'Sign a response to a message with an expired handle (using invalidate_handle).
From "Verifying with an Association"::
If an authentication request included an association handle for an
association between the OP and the Relying party, and the OP no
longer wishes to use that handle (because it has expired or the
secret has been compromised, for instance), the OP will send a
response that must be verified directly with the OP, as specified
in Section 11.3.2. In that instance, the OP will include the field
"openid.invalidate_handle" set to the association handle that the
Relying Party included with the original request.'

def test_signExpired(self):

    request = server.OpenIDRequest()
    request.namespace = OPENID2_NS
    assoc_handle = '{assoc}{lookatme}'
    self.store.storeAssociation(self._normal_key, association.Association.fromExpiresIn((-10), assoc_handle, 'sekrit', 'HMAC-SHA1'))
    self.failUnless(self.store.getAssociation(self._normal_key, assoc_handle))
    request.assoc_handle = assoc_handle
    response = server.OpenIDResponse(request)
    response.fields = Message.fromOpenIDArgs({'foo': 'amsigned', 'bar': 'notsigned', 'azu': 'alsosigned'})
    sresponse = self.signatory.sign(response)
    new_assoc_handle = sresponse.fields.getArg(OPENID_NS, 'assoc_handle')
    self.failUnless(new_assoc_handle)
    self.failIfEqual(new_assoc_handle, assoc_handle)
    self.failUnlessEqual(sresponse.fields.getArg(OPENID_NS, 'invalidate_handle'), assoc_handle)
    self.failUnlessEqual(sresponse.fields.getArg(OPENID_NS, 'signed'), 'assoc_handle,azu,bar,foo,invalidate_handle,signed')
    self.failUnless(sresponse.fields.getArg(OPENID_NS, 'sig'))
    self.failIf(self.store.getAssociation(self._normal_key, assoc_handle), 'expired    association    is    still    retrievable.')
    self.failUnless(self.store.getAssociation(self._dumb_key, new_assoc_handle))
    self.failIf(self.store.getAssociation(self._normal_key, new_assoc_handle))
    self.failUnless(self.messages)
