Issue 192 in openid4java: Association discovery with Steam OpenId: Required parameter missing: assoc_type

[codesite...@google.com]

Status: New
Owner: ----
Labels: Type-Defect Priority-Medium

New issue 192 by e.mass...@faceit.com: Association discovery with Steam
OpenId: Required parameter missing: assoc_type
http://code.google.com/p/openid4java/issues/detail?id=192

What steps will reproduce the problem?
1. Set http://steamcommunity.com/openid as the openid provider
2. Following the example on the tutorial, launch the discovery and
association

List discoveries = manager.discover(openidprovider);

// attempt to associate with the OpenID provider
// and retrieve one service endpoint for authentication
DiscoveryInformation discovered = manager.associate(discoveries);

3. My log is filling with exceptions from the ConsumerManager

org.openid4java.message.MessageException: 0x100: Required parameter
missing: assoc_type
at org.openid4java.message.Message.validate(Message.java:188)
at
org.openid4java.message.AssociationResponse.validate(AssociationResponse.java:235)
at
org.openid4java.message.AssociationResponse.createAssociationResponse(AssociationResponse.java:118)

and then I see
WARN ConsumerManager - Association failed; using first entry:
https://steamcommunity.com/openid/login

and all works perfectly: the user gets redirected to Steam for openid
authentication, Steam calls the callback url correcly and the
authentication goes fine.

What is the expected output? What do you see instead?
Why my log is full of exceptions? Ho can I stop them? Why these errors if
all is working perfectly?
I can't simply set the log4j to ignore ERROR level for ConsumerManager!

What version of the product are you using? On what operating system?
0.9.6 from maven repository

Please provide any additional information below.
JDK 7


--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

[codesite...@google.com]

Comment #1 on issue 192 by frank.co...@gmail.com: Association discovery

with Steam OpenId: Required parameter missing: assoc_type
http://code.google.com/p/openid4java/issues/detail?id=192

Seems like Steam does not support the default association type?
The attached patch fixes the error message to indicate what really happens,
i.e., Steam returns some specific association error.

Attachments:
AssociationResponse-error-code-unsupported-type.patch 600 bytes

[codesite...@google.com]

Comment #3 on issue 192 by marco.de...@gmail.com: Association discovery

with Steam OpenId: Required parameter missing: assoc_type
http://code.google.com/p/openid4java/issues/detail?id=192

Seems like Steam's OpenID service is using Stateless-mode.
Openid4java can be set to stateless by setting the maximum association
attempts to 0:

manager = new ConsumerManager();
manager.setMaxAssocAttempts(0); // triggering stateless mode, needed for
Steam

[codesite...@google.com]

Comment #4 on issue 192 by martin.t...@gmail.com: Association discovery

with Steam OpenId: Required parameter missing: assoc_type
http://code.google.com/p/openid4java/issues/detail?id=192

Hi! I had the same issue with getting Steam to work with openid4java,
setting assocAttemtps to 0 did help. However, I'm still getting an
exception from AxMessage.getExtension. Here's the full stack trace:
http://pastebin.com/gXXK25d5

And the source that does the OpenID stuff (I'm using Scala with Play 2.2)
https://github.com/GyrosOfWar/a-z-challenge-log/blob/master/app/controllers/Authentication.scala

Do I need to set any AxMessage for my request? I'm still very new to OpenID
and I can't find any helpful resources on this topic.

[codesite...@google.com]

Comment #5 on issue 192 by Johnny.B...@gmail.com: Association discovery

with Steam OpenId: Required parameter missing: assoc_type
http://code.google.com/p/openid4java/issues/detail?id=192

assoc_type is required in positive association responses; if a provider
doesn't support associations it should respond with an association error:
direct error message / http status code 400, per:
http://openid.net/specs/openid-authentication-2_0.html#anchor21
http://openid.net/specs/openid-authentication-2_0.html#anchor8

Steam OP is likely not responding with a correct association error.

[codesite...@google.com]

Comment #6 on issue 192 by Johnny.B...@gmail.com: Association discovery

with Steam OpenId: Required parameter missing: assoc_type
http://code.google.com/p/openid4java/issues/detail?id=192

Martin: the stack trace indicates that the OP you're interacting with does
send a AX response, however an invalid one.

And the Authentication controller requires a valid AX response, since its
policy seems to be to use the email attribute from the openid/ax response
as the authenticated username - so no way around it that I can see except
the OP fixing their AX responses.

[codesite...@google.com]

Comment #7 on issue 192 by martin.t...@gmail.com: Association discovery

with Steam OpenId: Required parameter missing: assoc_type
http://code.google.com/p/openid4java/issues/detail?id=192

Thank you very much for your quick response! I've found a workaround in the
meanwhile, I've completely ignored all Attribute Exchange stuff and I'm
fetching all the user data through the Steam API, which works because you
get the user's Steam ID through his OpenID.