Merge lp:~jamestait/canonical-identity-provider/unify-sreg-ax-forms into lp:canonical-identity-provider/release

[James Tait]

Unify the allowed_ax and allowed_sreg properties on the OpenIDRPConfig.

This branch unifies the allowed_ax and allowed_sreg properties on the
OpenIDRPConfig object, into an allowed_user_attribs property. There is a
migration script that will merge the allowed properties from original two
columns, so no additional configuration of RPs is required.

The SRegRequestForm and AXFetchRequestForm have been merged into a
UserAttribsRequestForm that takes the required and optional attributes from the
SReg and AX request and pulls them together such that if a requested attribute
is required in either request, it will be treated as a required attribute
over all. This really only affects the presentation of the form that is
displayed to the user - required attributes for untrusted RPs are still checked
by default, and also disabled for trusted RPs.

[Ricardo Kirkner (ricardokirkner)]

l. 102-103: this is not really needed unless allowed_user_attribs can be None, right?
l. 104-105: this can also be avoided by having allowed_attribs = known_attribus = set(...) in l. 97
l. 169: is it really necessary to shadow the 'value' attribute? can't we use name and value?
l. 180-181: is the comment right? because the code doesn't say the same.. also can we have an extra pair of () for the | expression? (just to be explict)
l. 197-202: wouldn't this mean you can approve a field by just posting it, disregarding whether it was checked? (maybe I'm missing some standard html subtlety here)
l. 573: shouldn't you skip the account_verified attrib here?
l. 1483,1621: why is it now necessary to set the allowed_attrs ?
l. 1645: how can this work? allowed_attrs don't match the already approved ones, so how were those possible to approve?
l. 1736, 1759: these two tests are virtually identical, except for the attribute being requested.. and that doesn't make the diff between a trusted/untrusted site. doesn't the untrusted test require that you remove the rpconfig entry? how are you sure the site is untrusted in the untrusted test?
l. 1866-1875: why was this change needed at all?

review: Needs Fixing

[James Tait (jamestait)]

> l. 102-103: this is not really needed unless allowed_user_attribs can be None,
> right?

The empty string is also caught by this, so I think it's still needed.

> l. 104-105: this can also be avoided by having allowed_attribs =
> known_attribus = set(...) in l. 97

Yep, that would save a couple of lines.

> l. 169: is it really necessary to shadow the 'value' attribute? can't we use
> name and value?

That would improved readability, actually, yes.

> l. 180-181: is the comment right? because the code doesn't say the same.. also
> can we have an extra pair of () for the | expression? (just to be explict)

Erm, no, I didn't update the comment. Good catch!

> l. 197-202: wouldn't this mean you can approve a field by just posting it,
> disregarding whether it was checked? (maybe I'm missing some standard html
> subtlety here)

So, e.g. fullname=&email=email results in both being checked? Hm, good point, I'm not actually sure. I'll experiment with it and see.

> l. 573: shouldn't you skip the account_verified attrib here?

Indeed! For the backward migration it probably will be there!

> l. 1483,1621: why is it now necessary to set the allowed_attrs ?

l. 1483 is the equivalent of the removed l 1463; l. 1621 addresses what appears to me to be a flaw in the original test - for a trusted, non-auto-authorising RP, a required attribute should be presented to the user as a checked, disabled checkbox, but only if we are configured to allow that attribute.

> l. 1645: how can this work? allowed_attrs don't match the already approved
> ones, so how were those possible to approve?

Ah, bugger, I made a real mess of that one. :-/

> l. 1736, 1759: these two tests are virtually identical, except for the
> attribute being requested.. and that doesn't make the diff between a
> trusted/untrusted site. doesn't the untrusted test require that you remove the
> rpconfig entry? how are you sure the site is untrusted in the untrusted test?

No, there is a difference - l. 1744 passes in the rpconfig, so the site is trusted; l. 1766 passes in no rpconfig, so the site is untrusted. Maybe this could be made clearer by using kwargs, though.

> l. 1866-1875: why was this change needed at all?

Not strictly needed, but the old test could match, e.g. nickname=assoc_handle, where the new test explicitly checks that openid.assoc_handle and openid.sig are form fields. It's just a bit more robust.

[Ricardo Kirkner (ricardokirkner)]

> > l. 102-103: this is not really needed unless allowed_user_attribs can be
> None,
> > right?
>
> The empty string is also caught by this, so I think it's still needed.
>

not really, bc ''.split(';') == [] so you get the same end result.

> > l. 104-105: this can also be avoided by having allowed_attribs =
> > known_attribus = set(...) in l. 97
>
> Yep, that would save a couple of lines.
>
> > l. 169: is it really necessary to shadow the 'value' attribute? can't we use
> > name and value?
>
> That would improved readability, actually, yes.
>
> > l. 180-181: is the comment right? because the code doesn't say the same..
> also
> > can we have an extra pair of () for the | expression? (just to be explict)
>
> Erm, no, I didn't update the comment. Good catch!
>
> > l. 197-202: wouldn't this mean you can approve a field by just posting it,
> > disregarding whether it was checked? (maybe I'm missing some standard html
> > subtlety here)
>
> So, e.g. fullname=&email=email results in both being checked? Hm, good point,
> I'm not actually sure. I'll experiment with it and see.
>
> > l. 573: shouldn't you skip the account_verified attrib here?
>
> Indeed! For the backward migration it probably will be there!
>
> > l. 1483,1621: why is it now necessary to set the allowed_attrs ?
>
> l. 1483 is the equivalent of the removed l 1463; l. 1621 addresses what
> appears to me to be a flaw in the original test - for a trusted, non-auto-
> authorising RP, a required attribute should be presented to the user as a
> checked, disabled checkbox, but only if we are configured to allow that
> attribute.
>
> > l. 1645: how can this work? allowed_attrs don't match the already approved
> > ones, so how were those possible to approve?
>
> Ah, bugger, I made a real mess of that one. :-/
>
> > l. 1736, 1759: these two tests are virtually identical, except for the
> > attribute being requested.. and that doesn't make the diff between a
> > trusted/untrusted site. doesn't the untrusted test require that you remove
> the
> > rpconfig entry? how are you sure the site is untrusted in the untrusted
> test?
>
> No, there is a difference - l. 1744 passes in the rpconfig, so the site is
> trusted; l. 1766 passes in no rpconfig, so the site is untrusted. Maybe this
> could be made clearer by using kwargs, though.

yes, that would help please

>
> > l. 1866-1875: why was this change needed at all?
>
> Not strictly needed, but the old test could match, e.g. nickname=assoc_handle,
> where the new test explicitly checks that openid.assoc_handle and openid.sig
> are form fields. It's just a bit more robust.

good, robust is good :)

[James Tait (jamestait)]

> > > l. 102-103: this is not really needed unless allowed_user_attribs can be
> > None,
> > > right?
> >
> > The empty string is also caught by this, so I think it's still needed.
> >
>
> not really, bc ''.split(';') == [] so you get the same end result.

I don't think so:

>>> ''.split(';')
['']
>>> len(''.split(';'))
1
>>>

[Ricardo Kirkner (ricardokirkner)]

> > > > l. 102-103: this is not really needed unless allowed_user_attribs can be
> > > None,
> > > > right?
> > >
> > > The empty string is also caught by this, so I think it's still needed.
> > >
> >
> > not really, bc ''.split(';') == [] so you get the same end result.
>
> I don't think so:
>
> >>> ''.split(';')
> ['']
> >>> len(''.split(';'))
> 1
> >>>

sorry, I really meant

allowed_attribs = known_attribs.intersection(self.rpconfig.allowed_user_attribs.split(','))

would return set([]) too if allowed_user_attribs is ''

The if is really only necessary if we can't always ensure allowed_user_attribs is a string.

[Ricardo Kirkner (ricardokirkner)]

Just a few minor issues/questions

l. 209: small correction needed in comment (it's not just ax data, right?)
l. 1802: why is email checked if it was optional?
l. 1829: don't we want to assert fullname is still required? this test seems to contradict l.1802 unless I'm missing something (maybe the default value for the rpconfig in the test is to pre-approve the email field?)

Everything else looks really good, and seems much clearer now. Thanks for the hard work!

review: Needs Information

[James Tait (jamestait)]

> sorry, I really meant
>
> allowed_attribs = known_attribs.intersection(self.rpconfig.allowed_user_attribs.split(','))
>
> would return set([]) too if allowed_user_attribs is ''
>
> The if is really only necessary if we can't always ensure allowed_user_attribs is a string.

Ah yes! I'm following you now - so the else is only really necessary if rpconfig.allowed_user_attribs can be None. I'll have to check if that's a possibility (and maybe fix that if it is).

> Just a few minor issues/questions
>
> l. 209: small correction needed in comment (it's not just ax data, right?)

Correct, nice catch!

> l. 1802: why is email checked if it was optional?

Checked by default, but not disabled - for a known trust root, we default to allowing all attributes, and disable the checkbox for required attributes so they can't be unchecked.

> l. 1829: don't we want to assert fullname is still required? this test seems
> to contradict l.1802 unless I'm missing something (maybe the default value for
> the rpconfig in the test is to pre-approve the email field?)

Yes, we should assert fullname is required as well, I'll add that. The email checkbox should be unchecked in this instance because the user has previously opted not to approve it (approved_data['approved'] = [] in l. 1822). I'll add a comment before l. 1829 to make this clear as I have done with similar tests elsewhere.

> Everything else looks really good, and seems much clearer now. Thanks for the
> hard work!

It's been a bit of an epic mission, but I think we've got it nailed this time! :)

[James Tait (jamestait)]

So with Simon's help I eventually managed to get the acceptance tests to run this morning. I got seven failures:

Three instances of this:
_StringException: Traceback (most recent call last):
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/runtests.py", line 571, in run_test_script
    exec self.code in self.context
  File "/home/jtait/src/canonical-identity-provider/identityprovider/tests/acceptance/consumer/return_private_teams.py", line 52, in <module>
    login_from_redirect()
  File "/home/jtait/src/canonical-identity-provider/identityprovider/tests/acceptance/shared/helpers.py", line 249, in login_from_redirect
    log_in = pages.LogInFromRedirect()
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/u1testutils/sst/__init__.py", line 74, in __init__
    self.assert_page_is_open()
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/u1testutils/sst/__init__.py", line 98, in assert_page_is_open
    self.assert_headings2()
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/u1testutils/sst/__init__.py", line 157, in assert_headings2
    self._assert_elements_text('h2', self.headings2)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/u1testutils/sst/__init__.py", line 148, in _assert_elements_text
    ', '.join(expected_texts), ', '.join(elements_text))
AssertionError: Expected elements texts: Log in, Are you new?
Actual elements texts: Log in to Ubuntu Single Sign On, Are you new?

Two instances of this:
_StringException: Traceback (most recent call last):
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/runtests.py", line 571, in run_test_script
    exec self.code in self.context
  File "/home/jtait/src/canonical-identity-provider/identityprovider/tests/acceptance/root/link_logo.py", line 25, in <module>
    wait_for(assert_title, 'Home | Ubuntu')
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 134, in wrapped
    return func(*args, **kwargs)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 750, in wait_for
    _wait_for(condition, False, _TIMEOUT, _POLL, *args, **kwargs)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 727, in _wait_for
    _raise(error)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 118, in _raise
    raise AssertionError(msg)
AssertionError: Timed out waiting for: assert_title
Error during wait: Title is: u"The world's most popular free OS | Ubuntu". Should be: 'Home | Ubuntu'

Those look to be out-of-date tests. Two were related to SReg opt-out and disabled fields, though:

_StringException: Traceback (most recent call last):
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/runtests.py", line 571, in run_test_script
    exec self.code in self.context
  File "/home/jta...

[James Tait (jamestait)]

I just re-ran the acceptance tests thus:

 - Stop any running instances
 - fab shutdown_postgresql_server
 - rm -r .env/db
 - fab setup_postgresql_server
 - edit scripts/local.cfg-dev
  - set db_host to the full path to .env/db
  - set basedir to the full path to the working tree
 - scripts/run-acceptance-tests dev

I got one failure:

FAIL [16.410s]: sst.runtests.SSTScriptTestCase.test_link_logo (sst.runtests.SSTScriptTestCase)
----------------------------------------------------------------------
_StringException: Traceback (most recent call last):
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/runtests.py", line 571, in run_test_script
    exec self.code in self.context
  File "/home/jtait/src/canonical-identity-provider/identityprovider/tests/acceptance/root/link_logo.py", line 25, in <module>
    wait_for(assert_title, 'Home | Ubuntu')
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 134, in wrapped
    return func(*args, **kwargs)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 750, in wait_for
    _wait_for(condition, False, _TIMEOUT, _POLL, *args, **kwargs)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 727, in _wait_for
    _raise(error)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 118, in _raise
    raise AssertionError(msg)
AssertionError: Timed out waiting for: assert_title
Error during wait: Title is: u"The world's most popular free OS | Ubuntu". Should be: 'Home | Ubuntu'

----------------------------------------------------------------------
Ran 116 tests in 1288.091s

FAILED (failures=1)

This is because the test clicks on the link in the page footer to www.ubuntu.com, which has recently changed its title text. It strikes me that this might not be the most robust test, but I don't currently have an alternative - ideally it wouldn't depend on an external resource, but in the interim maybe we could either update the text in the test, or change the test to look for some other unique attribute of the page.

[Ricardo Kirkner (ricardokirkner)]

Since that acceptance test is a known issue (and being worked on), this looks very good to me. Approving.

