does that make sense?
- [19:25:52] <cygnus>
say your server knows about URLs like USERNAME.nuxx.net, and you log into your server as "joe", then your URL there is "joe.nuxx.net", so if you want to use another URL and delegate to your server, opend.delegate should be "http://joe.nuxx.net/".
- [19:26:06] <c0nsumer>
not really, honestly.
- [19:26:08] <c0nsumer>
hrm...
- [19:26:18] * newtMcKerr (n=newtMcKe@osuosl/staff/newtMcKerr) has joined #openid
- [19:26:24] <c0nsumer>
i don't really have any user-specific stuffs, because i'm the only user of that domain
- [19:26:57] <cygnus>
what is the openid software running at http://nuxx.net/openid.php?
- [19:27:00] <c0nsumer>
but a whole url, okay
- [19:27:02] <j3h>
c0nsumer: the tester wants an OpenID URL that uses that server so it can try to send you to do authentication
- [19:27:04] <c0nsumer>
it's myphpid
- [19:27:19] <c0nsumer>
i just chaged things a bit to obfuscate it
- [19:27:25] <c0nsumer>
just titles and such
- [19:28:29] <c0nsumer>
i was initially following the directions in the README for the phpMyID package
- [19:28:40] <c0nsumer>
sorry, phpMyID. screwed up the name there
- [19:48:03] * tnarg (n=grant@c-71-236-228-127.hsd1.or.comcast.net) has joined #openid
- [19:58:04] <c0nsumer>
hrm. openid.delegate is "http://nuxx.net/" and openid.server is "http://nuxx.net/openid.php". it's still failing to pass the test. at this point i'm not sure what i may have done wrong
- [19:59:53] <gregh>
what's your actual openid?
- [20:00:48] <c0nsumer>
i was using 'nuxx.net'. i am attempting to run my own small provider with phpMyID
- [20:01:08] <gregh>
your openid should be the url to a document anybody can retrieve, that seems to redirect to your wiki instead
- [20:01:10] <cygnus>
looks like the server is broken
- [20:01:19] <cygnus>
when I try it with an example consumer, I get a cancel response
- [20:01:49] <chowells79>
Is that expected behavior if you don't whatever auth data in place?
- [20:01:51] <terrell>
and we saw someone yesterday or so who pointed that the hashes didn't match as expected with that server
- [20:01:59] <chowells79>
err. *don't have
- [20:02:23] <c0nsumer>
i was using LiveJournal as an example consumer, and when i try to use 'nuxx.net' as the openid it fails, but if i point it directly at http://nuxx.net/openid.php it works
- [20:02:27] <gregh>
yeah I looked at the phpmyid the other day, and you need to mess with the hash if you change the authentication realm
- [20:02:37] <cygnus>
neat
- [20:02:45] <c0nsumer>
yep, i generated a new hash, put it in changed the realm name appropriately, etc
- [20:03:11] <gregh>
you're delegating your identity to yourself
- [20:03:31] <c0nsumer>
gregh: is that incorrect? should i just have no delegation entry?
- [20:03:36] <gregh>
you probably don't want delegation at all
- [20:03:44] <c0nsumer>
ah, hmm. let me try that.
- [20:04:10] <gregh>
you would want delegation if you wanted your openid to be, say "foo.nuxx.net" but you really wanted livejournal to be your provider (and livejournal doesn't know anything about nuxx.net people)
- [20:04:42] <c0nsumer>
nope, i don't want livejournal to be my provider, i was just using it as an example because i'm familiar with it.
- [20:04:53] <c0nsumer>
gregh: removing the delegation entry doesn't help
- [20:05:02] <gregh>
yeah, I was just using it as an example of delegation too
- [20:05:03] <cygnus>
and depending on what phpmyid is willing to recognize, you might need it there, too
- [20:05:33] <c0nsumer>
cygnus: you mean, depending on phpmyid, it might require the delegation entry? hmm
- [20:05:50] <gregh>
now, next question, when you try this with an example consumer, what exactly are you putting in the "openid" prompt?
- [20:05:52] <cygnus>
well, I don't know what phpmyid is willing to authenticate
- [20:06:10] <c0nsumer>
gregh: i am putting 'nuxx.net'
- [20:06:18] <gregh>
ok, that's not going to work
- [20:06:29] <c0nsumer>
why not?
