up vote 4 down vote favorite

(related to Common parameter to retrieve email address from OpenID provider)

The following is subset of response from StackExchange OpenID server after successful authentication

array(14) {
  ["openid_mode"] => string(6) "id_res"
  ["openid_ns"] => string(32) "http://specs.openid.net/auth/2.0"
  ["openid_ns_alias3"] => string(28) "http://openid.net/srv/ax/1.0"
  ["openid_alias3_mode"] => string(14) "fetch_response"
  ["openid_alias3_type_alias1"] => string(33) "http://axschema.org/contact/email"
  ["openid_alias3_value_alias1"] => string(20) "[email protected]"
}

Instead of openid_alias3_type_alias1 it should be openid_ax_value_email (like done by Yahoo!) according to OpenID standard http://openid.net/specs/openid-attribute-exchange-1_0.html#fetch_response

share|improve this question

1 Answer

up vote 3 down vote accepted

This is incorrect.

In the spec, there's this line:

The actual extension namespace alias should be determined on a per-message basis by the party composing the messages, in such a manner as to avoid conflicts between multiple extensions.

It uses ax as an example for the rest of the document, but does not require the use of that namespace.

The proper way to parse an attribute exchange response is to find the namespace it's under, if any, and then find the relevant type/value pairs.

So, in this case, you'd scan till you found http://openid.net/srv/ax/1.0. Now armed with the knowledge that Attribute Exchange is under the alias3 namespace, you can find the type/value pairs.

share|improve this answer
why is it starting from alias3 and not from alias1? – emaillenin Sep 21 '11 at 16:33
@emaillenin - implementation detail in dotNetOpenAuth. – Kevin Montrose♦ Sep 21 '11 at 16:57
I dont know how dotNetOpenAuth works. But can you confirm, whenever 'email' is requested, it will be passed back in the same parameter 'openid_alias3_value_alias1' or the alias number changes based on the number of fields requested(like email, firstname,gender etc)? – emaillenin Sep 21 '11 at 17:16
@emaillenin - I could look into it, but there's no point. It's not guaranteed that it won't change in the future. You always need to lookup the alias. – Kevin Montrose♦ Sep 21 '11 at 17:19
If you are one of the contributors to dotNetOpenAuth library, I would like you to propose to team that the parameter name can be simplified like Yahoo! does. email is always returned using 'openid_ax_value_email'. Doing that is going to reduce 10 lines of code is all webapps that uses OpenID authentication :) – emaillenin Sep 21 '11 at 17:23
@emaillenin - If you just want to auth against Yahoo, that's fine. If you want any sort of interop with other provides (I'm pretty sure Google uses a different key, for example) that's a non-starter. I am not a dotNetOpenAuth contributor, for the record. – Kevin Montrose♦ Sep 21 '11 at 17:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged