DotNetOpenAuth 3.4: appels vers Yahoo! arrêter les réponses de retour, affecte parfois Google trop

Question

• DotNetOpenAuth 3.4.1.10044
• Windows 7 (64 bits)
• VS 2008 SP1, .NET 3.5, C#
• Windows Azure

ASP.NET code derrière fragment autour d'appel OpenID:

OpenIdRelyingParty rp = new OpenIdRelyingParty(null); 
string discoveryUri = ""; 
if (provider == "google") { 
    discoveryUri = "https://www.google.com/accounts/08/id"; 
    Application.Set("Provider", "Google"); 
} else if (provider == "yahoo") { 
    discoveryUri = "https://me.yahoo.com"; 
    Application.Set("Provider", "Yahoo"); 
} 
try { 
    string openIdUri = Request.Url.ToString(); 
    var b = new UriBuilder(openIdUri) { Query = "" }; 
    Response.Write("OpenId_Click: Request.Url = " + Request.Url); 
    var req = rp.CreateRequest(discoveryUri, b.Uri, b.Uri); 
    Response.Write("OpenId_Click: discoveryUri = " + discoveryUri); 
    try { 
     req.RedirectToProvider(); 
    } catch (ThreadAbortException tae) { 
     string taem = tae.Message; 
    } 
} catch (Exception ex) { 
    string s = ex.Message; 
} 
rp.Dispose(); 

J'ai les comportements suivants (3):

Lorsque je démarre ASP.NET (Azure Development Storage) pour la première fois, si je m'authentifie sur Yahoo !, c'est un succès. Si j'essaye de m'authentifier contre Yahoo! Une minute plus tard, l'appel à RedirectToProvider ne renvoie jamais de réponse. Après cela, des appels supplémentaires à Google et Yahoo! Ne renvoyez pas de réponse. Lorsque je démarre ASP.NET pour la première fois, si je m'authentifie auprès de Google, cela fonctionne. Si j'essaie de m'authentifier à nouveau contre Google une minute plus tard, l'appel à RedirectToProvider est réussi sans me demander mon nom d'utilisateur/mot de passe. ( n'a pas coché la case à cocher remember-me.) Par la suite, les appels supplémentaires à Google restent valables. (Google semble mettre en cache les résultats de la première demande.) Si je m'authentifie alors contre Yahoo! l'appel à RedirectToProvider ne renvoie jamais de réponse. Si je retourne à Google, je réussis à nouveau sans me demander mon nom d'utilisateur/mot de passe. Lorsque je lance ASP.NET (Azure Development Storage) pour la première fois, si je m'authentifie auprès de Yahoo !, c'est un succès. Si j'essaie de m'authentifier auprès de Google une minute plus tard, l'appel à RedirectToProvider ne renvoie jamais de réponse.

Il n'y a pas d'échec évident (autre que le bruit ThreadAbortException habituel qui semble se produire si les appels réussissent ou non).

Des idées sur ce qui pourrait se passer?

Voici quelques informations de trace du troisième cas où Yahoo! Est-ce succesful, Google n'est pas:

