Thanks. That was a good hint. He upgraded the security around then to invalidate check_authentication requests in stateless mode. I *think* my bug is because the consumer is saying is keeping state but I'm running the provider as stateless so the check_auth phase always fails; but that's just a guess right now. I'm not sure how to get around it yet. I'm either going to try to create my own assoc_handle to hand off to the server or roll back the version to the lesser security until I can figure out how to add state correctly. I also applied your patch to my local version. Going forward, if you ever do, I think registering the namespace, like "sreg," with the server so it can autogenerate the check/add/param-pass stuff would work more generically for any OpenID extension. If I get this working and clean/secure enough to not be embarrassing, I'll post something.