diff options
Diffstat (limited to 'models/Auth.old/OpenID/Server.php')
| -rw-r--r-- | models/Auth.old/OpenID/Server.php | 1698 |
1 files changed, 0 insertions, 1698 deletions
diff --git a/models/Auth.old/OpenID/Server.php b/models/Auth.old/OpenID/Server.php deleted file mode 100644 index 0d91769ad..000000000 --- a/models/Auth.old/OpenID/Server.php +++ /dev/null @@ -1,1698 +0,0 @@ -<?php - -/** - * OpenID server protocol and logic. - * - * Overview - * - * An OpenID server must perform three tasks: - * - * 1. Examine the incoming request to determine its nature and validity. - * 2. Make a decision about how to respond to this request. - * 3. Format the response according to the protocol. - * - * The first and last of these tasks may performed by the {@link - * Auth_OpenID_Server::decodeRequest()} and {@link - * Auth_OpenID_Server::encodeResponse} methods. Who gets to do the - * intermediate task -- deciding how to respond to the request -- will - * depend on what type of request it is. - * - * If it's a request to authenticate a user (a 'checkid_setup' or - * 'checkid_immediate' request), you need to decide if you will assert - * that this user may claim the identity in question. Exactly how you - * do that is a matter of application policy, but it generally - * involves making sure the user has an account with your system and - * is logged in, checking to see if that identity is hers to claim, - * and verifying with the user that she does consent to releasing that - * information to the party making the request. - * - * Examine the properties of the {@link Auth_OpenID_CheckIDRequest} - * object, and if and when you've come to a decision, form a response - * by calling {@link Auth_OpenID_CheckIDRequest::answer()}. - * - * Other types of requests relate to establishing associations between - * client and server and verifing the authenticity of previous - * communications. {@link Auth_OpenID_Server} contains all the logic - * and data necessary to respond to such requests; just pass it to - * {@link Auth_OpenID_Server::handleRequest()}. - * - * OpenID Extensions - * - * Do you want to provide other information for your users in addition - * to authentication? Version 1.2 of the OpenID protocol allows - * consumers to add extensions to their requests. For example, with - * sites using the Simple Registration - * Extension - * (http://www.openidenabled.com/openid/simple-registration-extension/), - * a user can agree to have their nickname and e-mail address sent to - * a site when they sign up. - * - * Since extensions do not change the way OpenID authentication works, - * code to handle extension requests may be completely separate from - * the {@link Auth_OpenID_Request} class here. But you'll likely want - * data sent back by your extension to be signed. {@link - * Auth_OpenID_ServerResponse} provides methods with which you can add - * data to it which can be signed with the other data in the OpenID - * signature. - * - * For example: - * - * <pre> // when request is a checkid_* request - * $response = $request->answer(true); - * // this will a signed 'openid.sreg.timezone' parameter to the response - * response.addField('sreg', 'timezone', 'America/Los_Angeles')</pre> - * - * Stores - * - * The OpenID server needs to maintain state between requests in order - * to function. Its mechanism for doing this is called a store. The - * store interface is defined in Interface.php. Additionally, several - * concrete store implementations are provided, so that most sites - * won't need to implement a custom store. For a store backed by flat - * files on disk, see {@link Auth_OpenID_FileStore}. For stores based - * on MySQL, SQLite, or PostgreSQL, see the {@link - * Auth_OpenID_SQLStore} subclasses. - * - * Upgrading - * - * The keys by which a server looks up associations in its store have - * changed in version 1.2 of this library. If your store has entries - * created from version 1.0 code, you should empty it. - * - * PHP versions 4 and 5 - * - * LICENSE: See the COPYING file included in this distribution. - * - * @package OpenID - * @author JanRain, Inc. <openid@janrain.com> - * @copyright 2005 Janrain, Inc. - * @license http://www.gnu.org/copyleft/lesser.html LGPL - */ - -/** - * Required imports - */ -require_once "Auth/OpenID.php"; -require_once "Auth/OpenID/Association.php"; -require_once "Auth/OpenID/CryptUtil.php"; -require_once "Auth/OpenID/BigMath.php"; -require_once "Auth/OpenID/DiffieHellman.php"; -require_once "Auth/OpenID/KVForm.php"; -require_once "Auth/OpenID/TrustRoot.php"; -require_once "Auth/OpenID/ServerRequest.php"; -require_once "Auth/OpenID/Message.php"; -require_once "Auth/OpenID/Nonce.php"; - -define('AUTH_OPENID_HTTP_OK', 200); -define('AUTH_OPENID_HTTP_REDIRECT', 302); -define('AUTH_OPENID_HTTP_ERROR', 400); - -/** - * @access private - */ -global $_Auth_OpenID_Request_Modes; -$_Auth_OpenID_Request_Modes = array('checkid_setup', - 'checkid_immediate'); - -/** - * @access private - */ -define('Auth_OpenID_ENCODE_KVFORM', 'kfvorm'); - -/** - * @access private - */ -define('Auth_OpenID_ENCODE_URL', 'URL/redirect'); - -/** - * @access private - */ -define('Auth_OpenID_ENCODE_HTML_FORM', 'HTML form'); - -/** - * @access private - */ -function Auth_OpenID_isError($obj, $cls = 'Auth_OpenID_ServerError') -{ - return is_a($obj, $cls); -} - -/** - * An error class which gets instantiated