- [20:06:38] <gregh>
the consumer will try to retrieve http://nuxx.net/ and look for the openid.server directive
- [20:06:56] <c0nsumer>
gregh: yep, and the openid.server directive points at http://nuxx.net/openid.php
- [20:07:17] <gregh>
there's no openid.server directive when I retrieve http://nuxx.net, it redirects to your wiki
- [20:07:35] <c0nsumer>
that's correct, and <head> on that wiki page includes it
- [20:07:49] <c0nsumer>
as the openidenabled.com tester says "OpenID links found at http://nuxx.net/wiki/Main_Page. Your server is at http://nuxx.net/openid.php."
- [20:07:54] * cygnus nods
- [20:07:56] <gregh>
hmm okay
- [20:08:11] <cygnus>
but the OpenID URL used will not be nuxx.net: it will be the wiki page URL.
- [20:08:12] <gregh>
sorry, I missed that :)
- [20:08:55] <c0nsumer>
cygnus: so would that be the .delegate URL?
- [20:08:55] <cygnus>
if you want to use nuxx.net as your openid, you cannot use an HTTP redirect to the wiki. you need to use a META tag to do that.
- [20:08:58] <c0nsumer>
gregh: :)
- [20:09:32] <c0nsumer>
cygnus: oh, hrm. odd that the tester tool would still gladly find it.
- [20:09:39] <cygnus>
it will, yes
- [20:09:49] <gregh>
it might be useful to set up another virtual server on http://c0nsumer.nuxx.net that serves only a small openid page
- [20:09:52] <gregh>
that's what I did
- [20:09:54] <c0nsumer>
cygnus: that makes sense, though. the tester still finding it is what was throwing me off
- [20:09:57] <c0nsumer>
gregh: good idea
- [20:10:21] <c0nsumer>
gregh: and maybe have c0nsumer.nuxx.net redirect straight to regular nuxx.net or something
- [20:10:44] <gregh>
redirect is tricky because it might confuse openid consumers
- [20:10:49] <gregh>
(as we've seen :)
- [20:11:02] <c0nsumer>
heh, yes. :) i was meaning using a meta tag to redirect things, as cygnus said
- [20:11:18] <c0nsumer>
now i'll go set up c0nsumer.nuxx.net. :D
- [20:11:26] <c0nsumer>
thank you, all
- [20:15:09] * SamRose (n=chatzill@brick.voyager.net) Quit ("Chatzilla 0.9.77 [Firefox 1.5.0.8/0000000000]")
- [20:33:25] * chimprawk (n=chimpraw@cpe-071-065-206-202.nc.res.rr.com) has joined #openid
- [20:37:17] <c0nsumer>
huh, i just stopped the server from doing the redirection, and set up an index.html with a meta refresh tag with a timeout of zero to redirect automatically to the wiki. the openid.server and openid.delegate tags are there, but the test still is completing the associate test, but not checkid_setup.
- [20:37:53] <c0nsumer>
i mean, the openid.server and openid.delegate tags are being set in the index.html, and the openidenabled.com tester is seeing them
- [20:40:17] <_keturn>
did it get an openid.mode=id_res response, or something else?
- [20:40:30] <gregh>
don't use openid.delegate
- [20:41:43] <c0nsumer>
openid.mode is checkid_setup when it failes.
- [20:41:51] <c0nsumer>
gregh: it's having the issue without openid.delegate
- [20:42:07] <gregh>
okay. but using openid.delegate isn't going to help :)
- [20:42:12] <c0nsumer>
hehe, okay. :)
- [20:43:25] <_keturn>
does the failure leave the browser at nuxx.net/openid.php, or at openidenabled?
- [20:44:19] <c0nsumer>
_keturn: i'm sorry, but i don't understand what you are asking. i'm using the server test at http://www.openidenabled.com/resources/openid-test/diagnose-server/
- [20:45:00] <_keturn>
the checkid_setup test involves a redirect to the server and back to openidenabled.com again
- [20:45:11] <_keturn>
so I'm wondering if 1) it is successfully making that round trip
- [20:45:34] <_keturn>
2) if so, what the _response_ mode is (not the request)
- [20:46:42] <c0nsumer>
i'm not actually sure how to tell that
- [20:47:37] <c0nsumer>
i do receive a yellow box at the top informing me that "this attempt is failing", and there are bullet points labeled Redirecting to: and Response received:
- [20:47:51] <c0nsumer>
the action for response received is 'response', attempt '2', and 'openid.mode cancel'
- [20:48:59] <_keturn>
ok, so your openid.php is *choosing* to issue a non-successful response. you'll have to check the logs and docs on that end.