Great work!

review: Approve

=== modified file 'identityprovider/admin.py'
--- identityprovider/admin.py	2013-03-23 01:27:58 +0000
+++ identityprovider/admin.py	2013-05-01 15:39:26 +0000
@@ -8,7 +8,6 @@
 
 from identityprovider.const import (
     AX_DATA_LABELS,
-    SREG_LABELS,
 )
 from identityprovider.fields import CommaSeparatedField
 from identityprovider.models import (
@@ -45,16 +44,11 @@
     displayname = forms.CharField(label="Display name")
     trust_root = forms.URLField(verify_exists=False)
     logo = forms.CharField(required=False)
-    allowed_ax = CommaSeparatedField(
+    allowed_user_attribs = CommaSeparatedField(
         choices=AX_DATA_LABELS.items(),
         required=False,
         widget=CommaSeparatedWidget,
     )
-    allowed_sreg = CommaSeparatedField(
-        choices=SREG_LABELS.items(),
-        required=False,
-        widget=CommaSeparatedWidget
-    )
     can_query_any_team = forms.BooleanField(label="Can query private teams",
                                             required=False)
     auto_authorize = forms.BooleanField(label="Auto-authorize",

=== modified file 'identityprovider/fixtures/2f.json'
--- identityprovider/fixtures/2f.json	2013-03-12 19:14:34 +0000
+++ identityprovider/fixtures/2f.json	2013-05-01 15:39:26 +0000
@@ -32,7 +32,7 @@
         "logo": "",
         "require_two_factor": false,
         "auto_authorize": false,
-        "allowed_sreg": "",
+        "allowed_user_attribs": "",
         "creation_rationale": 13}},
     {"pk": 1, "model": "auth.user", "fields": {
         "username": "KxHA3MH",

=== modified file 'identityprovider/forms.py'
--- identityprovider/forms.py	2013-04-24 07:08:03 +0000
+++ identityprovider/forms.py	2013-05-01 15:39:26 +0000
@@ -11,8 +11,6 @@
 from identityprovider.const import (
     AX_DATA_FIELDS,
     AX_DATA_LABELS,
-    SREG_DATA_FIELDS_ORDER,
-    SREG_LABELS,
 )
 from identityprovider.models import (
     Account,
@@ -371,147 +369,74 @@
     callback = forms.CharField(error_messages=default_errors)
 
 
-def _get_data_for_user(request, fields, for_ax=False):
-    """Get the data to ask about in the form based on the user's
-    account record.
-    """
-    values = {}
-    user = request.user
-    values['fullname'] = user.displayname
-    if user.preferredemail is not None:
-        values['email'] = user.preferredemail.email
-    if user.person is not None:
-        values['nickname'] = user.person.name
-        if user.person.time_zone is not None:
-            values['timezone'] = user.person.time_zone
-    if user.preferredlanguage is not None:
-        values['language'] = user.preferredlanguage
-    else:
-        values['language'] = translation.get_language_from_request(request)
-    if for_ax:
+class UserAttribsRequestForm(Form):
+    """A form object for user control over OpenID Attribute Exchange."""
+
+    def __init__(self, request, sreg_request, ax_request, rpconfig,
+                 approved_data=None):
+        self.request = request
+        self.sreg_request = sreg_request
+        self.ax_request = ax_request
+        self.rpconfig = rpconfig
+        self.approved_data = approved_data
+        # generate initial form data
+        self._split_and_filter_requested_attributes()
+        self._get_data_for_user()
+        super(UserAttribsRequestForm, self).__init__(self.data)
+        self._init_fields(self.data)
+
+    def _split_and_filter_requested_attributes(self):
+        # Merge the requested attributes from sreg_request and ax_request and
+        # filter out any that we don't recognise or that aren't allowed by our
+        # rpconfig.
+        # The rule is that if at least one request lists it as required, it's
+        # required, otherwise it's optional.
+        known_attribs = set([a for a in AX_DATA_FIELDS.iterAliases()])
+        if self.rpconfig is not None:
+            allowed = self.rpconfig.allowed_user_attribs or ''
+            allowed_attribs = known_attribs.intersection(allowed.split(','))
+        else:
+            allowed_attribs = known_attribs
+
+        required = set()
+        optional = set()
+        if self.sreg_request:
+            required.update(self.sreg_request.required)
+            optional.update(self.sreg_request.optional)
+        if self.ax_request:
+            for uri, attr in self.ax_request.requested_attributes.iteritems():
+                if attr.required:
+                    required.add(AX_DATA_FIELDS.getAlias(uri))
+                else:
+                    optional.add(AX_DATA_FIELDS.getAlias(uri))
+        optional.difference_update(required)
+        self.required = required.intersection(allowed_attribs)
+        self.optional = optional.intersection(allowed_attribs)
+
+    def _get_data_for_user(self):
+        """Get the data to ask about in the form based on the user's
+        account record.
+        """
+        values = {}
+        user = self.request.user
+        values['fullname'] = user.displayname
+        if user.preferredemail is not None:
+            values['email'] = user.preferredemail.email
+        if user.person is not None:
+            values['nickname'] = user.person.name
+            if user.person.time_zone is not None:
+                values['timezone'] = user.person.time_zone
+        if user.preferredlanguage is not None:
+            values['language'] = user.preferredlanguage
+        else:
+            values['language'] = translation.get_language_from_request(
+                self.request)
         values['account_verified'] = (
             'token_via_email' if user.is_verified else 'no')
-    logger.debug('values (%s_fields) = %s',
-                 'ax' if for_ax else 'sreg', str(values))
-
-    return dict([(f, values[f]) for f in fields if f in values])
-
-
-class SRegRequestForm(Form):
-    """A form object for user control over OpenID sreg data.
-    """
-    fields = {}
-
-    @property
-    def data_approved_for_request(self):
-        """Return the list of sreg data approved for the request."""
-        return dict([(f, self.data[f]) for f in self.data
-                     if self.field_approved(f)])
-
-    @property
-    def has_data(self):
-        """Helper property to check if this form has any data."""
-        return len(self.data) > 0
-
-    def __init__(self, request, sreg_request, rpconfig, approved_data=None):
-        self.request = request
-        self.request_method = request.META.get('REQUEST_METHOD')
-        self.sreg_request = sreg_request
-        self.rpconfig = rpconfig
-        self.approved_data = approved_data
-        # generate initial form data
-        sreg_fields = [f for f in SREG_DATA_FIELDS_ORDER if f in set(
-            self.sreg_request.required + self.sreg_request.optional)]
-        if rpconfig is not None:
-            if rpconfig.allowed_sreg:
-                fields = set(sreg_fields).intersection(
-                    set(rpconfig.allowed_sreg.split(',')))
-            else:
-                fields = set()
-        else:
-            fields = sreg_fields
-        self.data = _get_data_for_user(request, fields, for_ax=False)
-
-        super(SRegRequestForm, self).__init__(self.data)
-        self._init_fields(self.data)
-
-    def _init_fields(self, data):
-        """Initialises form fields for the user's sreg data.
-        """
-        for key, val in data.items():
-            label = "%s: %s" % (SREG_LABELS.get(key, key), val)
-            attrs = {}
-            if key in self.sreg_request.required:
-                attrs['class'] = 'required'
-                if self.rpconfig is not None:
-                    attrs['disabled'] = 'disabled'
-            self.fields[key] = fields.BooleanField(
-                label=label,
-                widget=forms.CheckboxInput(attrs=attrs,
-                                           check_test=self.check_test),
-            )
-
-    def check_test(self, value):
-        """Determines if a checkbox should be pre-checked based on previously
-        approved user data, openid request and relying party type.
-        """
-        for k, v in self.data.items():
-            if value == v:
-                value = k
-                break
-
-        if self.rpconfig and value in self.sreg_request.required:
-            return True
-        elif (self.approved_data and
-                value in self.approved_data.get('requested', [])):
-            return value in self.approved_data.get('approved', [])
-        elif self.rpconfig:
-            return True
-        else:
-            return value in self.sreg_request.required
-
-    def field_approved(self, field):
-        """Check if the field should be returned in the response based on user
-        preferences and overridden for trusted relying parties.
-        """
-        approved = set(self.request.POST.keys())
-        if self.rpconfig is not None:
-            sreg_fields = set(self.sreg_request.required)
-            if self.rpconfig.auto_authorize:
-                # also include optional fields
-                sreg_fields.update(set(self.sreg_request.optional))
-            approved.update(sreg_fields)
-        return field in approved
-
-
-class AXFetchRequestForm(Form):
-    """A form object for user control over OpenID Attribute Exchange."""
-
-    def __init__(self, request, ax_request, rpconfig, approved_data=None):
-        self.request = request
-        self.request_method = request.META.get('REQUEST_METHOD')
-        self.ax_request = ax_request
-        self.rpconfig = rpconfig
-        self.approved_data = approved_data
-        # generate initial form data
-        ax_fields = self._get_requested_field_aliases()
-        if rpconfig is not None:
-            ax_fields = self._filter_allowed_fields(ax_fields)
-        self.data = _get_data_for_user(request, ax_fields, for_ax=True)
-
-        super(AXFetchRequestForm, self).__init__(self.data)
-        self._init_fields(self.data)
-
-    def _get_requested_field_aliases(self):
-        return [AX_DATA_FIELDS.getAlias(f)
-                for f in AX_DATA_FIELDS.iterNamespaceURIs()
-                if f in set(self.ax_request.requested_attributes.keys())]
-
-    def _filter_allowed_fields(self, requested_fields):
-        if self.rpconfig.allowed_ax:
-            return set(requested_fields).intersection(
-                set(self.rpconfig.allowed_ax.split(',')))
-        return set()
+        logger.debug('user attrib values = %s', str(values))
+
+        self.data = dict([(f, values[f]) for f in self.required | self.optional
+                          if f in values])
 
     def _init_fields(self, data):
         """Initialises form fields for the user's ax data.
@@ -519,8 +444,7 @@
         for key, val in data.items():
             label = "%s: %s" % (AX_DATA_LABELS.get(key, key), val)
             attrs = {}
-            if (AX_DATA_FIELDS.getNamespaceURI(key) in
-                    self.ax_request.getRequiredAttrs()):
+            if (key in self.required):
                 attrs['class'] = 'required'
                 if self.rpconfig is not None:
                     attrs['disabled'] = 'disabled'
@@ -534,55 +458,52 @@
         """Determines if a checkbox should be pre-checked based on previously
         approved user data, openid request and relying party type.
         """
+        # We don't care about the value, so we first figure out the field name
+        name = value
         for k, v in self.data.items():
             if value == v:
-                value = k
+                name = k
                 break
 
+        # Don't approve fields that weren't requested
+        if name not in (self.required | self.optional):
+            return False
+
         if self.rpconfig:
             # Trusted site, check required fields
-            if (AX_DATA_FIELDS.getNamespaceURI(value) in
-                    self.ax_request.getRequiredAttrs()):
+            if (name in self.required):
                 return True
-            # If we have previous (dis)approval for this site, use it
-            if self.approved_data:
-                return (value in self.approved_data.get('requested', []) and
-                        value in self.approved_data.get('approved', []))
-            # Otherwise, default to True
-            return (AX_DATA_FIELDS.getNamespaceURI(value) in
-                    self.ax_request.requested_attributes)
+            if self.approved_data and name in self.approved_data.get(
+                    'requested', []):
+                # The field was previously requested, use the same response
+                return name in self.approved_data.get('approved', [])
+            # We've never (dis)approved this field before, default to True
+            return True
         else:
             # If we have previous (dis)approval for this site, use it
-            if self.approved_data:
-                return (value in self.approved_data.get('requested', []) and
-                        value in self.approved_data.get('approved', []))
+            if self.approved_data and name in self.approved_data.get(
+                    'requested', []):
+                return name in self.approved_data.get('approved', [])
             # No previous (dis)approval, check required and leave the rest
-            if (AX_DATA_FIELDS.getNamespaceURI(value) in
-                    self.ax_request.getRequiredAttrs()):
-                return True
-            # Otherwise default to False
-            return False
+            return name in self.required
 
     def field_approved(self, field):
         """Check if the field should be returned in the response based on user
         preferences and overridden for trusted relying parties.
         """
-        approved = set([AX_DATA_FIELDS.getNamespaceURI(f)
-                        for f in self.request.POST.keys()])
+        post = self.request.POST
+        approved = set([k for k in post.keys() if post[k]])
         if self.rpconfig is not None:
+            approved.update(self.required)
             if self.rpconfig.auto_authorize:
-                ax_fields = set(self.ax_request.requested_attributes.keys())
-            else:
-                ax_fields = set(self.ax_request.getRequiredAttrs())
-            approved.update(ax_fields)
+                approved.update(self.optional)
         return field in approved
 
     @property
     def data_approved_for_request(self):
-        """Return the list of ax data approved for the request."""
+        """Return the list of user attributes approved for the request."""
         return dict(
-            [(f, self.data[f]) for f in self.data
-             if self.field_approved(AX_DATA_FIELDS.getNamespaceURI(f))])
+            [(f, self.data[f]) for f in self.data if self.field_approved(f)])
 
     @property
     def has_data(self):

=== modified file 'identityprovider/management/commands/add_openid_rp_config.py'
--- identityprovider/management/commands/add_openid_rp_config.py	2013-04-15 20:31:04 +0000
+++ identityprovider/management/commands/add_openid_rp_config.py	2013-05-01 15:39:26 +0000
@@ -10,8 +10,8 @@
     option_list = BaseCommand.option_list + (
         make_option('--allow-unverified', action="store_true",
                     default=False, dest='allow_unverified'),
-        make_option('--allowed-ax', action="store", dest='allowed_ax'),
-        make_option('--allowed-sreg', action="store", dest='allowed_sreg'))
+        make_option('--allowed-user-attribs', action="store",
+                    dest='allowed_user_attribs'))
     help = "Create OpenID RP config entry."
 
     def handle(self, *args, **kwargs):
@@ -20,8 +20,7 @@
 
         trust_root = args[0]
         allow_unverified = kwargs.get('allow_unverified', False)
-        allowed_sreg = kwargs.get('allowed_sreg', '')
-        allowed_ax = kwargs.get('allowed_ax', '')
+        allowed_user_attribs = kwargs.get('allowed_user_attribs', '')
         OpenIDRPConfig.objects.create(
             trust_root=trust_root, allow_unverified=allow_unverified,
-            allowed_sreg=allowed_sreg, allowed_ax=allowed_ax)
+            allowed_user_attribs=allowed_user_attribs)

=== modified file 'identityprovider/management/commands/create_test_team.py'
--- identityprovider/management/commands/create_test_team.py	2013-04-22 20:35:58 +0000
+++ identityprovider/management/commands/create_test_team.py	2013-05-01 15:39:26 +0000
@@ -23,7 +23,7 @@
         name = 'isdtest'
         fullname = 'ISD Test'
         teams = ['canonical-voices', 'canonical-isd-hackers']
-        allowed_sreg = ','.join([
+        allowed_user_attribs = ','.join([
             'fullname', 'nickname', 'email', 'timezone',
             'language'
         ])
@@ -47,7 +47,7 @@
             defaults={
                 'displayname': 'test',
                 'auto_authorize': False,
-                'allowed_sreg': allowed_sreg,
+                'allowed_user_attribs': allowed_user_attribs,
                 'allow_unverified': True,
             }
         )

=== added file 'identityprovider/migrations/0008_add_allowed_user_attribs.py'
--- identityprovider/migrations/0008_add_allowed_user_attribs.py	1970-01-01 00:00:00 +0000
+++ identityprovider/migrations/0008_add_allowed_user_attribs.py	2013-05-01 15:39:26 +0000
@@ -0,0 +1,213 @@
+# -*- coding: utf-8 -*-
+from south.db import db
+from south.v2 import SchemaMigration
+
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        # Adding field 'OpenIDRPConfig.allowed_user_attribs'
+        db.add_column('ssoopenidrpconfig', 'allowed_user_attribs',
+                      self.gf('django.db.models.fields.TextField')(null=True, blank=True),
+                      keep_default=False)
+
+
+    def backwards(self, orm):
+        # Deleting field 'OpenIDRPConfig.allowed_user_attribs'
+        db.delete_column('ssoopenidrpconfig', 'allowed_user_attribs')
+
+
+    models = {
+        'identityprovider.account': {
+            'Meta': {'object_name': 'Account', 'db_table': "u'account'"},
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow'}),
+            'date_status_set': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow'}),
+            'displayname': ('identityprovider.models.account.DisplaynameField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'old_openid_identifier': ('django.db.models.fields.TextField', [], {'db_index': 'True', 'null': 'True', 'blank': 'True'}),
+            'openid_identifier': ('django.db.models.fields.TextField', [], {'default': "u'B4xBChz'", 'unique': 'True'}),
+            'preferredlanguage': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'status': ('django.db.models.fields.IntegerField', [], {}),
+            'status_comment': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'twofactor_attempts': ('django.db.models.fields.SmallIntegerField', [], {'default': '0', 'null': 'True'}),
+            'twofactor_required': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'warn_about_backup_device': ('django.db.models.fields.BooleanField', [], {'default': 'True'})
+        },
+        'identityprovider.accountpassword': {
+            'Meta': {'object_name': 'AccountPassword', 'db_table': "u'accountpassword'"},
+            'account': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['identityprovider.Account']", 'unique': 'True', 'db_column': "'account'"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('identityprovider.models.account.PasswordField', [], {})
+        },
+        'identityprovider.apiuser': {
+            'Meta': {'object_name': 'APIUser', 'db_table': "'api_user'"},
+            'created_at': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('django.db.models.fields.CharField', [], {'max_length': '256'}),
+            'updated_at': ('django.db.models.fields.DateTimeField', [], {'auto_now': 'True', 'blank': 'True'}),
+            'username': ('django.db.models.fields.CharField', [], {'max_length': '256'})
+        },
+        'identityprovider.authenticationdevice': {
+            'Meta': {'ordering': "('id',)", 'object_name': 'AuthenticationDevice'},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'devices'", 'to': "orm['identityprovider.Account']"}),
+            'counter': ('django.db.models.fields.IntegerField', [], {'default': '0'}),
+            'device_type': ('django.db.models.fields.TextField', [], {'null': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'key': ('django.db.models.fields.TextField', [], {}),
+            'name': ('django.db.models.fields.TextField', [], {})
+        },
+        'identityprovider.authtoken': {
+            'Meta': {'object_name': 'AuthToken', 'db_table': "u'authtoken'"},
+            'date_consumed': ('django.db.models.fields.DateTimeField', [], {'db_index': 'True', 'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'db_index': 'True', 'blank': 'True'}),
+            'displayname': ('identityprovider.models.account.DisplaynameField', [], {'null': 'True', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {'db_index': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('identityprovider.models.account.PasswordField', [], {'null': 'True', 'blank': 'True'}),
+            'redirection_url': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'requester': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'requester'", 'blank': 'True'}),
+            'requester_email': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'token': ('django.db.models.fields.TextField', [], {'unique': 'True'}),
+            'token_type': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.emailaddress': {
+            'Meta': {'object_name': 'EmailAddress', 'db_table': "u'emailaddress'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'account'", 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'lp_person': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'person'", 'blank': 'True'}),
+            'status': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.invalidatedemailaddress': {
+            'Meta': {'object_name': 'InvalidatedEmailAddress', 'db_table': "u'invalidated_emailaddress'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'account'", 'blank': 'True'}),
+            'account_notified': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'blank': 'True'}),
+            'date_invalidated': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'null': 'True', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'})
+        },
+        'identityprovider.lpopenididentifier': {
+            'Meta': {'object_name': 'LPOpenIdIdentifier', 'db_table': "u'lp_openididentifier'"},
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.date.today'}),
+            'identifier': ('django.db.models.fields.TextField', [], {'unique': 'True', 'primary_key': 'True'}),
+            'lp_account': ('django.db.models.fields.IntegerField', [], {'db_column': "'account'", 'db_index': 'True'})
+        },
+        'identityprovider.openidassociation': {
+            'Meta': {'unique_together': "(('server_url', 'handle'),)", 'object_name': 'OpenIDAssociation', 'db_table': "u'openidassociation'"},
+            'assoc_type': ('django.db.models.fields.CharField', [], {'max_length': '64'}),
+            'handle': ('django.db.models.fields.CharField', [], {'max_length': '255', 'primary_key': 'True'}),
+            'issued': ('django.db.models.fields.IntegerField', [], {}),
+            'lifetime': ('django.db.models.fields.IntegerField', [], {}),
+            'secret': ('django.db.models.fields.TextField', [], {}),
+            'server_url': ('django.db.models.fields.CharField', [], {'max_length': '2047'})
+        },
+        'identityprovider.openidauthorization': {
+            'Meta': {'object_name': 'OpenIDAuthorization', 'db_table': "u'openidauthorization'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'db_column': "'account'"}),
+            'client_id': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'date_expires': ('django.db.models.fields.DateTimeField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {})
+        },
+        'identityprovider.openidnonce': {
+            'Meta': {'unique_together': "(('server_url', 'timestamp', 'salt'),)", 'object_name': 'OpenIDNonce', 'db_table': "'openidnonce'"},
+            'salt': ('django.db.models.fields.CharField', [], {'max_length': '40'}),
+            'server_url': ('django.db.models.fields.CharField', [], {'max_length': '2047', 'primary_key': 'True'}),
+            'timestamp': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.openidrpconfig': {
+            'Meta': {'object_name': 'OpenIDRPConfig', 'db_table': "'ssoopenidrpconfig'"},
+            'allow_unverified': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'allowed_ax': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'allowed_sreg': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'allowed_user_attribs': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'auto_authorize': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'can_query_any_team': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {'default': '13'}),
+            'description': ('django.db.models.fields.TextField', [], {}),
+            'displayname': ('django.db.models.fields.TextField', [], {}),
+            'flag_twofactor': ('django.db.models.fields.CharField', [], {'max_length': '256', 'null': 'True', 'blank': 'True'}),
+            'ga_snippet': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'logo': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'prefer_canonical_email': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'require_two_factor': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {'unique': 'True'})
+        },
+        'identityprovider.openidrpsummary': {
+            'Meta': {'unique_together': "(('account', 'trust_root', 'openid_identifier'),)", 'object_name': 'OpenIDRPSummary', 'db_table': "u'openidrpsummary'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'db_column': "'account'"}),
+            'approved_data': ('django.db.models.fields.TextField', [], {'default': "''", 'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'date_last_used': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'openid_identifier': ('django.db.models.fields.TextField', [], {'db_index': 'True'}),
+            'total_logins': ('django.db.models.fields.IntegerField', [], {'default': '1'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {'db_index': 'True'})
+        },
+        'identityprovider.person': {
+            'Meta': {'object_name': 'Person', 'db_table': "u'lp_person'"},
+            'addressline1': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'addressline2': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'city': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'country': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'country'", 'blank': 'True'}),
+            'creation_comment': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'datecreated': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'null': 'True', 'blank': 'True'}),
+            'defaultmembershipperiod': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'defaultrenewalperiod': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'displayname': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'fti': ('django.db.models.fields.TextField', [], {'null': 'True'}),
+            'hide_email_addresses': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'homepage_content': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'icon': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'icon'", 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'language': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'language'", 'blank': 'True'}),
+            'logo': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'logo'", 'blank': 'True'}),
+            'lp_account': ('django.db.models.fields.IntegerField', [], {'unique': 'True', 'null': 'True', 'db_column': "'account'"}),
+            'mail_resumption_date': ('django.db.models.fields.DateField', [], {'null': 'True', 'blank': 'True'}),
+            'mailing_list_auto_subscribe_policy': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'}),
+            'mailing_list_receive_duplicates': ('django.db.models.fields.NullBooleanField', [], {'default': 'True', 'null': 'True', 'blank': 'True'}),
+            'merged': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'merged'", 'blank': 'True'}),
+            'mugshot': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'mugshot'", 'blank': 'True'}),
+            'name': ('django.db.models.fields.TextField', [], {'unique': 'True', 'null': 'True'}),
+            'organization': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'personal_standing': ('django.db.models.fields.IntegerField', [], {'default': '0', 'null': 'True'}),
+            'personal_standing_reason': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'phone': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'postcode': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'province': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'registrant': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'registrant'", 'blank': 'True'}),
+            'renewal_policy': ('django.db.models.fields.IntegerField', [], {'default': '10', 'null': 'True'}),
+            'subscriptionpolicy': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'}),
+            'teamdescription': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'teamowner': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'teamowner'", 'blank': 'True'}),
+            'verbose_bugnotifications': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'visibility': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'})
+        },
+        'identityprovider.personlocation': {
+            'Meta': {'object_name': 'PersonLocation', 'db_table': "u'lp_personlocation'"},
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'date_last_modified': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'last_modified_by': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'last_modified_by'"}),
+            'latitude': ('django.db.models.fields.FloatField', [], {'null': 'True', 'blank': 'True'}),
+            'locked': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'longitude': ('django.db.models.fields.FloatField', [], {'null': 'True', 'blank': 'True'}),
+            'person': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['identityprovider.Person']", 'unique': 'True', 'null': 'True', 'db_column': "'person'"}),
+            'time_zone': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'visible': ('django.db.models.fields.NullBooleanField', [], {'default': 'True', 'null': 'True', 'blank': 'True'})
+        },
+        'identityprovider.teamparticipation': {
+            'Meta': {'unique_together': "(('team', 'person'),)", 'object_name': 'TeamParticipation', 'db_table': "u'lp_teamparticipation'"},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'person': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Person']", 'null': 'True', 'db_column': "'person'"}),
+            'team': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'team_participations'", 'null': 'True', 'db_column': "'team'", 'to': "orm['identityprovider.Person']"})
+        }
+    }
+
+    complete_apps = ['identityprovider']