and returned whenever an - * OpenID protocol error occurs. Be prepared to use this in place of - * an ordinary server response. - * - * @package OpenID - */ -class Auth_OpenID_ServerError { - /** - * @access private - */ - function Auth_OpenID_ServerError($message = null, $text = null, - $reference = null, $contact = null) - { - $this->message = $message; - $this->text = $text; - $this->contact = $contact; - $this->reference = $reference; - } - - function getReturnTo() - { - if ($this->message && - $this->message->hasKey(Auth_OpenID_OPENID_NS, 'return_to')) { - return $this->message->getArg(Auth_OpenID_OPENID_NS, - 'return_to'); - } else { - return false; - } - } - - /** - * Returns the return_to URL for the request which caused this - * error. - */ - function hasReturnTo() - { - return $this->getReturnTo() !== false; - } - - /** - * Encodes this error's response as a URL suitable for - * redirection. If the response has no return_to, another - * Auth_OpenID_ServerError is returned. - */ - function encodeToURL() - { - if (!$this->message) { - return null; - } - - $msg = $this->toMessage(); - return $msg->toURL($this->getReturnTo()); - } - - /** - * Encodes the response to key-value form. This is a - * machine-readable format used to respond to messages which came - * directly from the consumer and not through the user-agent. See - * the OpenID specification. - */ - function encodeToKVForm() - { - return Auth_OpenID_KVForm::fromArray( - array('mode' => 'error', - 'error' => $this->toString())); - } - - function toFormMarkup() - { - $msg = $this->toMessage(); - return $msg->toFormMarkup($this->getReturnTo()); - } - - function toMessage() - { - // Generate a Message object for sending to the relying party, - // after encoding. - $namespace = $this->message->getOpenIDNamespace(); - $reply = new Auth_OpenID_Message($namespace); - $reply->setArg(Auth_OpenID_OPENID_NS, 'mode', 'error'); - $reply->setArg(Auth_OpenID_OPENID_NS, 'error', $this->toString()); - - if ($this->contact !== null) { - $reply->setArg(Auth_OpenID_OPENID_NS, 'contact', $this->contact); - } - - if ($this->reference !== null) { - $reply->setArg(Auth_OpenID_OPENID_NS, 'reference', - $this->reference); - } - - return $reply; - } - - /** - * Returns one of Auth_OpenID_ENCODE_URL, - * Auth_OpenID_ENCODE_KVFORM, or null, depending on the type of - * encoding expected for this error's payload. - */ - function whichEncoding() - { - global $_Auth_OpenID_Request_Modes; - - if ($this->hasReturnTo()) { - if ($this->message->isOpenID2() && - (strlen($this->encodeToURL()) > - Auth_OpenID_OPENID1_URL_LIMIT)) { - return Auth_OpenID_ENCODE_HTML_FORM; - } else { - return Auth_OpenID_ENCODE_URL; - } - } - - if (!$this->message) { - return null; - } - - $mode = $this->message->getArg(Auth_OpenID_OPENID_NS, - 'mode'); - - if ($mode) { - if (!in_array($mode, $_Auth_OpenID_Request_Modes)) { - return Auth_OpenID_ENCODE_KVFORM; - } - } - return null; - } - - /** - * Returns this error message. - */ - function toString() - { - if ($this->text) { - return $this->text; - } else { - return get_class($this) . " error"; - } - } -} - -/** - * Error returned by the server code when a return_to is absent from a - * request. - * - * @package OpenID - */ -class Auth_OpenID_NoReturnToError extends Auth_OpenID_ServerError { - function Auth_OpenID_NoReturnToError($message = null, - $text = "No return_to URL available") - { - parent::Auth_OpenID_ServerError($message, $text); - } - - function toString() - { - return "No return_to available"; - } -} - -/** - * An error indicating that the return_to URL is malformed. - * - * @package OpenID - */ -class Auth_OpenID_MalformedReturnURL extends Auth_OpenID_ServerError { - function Auth_OpenID_MalformedReturnURL($message, $return_to) - { - $this->return_to = $return_to; - parent::Auth_OpenID_ServerError($message, "malformed return_to URL"); - } -} - -/** - * This error is returned when the trust_root value is malformed. - * - * @package OpenID - */ -class Auth_OpenID_MalformedTrustRoot extends Auth_OpenID_ServerError { - function Auth_OpenID_MalformedTrustRoot($message = null, - $text = "Malformed trust root") - { - parent::Auth_OpenID_ServerError($message, $text); - } - - function toString() - { - return "Malformed trust root"; - } -} - -/** - * The base class for all server request classes. - * - * @package OpenID - */ -class Auth_OpenID_Request { - var $mode = null; -} - -/** - * A request to verify the validity of a previous response. - * - * @package OpenID - */ -class Auth_OpenID_CheckAuthRequest extends Auth_OpenID_Request { - var $mode = "check_authentication"; - var $invalidate_handle = null; - - function Auth_OpenID_CheckAuthRequest($assoc_handle, $signed, - $invalidate_handle = null) - { - $this->assoc_handle = $assoc_handle; - $this->signed = $signed; - if ($invalidate_handle !== null) { - $this->invalidate_handle = $invalidate_handle; - } - $this->namespace = Auth_OpenID_OPENID2_NS; - $this->message = null; - } - - function fromMessage($message, $server=null) - { - $required_keys = array('assoc_handle', 'sig', 'signed'); - - foreach ($required_keys as $k) { - if (!