Merge lp:~jamestait/canonical-identity-provider/add-ax-fetch into lp:canonical-identity-provider/release

[James Tait]

Added handling of OpenID Attribute Exchange.

Add support for OpenID Attribute Exchange 1.0 Fetch Requests
============================================================

This is a fairly large change to add support for OpenID Attribute Exchange 1.0 Fetch Requests [0]. AX is like Simple Registration (SReg, [1]) on steroids. It allows a Relying Party to request certain attributes about the user from the OpenID Provider at login time. Where SReg has a handful of fixed, predefined properties that can be requested, defined by short keywords, AX is extensible, with attributes being identified by a URI, and having a symbolic alias attached.

Taking advantage of this extensibility, as well as returning the same properties as SReg, by way of an SReg compatibility schema for AX, we also return the email verification status. This isn't defined in a spec anywhere, so I've assigned this attribute our own URI in the ns.launchpad.net namespace.

Points to Note
--------------

0) I've added the allowable AX properties for a given RP as a separate coluumn in the RPConfig (allowed_ax) from the allowable SReg properties (allowed_sreg). I initially did this because I was going to store the URIs in the RPConfig, but I later switched to storing the alias for the properties that we can provide. Maybe these could be amalgamated into a single column and the forms could DTRT to avoid people futzing with the SReg requests and getting attributes they shouldn't.
1) I'm not sure about AX_DATA_FIELDS as a NamespaceMap in identityprovider.const.
2) I'm a little unhappy with the complexity in places - lots of mapping using AX_DATA_FIELDS which makes the code somewhat ungainly. I switched from using the URIs to avoid form fields in the AXFetchRequestForm on the decide page with URIs for names, but maybe there's a middle ground where we can use symbolic names just for rendering the form and use the URIs everywhere else.
3) Maybe we don't want to use ns.launchpad.net for the email_verified attribute.
4) Maybe the label for email_verified could be improved.
5) Currently we do nothing with AX Store Requests.
6) If a request has both SReg and AX requests, the SReg request will be ignored and return empty results. This isn't a problem for django-openid-auth, which starts with the SReg results but uses the AX results in preference; other libraries may vary.

[0] http://goo.gl/CBlJZ
[1] http://goo.gl/JyRhC

[Ricardo Kirkner (ricardokirkner)]

- missing commit message
- instead of *_EMAIL_VERIFIED I'd use *_ACCOUNT_VERIFIED (as we should care about the status of the account, not the email; if the account is verified, the returned email is also verified).
- l. 96-99: I'd extract this into a helper method for readability
- l. 101-105: ditto
- l. 114-135: since these values (except email_verified) are the same for AX or SREG, why not have a common helper function to get them (DRY)?
- l. 462-463: you can use {% elif ... %} here I believe?
- l. 516: why not get the entry again and confirm it has the fields you just posted?
- l. 531: this could match any checkbox in the form? why not rather add a specific test to verify email is listed as an ax field?
- l. 613-614: you could also use assertIn, assertNotIn
- l. 818-819,870-894,930-954,988-1024,1065-1086: we now tend to prefer using pyquery for asserting against the DOM
- l. 1166: can we call _get_openid_request with named params? it's hard to understand what each param means otherwise
- l. 1250: why not just do: if ax_form.data: ?
- l. 1250-1253: or maybe add a helper to the form to get the values without having to know that data is a dict?

Despite some desired changes, I must say I'm impressed with the clarity of the work done. It was very easy to understand the changes and follow the new logic.

Well done!

review: Needs Fixing

[James Tait (jamestait)]

> - missing commit message

Fixed. :)

> - instead of *_EMAIL_VERIFIED I'd use *_ACCOUNT_VERIFIED (as we should care
> about the status of the account, not the email; if the account is verified,
> the returned email is also verified).

This came about as a result of a misunderstanding on my part about the difference between a verified account and an account with a verified e-mail address. Happy to fix this.

> - l. 96-99: I'd extract this into a helper method for readability
> - l. 101-105: ditto

Yes, that would clean things up nicely.

> - l. 114-135: since these values (except email_verified) are the same for AX
> or SREG, why not have a common helper function to get them (DRY)?

Ditto.

> - l. 462-463: you can use {% elif ... %} here I believe?

Alas, not in Django 1.3. ;)

> - l. 516: why not get the entry again and confirm it has the fields you just
> posted?

Yes, that should work. I'll look into adding that extra verification, and maybe do the same for the SReg tests.

> - l. 531: this could match any checkbox in the form? why not rather add a
> specific test to verify email is listed as an ax field?

Indeed, this should be made more robust. I'll shore this up and again look to do the same for the SReg tests.

> - l. 613-614: you could also use assertIn, assertNotIn

Good catch!

> - l. 818-819,870-894,930-954,988-1024,1065-1086: we now tend to prefer using
> pyquery for asserting against the DOM

I'll look into this. I have to admit I was cringing when writing the tests, so I'm grateful for the suggestion of a better method.

> - l. 1166: can we call _get_openid_request with named params? it's hard to
> understand what each param means otherwise

Yes, that would be an improvement.

> - l. 1250: why not just do: if ax_form.data: ?
> - l. 1250-1253: or maybe add a helper to the form to get the values without
> having to know that data is a dict?

I prefer the latter approach. It had occurred to me to do something like this, but I wanted to get eyes on the code before I made any further changes.

Thanks for the comments!

[Ricardo Kirkner (ricardokirkner)]

LGTM. Awesome stuff!

review: Approve

=== modified file 'identityprovider/admin.py'
--- identityprovider/admin.py	2013-03-21 17:03:32 +0000
+++ identityprovider/admin.py	2013-04-03 14:40:35 +0000
@@ -6,7 +6,10 @@
 from django.core.urlresolvers import reverse
 from django.template.defaultfilters import force_escape
 
-from identityprovider.const import SREG_LABELS
+from identityprovider.const import (
+    AX_DATA_LABELS,
+    SREG_LABELS,
+)
 from identityprovider.fields import CommaSeparatedField
 from identityprovider.models import (
     Account,
@@ -42,6 +45,11 @@
     displayname = forms.CharField(label="Display name")
     trust_root = forms.URLField(verify_exists=False)
     logo = forms.CharField(required=False)
+    allowed_ax = CommaSeparatedField(
+        choices=AX_DATA_LABELS.items(),
+        required=False,
+        widget=CommaSeparatedWidget,
+    )
     allowed_sreg = CommaSeparatedField(
         choices=SREG_LABELS.items(),
         required=False,

=== modified file 'identityprovider/const.py'
--- identityprovider/const.py	2012-10-12 21:23:31 +0000
+++ identityprovider/const.py	2013-04-03 14:40:35 +0000
@@ -1,6 +1,8 @@
 # Copyright 2010 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
+from openid.message import NamespaceMap
+
 LAUNCHPAD_TEAMS_NS = 'http://ns.launchpad.net/2007/openid-teams'
 
 PERSON_VISIBILITY_PUBLIC = 1
@@ -20,3 +22,27 @@
     'timezone': 'Time zone',
     'language': 'Preferred language',
 }
+
+AX_URI_FULL_NAME = 'http://axschema.org/namePerson'
+AX_URI_NICKNAME = 'http://axschema.org/namePerson/friendly'
+AX_URI_EMAIL = 'http://axschema.org/contact/email'
+AX_URI_TIMEZONE = 'http://axschema.org/timezone'
+AX_URI_LANGUAGE = 'http://axschema.org/language/pref'
+AX_URI_ACCOUNT_VERIFIED = 'http://ns.login.ubuntu.com/2013/validation/account'
+
+AX_DATA_FIELDS = NamespaceMap()
+AX_DATA_FIELDS.addAlias(AX_URI_FULL_NAME, 'fullname')
+AX_DATA_FIELDS.addAlias(AX_URI_NICKNAME, 'nickname')
+AX_DATA_FIELDS.addAlias(AX_URI_EMAIL, 'email')
+AX_DATA_FIELDS.addAlias(AX_URI_TIMEZONE, 'timezone')
+AX_DATA_FIELDS.addAlias(AX_URI_LANGUAGE, 'language')
+AX_DATA_FIELDS.addAlias(AX_URI_ACCOUNT_VERIFIED, 'account_verified')
+
+AX_DATA_LABELS = {
+    'fullname': 'Full name',
+    'nickname': 'Username',
+    'email': 'Email address',
+    'timezone': 'Time zone',
+    'language': 'Preferred language',
+    'account_verified': 'Account verified',
+}