=== added file 'identityprovider/migrations/0009_unify_allowed_sreg_ax.py'
--- identityprovider/migrations/0009_unify_allowed_sreg_ax.py	1970-01-01 00:00:00 +0000
+++ identityprovider/migrations/0009_unify_allowed_sreg_ax.py	2013-05-01 15:39:26 +0000
@@ -0,0 +1,292 @@
+# -*- coding: utf-8 -*-
+import json
+import logging
+
+from django.db.models import Q
+
+from south.v2 import DataMigration
+
+class Migration(DataMigration):
+
+    def forwards(self, orm):
+        "Write your forwards methods here."
+        # Merge OpenIDRPConfig.allowed_ax and OpenIDRPConfg.allowed_sreg
+        # So we take the value of both columns, create a set and populate the
+        # new column.
+        rpconfig_model = orm['identityprovider.OpenIDRPConfig']
+        rpconfigs = rpconfig_model.objects.filter(
+            Q(allowed_ax__isnull=False) | Q(allowed_sreg__isnull=False))
+        for rpconfig in rpconfigs:
+            allowed_ax = rpconfig.allowed_ax
+            allowed_ax = allowed_ax.split(',') if allowed_ax else []
+            allowed_sreg = rpconfig.allowed_sreg
+            allowed_sreg = allowed_sreg.split(',') if allowed_sreg else []
+            allowed_user_attribs = set(allowed_ax + allowed_sreg)
+            rpconfig.allowed_user_attribs = ','.join(allowed_user_attribs)
+            rpconfig.save()
+        # And now deal with users' previous (dis)approvals
+        summary_model = orm['identityprovider.OpenIDRPSummary']
+        summaries = summary_model.objects.filter(approved_data__isnull=False)
+        for summary in summaries:
+            try:
+                approved_data = json.loads(summary.approved_data)
+                ax_data = approved_data.get('ax', {})
+                requested_ax = set(ax_data.get('requested', []))
+                approved_ax = set(ax_data.get('approved', []))
+                sreg_data = approved_data.get('sreg', {})
+                requested_sreg = set(sreg_data.get('requested', []))
+                approved_sreg = set(sreg_data.get('approved', []))
+                approved_data.pop('ax', None)
+                approved_data.pop('sreg', None)
+                approved_data['user_attribs'] = {
+                    'requested': list(requested_ax | requested_sreg),
+                    'approved': list(approved_ax | approved_sreg),
+                }
+                summary.approved_data = json.dumps(approved_data)
+                summary.save()
+            except ValueError:
+                logging.warning(
+                    '[OpenIDRPSummary Migration] '
+                    'Could not parse approved_data for OpenIDRPSummary id %d, '
+                    'summary not migrated', summary.id)
+
+    def backwards(self, orm):
+        "Write your backwards methods here."
+        # So we take the value of the old column and copy it into the two new
+        # columns, taking care to filter account_verified from allowed_sreg.
+        rpconfig_model = orm['identityprovider.OpenIDRPConfig']
+        rpconfigs = rpconfig_model.objects.filter(
+            allowed_user_attribs__isnull=False)
+        for rpconfig in rpconfigs:
+            allowed_user_attribs = rpconfig.allowed_user_attribs
+            allowed_user_attribs = (
+                allowed_user_attribs.split(',') if allowed_user_attribs
+                else [])
+            allowed_sreg = [i for i in allowed_user_attribs
+                            if i != 'account_verified']
+            rpconfig.allowed_sreg = ','.join(allowed_sreg)
+            rpconfig.allowed_ax = ','.join(allowed_user_attribs)
+            rpconfig.save()
+        # And new the user's previous (dis)approvals
+        summary_model = orm['identityprovider.OpenIDRPSummary']
+        summaries = summary_model.objects.filter(approved_data__isnull=False)
+        for summary in summaries:
+            try:
+                approved_data = json.loads(summary.approved_data)
+                user_attribs_data = approved_data.get('user_attribs', {})
+                requested_user_attribs = user_attribs_data.get('requested', [])
+                approved_user_attribs = user_attribs_data.get('approved', [])
+                approved_data.pop('user_attribs', None)
+                approved_data['ax'] = {
+                    'requested': requested_user_attribs,
+                    'approved': approved_user_attribs,
+                }
+                approved_data['sreg'] = {
+                    'requested': [a for a in requested_user_attribs
+                                  if a != 'account_verified'],
+                    'approved': [a for a in approved_user_attribs
+                                 if a != 'account_verified'],
+                }
+                summary.approved_data = json.dumps(approved_data)
+                summary.save()
+            except ValueError:
+                logging.warning(
+                    '[OpenIDRPSummary Migration] '
+                    'Could not parse approved_data for OpenIDRPSummary id %d, '
+                    'summary not migrated', summary.id)
+
+    models = {
+        'identityprovider.account': {
+            'Meta': {'object_name': 'Account', 'db_table': "u'account'"},
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow'}),
+            'date_status_set': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow'}),
+            'displayname': ('identityprovider.models.account.DisplaynameField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'old_openid_identifier': ('django.db.models.fields.TextField', [], {'db_index': 'True', 'null': 'True', 'blank': 'True'}),
+            'openid_identifier': ('django.db.models.fields.TextField', [], {'default': "u'PNywzmm'", 'unique': 'True'}),
+            'preferredlanguage': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'status': ('django.db.models.fields.IntegerField', [], {}),
+            'status_comment': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'twofactor_attempts': ('django.db.models.fields.SmallIntegerField', [], {'default': '0', 'null': 'True'}),
+            'twofactor_required': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'warn_about_backup_device': ('django.db.models.fields.BooleanField', [], {'default': 'True'})
+        },
+        'identityprovider.accountpassword': {
+            'Meta': {'object_name': 'AccountPassword', 'db_table': "u'accountpassword'"},
+            'account': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['identityprovider.Account']", 'unique': 'True', 'db_column': "'account'"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('identityprovider.models.account.PasswordField', [], {})
+        },
+        'identityprovider.apiuser': {
+            'Meta': {'object_name': 'APIUser', 'db_table': "'api_user'"},
+            'created_at': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('django.db.models.fields.CharField', [], {'max_length': '256'}),
+            'updated_at': ('django.db.models.fields.DateTimeField', [], {'auto_now': 'True', 'blank': 'True'}),
+            'username': ('django.db.models.fields.CharField', [], {'max_length': '256'})
+        },
+        'identityprovider.authenticationdevice': {
+            'Meta': {'ordering': "('id',)", 'object_name': 'AuthenticationDevice'},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'devices'", 'to': "orm['identityprovider.Account']"}),
+            'counter': ('django.db.models.fields.IntegerField', [], {'default': '0'}),
+            'device_type': ('django.db.models.fields.TextField', [], {'null': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'key': ('django.db.models.fields.TextField', [], {}),
+            'name': ('django.db.models.fields.TextField', [], {})
+        },
+        'identityprovider.authtoken': {
+            'Meta': {'object_name': 'AuthToken', 'db_table': "u'authtoken'"},
+            'date_consumed': ('django.db.models.fields.DateTimeField', [], {'db_index': 'True', 'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'db_index': 'True', 'blank': 'True'}),
+            'displayname': ('identityprovider.models.account.DisplaynameField', [], {'null': 'True', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {'db_index': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('identityprovider.models.account.PasswordField', [], {'null': 'True', 'blank': 'True'}),
+            'redirection_url': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'requester': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'requester'", 'blank': 'True'}),
+            'requester_email': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'token': ('django.db.models.fields.TextField', [], {'unique': 'True'}),
+            'token_type': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.emailaddress': {
+            'Meta': {'object_name': 'EmailAddress', 'db_table': "u'emailaddress'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'account'", 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'lp_person': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'person'", 'blank': 'True'}),
+            'status': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.invalidatedemailaddress': {
+            'Meta': {'object_name': 'InvalidatedEmailAddress', 'db_table': "u'invalidated_emailaddress'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'account'", 'blank': 'True'}),
+            'account_notified': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'blank': 'True'}),
+            'date_invalidated': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'null': 'True', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'})
+        },
+        'identityprovider.lpopenididentifier': {
+            'Meta': {'object_name': 'LPOpenIdIdentifier', 'db_table': "u'lp_openididentifier'"},
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.date.today'}),
+            'identifier': ('django.db.models.fields.TextField', [], {'unique': 'True', 'primary_key': 'True'}),
+            'lp_account': ('django.db.models.fields.IntegerField', [], {'db_column': "'account'", 'db_index': 'True'})
+        },
+        'identityprovider.openidassociation': {
+            'Meta': {'unique_together': "(('server_url', 'handle'),)", 'object_name': 'OpenIDAssociation', 'db_table': "u'openidassociation'"},
+            'assoc_type': ('django.db.models.fields.CharField', [], {'max_length': '64'}),
+            'handle': ('django.db.models.fields.CharField', [], {'max_length': '255', 'primary_key': 'True'}),
+            'issued': ('django.db.models.fields.IntegerField', [], {}),
+            'lifetime': ('django.db.models.fields.IntegerField', [], {}),
+            'secret': ('django.db.models.fields.TextField', [], {}),
+            'server_url': ('django.db.models.fields.CharField', [], {'max_length': '2047'})
+        },
+        'identityprovider.openidauthorization': {
+            'Meta': {'object_name': 'OpenIDAuthorization', 'db_table': "u'openidauthorization'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'db_column': "'account'"}),
+            'client_id': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'date_expires': ('django.db.models.fields.DateTimeField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {})
+        },
+        'identityprovider.openidnonce': {
+            'Meta': {'unique_together': "(('server_url', 'timestamp', 'salt'),)", 'object_name': 'OpenIDNonce', 'db_table': "'openidnonce'"},
+            'salt': ('django.db.models.fields.CharField', [], {'max_length': '40'}),
+            'server_url': ('django.db.models.fields.CharField', [], {'max_length': '2047', 'primary_key': 'True'}),
+            'timestamp': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.openidrpconfig': {
+            'Meta': {'object_name': 'OpenIDRPConfig', 'db_table': "'ssoopenidrpconfig'"},
+            'allow_unverified': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'allowed_ax': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'allowed_sreg': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'allowed_user_attribs': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'auto_authorize': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'can_query_any_team': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {'default': '13'}),
+            'description': ('django.db.models.fields.TextField', [], {}),
+            'displayname': ('django.db.models.fields.TextField', [], {}),
+            'flag_twofactor': ('django.db.models.fields.CharField', [], {'max_length': '256', 'null': 'True', 'blank': 'True'}),
+            'ga_snippet': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'logo': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'prefer_canonical_email': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'require_two_factor': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {'unique': 'True'})
+        },
+        'identityprovider.openidrpsummary': {
+            'Meta': {'unique_together': "(('account', 'trust_root', 'openid_identifier'),)", 'object_name': 'OpenIDRPSummary', 'db_table': "u'openidrpsummary'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'db_column': "'account'"}),
+            'approved_data': ('django.db.models.fields.TextField', [], {'default': "''", 'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'date_last_used': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'openid_identifier': ('django.db.models.fields.TextField', [], {'db_index': 'True'}),
+            'total_logins': ('django.db.models.fields.IntegerField', [], {'default': '1'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {'db_index': 'True'})
+        },
+        'identityprovider.person': {
+            'Meta': {'object_name': 'Person', 'db_table': "u'lp_person'"},
+            'addressline1': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'addressline2': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'city': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'country': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'country'", 'blank': 'True'}),
+            'creation_comment': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'datecreated': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'null': 'True', 'blank': 'True'}),
+            'defaultmembershipperiod': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'defaultrenewalperiod': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'displayname': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'fti': ('django.db.models.fields.TextField', [], {'null': 'True'}),
+            'hide_email_addresses': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'homepage_content': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'icon': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'icon'", 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'language': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'language'", 'blank': 'True'}),
+            'logo': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'logo'", 'blank': 'True'}),
+            'lp_account': ('django.db.models.fields.IntegerField', [], {'unique': 'True', 'null': 'True', 'db_column': "'account'"}),
+            'mail_resumption_date': ('django.db.models.fields.DateField', [], {'null': 'True', 'blank': 'True'}),
+            'mailing_list_auto_subscribe_policy': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'}),
+            'mailing_list_receive_duplicates': ('django.db.models.fields.NullBooleanField', [], {'default': 'True', 'null': 'True', 'blank': 'True'}),
+            'merged': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'merged'", 'blank': 'True'}),
+            'mugshot': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'mugshot'", 'blank': 'True'}),
+            'name': ('django.db.models.fields.TextField', [], {'unique': 'True', 'null': 'True'}),
+            'organization': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'personal_standing': ('django.db.models.fields.IntegerField', [], {'default': '0', 'null': 'True'}),
+            'personal_standing_reason': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'phone': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'postcode': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'province': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'registrant': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'registrant'", 'blank': 'True'}),
+            'renewal_policy': ('django.db.models.fields.IntegerField', [], {'default': '10', 'null': 'True'}),
+            'subscriptionpolicy': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'}),
+            'teamdescription': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'teamowner': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'teamowner'", 'blank': 'True'}),
+            'verbose_bugnotifications': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'visibility': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'})
+        },
+        'identityprovider.personlocation': {
+            'Meta': {'object_name': 'PersonLocation', 'db_table': "u'lp_personlocation'"},
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'date_last_modified': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'last_modified_by': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'last_modified_by'"}),
+            'latitude': ('django.db.models.fields.FloatField', [], {'null': 'True', 'blank': 'True'}),
+            'locked': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'longitude': ('django.db.models.fields.FloatField', [], {'null': 'True', 'blank': 'True'}),
+            'person': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['identityprovider.Person']", 'unique': 'True', 'null': 'True', 'db_column': "'person'"}),
+            'time_zone': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'visible': ('django.db.models.fields.NullBooleanField', [], {'default': 'True', 'null': 'True', 'blank': 'True'})
+        },
+        'identityprovider.teamparticipation': {
+            'Meta': {'unique_together': "(('team', 'person'),)", 'object_name': 'TeamParticipation', 'db_table': "u'lp_teamparticipation'"},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'person': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Person']", 'null': 'True', 'db_column': "'person'"}),
+            'team': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'team_participations'", 'null': 'True', 'db_column': "'team'", 'to': "orm['identityprovider.Person']"})
+        }
+    }
+
+    complete_apps = ['identityprovider']
+    symmetrical = True