$message->getArg(Auth_OpenID_OPENID_NS, $k)) { - return new Auth_OpenID_ServerError($message, - sprintf("%s request missing required parameter %s from \ - query", "check_authentication", $k)); - } - } - - $assoc_handle = $message->getArg(Auth_OpenID_OPENID_NS, 'assoc_handle'); - $sig = $message->getArg(Auth_OpenID_OPENID_NS, 'sig'); - - $signed_list = $message->getArg(Auth_OpenID_OPENID_NS, 'signed'); - $signed_list = explode(",", $signed_list); - - $signed = $message; - if ($signed->hasKey(Auth_OpenID_OPENID_NS, 'mode')) { - $signed->setArg(Auth_OpenID_OPENID_NS, 'mode', 'id_res'); - } - - $result = new Auth_OpenID_CheckAuthRequest($assoc_handle, $signed); - $result->message = $message; - $result->sig = $sig; - $result->invalidate_handle = $message->getArg(Auth_OpenID_OPENID_NS, - 'invalidate_handle'); - return $result; - } - - function answer(&$signatory) - { - $is_valid = $signatory->verify($this->assoc_handle, $this->signed); - - // Now invalidate that assoc_handle so it this checkAuth - // message cannot be replayed. - $signatory->invalidate($this->assoc_handle, true); - $response = new Auth_OpenID_ServerResponse($this); - - $response->fields->setArg(Auth_OpenID_OPENID_NS, - 'is_valid', - ($is_valid ? "true" : "false")); - - if ($this->invalidate_handle) { - $assoc = $signatory->getAssociation($this->invalidate_handle, - false); - if (!$assoc) { - $response->fields->setArg(Auth_OpenID_OPENID_NS, - 'invalidate_handle', - $this->invalidate_handle); - } - } - return $response; - } -} - -/** - * A class implementing plaintext server sessions. - * - * @package OpenID - */ -class Auth_OpenID_PlainTextServerSession { - /** - * An object that knows how to handle association requests with no - * session type. - */ - var $session_type = 'no-encryption'; - var $needs_math = false; - var $allowed_assoc_types = array('HMAC-SHA1', 'HMAC-SHA256'); - - function fromMessage($unused_request) - { - return new Auth_OpenID_PlainTextServerSession(); - } - - function answer($secret) - { - return array('mac_key' => base64_encode($secret)); - } -} - -/** - * A class implementing DH-SHA1 server sessions. - * - * @package OpenID - */ -class Auth_OpenID_DiffieHellmanSHA1ServerSession { - /** - * An object that knows how to handle association requests with - * the Diffie-Hellman session type. - */ - - var $session_type = 'DH-SHA1'; - var $needs_math = true; - var $allowed_assoc_types = array('HMAC-SHA1'); - var $hash_func = 'Auth_OpenID_SHA1'; - - function Auth_OpenID_DiffieHellmanSHA1ServerSession($dh, $consumer_pubkey) - { - $this->dh = $dh; - $this->consumer_pubkey = $consumer_pubkey; - } - - function getDH($message) - { - $dh_modulus = $message->getArg(Auth_OpenID_OPENID_NS, 'dh_modulus'); - $dh_gen = $message->getArg(Auth_OpenID_OPENID_NS, 'dh_gen'); - - if ((($dh_modulus === null) && ($dh_gen !== null)) || - (($dh_gen === null) && ($dh_modulus !== null))) { - - if ($dh_modulus === null) { - $missing = 'modulus'; - } else { - $missing = 'generator'; - } - - return new Auth_OpenID_ServerError($message, - 'If non-default modulus or generator is '. - 'supplied, both must be supplied. Missing '. - $missing); - } - - $lib =& Auth_OpenID_getMathLib(); - - if ($dh_modulus || $dh_gen) { - $dh_modulus = $lib->base64ToLong($dh_modulus); - $dh_gen = $lib->base64ToLong($dh_gen); - if ($lib->cmp($dh_modulus, 0) == 0 || - $lib->cmp($dh_gen, 0) == 0) { - return new Auth_OpenID_ServerError( - $message, "Failed to parse dh_mod or dh_gen"); - } - $dh = new Auth_OpenID_DiffieHellman($dh_modulus, $dh_gen); - } else { - $dh = new Auth_OpenID_DiffieHellman(); - } - - $consumer_pubkey = $message->getArg(Auth_OpenID_OPENID_NS, - 'dh_consumer_public'); - if ($consumer_pubkey === null) { - return new Auth_OpenID_ServerError($message, - 'Public key for DH-SHA1 session '. - 'not found in query'); - } - - $consumer_pubkey = - $lib->base64ToLong($consumer_pubkey); - - if ($consumer_pubkey === false) { - return new Auth_OpenID_ServerError($message, - "dh_consumer_public is not base64"); - } - - return array($dh, $consumer_pubkey); - } - - function fromMessage($message) - { - $result = Auth_OpenID_DiffieHellmanSHA1ServerSession::getDH($message); - - if (is_a($result, 'Auth_OpenID_ServerError')) { - return $result; - } else { - list($dh, $consumer_pubkey) = $result; - return new Auth_OpenID_DiffieHellmanSHA1ServerSession($dh, - $consumer_pubkey); - } - } - - function answer($secret) - { - $lib =& Auth_OpenID_getMathLib(); - $mac_key = $this->dh->xorSecret($this->consumer_pubkey, $secret, - $this->hash_func); - return array( - 'dh_server_public' => - $lib->longToBase64($this->dh->public), - 'enc_mac_key' => base64_encode($mac_key)); - } -} - -/** - * A class implementing DH-SHA256 server sessions. - * - * @package OpenID - */ -class Auth_OpenID_DiffieHellmanSHA256ServerSession - extends Auth_OpenID_DiffieHellmanSHA1ServerSession { - - var $session_type = 'DH-SHA256'; - var $hash_func = 'Auth_OpenID_SHA256'; - var $allowed_assoc_types = array('HMAC-SHA256'); - - function fromMessage($message) - { - $result = Auth_OpenID_DiffieHellmanSHA1ServerSession::getDH($message); - - if (is_a($result, 'Auth_OpenID_ServerError')) { - return $result; - } else { - list($dh, $consumer_pubkey) = $result; - return new Auth_OpenID_DiffieHellmanSHA256ServerSession($dh, - $consumer_pubkey); - } - } -} - -/** - * A request to associate with the server. - * - * @package OpenID - */ -class Auth_OpenID_AssociateRequest extends Auth_OpenID_Request { - var $mode = "associate"; - - function getSessionClasses() - { - return array( - 'no-encryption' => 'Auth_OpenID_PlainTextServerSession', - 'DH-SHA1' => 'Auth_OpenID_DiffieHellmanSHA1ServerSession', - 'DH-SHA256' => 'Auth_OpenID_DiffieHellmanSHA256ServerSession'); - } - - function Auth_OpenID_AssociateRequest(&$session, $assoc_type) - { - $this->session =& $session; - $this->namespace = Auth_OpenID_OPENID2_NS; - $this->assoc_type = $assoc_type; - } - - function fromMessage($message, $server=null) - { - if ($message->isOpenID1()) { - $session_type = $message->getArg(Auth_OpenID_OPENID1_NS, - 'session_type'); - - if ($session_type == 'no-encryption') { - // oidutil.log('Received OpenID 1 request with a no-encryption ' - // 'assocaition session type. Continuing anyway.') - } else if (!$session_type) { - $session_type = 'no-encryption'; - } - } else { - $session_type = $message->getArg(Auth_OpenID_OPENID2_NS, - 'session_type'); - if ($session_type === null) { - return new Auth_OpenID_ServerError($message, - "session_type missing from request"); - } - } - - $session_class = Auth_OpenID::arrayGet( - Auth_OpenID_AssociateRequest::getSessionClasses(), - $session_type); - - if ($session_class === null) { - return new Auth_OpenID_ServerError($message, - "Unknown session type " . - $session_type); - } - - $session = call_user_func(array($session_class, 'fromMessage'), - $message); - if (is_a($session, 'Auth_OpenID_ServerError')) { - return $session; - } - - $assoc_type = $message->getArg(Auth_OpenID_OPENID_NS, - 'assoc_type', 'HMAC-SHA1'); - - if (!in_array($assoc_type, $session->allowed_assoc_types)) { - $fmt = "Session type %s does not support association type %s"; - return new Auth_OpenID_ServerError($message, - sprintf($fmt, $session_type, $assoc_type)); - } - - $obj = new Auth_OpenID_AssociateRequest($session, $assoc_type); - $obj->message = $message; - $obj->namespace = $message->getOpenIDNamespace(); - return $obj; - } - - function answer($assoc) - { - $response = new Auth_OpenID_ServerResponse($this); - $response->fields->updateArgs(Auth_OpenID_OPENID_NS, - array( - 'expires_in' => sprintf('%d', $assoc->getExpiresIn()), - 'assoc_type' => $this->assoc_type, - 'assoc_handle' => $assoc->handle)); - - $response->fields->updateArgs(Auth_OpenID_OPENID_NS, - $this->session->answer($assoc->secret)); - - if ($this->session->session_type != 'no-encryption') { - $response->fields->setArg(Auth_OpenID_OPENID_NS, - 'session_type', - $this->session->session_type); - } - - return $response; - } - - function answerUnsupported($text_message, - $preferred_association_type=null, - $preferred_session_type=null) - { - if ($this->message->isOpenID1()) { - return new Auth_OpenID_ServerError($this->message); - } - - $response = new Auth_OpenID_ServerResponse($this); - $response->fields->setArg(Auth_OpenID_OPENID_NS, - 'error_code', 'unsupported-type'); - $response->fields->setArg(Auth_OpenID_OPENID_NS, - 'error', $text_message); - - if ($preferred_association_type) { - $response->fields->setArg(Auth_OpenID_OPENID_NS, - 'assoc_type', - $preferred_association_type); - } - - if ($preferred_session_type) { - $response->fields->setArg(Auth_OpenID_OPENID_NS, - 'session_type', - $preferred_session_type); - } - - return $response; - } -} - -/** - * A request to confirm the identity of a user. - * - * @package OpenID - */ -class Auth_OpenID_CheckIDRequest extends Auth_OpenID_Request { - /** - * Return-to verification callback. Default is - * Auth_OpenID_verifyReturnTo from TrustRoot.php. - */ - var $verifyReturnTo = 'Auth_OpenID_verifyReturnTo'; - - /** - * The mode of this request. - */ - var $mode = "checkid_setup"; // or "checkid_immediate" - - /** - * Whether this request is for immediate mode. - */ - var $immediate = false; - - /** - * The trust_root value for this request. - */ - var $trust_root = null; - - function make(&$message, $identity, $return_to, $trust_root = null, - $immediate = false, $assoc_handle = null, $server = null) - { - if ($server === null) { - return new Auth_OpenID_ServerError($message, - "server must not be null"); - } - - if ($return_to && - !Auth_OpenID_TrustRoot::_parse($return_to)) { - return new Auth_OpenID_MalformedReturnURL($message, $return_to); - } - - $r = new Auth_OpenID_CheckIDRequest($identity, $return_to, - $trust_root, $immediate, - $assoc_handle, $server); - - $r->namespace = $message->getOpenIDNamespace(); - $r->message =& $message; - - if (!$r->trustRootValid()) { - return new Auth_OpenID_UntrustedReturnURL($message, - $return_to, - $trust_root); - } else { - return $r; - } - } - - function Auth_OpenID_CheckIDRequest($identity, $return_to, - $trust_root = null, $immediate = false, - $assoc_handle = null, $server = null) - { - $this->namespace = Auth_OpenID_OPENID2_NS; - $this->assoc_handle = $assoc_handle; - $this->identity = $identity; - $this->claimed_id = $identity; - $this->return_to = $return_to; - $this->trust_root = $trust_root; - $this->server =& $server; - - if ($immediate) { - $this->immediate = true; - $this->mode = "checkid_immediate"; - } else { - $this->immediate = false; - $this->mode = "checkid_setup"; - } - } - - function equals($other) - { - return ( - (is_a($other, 'Auth_OpenID_CheckIDRequest')) && - ($this->namespace == $other->namespace) && - ($this->assoc_handle == $other->assoc_handle) && - ($this->identity == $other->identity) && - ($this->claimed_id == $other->claimed_id) && - ($this->return_to == $other->return_to) && - ($this->trust_root == $other->trust_root)); - } - - /* - * Does the relying party publish the return_to URL for