Fixed Google Apps login after support for dual identifiers was removed.

1 files changed, 9 insertions, 3 deletions

diff --git a/src/DotNetOpenAuth/OpenId/HostMetaDiscoveryService.cs b/src/DotNetOpenAuth/OpenId/HostMetaDiscoveryService.cs
index 939ccab..b6ed2f7 100644
--- a/src/DotNetOpenAuth/OpenId/HostMetaDiscoveryService.cs
+++ b/src/DotNetOpenAuth/OpenId/HostMetaDiscoveryService.cs
@@ -117,12 +117,18 @@ namespace DotNetOpenAuth.OpenId {
 					ValidateXmlDSig(document, uriIdentifier, response, signingHost);
 					var xrds = GetXrdElements(document, uriIdentifier.Uri.Host);
 
-					// Find OP identifiers
-					results.AddRange(xrds.CreateServiceEndpoints(uriIdentifier, uriIdentifier));
-
 					// Look for claimed identifier template URIs for an additional XRDS document.
 					results.AddRange(GetExternalServices(xrds, uriIdentifier, requestHandler));
 
+					// If we couldn't find any claimed identifiers, look for OP identifiers.
+					// Normally this would be the opposite (OP Identifiers take precedence over
+					// claimed identifiers, but for Google Apps, XRDS' always have OP Identifiers
+					// mixed in, which the OpenID spec mandate should eclipse Claimed Identifiers,
+					// which would break positive assertion checks).
+					if (results.Count == 0) {
+						results.AddRange(xrds.CreateServiceEndpoints(uriIdentifier, uriIdentifier));
+					}
+
 					abortDiscoveryChain = true;
 				} catch (XmlException ex) {
 					Logger.Yadis.ErrorFormat("Error while parsing XRDS document at {0} pointed to by host-meta: {1}", response.FinalUri, ex);