=== added file 'identityprovider/migrations/0010_remove_allowed_sreg_ax.py'
--- identityprovider/migrations/0010_remove_allowed_sreg_ax.py	1970-01-01 00:00:00 +0000
+++ identityprovider/migrations/0010_remove_allowed_sreg_ax.py	2013-05-01 15:39:26 +0000
@@ -0,0 +1,219 @@
+# -*- coding: utf-8 -*-
+from south.db import db
+from south.v2 import SchemaMigration
+
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        # Deleting field 'OpenIDRPConfig.allowed_ax'
+        db.delete_column('ssoopenidrpconfig', 'allowed_ax')
+
+        # Deleting field 'OpenIDRPConfig.allowed_sreg'
+        db.delete_column('ssoopenidrpconfig', 'allowed_sreg')
+
+
+    def backwards(self, orm):
+        # Adding field 'OpenIDRPConfig.allowed_ax'
+        db.add_column('ssoopenidrpconfig', 'allowed_ax',
+                      self.gf('django.db.models.fields.TextField')(null=True, blank=True),
+                      keep_default=False)
+
+        # Adding field 'OpenIDRPConfig.allowed_sreg'
+        db.add_column('ssoopenidrpconfig', 'allowed_sreg',
+                      self.gf('django.db.models.fields.TextField')(null=True, blank=True),
+                      keep_default=False)
+
+
+    models = {
+        'identityprovider.account': {
+            'Meta': {'object_name': 'Account', 'db_table': "u'account'"},
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow'}),
+            'date_status_set': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow'}),
+            'displayname': ('identityprovider.models.account.DisplaynameField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'old_openid_identifier': ('django.db.models.fields.TextField', [], {'db_index': 'True', 'null': 'True', 'blank': 'True'}),
+            'openid_identifier': ('django.db.models.fields.TextField', [], {'default': "u'BDreFt7'", 'unique': 'True'}),
+            'preferredlanguage': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'status': ('django.db.models.fields.IntegerField', [], {}),
+            'status_comment': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'twofactor_attempts': ('django.db.models.fields.SmallIntegerField', [], {'default': '0', 'null': 'True'}),
+            'twofactor_required': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'warn_about_backup_device': ('django.db.models.fields.BooleanField', [], {'default': 'True'})
+        },
+        'identityprovider.accountpassword': {
+            'Meta': {'object_name': 'AccountPassword', 'db_table': "u'accountpassword'"},
+            'account': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['identityprovider.Account']", 'unique': 'True', 'db_column': "'account'"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('identityprovider.models.account.PasswordField', [], {})
+        },
+        'identityprovider.apiuser': {
+            'Meta': {'object_name': 'APIUser', 'db_table': "'api_user'"},
+            'created_at': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('django.db.models.fields.CharField', [], {'max_length': '256'}),
+            'updated_at': ('django.db.models.fields.DateTimeField', [], {'auto_now': 'True', 'blank': 'True'}),
+            'username': ('django.db.models.fields.CharField', [], {'max_length': '256'})
+        },
+        'identityprovider.authenticationdevice': {
+            'Meta': {'ordering': "('id',)", 'object_name': 'AuthenticationDevice'},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'devices'", 'to': "orm['identityprovider.Account']"}),
+            'counter': ('django.db.models.fields.IntegerField', [], {'default': '0'}),
+            'device_type': ('django.db.models.fields.TextField', [], {'null': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'key': ('django.db.models.fields.TextField', [], {}),
+            'name': ('django.db.models.fields.TextField', [], {})
+        },
+        'identityprovider.authtoken': {
+            'Meta': {'object_name': 'AuthToken', 'db_table': "u'authtoken'"},
+            'date_consumed': ('django.db.models.fields.DateTimeField', [], {'db_index': 'True', 'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'db_index': 'True', 'blank': 'True'}),
+            'displayname': ('identityprovider.models.account.DisplaynameField', [], {'null': 'True', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {'db_index': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'password': ('identityprovider.models.account.PasswordField', [], {'null': 'True', 'blank': 'True'}),
+            'redirection_url': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'requester': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'requester'", 'blank': 'True'}),
+            'requester_email': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'token': ('django.db.models.fields.TextField', [], {'unique': 'True'}),
+            'token_type': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.emailaddress': {
+            'Meta': {'object_name': 'EmailAddress', 'db_table': "u'emailaddress'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'account'", 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'lp_person': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'person'", 'blank': 'True'}),
+            'status': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.invalidatedemailaddress': {
+            'Meta': {'object_name': 'InvalidatedEmailAddress', 'db_table': "u'invalidated_emailaddress'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'null': 'True', 'db_column': "'account'", 'blank': 'True'}),
+            'account_notified': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'blank': 'True'}),
+            'date_invalidated': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'null': 'True', 'blank': 'True'}),
+            'email': ('django.db.models.fields.TextField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'})
+        },
+        'identityprovider.lpopenididentifier': {
+            'Meta': {'object_name': 'LPOpenIdIdentifier', 'db_table': "u'lp_openididentifier'"},
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.date.today'}),
+            'identifier': ('django.db.models.fields.TextField', [], {'unique': 'True', 'primary_key': 'True'}),
+            'lp_account': ('django.db.models.fields.IntegerField', [], {'db_column': "'account'", 'db_index': 'True'})
+        },
+        'identityprovider.openidassociation': {
+            'Meta': {'unique_together': "(('server_url', 'handle'),)", 'object_name': 'OpenIDAssociation', 'db_table': "u'openidassociation'"},
+            'assoc_type': ('django.db.models.fields.CharField', [], {'max_length': '64'}),
+            'handle': ('django.db.models.fields.CharField', [], {'max_length': '255', 'primary_key': 'True'}),
+            'issued': ('django.db.models.fields.IntegerField', [], {}),
+            'lifetime': ('django.db.models.fields.IntegerField', [], {}),
+            'secret': ('django.db.models.fields.TextField', [], {}),
+            'server_url': ('django.db.models.fields.CharField', [], {'max_length': '2047'})
+        },
+        'identityprovider.openidauthorization': {
+            'Meta': {'object_name': 'OpenIDAuthorization', 'db_table': "u'openidauthorization'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'db_column': "'account'"}),
+            'client_id': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'date_expires': ('django.db.models.fields.DateTimeField', [], {}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {})
+        },
+        'identityprovider.openidnonce': {
+            'Meta': {'unique_together': "(('server_url', 'timestamp', 'salt'),)", 'object_name': 'OpenIDNonce', 'db_table': "'openidnonce'"},
+            'salt': ('django.db.models.fields.CharField', [], {'max_length': '40'}),
+            'server_url': ('django.db.models.fields.CharField', [], {'max_length': '2047', 'primary_key': 'True'}),
+            'timestamp': ('django.db.models.fields.IntegerField', [], {})
+        },
+        'identityprovider.openidrpconfig': {
+            'Meta': {'object_name': 'OpenIDRPConfig', 'db_table': "'ssoopenidrpconfig'"},
+            'allow_unverified': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'allowed_user_attribs': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'auto_authorize': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'can_query_any_team': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {'default': '13'}),
+            'description': ('django.db.models.fields.TextField', [], {}),
+            'displayname': ('django.db.models.fields.TextField', [], {}),
+            'flag_twofactor': ('django.db.models.fields.CharField', [], {'max_length': '256', 'null': 'True', 'blank': 'True'}),
+            'ga_snippet': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'logo': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'prefer_canonical_email': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'require_two_factor': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {'unique': 'True'})
+        },
+        'identityprovider.openidrpsummary': {
+            'Meta': {'unique_together': "(('account', 'trust_root', 'openid_identifier'),)", 'object_name': 'OpenIDRPSummary', 'db_table': "u'openidrpsummary'"},
+            'account': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Account']", 'db_column': "'account'"}),
+            'approved_data': ('django.db.models.fields.TextField', [], {'default': "''", 'null': 'True', 'blank': 'True'}),
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'date_last_used': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.utcnow', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'openid_identifier': ('django.db.models.fields.TextField', [], {'db_index': 'True'}),
+            'total_logins': ('django.db.models.fields.IntegerField', [], {'default': '1'}),
+            'trust_root': ('django.db.models.fields.TextField', [], {'db_index': 'True'})
+        },
+        'identityprovider.person': {
+            'Meta': {'object_name': 'Person', 'db_table': "u'lp_person'"},
+            'addressline1': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'addressline2': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'city': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'country': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'country'", 'blank': 'True'}),
+            'creation_comment': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'creation_rationale': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'datecreated': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'null': 'True', 'blank': 'True'}),
+            'defaultmembershipperiod': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'defaultrenewalperiod': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'blank': 'True'}),
+            'displayname': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'fti': ('django.db.models.fields.TextField', [], {'null': 'True'}),
+            'hide_email_addresses': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'homepage_content': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'icon': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'icon'", 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'language': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'language'", 'blank': 'True'}),
+            'logo': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'logo'", 'blank': 'True'}),
+            'lp_account': ('django.db.models.fields.IntegerField', [], {'unique': 'True', 'null': 'True', 'db_column': "'account'"}),
+            'mail_resumption_date': ('django.db.models.fields.DateField', [], {'null': 'True', 'blank': 'True'}),
+            'mailing_list_auto_subscribe_policy': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'}),
+            'mailing_list_receive_duplicates': ('django.db.models.fields.NullBooleanField', [], {'default': 'True', 'null': 'True', 'blank': 'True'}),
+            'merged': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'merged'", 'blank': 'True'}),
+            'mugshot': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'mugshot'", 'blank': 'True'}),
+            'name': ('django.db.models.fields.TextField', [], {'unique': 'True', 'null': 'True'}),
+            'organization': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'personal_standing': ('django.db.models.fields.IntegerField', [], {'default': '0', 'null': 'True'}),
+            'personal_standing_reason': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'phone': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'postcode': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'province': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'registrant': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'registrant'", 'blank': 'True'}),
+            'renewal_policy': ('django.db.models.fields.IntegerField', [], {'default': '10', 'null': 'True'}),
+            'subscriptionpolicy': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'}),
+            'teamdescription': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'teamowner': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'teamowner'", 'blank': 'True'}),
+            'verbose_bugnotifications': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'visibility': ('django.db.models.fields.IntegerField', [], {'default': '1', 'null': 'True'})
+        },
+        'identityprovider.personlocation': {
+            'Meta': {'object_name': 'PersonLocation', 'db_table': "u'lp_personlocation'"},
+            'date_created': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'date_last_modified': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'last_modified_by': ('django.db.models.fields.IntegerField', [], {'null': 'True', 'db_column': "'last_modified_by'"}),
+            'latitude': ('django.db.models.fields.FloatField', [], {'null': 'True', 'blank': 'True'}),
+            'locked': ('django.db.models.fields.NullBooleanField', [], {'default': 'False', 'null': 'True', 'blank': 'True'}),
+            'longitude': ('django.db.models.fields.FloatField', [], {'null': 'True', 'blank': 'True'}),
+            'person': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['identityprovider.Person']", 'unique': 'True', 'null': 'True', 'db_column': "'person'"}),
+            'time_zone': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'visible': ('django.db.models.fields.NullBooleanField', [], {'default': 'True', 'null': 'True', 'blank': 'True'})
+        },
+        'identityprovider.teamparticipation': {
+            'Meta': {'unique_together': "(('team', 'person'),)", 'object_name': 'TeamParticipation', 'db_table': "u'lp_teamparticipation'"},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'person': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['identityprovider.Person']", 'null': 'True', 'db_column': "'person'"}),
+            'team': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'team_participations'", 'null': 'True', 'db_column': "'team'", 'to': "orm['identityprovider.Person']"})
+        }
+    }
+
+    complete_apps = ['identityprovider']

=== modified file 'identityprovider/models/openidmodels.py'
--- identityprovider/models/openidmodels.py	2013-03-20 17:37:36 +0000
+++ identityprovider/models/openidmodels.py	2013-05-01 15:39:26 +0000
@@ -154,8 +154,7 @@
     displayname = models.TextField()
     description = models.TextField()
     logo = models.TextField(blank=True, null=True)
-    allowed_ax = models.TextField(blank=True, null=True)
-    allowed_sreg = models.TextField(blank=True, null=True)
+    allowed_user_attribs = models.TextField(blank=True, null=True)
     creation_rationale = models.IntegerField(
         default=13, choices=AccountCreationRationale._get_choices())
     can_query_any_team = models.BooleanField(default=False)

=== modified file 'identityprovider/templates/server/decide.html'
--- identityprovider/templates/server/decide.html	2013-04-02 23:01:33 +0000
+++ identityprovider/templates/server/decide.html	2013-05-01 15:39:26 +0000
@@ -31,18 +31,12 @@
         <form action="{{ action }}" method="POST" name="decideform">
             {% csrf_token %}
             <div class="info-items">
-                {% if sreg_form.has_data or teams_form.has_data or ax_form.has_data %}
+                {% if user_attribs_form.has_data or teams_form.has_data %}
                 <ul class="list">
-                    {% if ax_form.has_data %}
-                        {% for field in ax_form %}
-                    <li class="ax">{{ field|safe }} {{ field.label_tag }}</li>
+                    {% if user_attribs_form.has_data %}
+                        {% for field in user_attribs_form %}
+                    <li class="user_attribs">{{ field|safe }} {{ field.label_tag }}</li>
                         {% endfor %}
-                    {% else %}
-                        {% if sreg_form.has_data %}
-                            {% for field in sreg_form %}
-                    <li class="sreg">{{ field|safe }} {{ field.label_tag }}</li>
-                            {% endfor %}
-                        {% endif %}
                     {% endif %}
                     {% if teams_form.has_data %}
                         {% ifequal teams_form.fields|length 1 %}

=== modified file 'identityprovider/tests/openid_server/per_version/test_restricted_sreg.py'
--- identityprovider/tests/openid_server/per_version/test_restricted_sreg.py	2013-04-01 15:24:48 +0000
+++ identityprovider/tests/openid_server/per_version/test_restricted_sreg.py	2013-05-01 15:39:26 +0000
@@ -89,10 +89,11 @@
         # If we create a Relying Party configuration for the trust root, things
         # play out a bit differently:
 
-        allowed_sreg = ','.join(['fullname', 'nickname', 'email', 'timezone'])
+        allowed_user_attribs = ','.join(['fullname', 'nickname',
+                                         'email', 'timezone'])
         self.create_openid_rp_config(
             trust_root=self.consumer_url,
-            allowed_sreg=allowed_sreg)
+            allowed_user_attribs=allowed_user_attribs)
 
         # Now begin another identical OpenID authentication request:
         response = self.initial_dance()
@@ -125,10 +126,10 @@
         # == Behaviour for known trust roots with auto_authorize ==
 
         # enable auto-authorize for the rpconfig
-        allowed_sreg = ','.join(['fullname', 'email', 'timezone'])
+        allowed_user_attribs = ','.join(['fullname', 'email', 'timezone'])
         self.create_openid_rp_config(
             trust_root=self.consumer_url,
-            allowed_sreg=allowed_sreg, auto_authorize=True)
+            allowed_user_attribs=allowed_user_attribs, auto_authorize=True)
         # Now begin another identical OpenID authentication request:
         response = self.initial_dance()
 

=== modified file 'identityprovider/tests/test_admin.py'
--- identityprovider/tests/test_admin.py	2013-04-02 16:24:29 +0000
+++ identityprovider/tests/test_admin.py	2013-05-01 15:39:26 +0000
@@ -52,17 +52,17 @@
         for model in (AccountPassword, Person, LPOpenIdIdentifier):
             self.assertRaises(NotRegistered, admin.site.unregister, model)
 
-    def test_openidrpconfig_allowed_sreg_checkboxes_postable(self):
+    def test_openidrpconfig_allowed_user_attribs_checkboxes_postable(self):
         trust_root = 'http://localhost/bla/'
         displayname = 'My Test RP'
         description = 'Bla'
-        allowed_sreg = ['fullname', 'email']
+        allowed_user_attribs = ['fullname', 'email']
         creation_rationale = 13
 
         data = {'trust_root': trust_root,
                 'displayname': displayname,
                 'description': description,
-                'allowed_sreg': allowed_sreg,
+                'allowed_user_attribs': allowed_user_attribs,
                 'creation_rationale': creation_rationale,
                 }
         add_view = reverse('admin:identityprovider_openidrpconfig_add')
@@ -77,15 +77,15 @@
         self.assertEqual(rpconfig.trust_root, trust_root)
         self.assertEqual(rpconfig.displayname, displayname)
         self.assertEqual(rpconfig.description, description)
-        self.assertEqual(sorted(rpconfig.allowed_sreg.split(',')),
-                         sorted(allowed_sreg))
+        self.assertEqual(sorted(rpconfig.allowed_user_attribs.split(',')),
+                         sorted(allowed_user_attribs))
         self.assertEqual(rpconfig.creation_rationale, creation_rationale)
 
-    def test_openidrpconfig_allowed_sreg_checkboxes_getable(self):
+    def test_openidrpconfig_allowed_user_attribs_checkboxes_getable(self):
         data = {'trust_root': 'http://localhost/bla/',
                 'displayname': 'My Test RP',
                 'description': 'Bla',
-                'allowed_sreg': 'fullname',
+                'allowed_user_attribs': 'fullname',
                 'creation_rationale': '13',
                 }
         rpconfig = OpenIDRPConfig.objects.create(**data)
@@ -98,53 +98,6 @@
         self.assertEqual(len(checked), 1)
         self.assertEqual(checked[0].value, 'fullname')
 
-    def test_openidrpconfig_allowed_ax_checkboxes_postable(self):
-        trust_root = 'http://localhost/bla/'
-        displayname = 'My Test RP'
-        description = 'Bla'
-        allowed_ax = ['fullname', 'email']
-        creation_rationale = 13
-
-        data = {'trust_root': trust_root,
-                'displayname': displayname,
-                'description': description,
-                'allowed_ax': allowed_ax,
-                'creation_rationale': creation_rationale,
-                }
-        add_view = reverse('admin:identityprovider_openidrpconfig_add')
-        response = self.client.get(add_view)
-        response = self.client.post(add_view, data)
-        self.assertEqual(302, response.status_code)
-        # We don't get the ID back, so ensure we only have one entity and
-        # assume it's the correct one.  This is racy, but the alternative is
-        # another request to the list screen to scrape the ID from there.
-        self.assertEqual(OpenIDRPConfig.objects.count(), 1)
-        rpconfig = OpenIDRPConfig.objects.get()
-        self.assertEqual(rpconfig.trust_root, trust_root)
-        self.assertEqual(rpconfig.displayname, displayname)
-        self.assertEqual(rpconfig.description, description)
-        self.assertEqual(sorted(rpconfig.allowed_ax.split(',')),
-                         sorted(allowed_ax))
-        self.assertEqual(rpconfig.creation_rationale, creation_rationale)
-
-    def test_openidrpconfig_allowed_ax_checkboxes_getable(self):
-        data = {'trust_root': 'http://localhost/bla/',
-                'displayname': 'My Test RP',
-                'description': 'Bla',
-                'allowed_ax': 'email',
-                'creation_rationale': '13',
-                }
-        rpconfig = OpenIDRPConfig(**data)
-        rpconfig.save()
-        change_view = reverse(
-            'admin:identityprovider_openidrpconfig_change',
-            args=(rpconfig.id,))
-        response = self.client.get(change_view)
-        dom = PyQuery(response.content)
-        checked = dom.find('input[checked=checked]')
-        self.assertEqual(len(checked), 1)
-        self.assertEqual(checked[0].value, 'email')
-
     def test_inline_models(self):
         expected_inlines = [AccountPasswordInline, EmailAddressInline,
                             AuthenticationDeviceInline]

