Projects

So the result:

When using OpenID the site redirects to registration form explaining that important data are missing... Among them - first name, email etc. So looks like Google does not return any data...

Here is what is in logs:

Processing AccountController#login (for 93.175.198.211 at 2011-06-04 16:19:11) [POST]
  Parameters: {"openid.mode"=>"id_res", "openid.op_endpoint"=>"https://www.google.com/accounts/o8/ud", "openid.return_to"=>"http://projects.andriylesyuk.com/login?_method=post&open_id_complete=1", "openid.sig"=>"*******", "openid.response_nonce"=>"******", "openid.ns"=>"http://specs.openid.net/auth/2.0", "action"=>"login", "_method"=>"post", "openid.identity"=>"https://www.google.com/accounts/o8/id?id=*******", "openid.assoc_handle"=>"******", "openid.signed"=>"op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle", "controller"=>"account", "open_id_complete"=>"1", "openid.claimed_id"=>"https://www.google.com/accounts/o8/id?id=*******"}
No pre-discovered information supplied
Performing discovery on https://www.google.com/accounts/o8/id?id=*******
WARNING: making https request to https://www.google.com/accounts/o8/id?id=******** without verifying server certificate; no CA path was specified.
Rendering template within layouts/base
Rendering account/register
Completed in 289ms (View: 55, DB: 7) | 200 OK [http://projects.andriylesyuk.com/login?...

As I understand the situation - Redmine requests data from Google but Google does not return anything... Perhaps OpenID spec changed or Redmine 1.0.x and/or Debian stable are too old.

It works if I change the open_id_authenticate function to the following:

  def open_id_authenticate(openid_url)
    authenticate_with_open_id(openid_url, :required => [:nickname, :fullname, :email,
        'http://axschema.org/namePerson/first', 'http://axschema.org/namePerson/last', 'http://axschema.org/contact/email'
      ], :return_to => signin_url) do |result, identity_url, registration|
      if result.successful?
        logger.info " >>> registration: #{registration.inspect}" # FIXME
        user = User.find_or_initialize_by_identity_url(identity_url)
        if user.new_record?
          # Self-registration off
          redirect_to(home_url) && return unless Setting.self_registration?

          # Create on the fly
          user.login = registration['nickname'] unless registration['nickname'].nil?
          user.mail = registration['email'] unless registration['email'].nil?
          user.firstname, user.lastname = registration['fullname'].split(' ') unless registration['fullname'].nil?

          user.login = registration['http://axschema.org/contact/email'].first unless registration['http://axschema.org/contact/email'].nil?
          user.mail = registration['http://axschema.org/contact/email'].first unless registration['http://axschema.org/contact/email'].nil?
          user.firstname = registration['http://axschema.org/namePerson/first'].first unless registration['http://axschema.org/namePerson/first'].nil?
          user.lastname = registration['http://axschema.org/namePerson/last'].first unless registration['http://axschema.org/namePerson/last'].nil?

          user.random_password
          user.register

          case Setting.self_registration
          when '1'
            register_by_email_activation(user) do
              onthefly_creation_failed(user)
            end
          when '3'
            register_automatically(user) do
              onthefly_creation_failed(user)
            end
          else
            register_manually_by_administrator(user) do
              onthefly_creation_failed(user)
            end
          end          
        else
          # Existing record
          if user.active?
            successful_authentication(user)
          else
            account_pending
          end
        end
      end
    end
  end

But not with the Extended Profile plugin...

Another issue is that I don’t see any reason for email or manual activation!.. This is needed for new users, I believe... OpenID ones should be “trusted” or not allowed. Besides, email activation does not work correctly with OpenID logins (could not get activated).