this - * response under the realm? It is up to the provider to set a - * policy for what kinds of realms should be allowed. This - * return_to URL verification reduces vulnerability to data-theft - * attacks based on open proxies, corss-site-scripting, or open - * redirectors. - * - * This check should only be performed after making sure that the - * return_to URL matches the realm. - * - * @return true if the realm publishes a document with the - * return_to URL listed, false if not or if discovery fails - */ - function returnToVerified() - { - return call_user_func_array($this->verifyReturnTo, - array($this->trust_root, $this->return_to)); - } - - function fromMessage(&$message, $server) - { - $mode = $message->getArg(Auth_OpenID_OPENID_NS, 'mode'); - $immediate = null; - - if ($mode == "checkid_immediate") { - $immediate = true; - $mode = "checkid_immediate"; - } else { - $immediate = false; - $mode = "checkid_setup"; - } - - $return_to = $message->getArg(Auth_OpenID_OPENID_NS, - 'return_to'); - - $namespace = $message->getOpenIDNamespace(); - - if (($namespace == Auth_OpenID_OPENID1_NS) && - (!$return_to)) { - $fmt = "Missing required field 'return_to' from checkid request"; - return new Auth_OpenID_ServerError($message, $fmt); - } - - $identity = $message->getArg(Auth_OpenID_OPENID_NS, - 'identity'); - - if ($identity && $message->isOpenID2()) { - $claimed_id = $message->getArg(Auth_OpenID_OPENID_NS, - 'claimed_id'); - if (!$claimed_id) { - return new Auth_OpenID_ServerError($message, - "OpenID 2.0 message contained openid.identity " . - "but not claimed_id"); - } - } else { - $claimed_id = null; - } - - if (($identity === null) && - ($namespace == Auth_OpenID_OPENID1_NS)) { - return new Auth_OpenID_ServerError($message, - "OpenID 1 message did not contain openid.identity"); - } - - // There's a case for making self.trust_root be a TrustRoot - // here. But if TrustRoot isn't currently part of the - // "public" API, I'm not sure it's worth doing. - if ($namespace == Auth_OpenID_OPENID1_NS) { - $trust_root = $message->getArg(Auth_OpenID_OPENID_NS, - 'trust_root', - $return_to); - } else { - $trust_root = $message->getArg(Auth_OpenID_OPENID_NS, - 'realm', - $return_to); - - if (($return_to === null) && - ($trust_root === null)) { - return new Auth_OpenID_ServerError($message, - "openid.realm required when openid.return_to absent"); - } - } - - $assoc_handle = $message->getArg(Auth_OpenID_OPENID_NS, - 'assoc_handle'); - - $obj = Auth_OpenID_CheckIDRequest::make($message, - $identity, - $return_to, - $trust_root, - $immediate, - $assoc_handle, - $server); - - if (is_a($obj, 'Auth_OpenID_ServerError')) { - return $obj; - } - - $obj->claimed_id = $claimed_id; - - return $obj; - } - - function idSelect() - { - // Is the identifier to be selected by the IDP? - // So IDPs don't have to import the constant - return $this->identity == Auth_OpenID_IDENTIFIER_SELECT; - } - - function trustRootValid() - { - if (!$this->trust_root) { - return true; - } - - $tr = Auth_OpenID_TrustRoot::_parse($this->trust_root); - if ($tr === false) { - return new Auth_OpenID_MalformedTrustRoot(null, $this->trust_root); - } - - if ($this->return_to !== null) { - return Auth_OpenID_TrustRoot::match($this->trust_root, - $this->return_to); - } else { - return true; - } - } - - /** - * Respond to this request. Return either an - * {@link Auth_OpenID_ServerResponse} or - * {@link Auth_OpenID_ServerError}. - * - * @param bool $allow Allow this user to claim this identity, and - * allow the consumer to have this information? - * - * @param string $server_url DEPRECATED. Passing $op_endpoint to - * the {@link Auth_OpenID_Server} constructor makes this optional. - * - * When an OpenID 1.x immediate mode request does not succeed, it - * gets back a URL where the request may be carried out in a - * not-so-immediate fashion. Pass my URL in here (the fully - * qualified address of this server's endpoint, i.e. - * http://example.com/server), and I will use it as a base for the - * URL for a new request. - * - * Optional for requests where {@link $immediate} is false or - * $allow is true. - * - * @param string $identity The OP-local identifier to answer with. - * Only for use when the relying party requested identifier - * selection. - * - * @param string $claimed_id The claimed identifier to answer - * with, for use with identifier selection in the case where the - * claimed identifier and the OP-local identifier differ, - * i.e. when the claimed_id uses delegation. - * - * If $identity is provided but this is not, $claimed_id will - * default to the value of $identity. When answering requests - * that did not ask for identifier selection, the response - * $claimed_id will default to that of the request. - * - * This parameter is new in OpenID 2.0. - * - * @return mixed - */ - function answer($allow, $server_url = null, $identity = null, - $claimed_id = null) - { - if (!$this->return_to) { - return new Auth_OpenID_NoReturnToError(); - } - - if (!$server_url) { - if (($this->namespace != Auth_OpenID_OPENID1_NS) && - (!$this->server->op_endpoint)) { - return new Auth_OpenID_ServerError(null, - "server should be constructed with op_endpoint to " . - "respond to OpenID 2.0 messages."); - } - - $server_url = $this->server->op_endpoint; - } - - if ($allow) { - $mode = 'id_res'; - } else if ($this->namespace == Auth_OpenID_OPENID1_NS) { - if ($this->immediate) { - $mode = 'id_res'; - } else { - $mode = 'cancel'; - } - } else { - if ($this->immediate) { - $mode = 'setup_needed'; - } else { - $mode = 'cancel'; - } - } - - if (!