=== modified file 'identityprovider/forms.py'
--- identityprovider/forms.py	2013-03-27 14:30:56 +0000
+++ identityprovider/forms.py	2013-04-03 14:40:35 +0000
@@ -10,6 +10,8 @@
 from django.utils.translation import ugettext as _
 
 from identityprovider.const import (
+    AX_DATA_FIELDS,
+    AX_DATA_LABELS,
     SREG_DATA_FIELDS_ORDER,
     SREG_LABELS,
 )
@@ -340,6 +342,31 @@
     callback = forms.CharField(error_messages=default_errors)
 
 
+def _get_data_for_user(request, fields, with_verified=False):
+    """Get the data to ask about in the form based on the user's
+    account record.
+    """
+    values = {}
+    user = request.user
+    values['fullname'] = user.displayname
+    if user.preferredemail is not None:
+        values['email'] = user.preferredemail.email
+        if with_verified:
+            values['account_verified'] = (
+                'token_via_email' if user.is_verified else 'no')
+    if user.person is not None:
+        values['nickname'] = user.person.name
+        if user.person.time_zone is not None:
+            values['timezone'] = user.person.time_zone
+    if user.preferredlanguage is not None:
+        values['language'] = user.preferredlanguage
+    else:
+        values['language'] = translation.get_language_from_request(request)
+    logger.debug("values (sreg_fields) = " + str(values))
+
+    return dict([(f, values[f]) for f in fields if f in values])
+
+
 class SRegRequestForm(Form):
     """A form object for user control over OpenID sreg data.
     """
@@ -351,6 +378,11 @@
         return dict([(f, self.data[f]) for f in self.data
                      if self.field_approved(f)])
 
+    @property
+    def has_data(self):
+        """Helper property to check if this form has any data."""
+        return len(self.data) > 0
+
     def __init__(self, request, sreg_request, rpconfig, approved_data=None):
         self.request = request
         self.request_method = request.META.get('REQUEST_METHOD')
@@ -368,32 +400,10 @@
                 fields = set()
         else:
             fields = sreg_fields
-        self.data = self._get_sreg_data_for_user(request.user, fields)
+        self.data = _get_data_for_user(request, fields, with_verified=False)
 
         super(SRegRequestForm, self).__init__(self.data)
         self._init_fields(self.data)
-        self.should_display = len(self.data) > 0
-
-    def _get_sreg_data_for_user(self, user, sreg_fields):
-        """Get the sreg data to ask about in the form based on the user's
-        account record.
-        """
-        values = {}
-        values['fullname'] = user.displayname
-        if user.preferredemail is not None:
-            values['email'] = user.preferredemail.email
-        if user.person is not None:
-            values['nickname'] = user.person.name
-            if user.person.time_zone is not None:
-                values['timezone'] = user.person.time_zone
-        if user.preferredlanguage is not None:
-            values['language'] = user.preferredlanguage
-        else:
-            values['language'] = translation.get_language_from_request(
-                self.request)
-        logger.debug("values (sreg_fields) = " + str(values))
-
-        return dict([(f, values[f]) for f in sreg_fields if f in values])
 
     def _init_fields(self, data):
         """Initialises form fields for the user's sreg data.
@@ -444,6 +454,114 @@
         return field in approved
 
 
+class AXFetchRequestForm(Form):
+    """A form object for user control over OpenID Attribute Exchange."""
+
+    def __init__(self, request, ax_request, rpconfig, approved_data=None):
+        self.request = request
+        self.request_method = request.META.get('REQUEST_METHOD')
+        self.ax_request = ax_request
+        self.rpconfig = rpconfig
+        self.approved_data = approved_data
+        # generate initial form data
+        ax_fields = self._get_requested_field_aliases()
+        if rpconfig is not None:
+            ax_fields = self._filter_allowed_fields(ax_fields)
+        self.data = _get_data_for_user(request, ax_fields, with_verified=True)
+
+        super(AXFetchRequestForm, self).__init__(self.data)
+        self._init_fields(self.data)
+
+    def _get_requested_field_aliases(self):
+        return [AX_DATA_FIELDS.getAlias(f)
+                for f in AX_DATA_FIELDS.iterNamespaceURIs()
+                if f in set(self.ax_request.requested_attributes.keys())]
+
+    def _filter_allowed_fields(self, requested_fields):
+        if self.rpconfig.allowed_ax:
+            return set(requested_fields).intersection(
+                set(self.rpconfig.allowed_ax.split(',')))
+        return set()
+
+    def _init_fields(self, data):
+        """Initialises form fields for the user's ax data.
+        """
+        for key, val in data.items():
+            label = "%s: %s" % (AX_DATA_LABELS.get(key, key), val)
+            attrs = {}
+            if (AX_DATA_FIELDS.getNamespaceURI(key) in
+                    self.ax_request.getRequiredAttrs()):
+                attrs['class'] = 'required'
+                if self.rpconfig is not None:
+                    attrs['disabled'] = 'disabled'
+            self.fields[key] = fields.BooleanField(
+                label=label,
+                widget=forms.CheckboxInput(attrs=attrs,
+                                           check_test=self.check_test),
+            )
+
+    def check_test(self, value):
+        """Determines if a checkbox should be pre-checked based on previously
+        approved user data, openid request and relying party type.
+        """
+        for k, v in self.data.items():
+            if value == v:
+                value = k
+                break
+
+        if self.rpconfig:
+            # Trusted site, check required fields
+            if (AX_DATA_FIELDS.getNamespaceURI(value) in
+                    self.ax_request.getRequiredAttrs()):
+                return True
+            # If we have previous (dis)approval for this site, use it
+            if self.approved_data:
+                return (value in self.approved_data.get('requested', []) and
+                        value in self.approved_data.get('approved', []))
+            # Otherwise, default to True
+            return (AX_DATA_FIELDS.getNamespaceURI(value) in
+                    self.ax_request.requested_attributes)
+        else:
+            # If we have previous (dis)approval for this site, use it
+            if self.approved_data:
+                return (value in self.approved_data.get('requested', []) and
+                        value in self.approved_data.get('approved', []))
+            # No previous (dis)approval, check required and leave the rest
+            if (AX_DATA_FIELDS.getNamespaceURI(value) in
+                    self.ax_request.getRequiredAttrs()):
+                return True
+            # Otherwise default to False
+            return False
+
+    def field_approved(self, field):
+        """Check if the field should be returned in the response based on user
+        preferences and overridden for trusted relying parties.
+        """
+        approved = set([AX_DATA_FIELDS.getNamespaceURI(f)
+                        for f in self.request.POST.keys()])
+        if self.rpconfig is not None:
+            if self.rpconfig.auto_authorize:
+                ax_fields = set(self.ax_request.requested_attributes.keys())
+            else:
+                ax_fields = set(self.ax_request.getRequiredAttrs())
+            approved.update(ax_fields)
+        return field in approved
+
+    @property
+    def data_approved_for_request(self):
+        """Return the list of ax data approved for the request."""
+        if self.request_method == 'POST':
+            return dict(
+                [(f, self.data[f]) for f in self.data
+                 if self.field_approved(AX_DATA_FIELDS.getNamespaceURI(f))])
+        return {}
+
+    @property
+    def has_data(self):
+        """Helper property to check if this form has any data."""
+        return len(self.data) > 0
+
+
 class TeamsRequestForm(Form):
     """A form object for user control over OpenID teams data.
     """
@@ -471,7 +589,6 @@
         super(TeamsRequestForm, self).__init__(self.memberships)
 
         self._init_fields(self.memberships)
-        self.should_display = len(self.memberships) > 0
 
     def _get_teams_for_user(self, user, include_private=False):
         """Get the list of teams to ask about in the form based on the user's
@@ -485,9 +602,14 @@
     def _init_fields(self, form_data):
         """Initialises form fields for the user's team memberships.
         """
+        if len(form_data) == 1:
+            label_format = 'Team membership: %s'
+        else:
+            label_format = '%s'
         for team in form_data:
+            label = label_format % team
             self.fields[team] = fields.BooleanField(
-                label=team, widget=forms.CheckboxInput(
+                label=label, widget=forms.CheckboxInput(
                     check_test=self.check_test))
 
     def check_test(self, value):
@@ -500,6 +622,11 @@
         else:
             return self.rpconfig is not None
 
+    @property
+    def has_data(self):
+        """Helper property to check if this form has any data."""
+        return len(self.memberships) > 0
+
 
 class HOTPDeviceForm(Form):
     name = fields.CharField()