=== modified file 'identityprovider/tests/test_command_add_openid_rp_config.py'
--- identityprovider/tests/test_command_add_openid_rp_config.py	2013-04-15 20:43:43 +0000
+++ identityprovider/tests/test_command_add_openid_rp_config.py	2013-05-01 15:39:26 +0000
@@ -26,7 +26,7 @@
         config = get_object_or_none(OpenIDRPConfig, trust_root=root)
         self.assertIsNotNone(config)
         self.assertFalse(config.allow_unverified)
-        self.assertEqual(config.allowed_sreg, '')
+        self.assertEqual(config.allowed_user_attribs, '')
 
     def test_add_with_allow_unverified(self):
         root = 'http://localhost:8000'
@@ -35,31 +35,12 @@
         self.assertIsNotNone(config)
         self.assertTrue(config.allow_unverified)
 
-    def test_add_with_sreg_value(self):
-        root = 'http://localhost:8000'
-        call_command(
-            'add_openid_rp_config', root, allowed_sreg='nickname,email')
-        config = get_object_or_none(OpenIDRPConfig, trust_root=root)
-        self.assertIsNotNone(config)
-        self.assertFalse(config.allow_unverified)
-        self.assertEqual(config.allowed_sreg, 'nickname,email')
-
-    def test_add_with_ax_value(self):
-        root = 'http://localhost:8000'
-        call_command(
-            'add_openid_rp_config', root, allowed_ax='nickname,email')
-        config = get_object_or_none(OpenIDRPConfig, trust_root=root)
-        self.assertIsNotNone(config)
-        self.assertFalse(config.allow_unverified)
-        self.assertEqual(config.allowed_ax, 'nickname,email')
-
-    def test_add_with_ax_and_sreg_value(self):
-        root = 'http://localhost:8000'
-        call_command(
-            'add_openid_rp_config', root, allowed_sreg='nickname',
-            allowed_ax='nickname,email')
-        config = get_object_or_none(OpenIDRPConfig, trust_root=root)
-        self.assertIsNotNone(config)
-        self.assertFalse(config.allow_unverified)
-        self.assertEqual(config.allowed_sreg, 'nickname')
-        self.assertEqual(config.allowed_ax, 'nickname,email')
+    def test_add_with_allowed_user_attribs_value(self):
+        root = 'http://localhost:8000'
+        call_command(
+            'add_openid_rp_config', root,
+            allowed_user_attribs='nickname,email')
+        config = get_object_or_none(OpenIDRPConfig, trust_root=root)
+        self.assertIsNotNone(config)
+        self.assertFalse(config.allow_unverified)
+        self.assertEqual(config.allowed_user_attribs, 'nickname,email')

=== modified file 'identityprovider/tests/test_forms.py'
--- identityprovider/tests/test_forms.py	2013-04-15 16:40:19 +0000
+++ identityprovider/tests/test_forms.py	2013-05-01 15:39:26 +0000
@@ -15,18 +15,19 @@
 from identityprovider.models.account import Account
 from identityprovider.models.const import EmailStatus
 from identityprovider.const import (
+    AX_URI_ACCOUNT_VERIFIED,
+    AX_URI_EMAIL,
     AX_URI_FULL_NAME,
-    AX_URI_EMAIL,
+    AX_URI_LANGUAGE,
 )
 from identityprovider.forms import (
-    AXFetchRequestForm,
     DeviceRenameForm,
     EditAccountForm,
     LoginForm,
     ResetPasswordForm,
-    SRegRequestForm,
     TeamsRequestForm,
     TokenForm,
+    UserAttribsRequestForm,
 )
 from identityprovider.models.openidmodels import OpenIDRPConfig
 from identityprovider.tests import DEFAULT_USER_PASSWORD
@@ -251,267 +252,180 @@
                          'Invalid characters in password')
 
 
-class SRegRequestFormTest(SSOBaseTestCase):
-
-    def _get_request_with_post_args(self, args={}):
-        request = HttpRequest()
-        request.user = self.test_user
-        request.POST = args
-        request.META = {'REQUEST_METHOD': 'POST'}
-        return request
-
-    def setUp(self):
-        super(SRegRequestFormTest, self).setUp()
-        self.test_user = Account.objects.create_account(
-            'My name', '[e-mail]', DEFAULT_USER_PASSWORD)
-        self.rpconfig = OpenIDRPConfig.objects.create(
-            trust_root='http://localhost/', description="Some description")
-
-    def test_no_approved_fields_without_post_request(self):
-        """The server should not generate a list of approved fields when the
-        request is not a POST request.
-        """
-        request = self._get_request_with_post_args()
-        request.META['REQUEST_METHOD'] = 'GET'
-        form = SRegRequestForm(
-            request,
-            SRegRequest(required=['fullname', 'email']),
-            self.rpconfig)
-        self.assertEqual(len(form.data_approved_for_request), 0)
-
-    def test_required_fields_for_trusted_site(self):
-        """The server should always return values for required fields to
-        trusted sites, regardless of the state of the checkbox in the UI.
-        Optional fields should not be returned if the user has unchecked them.
-        """
-        self.rpconfig.allowed_sreg = 'fullname,email'
-        form = SRegRequestForm(
-            self._get_request_with_post_args(),
-            SRegRequest(required=['fullname'], optional=['email']),
-            self.rpconfig)
-        self.assertIn('fullname', form.data_approved_for_request)
-        self.assertNotIn('email', form.data_approved_for_request)
-
-    def test_optional_fields_for_trusted_site(self):
-        """The server should return values for optional fields to trusted
-        sites only when the user checks the checkbox in the UI.
-        """
-        self.rpconfig.allowed_sreg = 'fullname,email'
-        post_args = {'email': 'email'}
-        form = SRegRequestForm(
-            self._get_request_with_post_args(post_args),
-            SRegRequest(optional=['fullname', 'email']),
-            self.rpconfig)
-        self.assertFalse('fullname' in form.data_approved_for_request)
-        self.assertTrue('email' in form.data_approved_for_request)
-
-    def test_required_fields_for_untrusted_site(self):
-        """The server should return values for required fields to untrusted
-        sites only when the user checks the checkbox in the UI.
-        """
-        post_args = {'email': 'email'}
-        form = SRegRequestForm(
-            self._get_request_with_post_args(post_args),
-            SRegRequest(required=['fullname', 'email']),
-            None)
-        self.assertFalse('fullname' in form.data_approved_for_request)
-        self.assertTrue('email' in form.data_approved_for_request)
-
-    def test_optional_fields_for_untrusted_site(self):
-        """The server should return values for optional fields to untrusted
-        sites only when the user checks the checkbox in the UI.
-        """
-        post_args = {'fullname': 'fullname'}
-        form = SRegRequestForm(
-            self._get_request_with_post_args(post_args),
-            SRegRequest(optional=['fullname', 'email']),
-            None)
-        self.assertTrue('fullname' in form.data_approved_for_request)
-        self.assertFalse('email' in form.data_approved_for_request)
-
-    def test_checkbox_status_for_trusted_site(self):
-        """Checkboxes are always checked if the site is trusted
-        """
-        form = SRegRequestForm(
-            self._get_request_with_post_args(),
-            SRegRequest(required=['fullname'], optional=['email']),
-            self.rpconfig)
-        self.assertTrue(form.check_test('fullname'))
-        self.assertTrue(form.check_test('email'))
-
-    def test_checkbox_status_for_trusted_site_with_approved_data(self):
-        """If the user has previously approved sending data to a trusted site
-        the same checkbox settings should be returned on the next request
-        unless those conflict with the required fields.
-        """
-        approved_data = {
-            'requested': ['fullname', 'email'],
-            'approved': ['email']}
-        form1 = SRegRequestForm(
-            self._get_request_with_post_args(),
-            SRegRequest(required=['fullname'], optional=['email']),
-            self.rpconfig, approved_data=approved_data)
-        self.assertTrue(form1.check_test('fullname'))
-        self.assertTrue(form1.check_test('email'))
-
-        approved_data['approved'] = []
-        form2 = SRegRequestForm(
-            self._get_request_with_post_args(),
-            SRegRequest(required=['fullname'], optional=['email']),
-            self.rpconfig, approved_data=approved_data)
-        self.assertFalse(form2.check_test('email'))
-
-    def test_checkbox_status_for_untrusted_site(self):
-        """Checkboxes are only checked on untrusted site requests if the field
-        is required
-        """
-        form = SRegRequestForm(
-            self._get_request_with_post_args(),
-            SRegRequest(required=['fullname'], optional=['email']),
-            None)
-        self.assertTrue(form.check_test('fullname'))
-        self.assertFalse(form.check_test('email'))
-
-    def test_checkbox_status_for_untrusted_site_with_approved_data(self):
-        """If the user has previously approved sending data to an untrusted
-        site the same checkbox settings should be returned on the next request.
-        """
-        approved_data = {
-            'requested': ['fullname', 'email'],
-            'approved': ['email']}
-        form = SRegRequestForm(
-            self._get_request_with_post_args(),
-            SRegRequest(required=['fullname'], optional=['email']),
-            None, approved_data=approved_data)
-        self.assertFalse(form.check_test('fullname'))
-        self.assertTrue(form.check_test('email'))
-
-
-class AXFetchRequestFormTestCase(SSOBaseTestCase):
-    """AX Fetch Request form tests.
-
-    This is all functionally very similar to Simple Registration, except that
-    the extensibility of AX adds an extra layer of complexity.
-    """
-
-    def _get_request_with_post_args(self, args={}):
-        request = HttpRequest()
-        request.user = self.test_user
-        request.POST = args
-        request.META = {'REQUEST_METHOD': 'POST'}
-        return request
-
-    def setUp(self):
-        super(AXFetchRequestFormTestCase, self).setUp()
-        self.test_user = Account.objects.create_account(
-            'My name', '[e-mail]', DEFAULT_USER_PASSWORD)
-        self.rpconfig = OpenIDRPConfig.objects.create(
-            trust_root='http://localhost/', description="Some description")
-
-    def test_no_approved_fields_without_post_request(self):
-        """The server should not generate a list of approved fields when the
-        request is not a POST request.
-        """
-        request = self._get_request_with_post_args()
-        request.META['REQUEST_METHOD'] = 'GET'
-        fetch_request = FetchRequest()
+class UserAttribsRequestFormTest(SSOBaseTestCase):
+
+    def _get_request_with_post_args(self, args={}):
+        request = HttpRequest()
+        request.user = self.test_user
+        request.POST = args
+        request.META = {'REQUEST_METHOD': 'POST'}
+        return request
+
+    def setUp(self):
+        super(UserAttribsRequestFormTest, self).setUp()
+        self.test_user = Account.objects.create_account(
+            'My name', '[e-mail]', DEFAULT_USER_PASSWORD)
+        self.rpconfig = OpenIDRPConfig.objects.create(
+            trust_root='http://localhost/', description="Some description")
+
+    def test_no_approved_fields_without_post_request(self):
+        """The server should not generate a list of approved fields when the
+        request is not a POST request.
+        """
+        sreg_request = SRegRequest(required=['fullname', 'email'])
+        ax_request = FetchRequest()
         for (attr, alias) in [
                 (AX_URI_FULL_NAME, 'fullname'),
                 (AX_URI_EMAIL, 'email')]:
-            fetch_request.add(AttrInfo(attr, alias=alias, required=True))
-        form = AXFetchRequestForm(request, fetch_request, self.rpconfig)
+            ax_request.add(AttrInfo(attr, alias=alias, required=True))
+        request = self._get_request_with_post_args()
+        request.META['REQUEST_METHOD'] = 'GET'
+        form = UserAttribsRequestForm(request=request,
+                                      sreg_request=sreg_request,
+                                      ax_request=ax_request,
+                                      rpconfig=self.rpconfig)
         self.assertEqual(len(form.data_approved_for_request), 0)
 
-    def test_required_fields_for_trusted_site(self):
-        """The server should always return values for required fields to
-        trusted sites, regardless of the state of the checkbox in the UI.
-        Optional fields should not be returned if the user has unchecked them.
-        """
-        self.rpconfig.allowed_ax = 'fullname,email'
-        fetch_request = FetchRequest()
-        fetch_request.add(
+    def test_sreg_required_fields_for_trusted_site(self):
+        """The server should always return values for required fields to
+        trusted sites, regardless of the state of the checkbox in the UI.
+        Optional fields should not be returned if the user has unchecked them.
+        """
+        self.rpconfig.allowed_user_attribs = 'fullname,email'
+        sreg_request = SRegRequest(required=['fullname'], optional=['email'])
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=sreg_request, ax_request=None, rpconfig=self.rpconfig)
+        self.assertIn('fullname', form.data_approved_for_request)
+        self.assertNotIn('email', form.data_approved_for_request)
+
+    def test_ax_required_fields_for_trusted_site(self):
+        """The server should always return values for required fields to
+        trusted sites, regardless of the state of the checkbox in the UI.
+        Optional fields should not be returned if the user has unchecked them.
+        """
+        self.rpconfig.allowed_user_attribs = 'fullname,email'
+        ax_request = FetchRequest()
+        ax_request.add(
             AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
-        fetch_request.add(
+        ax_request.add(
             AttrInfo(AX_URI_EMAIL, alias='email', required=False))
-        form = AXFetchRequestForm(self._get_request_with_post_args(),
-                                  fetch_request, self.rpconfig)
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(), sreg_request=None,
+            ax_request=ax_request, rpconfig=self.rpconfig)
         self.assertIn('fullname', form.data_approved_for_request)
         self.assertNotIn('email', form.data_approved_for_request)
 
-    def test_fields_for_trusted_auto_authorize_site(self):
+    def test_ax_and_sreg_required_fields_for_trusted_site(self):
+        """The server should always return values for required fields to
+        trusted sites, regardless of the state of the checkbox in the UI.
+        Optional fields should not be returned if the user has unchecked them.
+        Fields are required if at least one of the SReg and AX request lists
+        them as such.
+        """
+        self.rpconfig.allowed_user_attribs = (
+            'fullname,email,language,account_verified')
+        sreg_request = SRegRequest(
+            required=['language', 'email'], optional=['fullname'])
+        ax_request = FetchRequest()
+        ax_request.add(
+            AttrInfo(AX_URI_EMAIL, alias='email', required=True))
+        ax_request.add(
+            AttrInfo(AX_URI_ACCOUNT_VERIFIED, alias='account_verified',
+                     required=True))
+        ax_request.add(
+            AttrInfo(AX_URI_LANGUAGE, alias='language', required=False))
+        ax_request.add(
+            AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=False))
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=sreg_request, ax_request=ax_request,
+            rpconfig=self.rpconfig)
+        self.assertIn('email', form.data_approved_for_request)
+        self.assertIn('account_verified', form.data_approved_for_request)
+        self.assertIn('language', form.data_approved_for_request)
+        self.assertNotIn('fullname', form.data_approved_for_request)
+
+    def test_ax_fields_for_trusted_auto_authorize_site(self):
         """The server should always return values for requested fields to
         trusted sites configured to auto-authorize.
         """
-        self.rpconfig.allowed_ax = 'fullname,email'
+        self.rpconfig.allowed_user_attribs = 'fullname,email'
         self.rpconfig.auto_authorize = True
-        fetch_request = FetchRequest()
+        ax_request = FetchRequest()
         # One required attribute
-        fetch_request.add(
+        ax_request.add(
             AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
         # One optional attribute
-        fetch_request.add(
+        ax_request.add(
             AttrInfo(AX_URI_EMAIL, alias='email', required=False))
-        form = AXFetchRequestForm(self._get_request_with_post_args(),
-                                  fetch_request, self.rpconfig)
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(), sreg_request=None,
+            ax_request=ax_request, rpconfig=self.rpconfig)
         # Both attributes should be returned
         self.assertIn('fullname', form.data_approved_for_request)
         self.assertIn('email', form.data_approved_for_request)
 
-    def test_optional_fields_for_trusted_site(self):
+    def test_ax_optional_fields_for_trusted_site(self):
         """The server should return values for optional fields to trusted
         sites only when the user checks the checkbox in the UI.
         """
-        self.rpconfig.allowed_ax = 'fullname,email'
-        post_args = {'email': 'email'}
-        fetch_request = FetchRequest()
+        self.rpconfig.allowed_user_attribs = 'fullname,email'
+        post_args = {'email': 'email', 'fullname': None}
+        ax_request = FetchRequest()
         for (attr, alias) in [
                 (AX_URI_FULL_NAME, 'fullname'),
                 (AX_URI_EMAIL, 'email')]:
-            fetch_request.add(AttrInfo(attr, alias=alias, required=False))
-        form = AXFetchRequestForm(self._get_request_with_post_args(post_args),
-                                  fetch_request, self.rpconfig)
+            ax_request.add(AttrInfo(attr, alias=alias, required=False))
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(post_args),
+            sreg_request=None, ax_request=ax_request, rpconfig=self.rpconfig)
         self.assertFalse('fullname' in form.data_approved_for_request)
         self.assertTrue('email' in form.data_approved_for_request)
 
-    def test_required_fields_for_untrusted_site(self):
+    def test_ax_required_fields_for_untrusted_site(self):
         """The server should return values for required fields to untrusted
         sites only when the user checks the checkbox in the UI.
         """
         post_args = {'email': 'email'}
-        fetch_request = FetchRequest()
+        ax_request = FetchRequest()
         for (attr, alias) in [
                 (AX_URI_FULL_NAME, 'fullname'),
                 (AX_URI_EMAIL, 'email')]:
-            fetch_request.add(AttrInfo(attr, alias=alias, required=True))
-        form = AXFetchRequestForm(self._get_request_with_post_args(post_args),
-                                  fetch_request, None)
+            ax_request.add(AttrInfo(attr, alias=alias, required=True))
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(post_args),
+            sreg_request=None, ax_request=ax_request, rpconfig=None)
         self.assertFalse('fullname' in form.data_approved_for_request)
         self.assertTrue('email' in form.data_approved_for_request)
 
-    def test_optional_fields_for_untrusted_site(self):
+    def test_ax_optional_fields_for_untrusted_site(self):
         """The server should return values for optional fields to untrusted
         sites only when the user checks the checkbox in the UI.
         """
         post_args = {'fullname': 'fullname'}
-        fetch_request = FetchRequest()
+        ax_request = FetchRequest()
         for (attr, alias) in [
                 (AX_URI_FULL_NAME, 'fullname'),
                 (AX_URI_EMAIL, 'email')]:
-            fetch_request.add(AttrInfo(attr, alias=alias, required=False))
-        form = AXFetchRequestForm(self._get_request_with_post_args(post_args),
-                                  fetch_request, None)
+            ax_request.add(AttrInfo(attr, alias=alias, required=False))
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(post_args),
+            sreg_request=None, ax_request=ax_request, rpconfig=None)
         self.assertTrue('fullname' in form.data_approved_for_request)
         self.assertFalse('email' in form.data_approved_for_request)
 
-    def test_checkbox_status_for_trusted_site(self):
+    def test_ax_checkbox_status_for_trusted_site(self):
         """Checkboxes are always checked if the site is trusted"""
-        fetch_request = FetchRequest()
-        fetch_request.add(
+        self.rpconfig.allowed_user_attribs = 'fullname,email'
+        ax_request = FetchRequest()
+        ax_request.add(
             AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
-        fetch_request.add(
+        ax_request.add(
             AttrInfo(AX_URI_EMAIL, alias='email', required=False))
-        form = AXFetchRequestForm(self._get_request_with_post_args(),
-                                  fetch_request, self.rpconfig)
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=None, ax_request=ax_request, rpconfig=self.rpconfig)
         # True because fullname required
         self.assertTrue(form.check_test('fullname'))
         # True because trusted site and no previous disapproval
@@ -519,22 +433,24 @@
         # Throw in an unrequested field for good measure
         self.assertFalse(form.check_test('language'))
 
-    def test_checkbox_status_for_trusted_site_with_approved_data(self):
+    def test_ax_checkbox_status_for_trusted_site_with_approved_data(self):
         """If the user has previously approved sending data to a trusted site
         the same checkbox settings should be returned on the next request
         unless those conflict with the required fields.
         """
+        self.rpconfig.allowed_user_attribs = 'fullname,email,language'
         approved_data = {
-            'requested': ['fullname', 'email'],
+            'requested': ['fullname', 'email', 'language'],
             'approved': ['email', 'language']}
-        fetch_request = FetchRequest()
-        fetch_request.add(
+        ax_request = FetchRequest()
+        ax_request.add(
             AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
-        fetch_request.add(
+        ax_request.add(
             AttrInfo(AX_URI_EMAIL, alias='email', required=False))
-        form1 = AXFetchRequestForm(self._get_request_with_post_args(),
-                                   fetch_request, self.rpconfig,
-                                   approved_data=approved_data)
+        form1 = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=None, ax_request=ax_request, rpconfig=self.rpconfig,
+            approved_data=approved_data)
         # True because fullname required
         self.assertTrue(form1.check_test('fullname'))
         # True because email previously approved
@@ -543,9 +459,10 @@
         self.assertFalse(form1.check_test('language'))
 
         approved_data['approved'] = []
-        form2 = AXFetchRequestForm(self._get_request_with_post_args(),
-                                   fetch_request, self.rpconfig,
-                                   approved_data=approved_data)
+        form2 = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=None, ax_request=ax_request, rpconfig=self.rpconfig,
+            approved_data=approved_data)
         # True because fullname required
         self.assertTrue(form1.check_test('fullname'))
         # False because email previously disapproved
@@ -553,17 +470,18 @@
         # Throw in an unrequested field for good measure
         self.assertFalse(form2.check_test('language'))
 
-    def test_checkbox_status_for_untrusted_site(self):
+    def test_ax_checkbox_status_for_untrusted_site(self):
         """Checkboxes are only checked on untrusted site requests if the field
         is required
         """
-        fetch_request = FetchRequest()
-        fetch_request.add(
+        ax_request = FetchRequest()
+        ax_request.add(
             AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
-        fetch_request.add(
+        ax_request.add(
             AttrInfo(AX_URI_EMAIL, alias='email', required=False))
-        form = AXFetchRequestForm(self._get_request_with_post_args(),
-                                  fetch_request, None)
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=None, ax_request=ax_request, rpconfig=None)
         # True because fullname required
         self.assertTrue(form.check_test('fullname'))
         # False because untrusted site and no previous approval
@@ -571,21 +489,22 @@
         # Throw in an unrequested field for good measure
         self.assertFalse(form.check_test('language'))
 
-    def test_checkbox_status_for_untrusted_site_with_approved_data(self):
+    def test_ax_checkbox_status_for_untrusted_site_with_approved_data(self):
         """If the user has previously approved sending data to an untrusted
         site the same checkbox settings should be returned on the next request.
         """
         approved_data = {
             'requested': ['fullname', 'email'],
             'approved': ['email', 'language']}
-        fetch_request = FetchRequest()
-        fetch_request.add(
+        ax_request = FetchRequest()
+        ax_request.add(
             AttrInfo(AX_URI_FULL_NAME, alias='fullname', required=True))
-        fetch_request.add(
+        ax_request.add(
             AttrInfo(AX_URI_EMAIL, alias='email', required=False))
-        form = AXFetchRequestForm(self._get_request_with_post_args(),
-                                  fetch_request, None,
-                                  approved_data=approved_data)
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=None, ax_request=ax_request, rpconfig=None,
+            approved_data=approved_data)
         # False because untrusted site and previously disapproved
         self.assertFalse(form.check_test('fullname'))
         # True because previously approved
@@ -593,6 +512,115 @@
         # Throw in an unrequested, previously-approved field for good measure
         self.assertFalse(form.check_test('language'))
 
+    def test_sreg_optional_fields_for_trusted_site(self):
+        """The server should return values for optional fields to trusted
+        sites only when the user checks the checkbox in the UI.
+        """
+        self.rpconfig.allowed_user_attribs = 'fullname,email'
+        post_args = {'email': 'email'}
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(post_args),
+            sreg_request=SRegRequest(optional=['fullname', 'email']),
+            ax_request=None, rpconfig=self.rpconfig)
+        self.assertFalse('fullname' in form.data_approved_for_request)
+        self.assertTrue('email' in form.data_approved_for_request)
+
+    def test_sreg_required_fields_for_untrusted_site(self):
+        """The server should return values for required fields to untrusted
+        sites only when the user checks the checkbox in the UI.
+        """
+        post_args = {'email': 'email'}
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(post_args),
+            sreg_request=SRegRequest(required=['fullname', 'email']),
+            ax_request=None, rpconfig=None)
+        self.assertFalse('fullname' in form.data_approved_for_request)
+        self.assertTrue('email' in form.data_approved_for_request)
+
+    def test_sreg_optional_fields_for_untrusted_site(self):
+        """The server should return values for optional fields to untrusted
+        sites only when the user checks the checkbox in the UI.
+        """
+        post_args = {'fullname': 'fullname'}
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(post_args),
+            sreg_request=SRegRequest(optional=['fullname', 'email']),
+            ax_request=None, rpconfig=None)
+        self.assertTrue('fullname' in form.data_approved_for_request)
+        self.assertFalse('email' in form.data_approved_for_request)
+
+    def test_sreg_checkbox_status_for_trusted_site(self):
+        """Checkboxes are always checked if the site is trusted
+        """
+        self.rpconfig.allowed_user_attribs = 'fullname,email'
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=SRegRequest(
+                required=['fullname'], optional=['email']),
+            ax_request=None, rpconfig=self.rpconfig)
+        # Checked (and disabled) because fullname is required
+        self.assertTrue(form.check_test('fullname'))
+        # Checked (and togglable) because this is a known trust root
+        self.assertTrue(form.check_test('email'))
+
+    def test_sreg_checkbox_status_for_trusted_site_with_approved_data(self):
+        """If the user has previously approved sending data to a trusted site
+        the same checkbox settings should be returned on the next request
+        unless those conflict with the required fields.
+        """
+        self.rpconfig.allowed_user_attribs = 'fullname,email'
+        approved_data = {
+            'requested': ['fullname', 'email'],
+            'approved': ['email']}
+        form1 = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=SRegRequest(
+                required=['fullname'], optional=['email']),
+            ax_request=None, rpconfig=self.rpconfig,
+            approved_data=approved_data)
+        self.assertTrue(form1.check_test('fullname'))
+        self.assertTrue(form1.check_test('email'))
+
+        approved_data['approved'] = []
+        form2 = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=SRegRequest(
+                required=['fullname'], optional=['email']),
+            ax_request=None, rpconfig=self.rpconfig,
+            approved_data=approved_data)
+        # Checked (and disabled) because fullname is required
+        self.assertTrue(form2.check_test('fullname'))
+        # Unchecked (and togglable) because email is optional and the user
+        # previously disapproved it
+        self.assertFalse(form2.check_test('email'))
+
+    def test_sreg_checkbox_status_for_untrusted_site(self):
+        """Checkboxes are only checked on untrusted site requests if the field
+        is required
+        """
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=SRegRequest(
+                required=['fullname'], optional=['email']),
+            ax_request=None, rpconfig=None)
+        self.assertTrue(form.check_test('fullname'))
+        self.assertFalse(form.check_test('email'))
+
+    def test_sreg_checkbox_status_for_untrusted_site_with_approved_data(self):
+        """If the user has previously approved sending data to an untrusted
+        site the same checkbox settings should be returned on the next request.
+        """
+        approved_data = {
+            'requested': ['fullname', 'email'],
+            'approved': ['email']}
+        form = UserAttribsRequestForm(
+            request=self._get_request_with_post_args(),
+            sreg_request=SRegRequest(
+                required=['fullname'], optional=['email']),
+            ax_request=None, rpconfig=None, approved_data=approved_data)
+        self.assertFalse(form.check_test('fullname'))
+        self.assertTrue(form.check_test('email'))
+
 
 class TeamsRequestFormTestCase(SSOBaseTestCase):
 
@@ -705,7 +733,7 @@
         self.assertFalse(form2.check_test('ubuntu-team'))
 
 
-class TokenForrmTest(SSOBaseTestCase):
+class TokenFormTest(SSOBaseTestCase):
 
     def test_confirmation_code_error(self):
         data = {'confirmation_code': 'BOGUS', 'email': '[e-mail]'}

