Class: OpenID::Consumer

Inherits:
Object
  • Object
show all
Includes:
OpenID
Defined in:
lib/openid/consumer.rb

Overview

class SimpleHTTPClient

Constant Summary

Constants included from OpenID

DEFAULT_DH_GEN, DEFAULT_DH_MODULUS, SECRET_SIZES

Instance Method Summary collapse

Methods included from OpenID

#append_args, #error_page, #from_btwoc, #normalize_url, #parse_kv, #parse_link_attrs, #quote_minimal, #redirect, #response_page, #sign_reply, #url_encode

Constructor Details

#initialize(http_client = SimpleHTTPClient.new(), association_manager = DumbAssociationManager.new()) ⇒ Consumer

Takes an http_client and an association_manager. Will create some automatically if none are passed in.



63
64
65
66
 
# File 'lib/openid/consumer.rb', line 63

def initialize(http_client = SimpleHTTPClient.new(), association_manager = DumbAssociationManager.new())
	@http_client = http_client
	@association_manager = association_manager
end

Instance Method Details

#_dumb_auth(server_url, now, req) ⇒ Object 



140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
 
# File 'lib/openid/consumer.rb', line 140

def _dumb_auth(server_url, now, req)
	if !verify_return_to(req)
		raise ValueMismatchError, "return_to is not valid", caller
	end
	check_args = {}
	req.args.each { |k, v| check_args[k] = v if k.index('openid.') == 0 }
	check_args['openid.mode'] = 'check_authentication'
	body = url_encode(check_args)
	url, data = @http_client.post(server_url, body)
	results = parse_kv(data)
	lifetime = results['lifetime'].to_i
	if lifetime
		invalidate_handle = results['invalidate_handle']
		if invalidate_handle
			@association_manager.invalidate(server_url, invalidate_handle)
		end
		return now + lifetime
	else
		raise ValueMismatchError, 'Server failed to validate signature', caller
	end
end

#determine_server_url(req) ⇒ Object 



110
111
112
113
114
115
116
 
# File 'lib/openid/consumer.rb', line 110

def determine_server_url(req)
	identity, server_url = find_server(req['identity'])
	if req['identity'] != identity
		raise ValueMismatchError, "ID URL #{req['identity']} seems to have moved: #{identity}", caller
	end
	return server_url
end

#do_cancel(req) ⇒ Object

Raises:



191
192
193
 
# File 'lib/openid/consumer.rb', line 191

def do_cancel(req)
	raise UserCancelled
end

#do_error(req) ⇒ Object

Handle an error from the server



182
183
184
185
186
187
188
189
 
# File 'lib/openid/consumer.rb', line 182

def do_error(req)
	error = req.get('error')
	if error
		raise ProtocolError, "Server Response: #{error}", caller
	else
		raise ProtocolError, "Unspecified Server Error: #{req.args}", caller
	end
end

#do_id_res(req) ⇒ Object

Raises:



162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
 
# File 'lib/openid/consumer.rb', line 162

def do_id_res(req)
	now = Time.now
	user_setup_url = req.get('user_setup_url')
	raise UserSetupNeeded, user_setup_url, caller if user_setup_url
	server_url = determine_server_url(req)
	assoc = @association_manager.get_association(server_url, req['assoc_handle'])
	if assoc == nil
		return _dumb_auth(server_url, now, req)
	end
	sig = req.get('sig')
	signed_fields = req.get('signed').strip.split(',')
	signed, v_sig = sign_reply(req.args, assoc.secret, signed_fields)
	if v_sig != sig
		raise ValueMismatchError, "Signatures did not match: #{req.args}, #{v_sig}, #{assoc.secret}", caller
	end
	issued = DateTime.strptime(req.get('issued')).to_time
	valid_to = [assoc.expiry, DateTime.strptime(req.get('valid_to')).to_time].min
	return now + (valid_to - issued)
end

#find_server(url) ⇒ Object

Returns identity_url, server_url or nil if no server is found.



119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
 
# File 'lib/openid/consumer.rb', line 119

def find_server(url)
	identity, data = @http_client.get(url)
	identity = identity.to_s
	server = nil
	delegate = nil
	parse_link_attrs(data) { |link|
		rel = link['rel']
		if rel == 'openid.server' and server == nil
			href = link['href']
			server = href if href
		end
		if rel == 'openid.delegate' and delegate == nil
			href = link['href']
			delegate = href if href
		end
	}
	return nil if !server
	identity = delegate if delegate
	return normalize_url(identity), normalize_url(server)
end

#handle_request(url, return_to, trust_root = nil, immediate = false) ⇒ Object

Returns the url to redirect to or nil if no identity is found



68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
 
# File 'lib/openid/consumer.rb', line 68

def handle_request(url, return_to, trust_root = nil, immediate = false)
	url = normalize_url(url)
	
	server_info = find_server(url)
	return nil if server_info == nil
	identity, server_url = server_info
	redir_args = { 'openid.identity' => identity, 'openid.return_to' => return_to}
	
	redir_args['openid.trust_root'] = trust_root if trust_root
	
	if immediate
		mode = 'checkid_immediate'
	else
		mode = 'checkid_setup'
	end
	
	redir_args['openid.mode'] = mode
	assoc_handle = @association_manager.associate(server_url)
	if assoc_handle
		redir_args['openid.assoc_handle'] = assoc_handle
	end
	
	return append_args(server_url, redir_args).to_s
end

#handle_response(req) ⇒ Object

Handles an OpenID GET request with openid.mode in the arguments. req should be a Request instance, properly initialized with the http arguments given, and the http method used to make the request. Returns the expiry time of the session as a Time.

Will raise a ProtocolError if the http_method is not GET, or the request mode is unknown.



99
100
101
102
103
104
105
106
107
108
 
# File 'lib/openid/consumer.rb', line 99

def handle_response(req)
	if req.http_method != 'GET'
		raise ProtocolError, "Expected HTTP Method 'GET', got #{req.http_method}", caller
	end
	begin
		return __send__('do_' + req['mode'], req)
	rescue NoMethodError
		raise ProtocolError, "Unknown Mode: #{req['mode']}", caller
	end
end

#verify_return_to(req) ⇒ Object

This is called before the consumer makes a check_authentication call to the server. It can be used to verify that the request being authenticated is valid by confirming that the openid.return_to value signed by the server corresponds to this consumer. The full OpenID::Request object is passed in. Should return true if the return_to field corresponds to this consumer, false otherwise. The default function performs no check and returns true.



201
202
203
 
# File 'lib/openid/consumer.rb', line 201

def verify_return_to(req)
	return true	
end