fedora-infrastructure

#4201 ask.fedoraproject.org sign-in using OpenID fails
Closed: Fixed Opened by roxoff.

Closed: Fixed
Reopen Issue

= bug description =
Trying to log-in at https://ask.fedoraproject.org is failing when I provide credentials using my OpenID and certificate-based login.

Having raised this issue on the question board, I was directed to raise a ticket here. My OpenID login credential works elsewhere, particularly in askbot.org where I was asked to try it.

My openid url is cobra.startssl.com (or https://cobra.startssl.com) for which I have the certificate stored in my certificate store locally so that the browser can access it.

This was all working great until just before the weekend.

I've tried this from two different locations - both on separate IP addresses, and hosted by different ISPs.

The response it generates is a yellow bar at the top of the page saying:

"Server denied check_authentication"

There is quite a bit of information along the address bar on the page where the login failure occurs. It might help diagnosis of the problem, so I'm adding this too:

https://ask.fedoraproject.org/en/account/signin/complete/?next=%2Fen%2F&janrain_nonce=2014-01-28T11%3A09%3A17ZQ1YC2a&openid.assoc_handle=%7BHMAC-SHA1%7D%7B52e78fe3%7D%7Baz1mgw%3D%3D%7D&openid.claimed_id=https%3A%2F%2Fcobra.startssl.com%2F&openid.identity=https%3A%2F%2Fcobra.startssl.com%2F&openid.invalidate_handle=%7BHMAC-SHA1%7D%7B52570e04%7D%7BLJ3%2F7w%3D%3D%7D&openid.mode=id_res&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.sreg=http%3A%2F%2Fopenid.net%2Fextensions%2Fsreg%2F1.1&openid.op_endpoint=https%3A%2F%2Fwww.startssl.com%2Fid.ssl&openid.response_nonce=2014-01-28T11%3A09%3A23ZYnHrCi&openid.return_to=https%3A%2F%2Fask.fedoraproject.org%2Fen%2Faccount%2Fsignin%2Fcomplete%2F%3Fnext%3D%252Fen%252F%26janrain_nonce%3D2014-01-28T11%253A09%253A17ZQ1YC2a&openid.sig=K6p5f6w3iBdzQlC5FWcRl7KUpZQ%3D&openid.signed=assoc_handle%2Cclaimed_id%2Cidentity%2Cinvalidate_handle%2Cmode%2Cns%2Cns.sreg%2Cop_endpoint%2Cresponse_nonce%2Creturn_to%2Csigned%2Csreg.email%2Csreg.nickname&openid.sreg.email=neil.stevenson%40roxoff.net&openid.sreg.nickname=cobra

= bug analysis =

= fix recommendation =

I got this from the httpd error log:

{{{
../httpd/error_log:[Tue Jan 28 13:59:59 2014] [error] Performing discovery on https://cobra.startssl.com/
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] Received id_res response from https://www.startssl.com/id.ssl using association {HMAC-SHA1}{52e7b7c4}{vRBxAw==}
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] Using OpenID check_authentication
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] assoc_handle
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] claimed_id
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] identity
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] invalidate_handle
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] mode
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] ns
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] ns.sreg
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] op_endpoint
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] response_nonce
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] return_to
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] signed
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] sreg.email
../httpd/error_log-[Tue Jan 28 14:00:03 2014] [error] sreg.nickname
../httpd/error_log-[Tue Jan 28 14:00:05 2014] [error] check_authentication failed: Malformed HTTP header line in response: ''
../httpd/error_log-[Tue Jan 28 14:00:14 2014] [error] [client 192.168.1.15] File does not exist: /var/lib/askbot/upfiles/ask/ask_favicon.ico
../httpd/error_log-[Tue Jan 28 14:00:15 2014] [error] [client 192.168.1.15] File does not exist: /var/lib/askbot/upfiles/ask/ask_favicon.ico
../httpd/error_log-[Tue Jan 28 14:00:17 2014] [error] Generated checkid_setup request to https://www.startssl.com/id.ssl with assocication {HMAC-SHA1}{52570e04}{LJ3/7w==}
}}}

Still no closer to solving the issue, though. Will have to look around to see what it means.

The
{{{
Malformed HTTP header line in response: ''
}}}
could be it?

I found this:

https://github.com/agiliq/Django-Socialauth/issues/41

It looks like the issue you're running into.

Since it's working on askbot, it could be a difference in package versions or overall configuration. I'll have to ask upstream what their configuration is. We're using python-openid-2.2.5, for instance.

The funny thing is that we don't appear to using social-auth...

Patrick tracked this down eariler tonight...

https://github.com/openid/python-openid/pull/76

is the fix. It's a bug in python-openid. ;(

He was going to update this bug and do a hotfix, but has had connectivity problems. ;( Hopefully tomorrow.

How is the rollout for this going? Did the suggested fix get applied yet? It's still behaving in the same way.

Sorry for the delay.

Should be hotfixed now. Can you login ok now?

Please reopen if not and we will track it down...

Sorry Kevin, but it's still not working. I tried three times between approximately 22:55 and 22:58 UTC from both Chrome and Firefox on my desktop, using IP address 79.77.48.113 (I hope that's enough to help you find this in the logs). The effect looks exactly as it did the previous times it failed - with the message "Server denied check_authentication".

I'm running Fedora 19 64 bit, but I was having this problem at work too where I run Chrome on Windows 7/64 bit.

I don't rule out that I could be doing something badly to cause this at my end, but the cert I'm using has worked before, and has not changed.

Cheers.

Okay, I will look into this some more later today.

Did this get anywhere? It's still not working, and I still can't log-in to ask.fedoraproject.org using my certificate credential.

This should now be fixed.
These was a small bug in the hotfix.
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.