Question

我正在使用DotnetOpenAuth示例中的以下示例代码（OpenIdProviderMvc中的OpenId控制器）

public ActionResult ProcessAuthRequest() {
        if (ProviderEndpoint.PendingRequest == null) {
            return this.RedirectToAction("Index", "Home");
        }

        // Try responding immediately if possible.
        ActionResult response;
        if (this.AutoRespondIfPossible(out response)) {
            return response;
        }

        // We can't respond immediately with a positive result.  But if we still have to respond immediately...
        if (ProviderEndpoint.PendingRequest.Immediate) {
            // We can't stop to prompt the user -- we must just return a negative response.
            return this.SendAssertion();
        }

        return this.RedirectToAction("AskUser");
    }

private bool AutoRespondIfPossible(out ActionResult response)
    {
        if (ProviderEndpoint.PendingRequest.IsReturnUrlDiscoverable(OpenIdProvider.Channel.WebRequestHandler) == RelyingPartyDiscoveryResult.Success
            && User.Identity.IsAuthenticated) {
                if (ProviderEndpoint.PendingAuthenticationRequest != null) {
                    if (ProviderEndpoint.PendingAuthenticationRequest.IsDirectedIdentity
                        || this.UserControlsIdentifier(ProviderEndpoint.PendingAuthenticationRequest)) {
                            ProviderEndpoint.PendingAuthenticationRequest.IsAuthenticated = true;
                            response = this.SendAssertion();
                            return true;
                    }
                }

                if (ProviderEndpoint.PendingAnonymousRequest != null) {
                    ProviderEndpoint.PendingAnonymousRequest.IsApproved = true;
                    response = this.SendAssertion();
                    return true;
                }
        }

        response = null;
        return false;
    }

但是，我不想问用户任何事情。我正在尝试建立一个Web应用程序门户，如果用户已登录，则应自动响应RP（他是）。然而AutoRespondIfPossible返回false，因为ProviderEndpoint.PendingRequest.IsReturnUrlDiscoverable返回false而我不确定原因。我应该采取什么行动？

日志：

RP：http://pastebin.com/0EX2ZE1C EP：http://pastebin.com/q5CPrWp6

以前的相关问题：

SSO - No OpenID endpoint found

OpenIdProvider.GetRequest() returns null

Does an OpenID realm have to be the base URL of the web site?

Answer 1

IsReturnUrlDiscoverable执行OpenID称为“RP Discovery”的操作。无论如何它都很重要，但特别是如果你要自动登录用户，它对安全性至关重要。它返回false的事实告诉你RP需要做一些正确的工作。

这个blog post解释了RP必须做什么才能通过“RP Discovery”测试。

IsReturnUrlDiscoverable有什么作用？

1 个答案: