Google Apps OpenID endpoint gives errors, but standard Google endpoint with Apps account works - what gives?

1
votes

I'm building a site where people from an organization will login with their organization-provided Google Apps accounts. The site uses DotNetOpenAuth's standard OpenID sample code to authenticate with the Google OpenID provider.

OpenID is enabled on this Google Apps domain, but when I attempt to authenticate a user via the https://google.com/accounts/o8/site-xrds?hd=domain.com endpoint, I get the following error:

Error occurred while sending a direct message or getting the response.

However, if I use the standard https://www.google.com/accounts/o8/id endpoint and sign in with my Google Apps account, it works!

Why does the same Google Apps account produce two different results: one endpoint works, the other fails to authenticate properly?

1
c#openiddotnetopenauthgoogle-appsgoogle-openid

1 Answers

1
votes

Google Apps doesn't follow the OpenID 2.0 protocol exactly. It has a proprietary discovery mechanism which DotNetOpenAuth doesn't have switched on by default.

Check out the sample from SourceForge in the OpenIdRelyingPartyWebForms project's loginGoogleApps.aspx file. You'll see that its code-behind adds Google Apps discovery to the OpenIdRelyingParty class. If you do this, I think it will work for you too.