$this->trustRootValid()) { - return new Auth_OpenID_UntrustedReturnURL(null, - $this->return_to, - $this->trust_root); - } - - $response = new Auth_OpenID_ServerResponse($this); - - if ($claimed_id && - ($this->namespace == Auth_OpenID_OPENID1_NS)) { - return new Auth_OpenID_ServerError(null, - "claimed_id is new in OpenID 2.0 and not " . - "available for ".$this->namespace); - } - - if ($identity && !$claimed_id) { - $claimed_id = $identity; - } - - if ($allow) { - - if ($this->identity == Auth_OpenID_IDENTIFIER_SELECT) { - if (!$identity) { - return new Auth_OpenID_ServerError(null, - "This request uses IdP-driven identifier selection. " . - "You must supply an identifier in the response."); - } - - $response_identity = $identity; - $response_claimed_id = $claimed_id; - - } else if ($this->identity) { - if ($identity && - ($this->identity != $identity)) { - $fmt = "Request was for %s, cannot reply with identity %s"; - return new Auth_OpenID_ServerError(null, - sprintf($fmt, $this->identity, $identity)); - } - - $response_identity = $this->identity; - $response_claimed_id = $this->claimed_id; - } else { - if ($identity) { - return new Auth_OpenID_ServerError(null, - "This request specified no identity and " . - "you supplied ".$identity); - } - - $response_identity = null; - } - - if (($this->namespace == Auth_OpenID_OPENID1_NS) && - ($response_identity === null)) { - return new Auth_OpenID_ServerError(null, - "Request was an OpenID 1 request, so response must " . - "include an identifier."); - } - - $response->fields->updateArgs(Auth_OpenID_OPENID_NS, - array('mode' => $mode, - 'op_endpoint' => $server_url, - 'return_to' => $this->return_to, - 'response_nonce' => Auth_OpenID_mkNonce())); - - if ($response_identity !== null) { - $response->fields->setArg( - Auth_OpenID_OPENID_NS, - 'identity', - $response_identity); - if ($this->namespace == Auth_OpenID_OPENID2_NS) { - $response->fields->setArg( - Auth_OpenID_OPENID_NS, - 'claimed_id', - $response_claimed_id); - } - } - - } else { - $response->fields->setArg(Auth_OpenID_OPENID_NS, - 'mode', $mode); - - if ($this->immediate) { - if (($this->namespace == Auth_OpenID_OPENID1_NS) && - (!$server_url)) { - return new Auth_OpenID_ServerError(null, - 'setup_url is required for $allow=false \ - in OpenID 1.x immediate mode.'); - } - - $setup_request =& new Auth_OpenID_CheckIDRequest( - $this->identity, - $this->return_to, - $this->trust_root, - false, - $this->assoc_handle, - $this->server); - - $setup_url = $setup_request->encodeToURL($server_url); - - if ($setup_url === null) { - return new Auth_OpenID_NoReturnToError(); - } - - $response->fields->setArg(Auth_OpenID_OPENID_NS, - 'user_setup_url', - $setup_url); - } - } - - return $response; - } - - function encodeToURL($server_url) - { - if (!$this->return_to) { - return new Auth_OpenID_NoReturnToError(); - } - - // Imported from the alternate reality where these classes are - // used in both the client and server code, so Requests are - // Encodable too. That's right, code imported from alternate - // realities all for the love of you, id_res/user_setup_url. - - $q = array('mode' => $this->mode, - 'identity' => $this->identity, - 'claimed_id' => $this->claimed_id, - 'return_to' => $this->return_to); - - if ($this->trust_root) { - if ($this->namespace == Auth_OpenID_OPENID1_NS) { - $q['trust_root'] = $this->trust_root; - } else { - $q['realm'] = $this->trust_root; - } - } - - if ($this->assoc_handle) { - $q['assoc_handle'] = $this->assoc_handle; - } - - $response = new Auth_OpenID_Message($this->namespace); - $response->updateArgs($this->namespace, $q); - - return $response->toURL($server_url); - } - - function getCancelURL() - { - if (!$this->return_to) { - return new Auth_OpenID_NoReturnToError(); - } - - if ($this->immediate) { - return new Auth_OpenID_ServerError(null, - "Cancel is not an appropriate \ - response to immediate mode \ - requests."); - } - - $response = new Auth_OpenID_Message($this->namespace); - $response->setArg(Auth_OpenID_OPENID_NS, 'mode', 'cancel'); - return $response->toURL($this->return_to); - } -} - -/** - * This class encapsulates the response to an OpenID server request. - * - * @package OpenID - */ -class Auth_OpenID_ServerResponse { - - function Auth_OpenID_ServerResponse(&$request) - { - $this->request =& $request; - $this->fields = new Auth_OpenID_Message($this->request->namespace); - } - - function whichEncoding() - { - global $_Auth_OpenID_Request_Modes; - - if (in_array($this->request->mode, $_Auth_OpenID_Request_Modes)) { - if ($this->fields->isOpenID2() && - (strlen($this->encodeToURL()) > - Auth_OpenID_OPENID1_URL_LIMIT)) { - return Auth_OpenID_ENCODE_HTML_FORM; - } else { - return Auth_OpenID_ENCODE_URL; - } - } else { - return Auth_OpenID_ENCODE_KVFORM; - } - } - - /* - * Returns the form markup for this response. - * - * @return str - */ - function toFormMarkup() - { - return $this->fields->toFormMarkup( - $this->fields->getArg(Auth_OpenID_OPENID_NS, 'return_to')); - } - - /* - * Returns True if this response's encoding is ENCODE_HTML_FORM. - * Convenience method for server authors. - * - * @return bool - */ - function renderAsForm() - { - return $this->whichEncoding() == Auth_OpenID_ENCODE_HTML_FORM; - } - - - function encodeToURL() - { - return $this->fields->toURL($this->request->return_to); - } - - function addExtension($extension_response) - { - $extension_response->toMessage($this->fields); - } - - function needsSigning() - { - return $this->fields->getArg(Auth_OpenID_OPENID_NS, - 'mode') == 'id_res'; - } - - function encodeToKVForm() - { - return $this->fields->toKVForm(); - } -} - -/** - * A web-capable response object which you can use to generate a - * user-agent response. - * - * @package OpenID - */ -class Auth_OpenID_WebResponse { - var $code = AUTH_OPENID_HTTP_OK; - var $body = ""; - - function Auth_OpenID_WebResponse($code = null, $headers = null, - $body = null) - { - if ($code) { - $this->code = $code; - } - - if ($headers !