=== added file 'identityprovider/migrations/0007_add_allowed_ax.py'
--- identityprovider/migrations/0007_add_allowed_ax.py	1970-01-01 00:00:00 +0000
+++ identityprovider/migrations/0007_add_allowed_ax.py	2013-04-03 14:40:35 +0000
@@ -0,0 +1,212 @@
+# -*- coding: utf-8 -*-
+import datetime
+from south.db import db
+from south.v2 import SchemaMigration
+from django.db import models
+
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        # Adding field 'OpenIDRPConfig.allowed_ax'
+        db.add_column('ssoopenidrpconfig', 'allowed_ax',
+                      self.gf('django.db.models.fields.TextField')(null=True, blank=True),
+                      keep_default=False)
+
+
+    def backwards(self, orm):
+        # Deleting field 'OpenIDRPConfig.allowed_ax'
+        db.delete_column('ssoopenidrpconfig', 'allowed_ax')
+
+
+    models = {
+        'identityprovider.account': {
+            'Meta': {'object_name': 'Account', 'db_table': "u'account'"},
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow'}),
+            'date_status_set': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow'}),
+            'displayname': ('identityprovider.models.account.DisplaynameField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'old_openid_identifier': ('django.db.models.fields.TextField', [], {'db_index': 'True', 'null': 'True', 'blank': 'True'}),
+            'openid_identifier': ('django.db.models.fields.TextField', [], {'default': "u'XJm6fny'", 'unique': 'True'}),
+            'preferredlanguage': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'status': ('django.db.models.fields.IntegerField', [], {}),
+            'status_comment': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'twofactor_attempts': ('django.db.models.fields.SmallIntegerField', [], {'default': '0', 'null': 'True'}),
+            'twofactor_required': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'warn_about_backup_device': ('django.db.models.fields.BooleanField', [], {'default': 'True'})
+        },
+        'identityprovider.accountpassword': {
+            'Meta': {'object_name': 'AccountPassword', 'db_table': "u'accountpassword'"},
+            'account': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['identityprovider.Account']", 'unique': 'True', 'db_column': "'account'"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('identityprovider.models.account.PasswordField', [], {})
+        },
+        'identityprovider.apiuser': {
+            'Meta': {'object_name': 'APIUser', 'db_table': "'api_user'"},
+            'created_at': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('django.db.models.fields.CharField', [], {'max_length': '256'}),
+            'updated_at': ('django.db.models.fields.DateTimeField', [], {'auto_now': 'True', 'blank': 'True'}),
+            'username': ('django.db.models.fields.CharField', [], {'max_length': '256'})
+        },
+        'identityprovider.authenticationdevice': {
+            'Meta': {'ordering': "('id',)", 'object_name': 'AuthenticationDevice'},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'devices'", 'to': "orm['identityprovider.Account']"}),
+            'counter': ('django.db.models.fields.IntegerField', [], {'default': '0'}),
+            'device_type': ('django.db.models.fields.TextField', [], {'null': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'key': ('django.db.models.fields.TextField', [], {}),
+            'name': ('django.db.models.fields.TextField', [], {})
+        },
+        'identityprovider.authtoken': {
+            'Meta': {'object_name': 'AuthToken', 'db_table': "u'authtoken'"},
+            'date_consumed': ('django.db.models.fields.DateTimeField', [], {'db_index': 'True', 'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'db_index': 'True', 'blank': 'True'}),
+            'displayname': ('identityprovider.models.account.DisplaynameField', [], {'null': 'True', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {'db_index': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('identityprovider.models.account.PasswordField', [], {'null': 'True', 'blank': 'True'}),
+            'redirection_url': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'requester': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'requester'", 'blank': 'True'}),
+            'requester_email': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'token': ('django.db.models.fields.TextField', [], {'unique': 'True'}),
+            'token_type': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.emailaddress': {
+            'Meta': {'object_name': 'EmailAddress', 'db_table': "u'emailaddress'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'account'", 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'lp_person': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'person'", 'blank': 'True'}),
+            'status': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.invalidatedemailaddress': {
+            'Meta': {'object_name': 'InvalidatedEmailAddress', 'db_table': "u'invalidated_emailaddress'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'account'", 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'})
+        },
+        'identityprovider.lpopenididentifier': {
+            'Meta': {'object_name': 'LPOpenIdIdentifier', 'db_table': "u'lp_openididentifier'"},
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.date.today'}),
+            'identifier': ('django.db.models.fields.TextField', [], {'unique': 'True', 'primary_key': 'True'}),
+            'lp_account': ('django.db.models.fields.IntegerField', [], {'db_column': "'account'", 'db_index': 'True'})
+        },
+        'identityprovider.openidassociation': {
+            'Meta': {'unique_together': "(('server_url', 'handle'),)", 'object_name': 'OpenIDAssociation', 'db_table': "u'openidassociation'"},
+            'assoc_type': ('django.db.models.fields.CharField', [], {'max_length': '64'}),
+            'handle': ('django.db.models.fields.CharField', [], {'max_length': '255', 'primary_key': 'True'}),
+            'issued': ('django.db.models.fields.IntegerField', [], {}),
+            'lifetime': ('django.db.models.fields.IntegerField', [], {}),
+            'secret': ('django.db.models.fields.TextField', [], {}),
+            'server_url': ('django.db.models.fields.CharField', [], {'max_length': '2047'})
+        },
+        'identityprovider.openidauthorization': {
+            'Meta': {'object_name': 'OpenIDAuthorization', 'db_table': "u'openidauthorization'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'db_column': "'account'"}),
+            'client_id': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'date_expires': ('django.db.models.fields.DateTimeField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {})
+        },
+        'identityprovider.openidnonce': {
+            'Meta': {'unique_together': "(('server_url', 'timestamp', 'salt'),)", 'object_name': 'OpenIDNonce', 'db_table': "'openidnonce'"},
+            'salt': ('django.db.models.fields.CharField', [], {'max_length': '40'}),
+            'server_url': ('django.db.models.fields.CharField', [], {'max_length': '2047', 'primary_key': 'True'}),
+            'timestamp': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.openidrpconfig': {
+            'Meta': {'object_name': 'OpenIDRPConfig', 'db_table': "'ssoopenidrpconfig'"},
+            'allow_unverified': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'allowed_ax': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'allowed_sreg': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'auto_authorize': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'can_query_any_team': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {'default': '13'}),
+            'description': ('django.db.models.fields.TextField', [], {}),
+            'displayname': ('django.db.models.fields.TextField', [], {}),
+            'flag_twofactor': ('django.db.models.fields.CharField', [], {'max_length': '256', 'null': 'True', 'blank': 'True'}),
+            'ga_snippet': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'logo': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'prefer_canonical_email': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'require_two_factor': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {'unique': 'True'})
+        },
+        'identityprovider.openidrpsummary': {
+            'Meta': {'unique_together': "(('account', 'trust_root', 'openid_identifier'),)", 'object_name': 'OpenIDRPSummary', 'db_table': "u'openidrpsummary'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'db_column': "'account'"}),
+            'approved_data': ('django.db.models.fields.TextField', [], {'default': "''", 'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'date_last_used': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'openid_identifier': ('django.db.models.fields.TextField', [], {'db_index': 'True'}),
+            'total_logins': ('django.db.models.fields.IntegerField', [], {'default': '1'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {'db_index': 'True'})
+        },
+        'identityprovider.person': {
+            'Meta': {'object_name': 'Person', 'db_table': "u'lp_person'"},
+            'addressline1': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'addressline2': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'city': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'country': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'country'", 'blank': 'True'}),
+            'creation_comment': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'datecreated': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'null': 'True', 'blank': 'True'}),
+            'defaultmembershipperiod': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'defaultrenewalperiod': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'displayname': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'fti': ('django.db.models.fields.TextField', [], {'null': 'True'}),
+            'hide_email_addresses': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'homepage_content': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'icon': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'icon'", 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'language': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'language'", 'blank': 'True'}),
+            'logo': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'logo'", 'blank': 'True'}),
+            'lp_account': ('django.db.models.fields.IntegerField', [], {'unique': 'True', 'null': 'True', 'db_column': "'account'"}),
+            'mail_resumption_date': ('django.db.models.fields.DateField', [], {'null': 'True', 'blank': 'True'}),
+            'mailing_list_auto_subscribe_policy': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'}),
+            'mailing_list_receive_duplicates': ('django.db.models.fields.NullBooleanField', [], {'default': 'True', 'null': 'True', 'blank': 'True'}),
+            'merged': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'merged'", 'blank': 'True'}),
+            'mugshot': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'mugshot'", 'blank': 'True'}),
+            'name': ('django.db.models.fields.TextField', [], {'unique': 'True', 'null': 'True'}),
+            'organization': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'personal_standing': ('django.db.models.fields.IntegerField', [], {'default': '0', 'null': 'True'}),
+            'personal_standing_reason': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'phone': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'postcode': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'province': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'registrant': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'registrant'", 'blank': 'True'}),
+            'renewal_policy': ('django.db.models.fields.IntegerField', [], {'default': '10', 'null': 'True'}),
+            'subscriptionpolicy': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'}),
+            'teamdescription': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'teamowner': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'teamowner'", 'blank': 'True'}),
+            'verbose_bugnotifications': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'visibility': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'})
+        },
+        'identityprovider.personlocation': {
+            'Meta': {'object_name': 'PersonLocation', 'db_table': "u'lp_personlocation'"},
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'date_last_modified': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'last_modified_by': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'last_modified_by'"}),
+            'latitude': ('django.db.models.fields.FloatField', [], {'null': 'True', 'blank': 'True'}),
+            'locked': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'longitude': ('django.db.models.fields.FloatField', [], {'null': 'True', 'blank': 'True'}),
+            'person': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['identityprovider.Person']", 'unique': 'True', 'null': 'True', 'db_column': "'person'"}),
+            'time_zone': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'visible': ('django.db.models.fields.NullBooleanField', [], {'default': 'True', 'null': 'True', 'blank': 'True'})
+        },
+        'identityprovider.teamparticipation': {
+            'Meta': {'unique_together': "(('team', 'person'),)", 'object_name': 'TeamParticipation', 'db_table': "u'lp_teamparticipation'"},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'person': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Person']", 'null': 'True', 'db_column': "'person'"}),
+            'team': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'team_participations'", 'null': 'True', 'db_column': "'team'", 'to': "orm['identityprovider.Person']"})
+        }
+    }
+
+    complete_apps = ['identityprovider']
\ No newline at end of file

