python-openid和Google Apps联合登录错误
[英]Errors with python-openid and Google Apps Federated Login
问题描述
UPDATE 
更新
I managed to get it working although I'm not quite sure why ;) It seems like python-openid uses a POST-request to issue the openid mode=associate and for some reason Google doesn't like that. 尽管我不太清楚为什么，但我设法使它工作；）似乎python-openid使用POST请求来发出openid mode = associate，并且由于某种原因Google不喜欢这样做。 When I patched python-openid to use a GET-request instead everything worked fine. 当我修补python-openid以使用GET-request时，一切正常。 I'll continue my investigation and update this post when I have more information. 我将继续调查并在有更多信息时更新此帖子。 Below is the diff for my change. 以下是我找零的区别。
--- python-openid-2.2.1.orig/openid/consumer/consumer.py
+++ python-openid-2.2.1/openid/consumer/consumer.py
@@ -229,6 +229,20 @@
# Process response in separate function that can be shared by async code.
return _httpResponseToMessage(resp, server_url)
+def makeKVGet(request_message, server_url):
+ """Make a Direct Request to an OpenID Provider and return the
+ result as a Message object.
+
+ @raises openid.fetchers.HTTPFetchingError: if an error is
+ encountered in making the HTTP post.
+
+ @rtype: L{openid.message.Message}
+ """
+ # XXX: TESTME
+ resp = fetchers.fetch(request_message.toURL(server_url))
+
+ # Process response in separate function that can be shared by async code.
+ return _httpResponseToMessage(resp, server_url)
def _httpResponseToMessage(response, server_url):
"""Adapt a POST response to a Message.
@@ -682,6 +696,7 @@
return True
_makeKVPost = staticmethod(makeKVPost)
+ _makeKVGet = staticmethod(makeKVGet)
def _checkSetupNeeded(self, message):
"""Check an id_res message to see if it is a
@@ -1258,7 +1273,7 @@
endpoint, assoc_type, session_type)
try:
- response = self._makeKVPost(args, endpoint.server_url)
+ response = self._makeKVGet(args, endpoint.server_url)
except fetchers.HTTPFetchingError, why:
oidutil.log('openid.associate request failed: %s' % (why[0],))
return None
Old question, preserved for context 旧问题，保留上下文
I've been trying desperately to get the trac-authopenid plugin to work but with no luck. 我一直在拼命地尝试使trac-authopenid插件正常工作，但是没有运气。
We use Google Apps Premier at work so I'm trying to get openid auth working with that. 我们在工作中使用Google企业应用专业版，因此我正在尝试使用openid身份验证。 I think I've set up all the required stuff (XRDS and such) as far as google is concerned and I've gotten it to work fine with apache2 + mod-auth-openid as well as using it on other sites (SO for example). 我想我已经就Google而言设置了所有必需的东西（XRDS等），并且我已经使其与apache2 + mod-auth-openid以及在其他站点上使用时都可以正常工作（因此例）。
But I can't seem to get it to work with trac-authopenid. 但是我似乎无法使其与trac-authopenid一起使用。 I get redirected (via a form post, not a redirect as usual) to Google where I get to log in but when I return the plugin simply states that validation failed. 我被重定向（通过表单发布，而不是照常重定向）到登录的Google，但是当我返回插件时，它只是指出验证失败。
If i turn on debug logging I get this (I've replaced our domain name with example.com) 如果我打开调试日志记录，我会得到这个（我已经用example.com替换了域名）
2010-01-27 12:21:15,811 Trac[authopenid] DEBUG: beginning OpenID authentication.
2010-01-27 12:21:16,866 Trac[authopenid] DEBUG: kvToSeq warning: Line 1 does not contain a colon: '<HTML>\n<HEAD>\n<TITLE>Not Implemented</TITLE>\n</HEAD>\n
2010-01-27 12:21:16,866 Trac[authopenid] DEBUG: kvToSeq warning: Line 2 does not contain a colon: '<HTML>\n<HEAD>\n<TITLE>Not Implemented</TITLE>\n</HEAD>\n
2010-01-27 12:21:16,866 Trac[authopenid] DEBUG: kvToSeq warning: Line 3 does not contain a colon: '<HTML>\n<HEAD>\n<TITLE>Not Implemented</TITLE>\n</HEAD>\n
... snipped, repeats until line 9...
2010-01-27 12:21:16,867 Trac[authopenid] DEBUG: openid.associate request failed: bad status code from server https://www.google.com/a/example.com/o8/ud?be=
2010-01-27 12:21:16,868 Trac[authopenid] DEBUG: _get_trust_root href: /trac
2010-01-27 12:21:16,868 Trac[authopenid] DEBUG: _get_trust_root abs_href: https://developer.example.com/trac
2010-01-27 12:21:16,868 Trac[authopenid] DEBUG: _get_trust_root href: /trac
2010-01-27 12:21:16,868 Trac[authopenid] DEBUG: _get_trust_root abs_href: https://developer.example.com/trac
2010-01-27 12:21:16,869 Trac[authopenid] DEBUG: Generated checkid_setup request to https://www.google.com/a/example.com/o8/ud?be=o8 using stateless mode.