=== modified file 'identityprovider/tests/test_views_server.py'
--- identityprovider/tests/test_views_server.py	2013-04-17 15:44:15 +0000
+++ identityprovider/tests/test_views_server.py	2013-05-01 15:39:26 +0000
@@ -170,7 +170,7 @@
     def test_handle_user_response_ax_openid_is_authorized_idselect(self):
         # update rp to auto authorize
         self.rpconfig.auto_authorize = True
-        self.rpconfig.allowed_ax = 'fullname,email,account_verified'
+        self.rpconfig.allowed_user_attribs = 'fullname,email,account_verified'
         self.rpconfig.save()
 
         self.client.login(username=self.email, password=DEFAULT_USER_PASSWORD)
@@ -210,7 +210,7 @@
     def _test_auto_auth(self):
         # update rp to auto authorize
         self.rpconfig.auto_authorize = True
-        self.rpconfig.allowed_ax = 'fullname,email,account_verified'
+        self.rpconfig.allowed_user_attribs = 'fullname,email,account_verified'
         self.rpconfig.save()
 
         self.client.login(username=self.email, password=DEFAULT_USER_PASSWORD)
@@ -225,8 +225,6 @@
         })
         response = self.client.post(self.url, self.params)
         self.assertEqual('text/html', response['Content-type'].split(';')[0])
-        self.assertContains(response, 'assoc_handle')
-        self.assertContains(response, 'openid.sig')
         dom = PyQuery(response.content)
         root = dom.root.getroot()
         self.assertEqual('html', root.tag)
@@ -244,6 +242,8 @@
         )
         for k, v in expected_fields:
             self.assertEqual(v, forms[0].fields[k])
+        for k in ('openid.assoc_handle', 'openid.sig'):
+            self.assertIn(k, forms[0].fields)
 
     def test_handle_user_response_openid_is_authorized_idselect(self):
         # update rp to auto authorize
@@ -598,9 +598,9 @@
         # no extra check is needed
         server._check_team_membership(request, self.orequest, oresponse)
 
-    def test_only_ax_or_sreg_form_is_displayed(self):
-        """Even if both SReg and AX requests are present, only display the AX
-        form."""
+    def test_ax_and_sreg_fields_are_merged(self):
+        """If both SReg and AX requests are present, only display one set of
+        fields."""
         team_name = 'ubuntu-team'
         team = self.factory.make_team(name=team_name)
         self.factory.add_account_to_team(self.account, team)
@@ -608,8 +608,7 @@
         # create a trusted rpconfig
         rpconfig = OpenIDRPConfig(
             trust_root='http://localhost/',
-            allowed_sreg='fullname,email',
-            allowed_ax='fullname,email,account_verified',
+            allowed_user_attribs='fullname,email,account_verified',
             can_query_any_team=True,
             description="Some description",
         )
@@ -628,8 +627,8 @@
         self._prepare_openid_token(param_overrides=param_overrides)
         response = self.client.get('/%s/+decide' % self.token)
         dom = PyQuery(response.content)
-        self.assertEqual(len(dom.find('li.ax')), 3)
-        self.assertEqual(len(dom.find('li.sreg')), 0)
+        # Only 3 fields, because language isn't allowed by the rpconfig
+        self.assertEqual(len(dom.find('li.user_attribs')), 3)
 
     def test_list_of_details_is_complete_with_sreg(self):
         team_name = 'ubuntu-team'
@@ -639,7 +638,7 @@
         # create a trusted rpconfig
         OpenIDRPConfig.objects.create(
             trust_root='http://localhost/',
-            allowed_sreg='fullname,email,language',
+            allowed_user_attribs='fullname,email,language',
             can_query_any_team=True,
             description="Some description",
         )
@@ -662,7 +661,7 @@
         # create a trusted rpconfig
         rpconfig = OpenIDRPConfig(
             trust_root='http://localhost/',
-            allowed_ax='fullname,email,account_verified',
+            allowed_user_attribs='fullname,email,account_verified',
             can_query_any_team=True,
             description="Some description",
         )
@@ -747,7 +746,7 @@
         # create a trusted rpconfig
         OpenIDRPConfig.objects.create(
             trust_root='http://localhost/',
-            allowed_sreg='nickname,email,language',
+            allowed_user_attribs='nickname,email,language',
             can_query_any_team=True,
             description="Some description",
         )
@@ -759,7 +758,7 @@
         self._prepare_openid_token(param_overrides=param_overrides)
         response = self.client.get(self.url)
         dom = PyQuery(response.content)
-        self.assertEqual(len(dom.find('li.sreg')), 3)
+        self.assertEqual(len(dom.find('li.user_attribs')), 3)
 
         nickname = self.account.person.name
         self._test_required_trusted_field(dom, field='nickname',
@@ -784,7 +783,7 @@
         # create a trusted rpconfig
         rpconfig = OpenIDRPConfig(
             trust_root='http://localhost/',
-            allowed_ax='nickname,email,language,account_verified',
+            allowed_user_attribs='nickname,email,language,account_verified',
             can_query_any_team=True,
             description="Some description",
         )
@@ -803,7 +802,7 @@
         self._prepare_openid_token(param_overrides=param_overrides)
         response = self.client.get('/%s/+decide' % self.token)
         dom = PyQuery(response.content)
-        self.assertEqual(len(dom.find('li.ax')), 3)
+        self.assertEqual(len(dom.find('li.user_attribs')), 3)
 
         self._test_required_trusted_field(dom, field='email',
                                           label='Email address',
@@ -838,7 +837,7 @@
         self._prepare_openid_token(param_overrides=param_overrides)
         response = self.client.get(self.url)
         dom = PyQuery(response.content)
-        self.assertEqual(len(dom.find('li.sreg')), 4)
+        self.assertEqual(len(dom.find('li.user_attribs')), 4)
 
         nickname = self.account.person.name
         self._test_required_untrusted_field(dom, field='nickname',
@@ -885,7 +884,7 @@
         self._prepare_openid_token(param_overrides=param_overrides)
         response = self.client.get('/%s/+decide' % self.token)
         dom = PyQuery(response.content)
-        self.assertEqual(len(dom.find('li.ax')), 4)
+        self.assertEqual(len(dom.find('li.user_attribs')), 4)
 
         fullname = self.account.get_full_name()
         self._test_required_untrusted_field(dom, field='fullname',
@@ -1676,11 +1675,10 @@
             self._get_request_with_post_args(post_args),
             self._get_openid_request(with_sreg=True, with_ax=False,
                                      with_teams=False))
-        self.assertEqual(sorted(result['sreg']['requested']),
+        self.assertEqual(sorted(result['user_attribs']['requested']),
                          ['email', 'fullname'])
-        self.assertEqual(result['sreg']['approved'], ['email'])
+        self.assertEqual(result['user_attribs']['approved'], ['email'])
         self.assertNotIn('teams', result)
-        self.assertNotIn('ax', result)
 
     def test_approved_data_for_ax_only(self):
         post_args = {'email': 'email', 'ubuntu-team': 'ubuntu-team'}
@@ -1688,10 +1686,9 @@
             self._get_request_with_post_args(post_args),
             self._get_openid_request(with_sreg=False, with_ax=True,
                                      with_teams=False))
-        self.assertEqual(sorted(result['ax']['requested']),
+        self.assertEqual(sorted(result['user_attribs']['requested']),
                          ['email', 'fullname'])
-        self.assertEqual(result['ax']['approved'], ['email'])
-        self.assertNotIn('sreg', result)
+        self.assertEqual(result['user_attribs']['approved'], ['email'])
         self.assertNotIn('teams', result)
 
     def test_approved_data_for_teams_only(self):
@@ -1702,8 +1699,7 @@
                                      with_teams=True))
         self.assertEqual(result['teams']['requested'], ['ubuntu-team'])
         self.assertEqual(result['teams']['approved'], ['ubuntu-team'])
-        self.assertNotIn('ax', result)
-        self.assertNotIn('sreg', result)
+        self.assertNotIn('user_attribs', result)
 
     def test_approved_data_for_sreg_and_teams(self):
         post_args = {'email': 'email', 'ubuntu-team': 'ubuntu-team'}
@@ -1711,12 +1707,11 @@
             self._get_request_with_post_args(post_args),
             self._get_openid_request(with_sreg=True, with_ax=False,
                                      with_teams=True))
-        self.assertEqual(sorted(result['sreg']['requested']),
+        self.assertEqual(sorted(result['user_attribs']['requested']),
                          ['email', 'fullname'])
-        self.assertEqual(result['sreg']['approved'], ['email'])
+        self.assertEqual(result['user_attribs']['approved'], ['email'])
         self.assertEqual(result['teams']['requested'], ['ubuntu-team'])
         self.assertEqual(result['teams']['approved'], ['ubuntu-team'])
-        self.assertNotIn('ax', result)
 
     def test_approved_data_for_ax_and_teams(self):
         post_args = {'email': 'email', 'ubuntu-team': 'ubuntu-team'}
@@ -1724,12 +1719,11 @@
             self._get_request_with_post_args(post_args),
             self._get_openid_request(with_sreg=False, with_ax=True,
                                      with_teams=True))
-        self.assertEqual(sorted(result['ax']['requested']),
+        self.assertEqual(sorted(result['user_attribs']['requested']),
                          ['email', 'fullname'])
-        self.assertEqual(result['ax']['approved'], ['email'])
+        self.assertEqual(result['user_attribs']['approved'], ['email'])
         self.assertEqual(result['teams']['requested'], ['ubuntu-team'])
         self.assertEqual(result['teams']['approved'], ['ubuntu-team'])
-        self.assertNotIn('sreg', result)
 
 
 class TokenLoginTestCase(SSOBaseTestCase):

=== modified file 'identityprovider/views/server.py'
--- identityprovider/views/server.py	2013-04-17 15:25:21 +0000
+++ identityprovider/views/server.py	2013-05-01 15:39:26 +0000
@@ -69,10 +69,9 @@
     LAUNCHPAD_TEAMS_NS,
 )
 from identityprovider.forms import (
-    AXFetchRequestForm,
     PreAuthorizeForm,
-    SRegRequestForm,
     TeamsRequestForm,
+    UserAttribsRequestForm,
 )
 
 from identityprovider.middleware.xrds import XRDSMiddleware
@@ -177,8 +176,7 @@
                     True, identity=request.user.openid_identity_url)
             else:
                 oresponse = orequest.answer(True)
-            _add_sreg(request, orequest, oresponse)
-            _add_ax(request, orequest, oresponse)
+            _add_user_attribs(request, orequest, oresponse)
             _check_team_membership(request, orequest, oresponse,
                                    immediate=True)
             response = _django_response(request, oresponse, True)
@@ -199,8 +197,7 @@
                 True, identity=request.user.openid_identity_url)
         else:
             oresponse = orequest.answer(True)
-        _add_sreg(request, orequest, oresponse)
-        _add_ax(request, orequest, oresponse)
+        _add_user_attribs(request, orequest, oresponse)
         _check_team_membership(request, orequest, oresponse, immediate=True)
         response = _django_response(request, oresponse, True)
     elif (twofactor.is_authenticated(request) and not
@@ -299,19 +296,16 @@
     except OpenIDRPSummary.DoesNotExist:
         approved_data = {}
 
-    ax_form = (AXFetchRequestForm(
-        request, ax_request, rpconfig, approved_data=approved_data.get('ax'))
-        if ax_request else None)
-    sreg_form = SRegRequestForm(request, sreg_request, rpconfig,
-                                approved_data=approved_data.get('sreg'))
+    user_attribs_form = UserAttribsRequestForm(
+        request, sreg_request, ax_request, rpconfig,
+        approved_data=approved_data.get('user_attribs'))
     teams_form = TeamsRequestForm(request, teams_request, rpconfig,
                                   approved_data=approved_data.get('teams'))
     context = RequestContext(request, {
         'account': request.user,
         'trust_root': orequest.trust_root,
         'rpconfig': rpconfig,
-        'ax_form': ax_form,
-        'sreg_form': sreg_form,
+        'user_attribs_form': user_attribs_form,
         'teams_form': teams_form,
         'token': token,
         'sane_trust_root': _request_has_sane_trust_root(orequest)
@@ -568,19 +562,14 @@
     rpconfig = utils.get_rpconfig(orequest.trust_root)
 
     sreg_request = SRegRequest.fromOpenIDRequest(orequest)
-    sreg_form = SRegRequestForm(request, sreg_request, rpconfig)
-    if sreg_form.has_data:
-        approved_data['sreg'] = {
-            'requested': sreg_form.data.keys(),
-            'approved': sreg_form.data_approved_for_request.keys()}
-
     ax_request = ax.FetchRequest.fromOpenIDRequest(orequest)
-    if ax_request:
-        ax_form = AXFetchRequestForm(request, ax_request, rpconfig)
-        if ax_form.has_data:
-            approved_data['ax'] = {
-                'requested': ax_form.data.keys(),
-                'approved': ax_form.data_approved_for_request.keys()}
+
+    user_attribs_form = UserAttribsRequestForm(
+        request, sreg_request, ax_request, rpconfig)
+    if user_attribs_form.has_data:
+        approved_data['user_attribs'] = {
+            'requested': user_attribs_form.data.keys(),
+            'approved': user_attribs_form.data_approved_for_request.keys()}
 
     args = orequest.message.getArgs(LAUNCHPAD_TEAMS_NS)
     team_names = args.get('query_membership')
@@ -607,27 +596,21 @@
     return ret
 
 
-def _add_sreg(request, openid_request, openid_response):
-    # Add sreg result data
+def _add_user_attribs(request, openid_request, openid_response):
+    # Add ax and sreg result data
     sreg_request = SRegRequest.fromOpenIDRequest(openid_request)
+    ax_request = ax.FetchRequest.fromOpenIDRequest(openid_request)
     rpconfig = utils.get_rpconfig(openid_request.trust_root)
-    form = SRegRequestForm(request, sreg_request, rpconfig)
+    form = UserAttribsRequestForm(
+        request, sreg_request, ax_request, rpconfig)
     if form.data_approved_for_request:
         sreg_response = SRegResponse.extractResponse(
             sreg_request, form.data_approved_for_request)
         openid_response.addExtension(sreg_response)
-
-
-def _add_ax(request, openid_request, openid_response):
-    ax_request = ax.FetchRequest.fromOpenIDRequest(openid_request)
-    if ax_request:
-        rpconfig = utils.get_rpconfig(openid_request.trust_root)
-        form = AXFetchRequestForm(request, ax_request, rpconfig)
-        if form.data_approved_for_request:
-            ax_response = ax.FetchResponse(ax_request)
-            for k, v in form.data_approved_for_request.iteritems():
-                ax_response.addValue(AX_DATA_FIELDS.getNamespaceURI(k), v)
-            openid_response.addExtension(ax_response)
+        ax_response = ax.FetchResponse(ax_request)
+        for k, v in form.data_approved_for_request.iteritems():
+            ax_response.addValue(AX_DATA_FIELDS.getNamespaceURI(k), v)
+        openid_response.addExtension(ax_response)
 
 
 def _process_decide(request, orequest, decision):
@@ -646,8 +629,7 @@
             request.user,
             orequest.trust_root,
             client_id=request.session.session_key)
-        _add_sreg(request, orequest, oresponse)
-        _add_ax(request, orequest, oresponse)
+        _add_user_attribs(request, orequest, oresponse)
         # if there's no submitted POST data, this is an auto-authorized
         # (immediate) request
         immediate = not request.POST