使用 SSL 创建 OpenID 提供商
所以我目前正在尝试创建一个 OpenID 提供商。我尝试过使用两个基于 Java 的 OpenID 服务器包 - Atlassian 的 Crowd 和 WSO2 Identity Server。现在，在我的实现中，安全性是必须的，这意味着使用 SSL 并具有基于 HTTPS 的 OpenID。现在，对于 WSO2 和 Crowd 来说，大量站点根本无法使用所提供的 OpenID。在测试的 20 个站点中，8 个使用 Crowd 失败，10 个使用 WSO2 失败。如此高的故障率确实令人无法接受。几乎每个有问题的站点都声称他们找不到 OpenID 端点。
当我使用不带 SSL 的 OpenID（基于 HTTP 的 OpenID）时，站点突然变得更加合规，只有两个站点出现故障。我使用的是 AusCERT 的证书，因此问题不应是由于自签名证书造成的。
起初我认为这只是有大量 RP 根本不接受基于 HTTPS 的 OpenID 的问题。我尝试使用 Verisign 的基于 HTTPS 的 OpenID 登录失败的相同站点，结果成功了。仔细观察 WSO2 和 Crowd，我发现它们都不完全符合 OpenID 2.0 规范——特别是，它们都没有在头部提供指向 yadis 发现的 XRDS 文档的链接。考虑到我的问题是站点无法在我提供的 URL 处发现 OpenID 端点，这似乎是相关的，只是当我不使用 SSL 时，基于 HTML 的发现就足够了。
有谁知道我的问题到底出在哪里？丢失的 XRDS 文件看起来应该是相关的，但它可能只是转移注意力。除此之外，如果有人知道 Crowd 或 WSO2 的一个很好的替代方案，它有很好的文档记录，符合规范，并且（相对）易于配置，那么很高兴知道！
so I'm currently trying to make an OpenID provider. I've tried using two Java based OpenID server packages- Atlassian's Crowd, and WSO2 Identity Server. Now, in my implementation, security is a must, which means using SSL and having HTTPS based OpenIDs. Now, for both WSO2 and Crowd a large number of sites simply do not work with the OpenIDs provided. Of 20 sites tested, 8 failed with Crowd, and 10 failed with WSO2. This high failure rate is not really acceptable. Virtually every site which has a problem claims that they cannot find an OpenID endpoint.
When I used the OpenIDs without SSL (so HTTP based OpenIDs) suddenly the sites were far more compliant, with only two of them failing. I am using a certificate from AusCERT, so the problem should not be due to self-signed certificates.
At first I thought that this was just a matter of there being a large number of RPs which simply did not accept HTTPS based OpenIDs. I tried logging into the same sites I was failing on with an HTTPS based OpenID from Verisign though, and it worked. Looking closer at both WSO2 and Crowd I discovered that neither completely conformed to OpenID 2.0 specification- in particular, neither of them provide a link in the head to an XRDS document for yadis discovery. Considering that my problem is that sites cannot discover an OpenID endpoint at the URL I give, it seems relevant except that when I do not use SSL the HTML based discovery is sufficient.
Does anyone have any insight as to where my problem really lies? The missing XRDS document seems like it should be relevant, but it could just be a red herring. Baring that, if anyone knows a good alternative to Crowd or WSO2 which is well documented, works well to spec, and is (relatively) easy to configure, it would be nice to know!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
需要注意的一件事是，某些提供商的 SSL 证书并未由某些 RP 认为具有权威的根机构签名。确保您从所有 RP 信任的证书处获取证书。
如果您的提供商可以选择 .NET，请查看免费开源 DotNetOpenAuth 库，您可以使用该库自行托管，并由一些主要 OP 使用，例如 MySpace 和 netidme.com 和其他 。它的 OpenID 2.0 实现已完成，它支持美国政府 ICAM OpenID 2.0 配置文件，并已用于许多互操作性、安全性和合规性测试，并且它可与 OpenID 1.1 和 2.0 RP 配合使用，因此您很可能拥有与许多/所有 RP 具有良好的互操作性。它有一堆其他安全功能，您只需打开它们即可（例如要求正如您所说，HTTPS 是一个要求）。
（全面披露：我写了 DotNetOpenAuth。）
One thing to look at is that some Providers' SSL certificates are not signed by root authorities that are considered authoritative by some RPs. Make sure you get your certificate from one that all RPs trust.
If .NET is an option for your provider, check out the free and open source DotNetOpenAuth library, which you can host yourself and is used by some major OPs such as MySpace and netidme.com and others. It's implementation of OpenID 2.0 is complete, it supports the U.S. government ICAM OpenID 2.0 Profile, and has been used for many interoperability, security and compliance tests, and it works with both OpenID 1.1 and 2.0 RPs so you'd be very likely to have good interoperability with many/all RPs. It has a bunch of additional security features that you can just switch on (like requiring HTTPS as you said is a requirement).
(Full disclosure: I wrote DotNetOpenAuth.)