mozilla/browserid — Issue #1205: 'bad signature in chain' should clear public key cache for a primary and retry
Author: ozten
Created: 2012-02-27 18:16:20+00:00
State: open

I'm unable to test my primary in dev.diresworb.org and I think it is because it has an out of date public key in it's cache.

During local development, I saw this issue. If I changed my public key in my primary, I had to restart my local BID server.

Steps To Reproduce
1) Deploy Clortho or another primary
2) Succesfuly login
3) Restart Clortho or change key pair on your IdP
4) Start login flow a second time again, clicking "This is not me" and re-authing
5) Using firebug observe interaction

Expected:
BID server notices changed public key pair and completes auth properly. May involve some kind of error detection and re-try once behavior.

Actual:
POST to https://dev.diresworb.org/wsapi/auth_with_assertion

{"success":false,"reason":"bad signature in chain"}