 
Synch Queue Created with a single Message ==> Busy : Information[WaWebHost.exe] DotNetOpenAuth, Version=3.4.1.10044, Culture=neutral, PublicKeyToken=2780ccd10d57b246 (official) 
[WaWebHost.exe] Raising minimum OpenID version requirement for Providers to 2.0 to protect this stateless RP from replay attacks. 
[WaWebHost.exe] Reporting will use isolated storage with scope: User, Domain, Assembly 
[WaWebHost.exe] HTTP GET https://me.yahoo .com/ 
[WaWebHost.exe] X-XRDS-Location found in HTTP header. Preparing to pull XRDS from https://open.login.yahooapis.com/openid20/www.yahoo.com/xrds 
[WaWebHost.exe] HTTP GET https://open.login.yahooapis.com/openid20/www.yahoo.com/xrds 
[WaWebHost.exe] Total services discovered in XRDS: 1 
[WaWebHost.exe] [{ 
    ClaimedIdentifier: http://specs.openid.net/auth/2.0/identifier_select 
    ProviderLocalIdentifier: http://specs.openid.net/auth/2.0/identifier_select 
    ProviderEndpoint: https://open.login.yahooapis.com/openid/op/auth 
    OpenID version: 2.0 
    Service Type URIs: 
     http://specs.openid.net/auth/2.0/server 
     http://specs.openid.net/extensions/pape/1.0 
     http://openid.net/sreg/1.0 
     http://openid.net/extensions/sreg/1.1 
     http://openid.net/srv/ax/1.0 
     http://specs.openid.net/extensions/oauth/1.0 
     http://specs.openid.net/extensions/ui/1.0/lang-pref 
     http://specs.openid.net/extensions/ui/1.0/mode/popup 
     http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier 
     http://www.idmanagement.gov/schema/2009/05/icam/no-pii.pdf 
     http://www.idmanagement.gov/schema/2009/05/icam/openid-trust-level1.pdf 
     http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf 
},] 
[WaWebHost.exe] Skipping HTML discovery because XRDS contained service endpoints. 
[WaWebHost.exe] Performing discovery on user-supplied identifier: https://me.yahoo.com/ 
[WaWebHost.exe] Creating authentication request for user supplied Identifier: https://me.yahoo.com/ 
[WaWebHost.exe] Preparing to send CheckIdRequest (2.0) message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.ExtensionsBindingElement applied to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.RelyingPartySecurityOptions did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.BackwardCompatibilityBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.Messaging.Bindings.StandardExpirationBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.SigningBindingElement did not apply to message. 
[WaWebHost.exe] Sending message: CheckIdRequest 
[WaWebHost.exe] Redirecting to https://open.login.yahooapis.com/openid/op/auth?openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.return_to=http%3A%2F%2F127.0.0.1%3A5100%2FOpenId.aspx%3Fdnoa.userSuppliedIdentifier%3Dhttps%253A%252F%252Fme.yahoo.com&openid.realm=http%3A%2F%2F127.0.0.1%3A5100%2FOpenId.aspx&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0 
[WaWebHost.exe] Raising minimum OpenID version requirement for Providers to 2.0 to protect this stateless RP from replay attacks. 
[WaWebHost.exe] Incoming HTTP request: GET http://127.0.0.1:5100/OpenId.aspx?dnoa.userSuppliedIdentifier=https%3A%2F%2Fme.yahoo.com&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.mode=id_res&openid.return_to=http%3A%2F%2F127.0.0.1%3A5100%2FOpenId.aspx%3Fdnoa.userSuppliedIdentifier%3Dhttps%253A%252F%252Fme.yahoo.com&openid.claimed_id=https%3A%2F%2Fme.yahoo.com%2Fa%2FXLKt_2gxi_gDtLXSO4IyPi6gz3xDxA--%23afa8c&openid.identity=https%3A%2F%2Fme.yahoo.com%2Fa%2FXLKt_2gxi_gDtLXSO4IyPi6gz3xDxA--&openid.realm=http%3A%2F%2F127.0.0.1%3A5100%2FOpenId.aspx&openid.assoc_handle=kCG5j8w0Czja2yJ.JumEVy3SNaHp4aZQ4AdjguIo.OU2SrcpQsEtBxiZvqP_wP9Yf03KI_eOet5.Qsbv2Ov7MXEyGdVP4b4p4Cewoent7pmFNBxanpkYCg_W_zvJXkUo&openid.response_nonce=2010-03-04T19%3A48%3A00ZT3svYxSveINSAkkLdpO.IApS8NhEBBSdLQ--&openid.signed=assoc_handle%2Cclaimed_id%2Cidentity%2Cmode%2Cns%2Cop_endpoint%2Cresponse_nonce%2Creturn_to%2Csigned%2Cpape.auth_level.nist&openid.op_endpoint=https%3A%2F%2Fopen.login.yahooapis.com%2Fopenid%2Fop%2Fauth&openid.pape.auth_level.nist=0&openid.sig=mnpe8U7hLo3XBpUnmuX2tRgPwHA%3D 
[WaWebHost.exe] Incoming request received: PositiveAssertionResponse 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.BackwardCompatibilityBindingElement did not apply to message. 
[WaWebHost.exe] Verifying incoming PositiveAssertionResponse message signature of: mnpe8U7hLo3XBpUnmuX2tRgPwHA= 
[WaWebHost.exe] Preparing to send CheckAuthenticationRequest (2.0) message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.ExtensionsBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.RelyingPartySecurityOptions did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.BackwardCompatibilityBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.Messaging.Bindings.StandardExpirationBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.SigningBindingElement did not apply to message. 
[WaWebHost.exe] Sending CheckAuthenticationRequest request. 
[WaWebHost.exe] HTTP POST https://open.login.yahooapis.com/openid/op/auth 
[WaWebHost.exe] Received CheckAuthenticationResponse response. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.BackwardCompatibilityBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.SigningBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.Messaging.Bindings.StandardExpirationBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.RelyingPartySecurityOptions did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.ExtensionsBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.SigningBindingElement applied to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.Messaging.Bindings.StandardExpirationBindingElement applied to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.RelyingPartySecurityOptions applied to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.ExtensionsBindingElement applied to message. 
