OpenID login fails on try.gitea.io

[strk]

Whenever I try to connect on try.gitea.io with OpenID I get:

Nonce too old: %!d(float64=126.332404525)s

It used to work so something must have broke "recently". Could be a problem with just try.gitea.io (if time is messed up). I don't have a test install to try it there. Maybe @geek1011 does ?

[strk]

As I seemed to be able to "login" via livejournal.com (see #2101) this may be an issue just with my own OpenID provider (SimpleID)

[strk]

I've tried my OpenID against a GNUSocial server and it worked fine, so the problem is with Gitea (maybe with try.gitea.io deploy only)

[strk]

One comment I found in the NonceStore implementation we use (an example one that comes with the library we use for OpenID) might be related to the issue:

        // The nonce MUST start with the current time on the server, and MAY    
        // contain additional ASCII characters in the range 33-126 inclusive    
        // (printable non-whitespace characters), as necessary to make each     
        // response unique. The date and time MUST be formatted as specified in 
        // section 5.6 of [RFC3339], with the following restrictions:           
                                                                                
        // All times must be in the UTC timezone, indicated with a "Z".  No     
        // fractional seconds are allowed For example:                          
        // 2005-05-15T17:11:51ZUNIQUE       

[strk]

Ok this issue is sorted. It's just a clock skew between the Gitea server and the OpenID server of ~2 minutes with a Nonce timeout of 1 minute.

Maybe 1 minute is too low for a TTL (but we're using an demo implementation of the store and I'm not sure how to change that value...)

[strk]

I confirm installing rdate on the server (which went missed on disk failure) fixes the issue for me.
This ticket can either be closed as invalid or kept open for dealing with making the Nonce timeout configurable. Opinions welcome @cweiske :)

[cweiske]

I'd keep it the way it is now.

[strk]

Alright then, I'm closing this invalid ticket.