{"action":"created","issue":{"url":"https://api.github.com/repos/bmuller/mod_auth_openid/issues/42","labels_url":"https://api.github.com/repos/bmuller/mod_auth_openid/issues/42/labels{/name}","comments_url":"https://api.github.com/repos/bmuller/mod_auth_openid/issues/42/comments","events_url":"https://api.github.com/repos/bmuller/mod_auth_openid/issues/42/events","html_url":"https://github.com/bmuller/mod_auth_openid/issues/42","id":8682543,"number":42,"title":"Doesn't handle invalidate.handle requests correctly","user":{"login":"docwhat","id":40799,"avatar_url":"https://avatars.githubusercontent.com/u/40799?v=3","gravatar_id":"","url":"https://api.github.com/users/docwhat","html_url":"https://github.com/docwhat","followers_url":"https://api.github.com/users/docwhat/followers","following_url":"https://api.github.com/users/docwhat/following{/other_user}","gists_url":"https://api.github.com/users/docwhat/gists{/gist_id}","starred_url":"https://api.github.com/users/docwhat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docwhat/subscriptions","organizations_url":"https://api.github.com/users/docwhat/orgs","repos_url":"https://api.github.com/users/docwhat/repos","events_url":"https://api.github.com/users/docwhat/events{/privacy}","received_events_url":"https://api.github.com/users/docwhat/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2012-11-26T16:22:24Z","updated_at":"2015-02-05T03:34:18Z","closed_at":null,"body":"This is complicated, bare with me.\n\nMy openid server, based on the [blah](blah) ruby gem, had a bug where it would lose track of associations and nonces every so often.\n\nThis lead to already remembered associations being invalid.  We were fixing it by removing `/tmp/mod_auth_openid.db` when this happened, but this is not an ideal situation. :-)\n\nThe debug log for this looked like so:\n\n```\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] Queueing endpoint http://specs.openid.net/auth/2.0/identifier_select : http://specs.openid.net/auth/2.0/identifier_select @ https://openid.example.com/server\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] INSERT INTO authentication_sessions (nonce,uri,claimed_id,local_id,expires_on) VALUES('yN1SYmjSxv','https://openid.example.com/server','http://specs.openid.net/auth/2.0/identifier_select','http://specs.openid.net/auth/2.0/identifier_select',1353947952)\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] Set normalized id to: https://openid.example.com/\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] UPDATE authentication_sessions SET normalized_id='https://openid.example.com/' WHERE nonce='yN1SYmjSxv'\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] Fetching endpoint\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] looking up association: server = https://openid.example.com/server\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] found a handle for server \"https://openid.example.com/server\" in db.\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] Fetching endpoint\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] https://openid.example.com/server is a trusted identity provider\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] Redirecting via HTTP_MOVED_TEMPORARILY to: https://openid.example.com/server?openid.assoc_handle=%%7BHMAC-SHA256%%7D%%7B50abf113%%7D%%7BbSPw2Q%%3D%%3D%%7D&openid.claimed_id=http%%3A%%2F%%2Fspecs.openid.net%%2Fauth%%2F2.0%%2Fidentifier_select&openid.identity=http%%3A%%2F%%2Fspecs.openid.net%%2Fauth%%2F2.0%%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%%3A%%2F%%2Fspecs.openid.net%%2Fauth%%2F2.0&openid.realm=https%%3A%%2F%%2Fpaste.example.com%%2F&openid.return_to=https%%3A%%2F%%2Fpaste.example.com%%2F%%3F%%26modauthopenid.nonce%%3DyN1SYmjSxv&openid.trust_root=https%%3A%%2F%%2Fpaste.example.com%%2F&openid.ax.mode=fetch_request&openid.ax.required=email&openid.ax.type.email=http%%3A%%2F%%2Fopenid.net%%2Fschema%%2Fcontact%%2Finternet%%2Femail&openid.ns.ax=http%%3A%%2F%%2Fopenid.net%%2Fsrv%%2Fax%%2F1.0\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] Request GET params: &modauthopenid.nonce=yN1SYmjSxv&openid.assoc_handle=%%7BHMAC-SHA1%%7D%%7B50b38d20%%7D%%7B6Oo6eA%%3D%%3D%%7D&openid.ax.mode=fetch_response&openid.ax.type.email=http%%3A%%2F%%2Fopenid.net%%2Fschema%%2Fcontact%%2Finternet%%2Femail&openid.ax.value.email=docwhat%%40corp.example.com&openid.claimed_id=https%%3A%%2F%%2Fopenid.example.com%%2Fuser%%2F1&openid.identity=https%%3A%%2F%%2Fopenid.example.com%%2Fuser%%2F1&openid.invalidate_handle=%%7BHMAC-SHA256%%7D%%7B50abf113%%7D%%7BbSPw2Q%%3D%%3D%%7D&openid.mode=id_res&openid.ns=http%%3A%%2F%%2Fspecs.openid.net%%2Fauth%%2F2.0&openid.ns.ax=http%%3A%%2F%%2Fopenid.net%%2Fsrv%%2Fax%%2F1.0&openid.op_endpoint=https%%3A%%2F%%2Fopenid.example.com%%2Fserver&openid.response_nonce=2012-11-26T15%%3A39%%3A12ZEk6eQy&openid.return_to=https%%3A%%2F%%2Fpaste.example.com%%2F%%3F%%26modauthopenid.nonce%%3DyN1SYmjSxv&openid.sig=Ghyx%%2Fve4mi4UV1q6vek68IOm%%2BdI%%3D&openid.signed=assoc_handle%%2Cax.mode%%2Cax.type.email%%2Cax.value.email%%2Cclaimed_id%%2Cidentity%%2Cinvalidate_handle%%2Cmode%%2Cns%%2Cns.ax%%2Cop_endpoint%%2Cresponse_nonce%%2Creturn_to%%2Csigned\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] looking up association: server = https://openid.example.com/server handle = {HMAC-SHA1}{50b38d20}{6Oo6eA==}\n[Mon Nov 26 10:39:12 2012] [mod_auth_openid] could not find server \"https://openid.example.com/server\" and handle \"{HMAC-SHA1}{50b38d20}{6Oo6eA==}\" in db.\n[Mon Nov 26 10:39:12 2012] [error] [client workstation.example.com] Error in authentication: openid.modauthopenid.nonce: no such field\n[Mon Nov 26 10:39:13 2012] [mod_auth_openid] Request GET params: &modauthopenid.nonce=gejodtGc5q&openid.assoc_handle=%%7BHMAC-SHA1%%7D%%7B50b38d21%%7D%%7BrVcaQQ%%3D%%3D%%7D&openid.ax.mode=fetch_response&openid.ax.type.email=http%%3A%%2F%%2Fopenid.net%%2Fschema%%2Fcontact%%2Finternet%%2Femail&openid.ax.value.email=docwhat%%40corp.example.com&openid.claimed_id=https%%3A%%2F%%2Fopenid.example.com%%2Fuser%%2F1&openid.identity=https%%3A%%2F%%2Fopenid.example.com%%2Fuser%%2F1&openid.invalidate_handle=%%7BHMAC-SHA256%%7D%%7B50abf113%%7D%%7BbSPw2Q%%3D%%3D%%7D&openid.mode=id_res&openid.ns=http%%3A%%2F%%2Fspecs.openid.net%%2Fauth%%2F2.0&openid.ns.ax=http%%3A%%2F%%2Fopenid.net%%2Fsrv%%2Fax%%2F1.0&openid.op_endpoint=https%%3A%%2F%%2Fopenid.example.com%%2Fserver&openid.response_nonce=2012-11-26T15%%3A39%%3A13Z8AVmce&openid.return_to=https%%3A%%2F%%2Fpaste.example.com%%2Ffavicon.ico%%3F%%26modauthopenid.nonce%%3DgejodtGc5q&openid.sig=OC%%2BJlWjo%%2F4mWtoFjfeLu%%2BvDFdSg%%3D&openid.signed=assoc_handle%%2Cax.mode%%2Cax.type.email%%2Cax.value.email%%2Cclaimed_id%%2Cidentity%%2Cinvalidate_handle%%2Cmode%%2Cns%%2Cns.ax%%2Cop_endpoint%%2Cresponse_nonce%%2Creturn_to%%2Csigned\n[Mon Nov 26 10:39:13 2012] [mod_auth_openid] looking up association: server = https://openid.example.com/server handle = {HMAC-SHA1}{50b38d21}{rVcaQQ==}\n[Mon Nov 26 10:39:13 2012] [mod_auth_openid] could not find server \"https://openid.example.com/server\" and handle \"{HMAC-SHA1}{50b38d21}{rVcaQQ==}\" in db.\n[Mon Nov 26 10:39:13 2012] [error] [client workstation.example.com] Error in authentication: openid.modauthopenid.nonce: no such field\n```\n\nAs you can see, the openid server is requesting a new handle and invalidating the old handle (`openid.invalidate_handle`) because it doesn't know it.\n\nI feel like the mod_auth_openid should be able to deal with this.\n\nMeanwhile, I'm off to fix my openid server so it stops forgetting associations.\n\nCiao!"},"comment":{"url":"https://api.github.com/repos/bmuller/mod_auth_openid/issues/comments/72988691","html_url":"https://github.com/bmuller/mod_auth_openid/issues/42#issuecomment-72988691","issue_url":"https://api.github.com/repos/bmuller/mod_auth_openid/issues/42","id":72988691,"user":{"login":"bmuller","id":182344,"avatar_url":"https://avatars.githubusercontent.com/u/182344?v=3","gravatar_id":"","url":"https://api.github.com/users/bmuller","html_url":"https://github.com/bmuller","followers_url":"https://api.github.com/users/bmuller/followers","following_url":"https://api.github.com/users/bmuller/following{/other_user}","gists_url":"https://api.github.com/users/bmuller/gists{/gist_id}","starred_url":"https://api.github.com/users/bmuller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bmuller/subscriptions","organizations_url":"https://api.github.com/users/bmuller/orgs","repos_url":"https://api.github.com/users/bmuller/repos","events_url":"https://api.github.com/users/bmuller/events{/privacy}","received_events_url":"https://api.github.com/users/bmuller/received_events","type":"User","site_admin":false},"created_at":"2015-02-05T03:34:18Z","updated_at":"2015-02-05T03:34:18Z","body":"It's there."}}