[WaWebHost.exe] Verifying assertion matches identifier discovery results... 
[WaWebHost.exe] HTTP GET https://me.yahoo.com/a/XLKt_2gxi_gDtLXSO4IyPi6gz3xDxA--#afa8c 
[WaWebHost.exe] X-XRDS-Location found in HTTP header. Preparing to pull XRDS from https://open.login.yahooapis.com/openid20/user_profile/xrds 
[WaWebHost.exe] HTTP GET https://open.login.yahooapis.com/openid20/user_profile/xrds 
[WaWebHost.exe] Total services discovered in XRDS: 1 
[WaWebHost.exe] [{ 
    ClaimedIdentifier: https://me.yahoo.com/a/XLKt_2gxi_gDtLXSO4IyPi6gz3xDxA--#afa8c 
    ProviderLocalIdentifier: https://me.yahoo.com/a/XLKt_2gxi_gDtLXSO4IyPi6gz3xDxA--#afa8c 
    ProviderEndpoint: https://open.login.yahooapis.com/openid/op/auth 
    OpenID version: 2.0 
    Service Type URIs: 
     http://specs.openid.net/auth/2.0/signon 
     http://specs.openid.net/extensions/pape/1.0 
     http://openid.net/sreg/1.0 
     http://openid.net/extensions/sreg/1.1 
     http://openid.net/srv/ax/1.0 
     http://specs.openid.net/extensions/oauth/1.0 
     http://specs.openid.net/extensions/ui/1.0/lang-pref 
     http://specs.openid.net/extensions/ui/1.0/mode/popup 
     http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier 
     http://www.idmanagement.gov/schema/2009/05/icam/no-pii.pdf 
     http://www.idmanagement.gov/schema/2009/05/icam/openid-trust-level1.pdf 
     http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf 
},] 
[WaWebHost.exe] Skipping HTML discovery because XRDS contained service endpoints. 
[WaWebHost.exe] Received identity assertion for https://me.yahoo.com/a/XLKt_2gxi_gDtLXSO4IyPi6gz3xDxA--#afa8c via https://open.login.yahooapis.com/openid/op/auth. 
[WaWebHost.exe] Raising minimum OpenID version requirement for Providers to 2.0 to protect this stateless RP from replay attacks. 
[WaWebHost.exe] Incoming HTTP request: GET http://127.0.0.1:81/OpenId.aspx?provider=Yahoo&email=rjf@surfmark.com&userid=XLKt_2gxi_gDtLXSO4IyPi6gz3xDxA-- 
[WaWebHost.exe] Raising minimum OpenID version requirement for Providers to 2.0 to protect this stateless RP from replay attacks. 
[WaWebHost.exe] HTTP GET https://www.google.com/accounts/o8/id 
[WaWebHost.exe] An XRDS response was received from GET at user-supplied identifier. 
[WaWebHost.exe] Total services discovered in XRDS: 1 
[WaWebHost.exe] [{ 
    ClaimedIdentifier: http://specs.openid.net/auth/2.0/identifier_select 
    ProviderLocalIdentifier: http://specs.openid.net/auth/2.0/identifier_select 
    ProviderEndpoint: https://www.google.com/accounts/o8/ud 
    OpenID version: 2.0 
    Service Type URIs: 
     http://specs.openid.net/auth/2.0/server 
     http://openid.net/srv/ax/1.0 
     http://specs.openid.net/extensions/ui/1.0/mode/popup 
     http://specs.openid.net/extensions/ui/1.0/icon 
     http://specs.openid.net/extensions/pape/1.0 
},] 
[WaWebHost.exe] Skipping HTML discovery because XRDS contained service endpoints. 
[WaWebHost.exe] Performing discovery on user-supplied identifier: https://www.google.com/accounts/o8/id 
[WaWebHost.exe] Creating authentication request for user supplied Identifier: https://www.google.com/accounts/o8/id 
[WaWebHost.exe] Preparing to send CheckIdRequest (2.0) message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.ExtensionsBindingElement applied to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.RelyingPartySecurityOptions did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.BackwardCompatibilityBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.Messaging.Bindings.StandardExpirationBindingElement did not apply to message. 
[WaWebHost.exe] Binding element DotNetOpenAuth.OpenId.ChannelElements.SigningBindingElement did not apply to message. 
[WaWebHost.exe] Sending message: CheckIdRequest 
[WaWebHost.exe] Redirecting to https://www.google.com/accounts/o8/ud?openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.return_to=http%3A%2F%2F127.0.0.1%3A5100%2FOpenId.aspx%3Fdnoa.userSuppliedIdentifier%3Dhttps%253A%252F%252Fwww.google.com%252Faccounts%252Fo8%252Fid&openid.realm=http%3A%2F%2F127.0.0.1%3A5100%2FOpenId.aspx&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0 

Answer 1

Il semble que vous attraper des exceptions et non les rethrowing, qui, dans le cas de ThreadAbortException peut changer la façon dont il est censé fonctionner. Je ne sais pas si cela fait partie du problème, mais ce n'est qu'une idée.

En outre, je remarque que vous utilisez l'URL de la requête (quelle qu'elle soit) en tant que return_to et le domaine. Je recommande de ne pas autoriser le domaine à être quelque soit l'URL de demande, car Google utilise l'identité dirigée et si un utilisateur visite "login.aspx" et plus tard le même utilisateur visite "Login.aspx" (capitalisation différente seulement) Google le verra comme deux différents sites et vous envoyer deux identités différentes. Vous devez vous assurer que le «domaine» est toujours le même à partir de votre site, la capitalisation et tout.

En ce qui concerne le problème de redirection intermittente, je ne vois rien qui pourrait causer cela. Le journal suggère que la redirection est en cours. Bien que votre capture de l'exception puisse à nouveau provoquer des échecs ici. Que faire vous obtenez quand la redirection ne se produit pas?