Head. Desk. Bam. -- or, Any OpenID (or LJ) experts in the audience?

[jducoeur]

There are days that I really hate being anywhere near the cutting edge, because it mostly tends to cut my legs off.

It appears that, sometime in the very recent past (past couple of weeks), CommYou's LiveJournal integration broke. Far as I can tell, this isn't due to anything I did: the version on the live site is just as dead as on my test laptop. I'm not sure when it happened, because I don't re-login very often, but it's sometime since I put up release 0.3.0.

Best I can tell, LJ's OpenID implementation is now broken, but that's based on a very inexpert understanding of the protocol. I seem to be using Version 1.1 of the protocol, and according to this report, Version 1.1 isn't allowed to send the op_endpoint parameter. LJ is not only sending it, it's sending it *empty*, which is causing the OpenID libraries to crash. (If present, it's supposed to be a URL.) Don't know what changed; like I said, this was working a few weeks ago, and my code hasn't changed.

Grumph. Does anyone know OpenID well enough to confirm my understanding that this is LJ's fault? (It's certainly possible that the problem is in the SXIP library I'm using -- that it's doing something wrong and LJ stopped tolerating it.) Does anyone know LJ well enough to know who I should be reporting it to? For the moment, I'll probably just have to hack around it, but I assume I'm not the only person seeing this problem...

Comments

[crschmidt.livejournal.com]

For what it's worth, I just skimmed LJ's changelog for the past 400 entries, (back to early September) and couldn't find anything with "openid" in it that seemed relevant...

[jducoeur]

Hmm; curious. Not sure what the hell is happening, but thanks for checking...

[jducoeur]

See also the response down-thread -- apparently the public release notes for yesterday's release (which I hadn't gotten to yet, being perpetually behind on LJ) say that they just upgraded to OpenID 2.0. Which goes a ways towards explaining why I only just today saw CommYou break.

My best guess is that this didn't show up in the changelog because they didn't change the core LJ code, but instead swapped in different libraries...

[crschmidt.livejournal.com]

Doesn't surprise me in the slightest. I was actually going to suggest exactly that (having ha a discussion earlier this week on LJ not supporting 2.0, and most things moving towards it), but couldn't remember where the featureannounce community was.

[jducoeur]

In researching the problem the other day, I came across a recent article somewhere that blasted LJ for not supporting 2.0, specifically in the context of being able to interoperate with Yahoo. I suspect that that was the impetus for the change...

[crschmidt.livejournal.com]

I wonder if we read the same article :) Certainly sounds familiar.

(Of course, since Yahoo! isn't a damn OpenID consumer itself, feels somewhat unfair to blame LJ for not having full support for one directional communication with a provider who doesn't seem to care about doing the same... I'm so tired of the "We can login to you, but you can't login to us!" OpenID sites.)

[cellio]

I don't know if this is relevant, but: Upgraded OpenID client support to support OpenID 2.0. (Oct 23)

[jducoeur]

Ahhh -- yes, I think you've put your finger on it, especially since the timing fits. The behaviour I'm seeing is very consistent with LJ now supporting 2.0: the most obvious problems were all that it is giving a bunch of parameters that are forbidden in the 1.1 protocol that we're supposedly using. I think the crux of the issue is that my third-party libraries *think* it's using 1.1, but LJ is actually sending 2.0.

*Sigh*. All right -- this is a pain in my ass, but at least I now vaguely understand what changed. Now I need to figure out why the OpenID library isn't supporting 2.0 properly. (Which may just require me to go back to the sources: the binary release is fully 200 checkins behind the source, so there may be bugfixes I have to pick up.) Thanks for noticing that...

[cellio]

What I couldn't tell from this report (not knowing the relevant protocols at all) was whether this was "2.0 in addition to 1.x" or "2.0 instead of 1.x". Sounds from your comments like it's the latter, which is a bummer. I hope there's already a bugfix waiting for you.

[jducoeur]

Well, I'm not going to despair terribly. It's entirely likely that the problem is actually that the old version of the OpenID library just doesn't do 2.0 properly, and is getting confused about which version it's talking. (It clearly *thinks* it's using 1.1.) If I'm *lucky*, all I have to do is download the current code and rebuild from that...