Fixed Provider to not re-send the check_auth request if it does not recognize the association handle.

1 files changed, 6 insertions, 0 deletions

diff --git a/src/DotNetOpenAuth/OpenId/ChannelElements/SigningBindingElement.cs b/src/DotNetOpenAuth/OpenId/ChannelElements/SigningBindingElement.cs
index 1ebe144..d2eef6c 100644
--- a/src/DotNetOpenAuth/OpenId/ChannelElements/SigningBindingElement.cs
+++ b/src/DotNetOpenAuth/OpenId/ChannelElements/SigningBindingElement.cs
@@ -144,6 +144,12 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 				} else {
 					ErrorUtilities.VerifyInternal(this.Channel != null, "Cannot verify private association signature because we don't have a channel.");
 
+					// If we're on the Provider, then the RP sent us a check_auth with a signature
+					// we don't have an association for.  (It may have expired, or it may be a faulty RP).
+					if (this.IsOnProvider) {
+						throw new InvalidSignatureException(message);
+					}
+
 					// We did not recognize the association the provider used to sign the message.
 					// Ask the provider to check the signature then.
 					var indirectSignedResponse = (IndirectSignedResponse)signedMessage;