OpenID login code does not work on real server

Question

I want to implement an OpenID login system with the latest version of LightOpenID . I am testing the source code example line by line (I just replaced localhost with $_SERVER['HTTP_HOST'] in the constructor).

The problem is that everything works well in my development area inside the private network (PHP / 5.3.6 on Windows Vista), but the validation always ends on my life server on the public HSP network (PHP / 5.3.3 on CentOS).

I added var_dump() , and I can say that both copies of the code give exactly the same request parameters and get exactly the same response parameters (via GET). Only openid.assoc_handle , openid.sig , openid.response_nonce and openid.return_to have different meanings, which I think are the expected behavior.

However, my dev block gets this from the OpenID provider (no matter which one I use):

 is_valid:true ns:http://specs.openid.net/auth/2.0 

... and my living fox gets this:

 is_valid:false ns:http://specs.openid.net/auth/2.0 

There are no non-ASCII characters, so this may not be a coding problem. There should be something wrong with my hosting service, but I just can't figure that out.

I need suggestions on possible causes and troubleshooting tips.

Answer 1

I highlighted the problem and found a workaround. The request() method does some automatic discovery to find out how to establish HTTP connections:

 protected function request($url, $method='GET', $params=array(), $update_claimed_id=false) { if (function_exists('curl_init') && (!in_array('https', stream_get_wrappers()) || !ini_get('safe_mode') && !ini_get('open_basedir')) ) { return $this->request_curl($url, $method, $params, $update_claimed_id); } return $this->request_streams($url, $method, $params, $update_claimed_id); } 

In my dev block, CURL is used, but in my box it uses file_get_contents() , because the check fails. The reason is that the open_basedir directive is not empty.

If I force LightOpenID to use CURL, everything works smoothly.

---

Update # 1: LightOpenID was right when it decided that curl was not used. I found this in the log file:

CURLOPT_FOLLOWLOCATION cannot be activated if safe_mode is enabled or open_basedir is set

Regarding the version of file_get_contents() , I suspect I found a typo in the library:

 Index: lightopenid/openid.php =================================================================== --- lightopenid/openid.php (0.60) +++ lightopenid/openid.php (working copy) @@ -349,7 +349,7 @@ $this->headers = $this->parse_header_array($http_response_header, $update_claimed_id); } - return file_get_contents($url, false, $context); + return $data; } protected function request($url, $method='GET', $params=array(), $update_claimed_id=false) 

I notified the author, and he confirmed this as an error. I will send a report if it is fixed.

Update # 2: Fixed a bug in the master branch in June 2012. It is still not part of the stable version, but can be downloaded from the code repository .

Answer 2

Just a shot in the dark, but when I was working with OpenID (not lightopenid), but the library for CodeIgniter, I had a similar problem when my permissions were set incorrectly for the nonce cache folder. Maybe this is a simple storage problem?