=== modified file 'identityprovider/models/openidmodels.py'
--- identityprovider/models/openidmodels.py	2013-03-05 18:08:29 +0000
+++ identityprovider/models/openidmodels.py	2013-04-03 14:40:35 +0000
@@ -154,6 +154,7 @@
     displayname = models.TextField()
     description = models.TextField()
     logo = models.TextField(blank=True, null=True)
+    allowed_ax = models.TextField(blank=True, null=True)
     allowed_sreg = models.TextField(blank=True, null=True)
     creation_rationale = models.IntegerField(
         default=13, choices=AccountCreationRationale._get_choices())

=== modified file 'identityprovider/templates/server/decide.html'
--- identityprovider/templates/server/decide.html	2013-02-14 17:12:13 +0000
+++ identityprovider/templates/server/decide.html	2013-04-03 14:40:35 +0000
@@ -31,15 +31,23 @@
         <form action="{{ action }}" method="POST" name="decideform">
             {% csrf_token %}
             <div class="info-items">
-                {% if sreg_form.should_display or teams_form.should_display %}
+                {% if sreg_form.has_data or teams_form.has_data or ax_form.has_data %}
                 <ul class="list">
-                    {% for field in sreg_form %}
+                    {% if ax_form.has_data %}
+                        {% for field in ax_form %}
+                    <li class="ax">{{ field|safe }} {{ field.label_tag }}</li>
+                        {% endfor %}
+                    {% else %}
+                        {% if sreg_form.has_data %}
+                            {% for field in sreg_form %}
+                    <li class="sreg">{{ field|safe }} {{ field.label_tag }}</li>
+                            {% endfor %}
+                        {% endif %}
+                    {% endif %}
+                    {% if teams_form.has_data %}
+                        {% ifequal teams_form.fields|length 1 %}
+                            {% for field in teams_form %}
                     <li>{{ field|safe }} {{ field.label_tag }}</li>
-                    {% endfor %}
-                    {% if teams_form.should_display %}
-                        {% ifequal teams_form.fields|length 1 %}
-                            {% for field in teams_form %}
-                    <li>{{ field|safe }} <label for="id_{{ field.html_name }}">{% trans "Team membership:"%}</label> {{ field.label_tag }}</li>
                             {% endfor %}
                         {% else %}
                     <li id="teamslist_item">

=== modified file 'identityprovider/templates/server/openidapplication-xrds.xml'
--- identityprovider/templates/server/openidapplication-xrds.xml	2012-12-04 18:51:42 +0000
+++ identityprovider/templates/server/openidapplication-xrds.xml	2013-04-03 14:40:35 +0000
@@ -5,6 +5,7 @@
   <XRD>
     <Service priority="0">
       <Type>http://specs.openid.net/auth/2.0/server</Type>
+      <Type>http://openid.net/srv/ax/1.0</Type>
       <Type>http://openid.net/extensions/sreg/1.1</Type>
       <Type>http://ns.launchpad.net/2007/openid-teams</Type>
       <URI>{{ endpoint_url }}</URI>

=== modified file 'identityprovider/tests/openid_server/test_discovery.py'
--- identityprovider/tests/openid_server/test_discovery.py	2013-04-01 16:17:07 +0000
+++ identityprovider/tests/openid_server/test_discovery.py	2013-04-03 14:40:35 +0000
@@ -54,6 +54,7 @@
                 'server_url': self.base_openid_url,
                 'supports': [
                     'http://specs.openid.net/auth/2.0/server',
+                    'http://openid.net/srv/ax/1.0',
                     'http://openid.net/extensions/sreg/1.1',
                     'http://ns.launchpad.net/2007/openid-teams',
                 ],

=== modified file 'identityprovider/tests/test_admin.py'
--- identityprovider/tests/test_admin.py	2013-03-29 20:36:42 +0000
+++ identityprovider/tests/test_admin.py	2013-04-03 14:40:35 +0000
@@ -53,18 +53,33 @@
             self.assertRaises(NotRegistered, admin.site.unregister, model)
 
     def test_openidrpconfig_allowed_sreg_checkboxes_postable(self):
-        data = {'trust_root': 'http://localhost/bla/',
-                'displayname': 'My Test RP',
-                'description': 'Bla',
-                'allowed_sreg': ['fullname', 'email'],
-                'creation_rationale': '13',
+        trust_root = 'http://localhost/bla/'
+        displayname = 'My Test RP'
+        description = 'Bla'
+        allowed_sreg = ['fullname', 'email']
+        creation_rationale = 13
+
+        data = {'trust_root': trust_root,
+                'displayname': displayname,
+                'description': description,
+                'allowed_sreg': allowed_sreg,
+                'creation_rationale': creation_rationale,
                 }
         add_view = reverse('admin:identityprovider_openidrpconfig_add')
         response = self.client.get(add_view)
         response = self.client.post(add_view, data)
         self.assertEqual(302, response.status_code)
-        # We don't get the ID back, so continue on to the next test to
-        # verify that the checkbox appears on the model's screen.
+        # We don't get the ID back, so ensure we only have one entity and
+        # assume it's the correct one.  This is racy, but the alternative is
+        # another request to the list screen to scrape the ID from there.
+        self.assertEqual(OpenIDRPConfig.objects.count(), 1)
+        rpconfig = OpenIDRPConfig.objects.get()
+        self.assertEqual(rpconfig.trust_root, trust_root)
+        self.assertEqual(rpconfig.displayname, displayname)
+        self.assertEqual(rpconfig.description, description)
+        self.assertEqual(sorted(rpconfig.allowed_sreg.split(',')),
+                         sorted(allowed_sreg))
+        self.assertEqual(rpconfig.creation_rationale, creation_rationale)
 
     def test_openidrpconfig_allowed_sreg_checkboxes_getable(self):
         data = {'trust_root': 'http://localhost/bla/',
@@ -78,7 +93,57 @@
             'admin:identityprovider_openidrpconfig_change',
             args=(rpconfig.id,))
         response = self.client.get(change_view)
-        self.assertContains(response, 'checked')
+        dom = PyQuery(response.content)
+        checked = dom.find('input[checked=checked]')
+        self.assertEqual(len(checked), 1)
+        self.assertEqual(checked[0].value, 'fullname')
+
+    def test_openidrpconfig_allowed_ax_checkboxes_postable(self):
+        trust_root = 'http://localhost/bla/'
+        displayname = 'My Test RP'
+        description = 'Bla'
+        allowed_ax = ['fullname', 'email']
+        creation_rationale = 13
+
+        data = {'trust_root': trust_root,
+                'displayname': displayname,
+                'description': description,
+                'allowed_ax': allowed_ax,
+                'creation_rationale': creation_rationale,
+                }
+        add_view = reverse('admin:identityprovider_openidrpconfig_add')
+        response = self.client.get(add_view)
+        response = self.client.post(add_view, data)
+        self.assertEqual(302, response.status_code)
+        # We don't get the ID back, so ensure we only have one entity and
+        # assume it's the correct one.  This is racy, but the alternative is
+        # another request to the list screen to scrape the ID from there.
+        self.assertEqual(OpenIDRPConfig.objects.count(), 1)
+        rpconfig = OpenIDRPConfig.objects.get()
+        self.assertEqual(rpconfig.trust_root, trust_root)
+        self.assertEqual(rpconfig.displayname, displayname)
+        self.assertEqual(rpconfig.description, description)
+        self.assertEqual(sorted(rpconfig.allowed_ax.split(',')),
+                         sorted(allowed_ax))
+        self.assertEqual(rpconfig.creation_rationale, creation_rationale)
+
+    def test_openidrpconfig_allowed_ax_checkboxes_getable(self):
+        data = {'trust_root': 'http://localhost/bla/',
+                'displayname': 'My Test RP',
+                'description': 'Bla',
+                'allowed_ax': 'email',
+                'creation_rationale': '13',
+                }
+        rpconfig = OpenIDRPConfig(**data)
+        rpconfig.save()
+        change_view = reverse(
+            'admin:identityprovider_openidrpconfig_change',
+            args=(rpconfig.id,))
+        response = self.client.get(change_view)
+        dom = PyQuery(response.content)
+        checked = dom.find('input[checked=checked]')
+        self.assertEqual(len(checked), 1)
+        self.assertEqual(checked[0].value, 'email')
 
     def test_inline_models(self):
         expected_inlines = [AccountPasswordInline, EmailAddressInline,