- [20:49:24] <c0nsumer>
if i point the tester specifically at http://nuxx.net/openid.php, it works properly, though.
- [20:51:07] <_keturn>
'''and it knows you as "http://nuxx.net:80/openid.php".''', hmm
- [20:51:31] <gregh>
when setting up phpmyid, what did you use as your openid name?
- [20:52:08] <c0nsumer>
gregh: the username for digest authentication? c0nsumer
- [20:53:20] <gregh>
ok wait, I think I asked the wrong question
- [20:53:56] <c0nsumer>
:)
- [20:57:55] <c0nsumer>
sorry, i need to run home. i'll leave this open and be back later. :) thanks again
- [20:58:16] <gregh>
looks like phpmyid is checking that the identity it's passed matches $profile['idp_url']
- [20:58:43] <_keturn>
I think if you put the openid.delegate tag back in (I know, I know, we just told you to take it out), _with_ the stupid :80, that might make openid.php happy. or maybe not, if our end of it normalizes the :80 out of there, which it might perhaps do
- [20:59:00] <gregh>
and by the response from your openid.php, it appears that your idp_url is "http://nuxx.net:80/openid.php"
- [20:59:16] <gregh>
I think perhaps you've not set up phpmyid in exactly the way the author intended
- [21:00:37] <_keturn>
(actually, if it ever works at all, it should work okay with delegation.)
- [21:01:01] <gregh>
I'd be afraid of a delegation loop
- [21:01:09] <_keturn>
huh? no such thing
- [21:02:05] <chowells79>
Delegation doesn't result in looking up info about the identifier claimed in the delegate field.
- [21:02:25] <chowells79>
It just presents that identifier to the server listed, no questions asked.
- [21:02:33] <gregh>
ok yeah, you're right of course
- [21:39:07] <c0nsumer>
sorry about that, i'm back
- [21:41:31] <c0nsumer>
okay, it seems that setting up the openid.delegate tag again with the full 'http://nuxx.net:80/openid.php' has made it pass the test
- [21:41:48] <c0nsumer>
let's see if it works with livejournal, as a test
- [21:42:40] <c0nsumer>
yep, that has worked
- [21:42:57] <c0nsumer>
_keturn: so, that did it. thanks.
- [21:43:08] <c0nsumer>
just to show: http://c0nsumer.livejournal.com/955068.html
- [21:50:26] <gregh>
looks good, finally :)
- [21:51:13] * cygnus (n=cygnus@198.145.244.134) has left #openid
- [21:56:15] <gregh>
yay http://digg.com/programming/OpenID_is_growing_in_momentum
- [22:25:42] * sanedragon (n=sanedrag@c-71-236-228-127.hsd1.or.comcast.net) has joined #openid
- [22:25:42] <jibot>
sanedragon is an engineer for JanRain named Dag
- [22:37:00] * don-o (n=donp@206.163.122.98) has joined #openid
- [22:37:00] <jibot>
don-o is in Portland, Or USA and likes to blog at http://www.livejournal.com/users/doncam
- [22:37:10] <don-o>
ha. thanks jibot.
- [22:40:12] <don-o>
anyone tried making an openid server in rails? (besides brian of course)
- [22:57:45] <don-o>
jibot hello
- [22:57:51] <don-o>
!jibot hello
- [22:57:57] <don-o>
.help
- [22:58:11] <don-o>
jibot: help
- [23:07:57] <chowells79>
?help
- [23:08:05] <chowells79>
That's the command you want
- [23:27:51] * don-o (n=donp@206.163.122.98) Quit (Remote closed the connection)
- [23:36:09] * don-o (n=donp@206.163.122.98) has joined #openid
- [23:39:19] <don-o>
?forgetme
- [23:39:19] <jibot>
I have expunged don-o from my mind
- [23:39:31] <don-o>
?don-o is in Portland, Or and blogs at http://doncam.livejournal.com/tag/ruby
These logs were automatically created by OpenIDlogbot on
chat.freenode.net
using a modified version of the Java IRC LogBot.