Question

I’ve just implemented oauth into a website and it’s working great, however it seems that when people login a temporary file is created. WHM keeps emailing me to tell me about this problem:

Time:   Thu Dec 15 10:50:52 2011 +0000
File:   /tmp/root/openid/consumer/assoc_handle_ecde01da0a6bbfaed7f04379150d3c9f
Reason: Suspicious symlink (->/tmp/root/openid/consumer/assoc_url_988e35039cce1819e501ae6e1217c786)
Owner:  X:X (513:509)
Action: No action taken

Now, it’s fairly obvious this is a temp file. But two questions:

1. Why is it needed to login people in? (purely for my knowledge)
2. How can I get it out of that folder or ensure it doesn’t keep symlink’ing

The oauth is processed by Zend Framework’s library

Answer 1

Here is the reasoning behind the temp files, this is from the Zend OpenID Introduction:

The OpenID consumer establishes an optional association with the
provider using Diffie-Hellman keys. As a result, both parties have a
common “shared secret” that is used for signing and verification of
the subsequent messages.

Since it is optional, you can disable it by passing true as the second parameter to Zend_OpenId_Consumer to put it in “dumb mode” where it :

$consumer = new Zend_OpenId_Consumer(null, true);

Here are the caveats of dumb mode:

OpenID Authentication supports both a “smart mode” and “dumb mode” to accomodate Consumers of differing capabilities. A smart Consumer does a little more work at the beginning to save itself work later, but requires local caching of state information. A dumb Consumer is completely stateless, but requires extra an HTTP request. Source

You can control the location of the cache files as well to avoid the whm warnings.

$path        = '/home/you/zend/application/data';  // dir to store associations
$authStorage = new Zend_OpenId_Consumer_Storage_File($path);
$consumer    = new Zend_OpenId_Consumer($authStorage);