=== modified file 'identityprovider/tests/test_forms.py'
--- identityprovider/tests/test_forms.py	2013-03-29 21:15:13 +0000
+++ identityprovider/tests/test_forms.py	2013-04-03 14:40:35 +0000
@@ -6,11 +6,20 @@
 from django.http import HttpRequest
 from django_openid_auth.teams import TeamsRequest
 from mock import patch
+from openid.extensions.ax import (
+    AttrInfo,
+    FetchRequest,
+)
 from openid.extensions.sreg import SRegRequest
 
 from identityprovider.models.account import Account
 from identityprovider.models.const import EmailStatus
+from identityprovider.const import (
+    AX_URI_FULL_NAME,
+    AX_URI_EMAIL,
+)
 from identityprovider.forms import (
+    AXFetchRequestForm,
     DeviceRenameForm,
     EditAccountForm,
     LoginForm,
@@ -280,8 +289,8 @@
             self._get_request_with_post_args(),
             SRegRequest(required=['fullname'], optional=['email']),
             self.rpconfig)
-        self.assertTrue('fullname' in form.data_approved_for_request)
-        self.assertFalse('email' in form.data_approved_for_request)
+        self.assertIn('fullname', form.data_approved_for_request)
+        self.assertNotIn('email', form.data_approved_for_request)
 
     def test_optional_fields_for_trusted_site(self):
         """The server should return values for optional fields to trusted
@@ -378,6 +387,194 @@
         self.assertTrue(form.check_test('email'))
 
 
+class AXFetchRequestFormTestCase(SSOBaseTestCase):
+    """AX Fetch Request form tests.
+
+    This is all functionally very similar to Simple Registration, except that
+    the extensibility of AX adds an extra layer of complexity.
+    """
+
+    def _get_request_with_post_args(self, args={}):
+        request = HttpRequest()
+        request.user = self.test_user
+        request.POST = args
+        request.META = {'REQUEST_METHOD': 'POST'}
+        return request
+
+    def setUp(self):
+        super(AXFetchRequestFormTestCase, self).setUp()
+        self.test_user = Account.objects.create_account(
+            'My name', '[e-mail]', DEFAULT_USER_PASSWORD)
+        self.rpconfig = OpenIDRPConfig.objects.create(
+            trust_root='http://localhost/', description="Some description")
+
+    def test_no_approved_fields_without_post_request(self):
+        """The server should not generate a list of approved fields when the
+        request is not a POST request.
+        """
+        request = self._get_request_with_post_args()
+        request.META['REQUEST_METHOD'] = 'GET'
+        fetch_request = FetchRequest()
+        for (attr, alias) in [
+                (AX_URI_FULL_NAME, 'fullname'),
+                (AX_URI_EMAIL, 'email')]:
+            fetch_request.add(AttrInfo(attr, alias=alias, required=True))
+        form = AXFetchRequestForm(request, fetch_request, self.rpconfig)
+        self.assertEqual(len(form.data_approved_for_request), 0)
+
+    def test_required_fields_for_trusted_site(self):
+        """The server should always return values for required fields to
+        trusted sites, regardless of the state of the checkbox in the UI.
+        Optional fields should not be returned if the user has unchecked them.
+        """
+        self.rpconfig.allowed_ax = 'fullname,email'
+        fetch_request = FetchRequest()
+        fetch_request.add(
+            AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
+        fetch_request.add(
+            AttrInfo(AX_URI_EMAIL, alias='email', required=False))
+        form = AXFetchRequestForm(self._get_request_with_post_args(),
+                                  fetch_request, self.rpconfig)
+        self.assertTrue('fullname' in form.data_approved_for_request)
+        self.assertFalse('email' in form.data_approved_for_request)
+
+    def test_optional_fields_for_trusted_site(self):
+        """The server should return values for optional fields to trusted
+        sites only when the user checks the checkbox in the UI.
+        """
+        self.rpconfig.allowed_ax = 'fullname,email'
+        post_args = {'email': 'email'}
+        fetch_request = FetchRequest()
+        for (attr, alias) in [
+                (AX_URI_FULL_NAME, 'fullname'),
+                (AX_URI_EMAIL, 'email')]:
+            fetch_request.add(AttrInfo(attr, alias=alias, required=False))
+        form = AXFetchRequestForm(self._get_request_with_post_args(post_args),
+                                  fetch_request, self.rpconfig)
+        self.assertFalse('fullname' in form.data_approved_for_request)
+        self.assertTrue('email' in form.data_approved_for_request)
+
+    def test_required_fields_for_untrusted_site(self):
+        """The server should return values for required fields to untrusted
+        sites only when the user checks the checkbox in the UI.
+        """
+        post_args = {'email': 'email'}
+        fetch_request = FetchRequest()
+        for (attr, alias) in [
+                (AX_URI_FULL_NAME, 'fullname'),
+                (AX_URI_EMAIL, 'email')]:
+            fetch_request.add(AttrInfo(attr, alias=alias, required=True))
+        form = AXFetchRequestForm(self._get_request_with_post_args(post_args),
+                                  fetch_request, None)
+        self.assertFalse('fullname' in form.data_approved_for_request)
+        self.assertTrue('email' in form.data_approved_for_request)
+
+    def test_optional_fields_for_untrusted_site(self):
+        """The server should return values for optional fields to untrusted
+        sites only when the user checks the checkbox in the UI.
+        """
+        post_args = {'fullname': 'fullname'}
+        fetch_request = FetchRequest()
+        for (attr, alias) in [
+                (AX_URI_FULL_NAME, 'fullname'),
+                (AX_URI_EMAIL, 'email')]:
+            fetch_request.add(AttrInfo(attr, alias=alias, required=False))
+        form = AXFetchRequestForm(self._get_request_with_post_args(post_args),
+                                  fetch_request, None)
+        self.assertTrue('fullname' in form.data_approved_for_request)
+        self.assertFalse('email' in form.data_approved_for_request)
+
+    def test_checkbox_status_for_trusted_site(self):
+        """Checkboxes are always checked if the site is trusted"""
+        fetch_request = FetchRequest()
+        fetch_request.add(
+            AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
+        fetch_request.add(
+            AttrInfo(AX_URI_EMAIL, alias='email', required=False))
+        form = AXFetchRequestForm(self._get_request_with_post_args(),
+                                  fetch_request, self.rpconfig)
+        # True because fullname required
+        self.assertTrue(form.check_test('fullname'))
+        # True because trusted site and no previous disapproval
+        self.assertTrue(form.check_test('email'))
+        # Throw in an unrequested field for good measure
+        self.assertFalse(form.check_test('language'))
+
+    def test_checkbox_status_for_trusted_site_with_approved_data(self):
+        """If the user has previously approved sending data to a trusted site
+        the same checkbox settings should be returned on the next request
+        unless those conflict with the required fields.
+        """
+        approved_data = {
+            'requested': ['fullname', 'email'],
+            'approved': ['email', 'language']}
+        fetch_request = FetchRequest()
+        fetch_request.add(
+            AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
+        fetch_request.add(
+            AttrInfo(AX_URI_EMAIL, alias='email', required=False))
+        form1 = AXFetchRequestForm(self._get_request_with_post_args(),
+                                   fetch_request, self.rpconfig,
+                                   approved_data=approved_data)
+        # True because fullname required
+        self.assertTrue(form1.check_test('fullname'))
+        # True because email previously approved
+        self.assertTrue(form1.check_test('email'))
+        # Throw in an unrequested, previously-approved field for good measure
+        self.assertFalse(form1.check_test('language'))
+
+        approved_data['approved'] = []
+        form2 = AXFetchRequestForm(self._get_request_with_post_args(),
+                                   fetch_request, self.rpconfig,
+                                   approved_data=approved_data)
+        # True because fullname required
+        self.assertTrue(form1.check_test('fullname'))
+        # False because email previously disapproved
+        self.assertFalse(form2.check_test('email'))
+        # Throw in an unrequested field for good measure
+        self.assertFalse(form2.check_test('language'))
+
+    def test_checkbox_status_for_untrusted_site(self):
+        """Checkboxes are only checked on untrusted site requests if the field
+        is required
+        """
+        fetch_request = FetchRequest()
+        fetch_request.add(
+            AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
+        fetch_request.add(
+            AttrInfo(AX_URI_EMAIL, alias='email', required=False))
+        form = AXFetchRequestForm(self._get_request_with_post_args(),
+                                  fetch_request, None)
+        # True because fullname required
+        self.assertTrue(form.check_test('fullname'))
+        # False because untrusted site and no previous approval
+        self.assertFalse(form.check_test('email'))
+        # Throw in an unrequested field for good measure
+        self.assertFalse(form.check_test('language'))
+
+    def test_checkbox_status_for_untrusted_site_with_approved_data(self):
+        """If the user has previously approved sending data to an untrusted
+        site the same checkbox settings should be returned on the next request.
+        """
+        approved_data = {
+            'requested': ['fullname', 'email'],
+            'approved': ['email', 'language']}
+        fetch_request = FetchRequest()
+        fetch_request.add(
+            AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
+        fetch_request.add(
+            AttrInfo(AX_URI_EMAIL, alias='email', required=False))
+        form = AXFetchRequestForm(self._get_request_with_post_args(),
+                                  fetch_request, None,
+                                  approved_data=approved_data)
+        # False because untrusted site and previously disapproved
+        self.assertFalse(form.check_test('fullname'))
+        # True because previously approved
+        self.assertTrue(form.check_test('email'))
+        # Throw in an unrequested, previously-approved field for good measure
+        self.assertFalse(form.check_test('language'))
+
+
 class TeamsRequestFormTestCase(SSOBaseTestCase):
 