== null) { - $this->headers = $headers; - } else { - $this->headers = array(); - } - - if ($body !== null) { - $this->body = $body; - } - } -} - -/** - * Responsible for the signature of query data and the verification of - * OpenID signature values. - * - * @package OpenID - */ -class Auth_OpenID_Signatory { - - // = 14 * 24 * 60 * 60; # 14 days, in seconds - var $SECRET_LIFETIME = 1209600; - - // keys have a bogus server URL in them because the filestore - // really does expect that key to be a URL. This seems a little - // silly for the server store, since I expect there to be only one - // server URL. - var $normal_key = 'http://localhost/|normal'; - var $dumb_key = 'http://localhost/|dumb'; - - /** - * Create a new signatory using a given store. - */ - function Auth_OpenID_Signatory(&$store) - { - // assert store is not None - $this->store =& $store; - } - - /** - * Verify, using a given association handle, a signature with - * signed key-value pairs from an HTTP request. - */ - function verify($assoc_handle, $message) - { - $assoc = $this->getAssociation($assoc_handle, true); - if (!$assoc) { - // oidutil.log("failed to get assoc with handle %r to verify sig %r" - // % (assoc_handle, sig)) - return false; - } - - return $assoc->checkMessageSignature($message); - } - - /** - * Given a response, sign the fields in the response's 'signed' - * list, and insert the signature into the response. - */ - function sign($response) - { - $signed_response = $response; - $assoc_handle = $response->request->assoc_handle; - - if ($assoc_handle) { - // normal mode - $assoc = $this->getAssociation($assoc_handle, false, false); - if (!$assoc || ($assoc->getExpiresIn() <= 0)) { - // fall back to dumb mode - $signed_response->fields->setArg(Auth_OpenID_OPENID_NS, - 'invalidate_handle', $assoc_handle); - $assoc_type = ($assoc ? $assoc->assoc_type : 'HMAC-SHA1'); - - if ($assoc && ($assoc->getExpiresIn() <= 0)) { - $this->invalidate($assoc_handle, false); - } - - $assoc = $this->createAssociation(true, $assoc_type); - } - } else { - // dumb mode. - $assoc = $this->createAssociation(true); - } - - $signed_response->fields = $assoc->signMessage( - $signed_response->fields); - return $signed_response; - } - - /** - * Make a new association. - */ - function createAssociation($dumb = true, $assoc_type = 'HMAC-SHA1') - { - $secret = Auth_OpenID_CryptUtil::getBytes( - Auth_OpenID_getSecretSize($assoc_type)); - - $uniq = base64_encode(Auth_OpenID_CryptUtil::getBytes(4)); - $handle = sprintf('{%s}{%x}{%s}', $assoc_type, intval(time()), $uniq); - - $assoc = Auth_OpenID_Association::fromExpiresIn( - $this->SECRET_LIFETIME, $handle, $secret, $assoc_type); - - if ($dumb) { - $key = $this->dumb_key; - } else { - $key = $this->normal_key; - } - - $this->store->storeAssociation($key, $assoc); - return $assoc; - } - - /** - * Given an association handle, get the association from the - * store, or return a ServerError or null if something goes wrong. - */ - function getAssociation($assoc_handle, $dumb, $check_expiration=true) - { - if ($assoc_handle === null) { - return new Auth_OpenID_ServerError(null, - "assoc_handle must not be null"); - } - - if ($dumb) { - $key = $this->dumb_key; - } else { - $key = $this->normal_key; - } - - $assoc = $this->store->getAssociation($key, $assoc_handle); - - if (($assoc !== null) && ($assoc->getExpiresIn() <= 0)) { - if ($check_expiration) { - $this->store->removeAssociation($key, $assoc_handle); - $assoc = null; - } - } - - return $assoc; - } - - /** - * Invalidate a given association handle. - */ - function invalidate($assoc_handle, $dumb) - { - if ($dumb) { - $key = $this->dumb_key; - } else { - $key = $this->normal_key; - } - $this->store->removeAssociation($key, $assoc_handle); - } -} - -/** - * Encode an {@link Auth_OpenID_ServerResponse} to an - * {@link Auth_OpenID_WebResponse}. - * - * @package OpenID - */ -class Auth_OpenID_Encoder { - - var $responseFactory = 'Auth_OpenID_WebResponse'; - - /** - * Encode an {@link Auth_OpenID_ServerResponse} and return an - * {@link Auth_OpenID_WebResponse}. - */ - function encode(&$response) - { - $cls = $this->responseFactory; - - $encode_as = $response->whichEncoding(); - if ($encode_as == Auth_OpenID_ENCODE_KVFORM) { - $wr = new $cls(null, null, $response->encodeToKVForm()); - if (is_a($response, 'Auth_OpenID_ServerError')) { - $wr->code = AUTH_OPENID_HTTP_ERROR; - } - } else if ($encode_as == Auth_OpenID_ENCODE_URL) { - $location = $response->encodeToURL(); - $wr = new $cls(AUTH_OPENID_HTTP_REDIRECT, - array('location' => $location)); - } else if ($encode_as == Auth_OpenID_ENCODE_HTML_FORM) { - $wr = new $cls(AUTH_OPENID_HTTP_OK, array(), - $response->toFormMarkup()); - } else { - return new Auth_OpenID_EncodingError($response); - } - return $wr; - } -} - -/** - * An encoder which also takes care of signing fields when required. - * - * @package OpenID - */ -class Auth_OpenID_SigningEncoder extends Auth_OpenID_Encoder { - - function Auth_OpenID_SigningEncoder(&$signatory) - { - $this->signatory =& $signatory; - } - - /** - * Sign an {@link Auth_OpenID_ServerResponse} and return an - * {@link Auth_OpenID_WebResponse}. - */ - function encode(&$response) - { - // the isinstance is a bit of a kludge... it means there isn't - // really an adapter to make the interfaces quite match. - if (!is_a($response, 'Auth_OpenID_ServerError') && - $response->needsSigning()) { - - if (!