2010-01-27 12:21:18,068 Trac[main] DEBUG: Dispatching <Request "GET u'/openidprocess'">
2010-01-27 12:21:18,075 Trac[session] DEBUG: Retrieving session for ID '25a842642693232301aad341'
2010-01-27 12:21:18,078 Trac[authopenid] DEBUG: Error attempting to use stored discovery information: <openid.consumer.consumer.TypeURIMismatch: Required ty
2010-01-27 12:21:18,078 Trac[authopenid] DEBUG: Attempting discovery to verify endpoint
2010-01-27 12:21:18,078 Trac[authopenid] DEBUG: Performing discovery on http://example.com/openid?id=113663311178245814720
2010-01-27 12:21:18,121 Trac[authopenid] DEBUG: Received id_res response from https://www.google.com/a/example.com/o8/ud?be=o8 using association AOQobUefon
2010-01-27 12:21:18,121 Trac[authopenid] DEBUG: Using OpenID check_authentication
2010-01-27 12:21:18,121 Trac[authopenid] DEBUG: op_endpoint
2010-01-27 12:21:18,121 Trac[authopenid] DEBUG: claimed_id
2010-01-27 12:21:18,121 Trac[authopenid] DEBUG: identity
2010-01-27 12:21:18,122 Trac[authopenid] DEBUG: return_to
2010-01-27 12:21:18,122 Trac[authopenid] DEBUG: response_nonce
2010-01-27 12:21:18,122 Trac[authopenid] DEBUG: assoc_handle
2010-01-27 12:21:18,576 Trac[authopenid] DEBUG: kvToSeq warning: Line 1 does not contain a colon: '<HTML>\n<HEAD>\n<TITLE>Not Implemented</TITLE>\n</HEAD>\n
2010-01-27 12:21:18,577 Trac[authopenid] DEBUG: kvToSeq warning: Line 2 does not contain a colon: '<HTML>\n<HEAD>\n<TITLE>Not Implemented</TITLE>\n</HEAD>\n
2010-01-27 12:21:18,577 Trac[authopenid] DEBUG: kvToSeq warning: Line 3 does not contain a colon: '<HTML>\n<HEAD>\n<TITLE>Not Implemented</TITLE>\n</HEAD>\n
... snipped, repeats until line 9...
2010-01-27 12:21:18,578 Trac[authopenid] DEBUG: check_authentication failed: bad status code from server https://www.google.com/a/example.com/o8/ud?be=o8: 501
I tried writing some code directly against the python-openid library in order to narrow it down a little but I'm clueless. 我尝试直接针对python-openid库编写一些代码，以将其范围缩小一点，但我一无所知。 I've been able to reproduce the error with this code snippet: 我已经能够使用以下代码片段重现该错误：
from openid.store.memstore import MemoryStore
from openid.consumer import consumer
session = { 'id' : 'foobar' }
store = MemoryStore()
consumer = consumer.Consumer(session, store)
consumer.begin('https://www.google.com/accounts/o8/site-xrds?hd=example.com')
Which consistently outputs 始终输出
kvToSeq warning: Line 1 does not contain a colon: '<HTML>\n<HEAD>\n<TITLE>Not Implemented</TITLE>\n</HEAD>\n<BODY BGCOLOR="#FFFFFF" TEXT="#000000">\n<H1>Not Implemented</H1>\n<H2>Error 501</H2>\n</BODY>\n</HTML>\n'
kvToSeq warning: Line 2 does not contain a colon: '<HTML>\n<HEAD>\n<TITLE>Not Implemented</TITLE>\n</HEAD>\n<BODY BGCOLOR="#FFFFFF" TEXT="#000000">\n<H1>Not Implemented</H1>\n<H2>Error 501</H2>\n</BODY>\n</HTML>\n'
kvToSeq warning: Line 3 does not contain a colon: '<HTML>\n<HEAD>\n<TITLE>Not Implemented</TITLE>\n</HEAD>\n<BODY BGCOLOR="#FFFFFF" TEXT="#000000">\n<H1>Not Implemented</H1>\n<H2>Error 501</H2>\n</BODY>\n</HTML>\n'
... snip ...
openid.associate request failed: bad status code from server https://www.google.com/a/example.com/o8/ud?be=o8: 501
Some version numbers: 一些版本号：
Python 2.6.2
trac-authopenid 0.1.6
python-openid 2.2.1
I'm at a complete loss and I could really use some help. 我完全不知所措，我真的可以使用一些帮助。
2 个解决方案
解决方案1
2 已采纳 2010-01-28 08:47:47
Okay. 好的。 I don't have an Apps account so I can't test logging in, but I can successfully associate with an apps domain with python-openid 2.2.4. 我没有Apps帐户，因此无法测试登录，但是我可以使用python-openid 2.2.4与应用程序域成功关联。 Here's a little debugging tool for making association requests: http://gist.github.com/288560 这是一个用于发出关联请求的调试工具： http : //gist.github.com/288560
Your patch should not have fixed things; 您的补丁程序应该没有固定的东西。 associate requests are always POSTs . 关联请求始终是POST 。 And the Ruby library also always POSTs, so unless rpxnow has made some unusual modifications, rpxnow shouldn't work when python-openid fails here. 而且Ruby库也总是POST，因此，除非rpxnow进行了一些不寻常的修改，否则当python-openid在此处失败时，rpxnow将不起作用。
I was about to ask you about the openid.store on your install, but if your minimal example with the MemoryStore reproduces it, that's not it. 我openid.store您有关安装时的openid.store信息，但是如果您的MemoryStore最小示例可以复制它，那不是。
I guess the only thing left I have for you is to suggest that you ask Google Apps customer support. 我想剩下的唯一事情就是建议您向Google Apps客户支持寻求帮助。
解决方案2
0 2010-11-14 01:09:11
You mentioned that you're using Python 2.6.2 with python-openid. 您提到使用的是Python 2.6.2和python-openid。 The Requirements section of the README file currently only lists Python 2.3, 2.4, or 2.5. 自述文件的“需求”部分当前仅列出Python 2.3、2.4或2.5。 It's good to hear you got it working. 听到您的使用效果很好，真是太好了。
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.