     def _get_request_with_post_args(self, args={}):

=== modified file 'identityprovider/tests/test_views_server.py'
--- identityprovider/tests/test_views_server.py	2013-03-29 20:36:42 +0000
+++ identityprovider/tests/test_views_server.py	2013-04-03 14:40:35 +0000
@@ -15,6 +15,10 @@
 from django.http import HttpRequest
 from gargoyle.testutils import switches
 from mock import Mock, patch
+from openid.extensions.ax import (
+    AXMessage,
+    FetchRequest,
+)
 from openid.extensions.sreg import SRegRequest
 from openid.message import (
     IDENTIFIER_SELECT,
@@ -26,6 +30,12 @@
 from pyquery import PyQuery
 
 import identityprovider.signed as signed
+from identityprovider.const import (
+    AX_URI_ACCOUNT_VERIFIED,
+    AX_URI_EMAIL,
+    AX_URI_FULL_NAME,
+    AX_URI_LANGUAGE,
+)
 from identityprovider.models import (
     Account,
     OpenIDAuthorization,
@@ -509,7 +519,40 @@
         # no extra check is needed
         server._check_team_membership(request, self.orequest, oresponse)
 
-    def test_list_of_details_is_complete(self):
+    def test_only_ax_or_sreg_form_is_displayed(self):
+        """Even if both SReg and AX requests are present, only display the AX
+        form."""
+        team_name = 'ubuntu-team'
+        team = self.factory.make_team(name=team_name)
+        self.factory.add_account_to_team(self.account, team)
+
+        # create a trusted rpconfig
+        rpconfig = OpenIDRPConfig(
+            trust_root='http://localhost/',
+            allowed_sreg='fullname,email',
+            allowed_ax='fullname,email,account_verified',
+            can_query_any_team=True,
+            description="Some description",
+        )
+        rpconfig.save()
+        param_overrides = {
+            'openid.sreg.required': 'nickname,email,fullname,language',
+            'openid.ns.ax': AXMessage.ns_uri,
+            'openid.ax.mode': FetchRequest.mode,
+            'openid.ax.type.fullname': AX_URI_FULL_NAME,
+            'openid.ax.type.email': AX_URI_EMAIL,
+            'openid.ax.type.account_verified': AX_URI_ACCOUNT_VERIFIED,
+            'openid.ax.type.language': AX_URI_LANGUAGE,
+            'openid.ax.required': 'fullname,email,account_verified,language',
+            'openid.lp.query_membership': team_name,
+        }
+        self._prepare_openid_token(param_overrides=param_overrides)
+        response = self.client.get('/%s/+decide' % self.token)
+        dom = PyQuery(response.content)
+        self.assertEqual(len(dom.find('li.ax')), 3)
+        self.assertEqual(len(dom.find('li.sreg')), 0)
+
+    def test_list_of_details_is_complete_with_sreg(self):
         team_name = 'ubuntu-team'
         team = self.factory.make_team(name=team_name)
         self.factory.add_account_to_team(self.account, team)
@@ -532,7 +575,91 @@
         self.assertContains(response, "Email address")
         self.assertContains(response, "Preferred language")
 
