How to make joid return a negative assertion if user does not want to allow access?

[Travis Reeder]

Hans,

Lets say a user does not want to allow access to a particular realm,
is there a way to send a negative assertion?

[Hans Granqvist]

Section 14.2.2 of the spec requires you to return extra values for
immediate requests,
so the servlet code becomes something like:

// if user cancels
if (is immediate request) {
return "openid.mode=id_res&openid.user_setup_url=" + setupUrl;
} else {
return "openid.mode=cancel";

[Travis Reeder]

Ok, but is there anything built into joid (yet) to generate that
response?

[Hans Granqvist]

Nope, there isn't.

It's not completely trivial to implement it, though, is it? There is
by definition user interaction taking place between request and
response, and that messes the processing flow up a bit. Perhaps you
have a simple solution?

On 7/22/07, Travis Reeder <tre...@gmail.com> wrote:
>