1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
Sometimes when I try to login (to edit a page) here then I can see
the following error message:
Error: OpenID failure: time_bad_sig:
Please note that authorization process successes on OpenID server side.
It occurs both for [getopenid.com](http://www.getopenid.com/)
and [myopenid.com](http://www.myopenid.com/) servers I use.
I'm reporting this, but I'm not sure whether a problem is with your
ikiwiki or my OpenID servers. --[[Paweł|ptecza]]
> I've seen this too, once or twice (using myopenid), and reauthenticating
> fixed it -- so I can't reproduce it reliably to work on it. I think I've
> seen it both on this wiki and on the one running on my laptop.
>
> The perl openid client module seems
> to fail with time_bad_sig if the time in the signature from the other end
> is "faked". I'm not 100% sure what this code does yet:
# check age/signature of return_to
my $now = time();
{
my ($sig_time, $sig) = split(/\-/, $self->args("oic.time") || "");
# complain if more than an hour since we sent them off
return $self->_fail("time_expired") if $sig_time < $now - 3600;
also complain if the signature is from the future by more than 30 seconds,
# which compensates for potential clock drift between nodes in a web farm.
return $self->_fail("time_in_future") if $sig_time - 30 > $now;
# and check that the time isn't faked
my $c_secret = $self->_get_consumer_secret($sig_time);
my $good_sig = substr(OpenID::util::hmac_sha1_hex($sig_time, $c_secret), 0, 20);
return $self->_fail("time_bad_sig") unless $sig eq $good_sig;
}
> At least it doesn't seem to be a time sync problem since the test for too
> early/too late times have different error messages.. --[[Joey]]
I've had this problem too, but with my track record of reporting OpenID bugs
I thought it best if I held my tongue. I usually experience this the first
time I sign in on any ikiwiki installation of {ikiwiki.kitenet, ikidev,
betacantrips}, and I think re-logging in always works. --Ethan
> Does seem easier to repro than I thought.
> Ok, fixed it.. [[bugs/done]] --[[Joey]]
Hmmmmm, looks like it is not entirely fixed. I am getting it on my own
[blog](http://blog.tobez.org/). Just upgraded to 3.20110430, same same.
I am using custom openid with redirection to myopenid.com.
Please tell me if you need more info. The same openid worked fine to login to *this* site to post this.
-- Anton
> Well, this bug is from 2007. Probably you are not encountering the same
> bug.
>
> I also have a openid delegation to myopenid, and I can reproduce the
> problem when logging into your site.
>
> What version of the
> Net::OpenId::Consumer perl library do you have installed? --[[Joey]]
|