-    def test_state_of_checkboxes_and_data_formats_trusted(self):
+    def test_list_of_details_is_complete_with_ax(self):
+        team_name = 'ubuntu-team'
+        team = self.factory.make_team(name=team_name)
+        self.factory.add_account_to_team(self.account, team)
+
+        # create a trusted rpconfig
+        rpconfig = OpenIDRPConfig(
+            trust_root='http://localhost/',
+            allowed_ax='fullname,email,account_verified',
+            can_query_any_team=True,
+            description="Some description",
+        )
+        rpconfig.save()
+        param_overrides = {
+            'openid.ns.ax': AXMessage.ns_uri,
+            'openid.ax.mode': FetchRequest.mode,
+            'openid.ax.type.fullname': AX_URI_FULL_NAME,
+            'openid.ax.type.email': AX_URI_EMAIL,
+            'openid.ax.type.account_verified': AX_URI_ACCOUNT_VERIFIED,
+            'openid.ax.type.language': AX_URI_LANGUAGE,
+            'openid.ax.required': 'fullname,email,account_verified,language',
+            'openid.lp.query_membership': team_name,
+        }
+        self._prepare_openid_token(param_overrides=param_overrides)
+        response = self.client.get('/%s/+decide' % self.token)
+        self.assertContains(response, "Team membership")
+        self.assertContains(response, "Full name")
+        self.assertContains(response, "Email address")
+        self.assertContains(response, "Account verified")
+
+    def _test_state_of_checkboxes_and_data_formats(
+            self, dom, field, label=None, value=None, required=False,
+            disabled=False, checked=False):
+        elem = dom.find('#id_%s' % field)
+        self.assertEqual(len(elem), 1)
+        self.assertEqual(elem[0].get('type'), 'checkbox')
+        if required:
+            self.assertEqual(elem[0].get('class'), 'required')
+        else:
+            self.assertIsNone(elem[0].get('class'))
+        if checked:
+            self.assertEqual(elem[0].get('checked'), 'checked')
+        else:
+            self.assertIsNone(elem[0].get('checked'))
+        if disabled:
+            self.assertEqual(elem[0].get('disabled'), 'disabled')
+        else:
+            self.assertIsNone(elem[0].get('disabled'))
+        self.assertEqual(elem[0].get('value'), value)
+        elem = dom.find('label[for=id_%s]' % field)
+        self.assertEqual(len(elem), 1)
+        self.assertEqual(
+            elem[0].text, '%s: %s' % (label, value) if label else value)
+
+    def _test_required_trusted_field(self, dom, field, label=None, value=None):
+        """Required fields for trusted RPs *should* be checked, *should* be
+        disabled and *should* be required."""
+        self._test_state_of_checkboxes_and_data_formats(
+            dom, field=field, label=label, value=value,
+            required=True, disabled=True, checked=True)
+
+    def _test_optional_trusted_field(self, dom, field, label=None, value=None):
+        """Optional fields for trusted RPs *should* be checked, *should not* be
+        disabled and *should not* be required."""
+        self._test_state_of_checkboxes_and_data_formats(
+            dom, field=field, label=label, value=value, checked=True,
+            disabled=False, required=False)
+
+    def _test_required_untrusted_field(self, dom, field, label=None,
+                                       value=None):
+        """Required fields for untrusted RPs *should* be checked, *should not*
+        be disabled and *should* be required."""
+        self._test_state_of_checkboxes_and_data_formats(
+            dom, field=field, label=label, value=value, checked=True,
+            disabled=False, required=True)
+
+    def _test_optional_untrusted_field(self, dom, field, label=None,
+                                       value=None):
+        """Optional fields for untrusted RPs *should not* be checked,
+        *should not* be disabled and *should not* be required."""
+        self._test_state_of_checkboxes_and_data_formats(
+            dom, field=field, label=label, value=value, required=False,
+            checked=False, disabled=False)
+
+    def test_state_of_checkboxes_and_data_formats_trusted_sreg(self):
         teams = ('ubuntu-team', 'launchpad-team', 'isd-team')
         for team_name in teams:
             team = self.factory.make_team(name=team_name)
@@ -552,39 +679,68 @@
         }
         self._prepare_openid_token(param_overrides=param_overrides)
         response = self.client.get(self.url)
-        # checkbox checked and disabled for required fields and label is bold
+        dom = PyQuery(response.content)
+        self.assertEqual(len(dom.find('li.sreg')), 3)
+
         nickname = self.account.person.name
-        username_html = ('<li><input checked="checked" name="nickname" '
-                         'value="%s" class="required" disabled="disabled" '
-                         'type="checkbox" id="id_nickname" /> <label '
-                         'for="id_nickname">Username: %s</label></li>' %
-                         (nickname, nickname))
-        email_html = ('<li><input checked="checked" name="email" '
-                      'value="%s" class="required" '
-                      'disabled="disabled" type="checkbox" id="id_email" /> '
-                      '<label for="id_email">Email address: %s</label></li>' %
-                      (self.login_email, self.login_email))
-        # checkbox checked and enabled for optional fields and label is plain
-        language_html = ('<li><input checked="checked" type="checkbox" '
-                         'name="language" value="en" id="id_language" /> '
-                         '<label for="id_language">Preferred language: en'
-                         '</label></li>')
-        # team data is enabled and checked, the label is plain
-        team_html_1 = ('<li><input checked="checked" type="checkbox" '
-                       'name="ubuntu-team" value="ubuntu-team" id="id_'
-                       'ubuntu-team" /> <label for="id_ubuntu-team">'
-                       'ubuntu-team</label></li>')
-        team_html_2 = ('<li><input checked="checked" type="checkbox" '
-                       'name="isd-team" value="isd-team" id="id_isd-team" /> '
-                       '<label for="id_isd-team">isd-team</label></li>')
-
-        self.assertContains(response, username_html)
-        self.assertContains(response, email_html)
-        self.assertContains(response, language_html)
-        self.assertContains(response, team_html_1)
-        self.assertContains(response, team_html_2)
-
-    def test_state_of_checkboxes_and_data_formats_untrusted(self):
+        self._test_required_trusted_field(dom, field='nickname',
+                                          label='Username', value=nickname)
+        self._test_required_trusted_field(dom, field='email',
+                                          label='Email address',
+                                          value=self.login_email)
+
+        self._test_optional_trusted_field(dom, field='language',
+                                          label='Preferred language',
+                                          value='en')
+
+        for team in teams:
+            self._test_optional_trusted_field(dom, field=team, value=team)
+
+    def test_state_of_checkboxes_and_data_formats_trusted_ax(self):
+        teams = ('ubuntu-team', 'launchpad-team', 'isd-team')
+        for team_name in teams:
+            team = self.factory.make_team(name=team_name)
+            self.factory.add_account_to_team(self.account, team)
+
+        # create a trusted rpconfig
+        rpconfig = OpenIDRPConfig(
+            trust_root='http://localhost/',
+            allowed_ax='nickname,email,language,account_verified',
+            can_query_any_team=True,
+            description="Some description",
+        )
+        rpconfig.save()
+        param_overrides = {
+            'openid.ns.ax': AXMessage.ns_uri,
+            'openid.ax.mode': FetchRequest.mode,
+            'openid.ax.type.fullname': AX_URI_FULL_NAME,
+            'openid.ax.type.email': AX_URI_EMAIL,
+            'openid.ax.type.account_verified': AX_URI_ACCOUNT_VERIFIED,
+            'openid.ax.type.language': AX_URI_LANGUAGE,
+            'openid.ax.required': 'fullname,email,account_verified',
+            'openid.ax.if_available': 'language',
+            'openid.lp.query_membership': ','.join(teams),
+        }
+        self._prepare_openid_token(param_overrides=param_overrides)
+        response = self.client.get('/%s/+decide' % self.token)
+        dom = PyQuery(response.content)
+        self.assertEqual(len(dom.find('li.ax')), 3)
+
+        self._test_required_trusted_field(dom, field='email',
+                                          label='Email address',
+                                          value=self.login_email)
+        self._test_required_trusted_field(dom, field='account_verified',
+                                          label='Account verified',
+                                          value='token_via_email')
+
+        self._test_optional_trusted_field(dom, field='language',
+                                          label='Preferred language',
+                                          value='en')
+
+        for team in teams:
+            self._test_optional_trusted_field(dom, field=team, value=team)
+
+    def test_state_of_checkboxes_and_data_formats_untrusted_sreg(self):
         team_name = 'ubuntu-team'
         team = self.factory.make_team(name=team_name)
         self.factory.add_account_to_team(self.account, team)
@@ -602,30 +758,71 @@
         }
         self._prepare_openid_token(param_overrides=param_overrides)
         response = self.client.get(self.url)
+        dom = PyQuery(response.content)
+        self.assertEqual(len(dom.find('li.sreg')), 4)
+
         nickname = self.account.person.name
-        # checkbox checked and *enabled* for required fields and label is bold
-        username_html = ('<li><input checked="checked" name="nickname" '
-                         'value="%s" class="required" type="checkbox" '
-                         'id="id_nickname" /> <label for="id_nickname">'
-                         'Username: %s</label></li>' % (nickname, nickname))
-        email_html = ('<li><input checked="checked" name="email" '
-                      'value="%s" class="required" type='
-                      '"checkbox" id="id_email" /> <label for="id_email">'
-                      'Email address: %s</label></li>' %
-                      (self.login_email, self.login_email))
-        # checkbox *not checked* and enabled for optional fields & plain label
-        language_html = ('<li><input type="checkbox" name="language" value="'
-                         'en" id="id_language" /> <label for="id_language">'
-                         'Preferred language: en</label></li>')
-        # team data is enabled and *not checked*, the label is plain
-        team_html = ('<li><input type="checkbox" name="ubuntu-team" '
-                     'value="ubuntu-team" id="id_ubuntu-team" /> '
-                     '<label for="id_ubuntu-team">Team membership:</label> '
-                     '<label for="id_ubuntu-team">ubuntu-team</label></li>')
-        self.assertContains(response, username_html)
-        self.assertContains(response, email_html)
-        self.assertContains(response, language_html)
-        self.assertContains(response, team_html)
+        self._test_required_untrusted_field(dom, field='nickname',
+                                            label='Username', value=nickname)
+        self._test_required_untrusted_field(dom, field='email',
+                                            label='Email address',
+                                            value=self.login_email)
+
+        self._test_optional_untrusted_field(dom, field='language',
+                                            label='Preferred language',
+                                            value='en')
+
+        self._test_optional_untrusted_field(dom, field=team_name,
+                                            label='Team membership',
+                                            value=team_name)
+
+    def test_state_of_checkboxes_and_data_formats_untrusted_ax(self):
+        team_name = 'ubuntu-team'
+        team = self.factory.make_team(name=team_name)
+        self.factory.add_account_to_team(self.account, team)
+
+        # create a trusted rpconfig
+        trust_root = 'http://untrusted/'
+        rpconfig = OpenIDRPConfig(
+            trust_root=trust_root,
+            can_query_any_team=True,
+            description="Some description",
+        )
+
+        delete_rpconfig_cache_entry("http://localhost/")
+
+        rpconfig.save()
+        param_overrides = {
+            'openid.ns.ax': AXMessage.ns_uri,
+            'openid.ax.mode': FetchRequest.mode,
+            'openid.ax.type.fullname': AX_URI_FULL_NAME,
+            'openid.ax.type.email': AX_URI_EMAIL,
+            'openid.ax.type.account_verified': AX_URI_ACCOUNT_VERIFIED,
+            'openid.ax.type.language': AX_URI_LANGUAGE,
+            'openid.ax.required': 'fullname,email,account_verified',
+            'openid.ax.if_available': 'language',
+            'openid.lp.query_membership': 'ubuntu-team',
+        }
+        self._prepare_openid_token(param_overrides=param_overrides)
+        response = self.client.get('/%s/+decide' % self.token)
+        dom = PyQuery(response.content)
+        self.assertEqual(len(dom.find('li.ax')), 4)
+
+        fullname = self.account.get_full_name()
+        self._test_required_untrusted_field(dom, field='fullname',
+                                            label='Full name',
+                                            value=fullname)
+        self._test_required_untrusted_field(dom, field='email',
+                                            label='Email address',
+                                            value=self.login_email)
+
+        self._test_optional_untrusted_field(dom, field='language',
+                                            label='Preferred language',
+                                            value='en')
+
+        self._test_optional_untrusted_field(dom, field=team_name,
+                                            label='Team membership',
+                                            value=team_name)
 
 
 class DecideUserUnverifiedTestCase(DecideBaseTestCase):
@@ -1353,7 +1550,8 @@
 
 class ApprovedDataTestCase(SSOBaseTestCase):
 
