1 files changed, 21 insertions, 5 deletions
diff --git a/src/DotNetOpenId/RelyingParty/AuthenticationResponse.cs b/src/DotNetOpenId/RelyingParty/AuthenticationResponse.cs
index 3ccfc97..87424fa 100644
--- a/src/DotNetOpenId/RelyingParty/AuthenticationResponse.cs
+++ b/src/DotNetOpenId/RelyingParty/AuthenticationResponse.cs
@@ -74,9 +74,21 @@ namespace DotNetOpenId.RelyingParty {
 		/// An Identifier that the end user claims to own.
 		/// </summary>
 		public Identifier ClaimedIdentifier {
+			[DebuggerStepThrough]
 			get { return Provider.ClaimedIdentifier; }
 		}
 		/// <summary>
+		/// Gets a user-friendly OpenID Identifier for display purposes ONLY.
+		/// </summary>
+		/// <remarks>
+		/// See <see cref="IAuthenticationResponse.FriendlyIdentifierForDisplay"/>.
+		/// </remarks>
+		public string FriendlyIdentifierForDisplay {
+			[DebuggerStepThrough]
+			get { return Provider.FriendlyIdentifierForDisplay; }
+		}
+		
+		/// <summary>
 		/// The discovered endpoint information.
 		/// </summary>
 		internal ServiceEndpoint Provider { get; private set; }
@@ -169,8 +181,11 @@ namespace DotNetOpenId.RelyingParty {
 						throw new OpenIdException(string.Format(CultureInfo.CurrentCulture,
 							Strings.MissingInternalQueryParameter, Token.TokenKey));
 				} else {
-					// 2.0 OPs provide enough information to assemble the entire endpoint info
-					responseEndpoint = ServiceEndpoint.ParseFromAuthResponse(query);
+					// 2.0 OPs provide enough information to assemble the entire endpoint info,
+					// except perhaps for the original user supplied identifier, which if available
+					// allows us to display a friendly XRI.
+					Identifier friendlyIdentifier = tokenEndpoint != null ? tokenEndpoint.UserSuppliedIdentifier : null;
+					responseEndpoint = ServiceEndpoint.ParseFromAuthResponse(query, friendlyIdentifier);
 					// If this is a solicited assertion, we'll have a token with endpoint data too,
 					// which we can use to more quickly confirm the validity of the claimed
 					// endpoint info.
@@ -269,10 +284,11 @@ namespace DotNetOpenId.RelyingParty {
 				if (tokenEndpoint == null ||
 					tokenEndpoint.ClaimedIdentifier == tokenEndpoint.Protocol.ClaimedIdentifierForOPIdentifier) {
 					Identifier claimedIdentifier = Util.GetRequiredArg(query, responseEndpoint.Protocol.openid.claimed_id);
-					ServiceEndpoint claimedEndpoint = claimedIdentifier.Discover();
-					// Compare the two ServiceEndpoints to make sure they are the same.
-					if (responseEndpoint != claimedEndpoint)
+					List<ServiceEndpoint> discoveredEndpoints = new List<ServiceEndpoint>(claimedIdentifier.Discover());
+					// Make sure the response endpoint matches one of the discovered endpoints.
+					if (!discoveredEndpoints.Contains(responseEndpoint)) {
 						throw new OpenIdException(Strings.IssuedAssertionFailsIdentifierDiscovery);
+					}
 				} else {
 					// Check that the assertion matches the service endpoint we know about.
 					if (responseEndpoint != tokenEndpoint)