verify_discovery_single (OpenID::Consumer::IdResHandler)

    # File lib/openid/consumer/idres.rb, line 460
          def verify_discovery_single(endpoint, to_match)
            # Every type URI that's in the to_match endpoint has to be
            # present in the discovered endpoint.
            for type_uri in to_match.type_uris
              if !endpoint.uses_extension(type_uri)
                raise TypeURIMismatch.new(type_uri, endpoint)
              end
            end

            # Fragments do not influence discovery, so we can't compare a
            # claimed identifier with a fragment to discovered information.
            defragged_claimed_id =
              case Yadis::XRI.identifier_scheme(to_match.claimed_id)
              when :xri
                to_match.claimed_id
              when :uri
                begin
                  parsed = URI.parse(to_match.claimed_id)
                rescue URI::InvalidURIError
                  to_match.claimed_id
                else
                  parsed.fragment = nil
                  parsed.to_s
                end
              else
                raise StandardError, 'Not reached'
              end

            if defragged_claimed_id != endpoint.claimed_id
              raise ProtocolError, ("Claimed ID does not match (different "\
                                    "subjects!), Expected "\
                                    "#{defragged_claimed_id}, got "\
                                    "#{endpoint.claimed_id}")
            end

            if to_match.get_local_id != endpoint.get_local_id
              raise ProtocolError, ("local_id mismatch. Expected "\
                                    "#{to_match.get_local_id}, got "\
                                    "#{endpoint.get_local_id}")
            end

            # If the server URL is nil, this must be an OpenID 1
            # response, because op_endpoint is a required parameter in
            # OpenID 2. In that case, we don't actually care what the
            # discovered server_url is, because signature checking or
            # check_auth should take care of that check for us.
            if to_match.server_url.nil?
              if to_match.preferred_namespace != OPENID1_NS
                raise StandardError,
                "The code calling this must ensure that OpenID 2 "\
                "responses have a non-none `openid.op_endpoint' and "\
                "that it is set as the `server_url' attribute of the "\
                "`to_match' endpoint."
              end
            elsif to_match.server_url != endpoint.server_url
              raise ProtocolError, ("OP Endpoint mismatch. Expected"\
                                    "#{to_match.server_url}, got "\
                                    "#{endpoint.server_url}")
            end
          end