-    def _get_openid_request(self, with_sreg=True, with_teams=True):
+    def _get_openid_request(
+            self, with_sreg=True, with_ax=True, with_teams=True):
         request = {
             'openid.mode': 'checkid_setup',
             'openid.trust_root': 'http://localhost/',
@@ -1361,6 +1559,12 @@
             'openid.identity': IDENTIFIER_SELECT}
         if with_sreg:
             request['openid.sreg.required'] = 'email,fullname'
+        if with_ax:
+            request['openid.ns.ax'] = AXMessage.ns_uri
+            request['openid.ax.mode'] = FetchRequest.mode
+            request['openid.ax.type.fullname'] = AX_URI_FULL_NAME
+            request['openid.ax.type.email'] = AX_URI_EMAIL
+            request['openid.ax.required'] = 'email,fullname'
         if with_teams:
             request['openid.lp.query_membership'] = 'ubuntu-team'
         openid_server = server._get_openid_server()
@@ -1391,31 +1595,62 @@
         post_args = {'email': 'email', 'ubuntu-team': 'ubuntu-team'}
         result = server._get_approved_data(
             self._get_request_with_post_args(post_args),
-            self._get_openid_request(True, False))
+            self._get_openid_request(with_sreg=True, with_ax=False,
+                                     with_teams=False))
         self.assertEqual(sorted(result['sreg']['requested']),
                          ['email', 'fullname'])
         self.assertEqual(result['sreg']['approved'], ['email'])
         self.assertNotIn('teams', result)
+        self.assertNotIn('ax', result)
+
+    def test_approved_data_for_ax_only(self):
+        post_args = {'email': 'email', 'ubuntu-team': 'ubuntu-team'}
+        result = server._get_approved_data(
+            self._get_request_with_post_args(post_args),
+            self._get_openid_request(with_sreg=False, with_ax=True,
+                                     with_teams=False))
+        self.assertEqual(sorted(result['ax']['requested']),
+                         ['email', 'fullname'])
+        self.assertEqual(result['ax']['approved'], ['email'])
+        self.assertNotIn('sreg', result)
+        self.assertNotIn('teams', result)
 
     def test_approved_data_for_teams_only(self):
         post_args = {'ubuntu-team': 'ubuntu-team'}
         result = server._get_approved_data(
             self._get_request_with_post_args(post_args),
-            self._get_openid_request(False, True))
+            self._get_openid_request(with_sreg=False, with_ax=False,
+                                     with_teams=True))
         self.assertEqual(result['teams']['requested'], ['ubuntu-team'])
         self.assertEqual(result['teams']['approved'], ['ubuntu-team'])
+        self.assertNotIn('ax', result)
         self.assertNotIn('sreg', result)
 
     def test_approved_data_for_sreg_and_teams(self):
         post_args = {'email': 'email', 'ubuntu-team': 'ubuntu-team'}
         result = server._get_approved_data(
             self._get_request_with_post_args(post_args),
-            self._get_openid_request())
+            self._get_openid_request(with_sreg=True, with_ax=False,
+                                     with_teams=True))
         self.assertEqual(sorted(result['sreg']['requested']),
                          ['email', 'fullname'])
         self.assertEqual(result['sreg']['approved'], ['email'])
         self.assertEqual(result['teams']['requested'], ['ubuntu-team'])
         self.assertEqual(result['teams']['approved'], ['ubuntu-team'])
+        self.assertNotIn('ax', result)
+
+    def test_approved_data_for_ax_and_teams(self):
+        post_args = {'email': 'email', 'ubuntu-team': 'ubuntu-team'}
+        result = server._get_approved_data(
+            self._get_request_with_post_args(post_args),
+            self._get_openid_request(with_sreg=False, with_ax=True,
+                                     with_teams=True))
+        self.assertEqual(sorted(result['ax']['requested']),
+                         ['email', 'fullname'])
+        self.assertEqual(result['ax']['approved'], ['email'])
+        self.assertEqual(result['teams']['requested'], ['ubuntu-team'])
+        self.assertEqual(result['teams']['approved'], ['ubuntu-team'])
+        self.assertNotIn('sreg', result)
 
 
 class TokenLoginTestCase(SSOBaseTestCase):

=== modified file 'identityprovider/views/server.py'
--- identityprovider/views/server.py	2013-03-28 17:20:52 +0000
+++ identityprovider/views/server.py	2013-04-03 14:40:35 +0000
@@ -12,7 +12,10 @@
     timedelta,
 )
 
-from openid.extensions import pape
+from openid.extensions import (
+    ax,
+    pape,
+)
 from openid.extensions.sreg import (
     SRegRequest,
     SRegResponse,
@@ -59,8 +62,12 @@
 
 import identityprovider.signed as signed
 
-from identityprovider.const import LAUNCHPAD_TEAMS_NS
+from identityprovider.const import (
+    AX_DATA_FIELDS,
+    LAUNCHPAD_TEAMS_NS,
+)
 from identityprovider.forms import (
+    AXFetchRequestForm,
     PreAuthorizeForm,
     SRegRequestForm,
     TeamsRequestForm,
@@ -278,6 +285,7 @@
         return _process_decide(request, orequest, decision=True)
 
     sreg_request = SRegRequest.fromOpenIDRequest(orequest)
+    ax_request = ax.FetchRequest.fromOpenIDRequest(orequest)
     teams_request = TeamsRequest.fromOpenIDRequest(orequest)
     try:
         summary = OpenIDRPSummary.objects.get(
@@ -287,6 +295,9 @@
     except OpenIDRPSummary.DoesNotExist:
         approved_data = {}
 
+    ax_form = (AXFetchRequestForm(
+        request, ax_request, rpconfig, approved_data=approved_data.get('ax'))
+        if ax_request else None)
     sreg_form = SRegRequestForm(request, sreg_request, rpconfig,
                                 approved_data=approved_data.get('sreg'))
     teams_form = TeamsRequestForm(request, teams_request, rpconfig,
@@ -295,6 +306,7 @@
         'account': request.user,
         'trust_root': orequest.trust_root,
         'rpconfig': rpconfig,
+        'ax_form': ax_form,
         'sreg_form': sreg_form,
         'teams_form': teams_form,
         'token': token,
@@ -541,15 +553,23 @@
         return None
 
     approved_data = {}
-
-    sreg_request = SRegRequest.fromOpenIDRequest(orequest)
     rpconfig = utils.get_rpconfig(orequest.trust_root)
+
+    sreg_request = SRegRequest.fromOpenIDRequest(orequest)
     sreg_form = SRegRequestForm(request, sreg_request, rpconfig)
-    if len(sreg_form.data.keys()) > 0:
+    if sreg_form.has_data:
         approved_data['sreg'] = {
             'requested': sreg_form.data.keys(),
             'approved': sreg_form.data_approved_for_request.keys()}
 
+    ax_request = ax.FetchRequest.fromOpenIDRequest(orequest)
+    if ax_request:
+        ax_form = AXFetchRequestForm(request, ax_request, rpconfig)
+        if ax_form.has_data:
+            approved_data['ax'] = {
+                'requested': ax_form.data.keys(),
+                'approved': ax_form.data_approved_for_request.keys()}
+
     args = orequest.message.getArgs(LAUNCHPAD_TEAMS_NS)
     team_names = args.get('query_membership')
     if team_names:
@@ -586,6 +606,18 @@
         openid_response.addExtension(sreg_response)
 
 
+def _add_ax(request, openid_request, openid_response):
+    ax_request = ax.FetchRequest.fromOpenIDRequest(openid_request)
+    if ax_request:
+        rpconfig = utils.get_rpconfig(openid_request.trust_root)
+        form = AXFetchRequestForm(request, ax_request, rpconfig)
+        if form.data_approved_for_request:
+            ax_response = ax.FetchResponse(ax_request)
+            for k, v in form.data_approved_for_request.iteritems():
+                ax_response.addValue(AX_DATA_FIELDS.getNamespaceURI(k), v)
+            openid_response.addExtension(ax_response)
+
+
 def _process_decide(request, orequest, decision):
     oresponse = orequest.answer(
         decision, identity=request.user.openid_identity_url)
@@ -603,6 +635,7 @@
             orequest.trust_root,
             client_id=request.session.session_key)
         _add_sreg(request, orequest, oresponse)
+        _add_ax(request, orequest, oresponse)
         # if there's no submitted POST data, this is an auto-authorized
         # (immediate) request
         immediate = not request.POST