$this->signatory) { - return new Auth_OpenID_ServerError(null, - "Must have a store to sign request"); - } - - if ($response->fields->hasKey(Auth_OpenID_OPENID_NS, 'sig')) { - return new Auth_OpenID_AlreadySigned($response); - } - $response = $this->signatory->sign($response); - } - - return parent::encode($response); - } -} - -/** - * Decode an incoming query into an Auth_OpenID_Request. - * - * @package OpenID - */ -class Auth_OpenID_Decoder { - - function Auth_OpenID_Decoder(&$server) - { - $this->server =& $server; - - $this->handlers = array( - 'checkid_setup' => 'Auth_OpenID_CheckIDRequest', - 'checkid_immediate' => 'Auth_OpenID_CheckIDRequest', - 'check_authentication' => 'Auth_OpenID_CheckAuthRequest', - 'associate' => 'Auth_OpenID_AssociateRequest' - ); - } - - /** - * Given an HTTP query in an array (key-value pairs), decode it - * into an Auth_OpenID_Request object. - */ - function decode($query) - { - if (!$query) { - return null; - } - - $message = Auth_OpenID_Message::fromPostArgs($query); - - $mode = $message->getArg(Auth_OpenID_OPENID_NS, 'mode'); - if (!$mode) { - return new Auth_OpenID_ServerError($message, - "No mode value in message"); - } - - $handlerCls = Auth_OpenID::arrayGet($this->handlers, $mode, - $this->defaultDecoder($message)); - - if (!is_a($handlerCls, 'Auth_OpenID_ServerError')) { - return call_user_func_array(array($handlerCls, 'fromMessage'), - array($message, $this->server)); - } else { - return $handlerCls; - } - } - - function defaultDecoder($message) - { - $mode = $message->getArg(Auth_OpenID_OPENID_NS, 'mode'); - return new Auth_OpenID_ServerError($message, - sprintf("No decoder for mode %s", $mode)); - } -} - -/** - * An error that indicates an encoding problem occurred. - * - * @package OpenID - */ -class Auth_OpenID_EncodingError { - function Auth_OpenID_EncodingError(&$response) - { - $this->response =& $response; - } -} - -/** - * An error that indicates that a response was already signed. - * - * @package OpenID - */ -class Auth_OpenID_AlreadySigned extends Auth_OpenID_EncodingError { - // This response is already signed. -} - -/** - * An error that indicates that the given return_to is not under the - * given trust_root. - * - * @package OpenID - */ -class Auth_OpenID_UntrustedReturnURL extends Auth_OpenID_ServerError { - function Auth_OpenID_UntrustedReturnURL($message, $return_to, - $trust_root) - { - parent::Auth_OpenID_ServerError($message, "Untrusted return_to URL"); - $this->return_to = $return_to; - $this->trust_root = $trust_root; - } - - function toString() - { - return sprintf("return_to %s not under trust_root %s", - $this->return_to, $this->trust_root); - } -} - -/** - * I handle requests for an OpenID server. - * - * Some types of requests (those which are not checkid requests) may - * be handed to my {@link handleRequest} method, and I will take care - * of it and return a response. - * - * For your convenience, I also provide an interface to {@link - * Auth_OpenID_Decoder::decode()} and {@link - * Auth_OpenID_SigningEncoder::encode()} through my methods {@link - * decodeRequest} and {@link encodeResponse}. - * - * All my state is encapsulated in an {@link Auth_OpenID_OpenIDStore}. - * - * Example: - * - * <pre> $oserver = new Auth_OpenID_Server(Auth_OpenID_FileStore($data_path), - * "http://example.com/op"); - * $request = $oserver->decodeRequest(); - * if (in_array($request->mode, array('checkid_immediate', - * 'checkid_setup'))) { - * if ($app->isAuthorized($request->identity, $request->trust_root)) { - * $response = $request->answer(true); - * } else if ($request->immediate) { - * $response = $request->answer(false); - * } else { - * $app->showDecidePage($request); - * return; - * } - * } else { - * $response = $oserver->handleRequest($request); - * } - * - * $webresponse = $oserver->encode($response);</pre> - * - * @package OpenID - */ -class Auth_OpenID_Server { - function Auth_OpenID_Server(&$store, $op_endpoint=null) - { - $this->store =& $store; - $this->signatory =& new Auth_OpenID_Signatory($this->store); - $this->encoder =& new Auth_OpenID_SigningEncoder($this->signatory); - $this->decoder =& new Auth_OpenID_Decoder($this); - $this->op_endpoint = $op_endpoint; - $this->negotiator =& Auth_OpenID_getDefaultNegotiator(); - } - - /** - * Handle a request. Given an {@link Auth_OpenID_Request} object, - * call the appropriate {@link Auth_OpenID_Server} method to - * process the request and generate a response. - * - * @param Auth_OpenID_Request $request An {@link Auth_OpenID_Request} - * returned by {@link Auth_OpenID_Server::decodeRequest()}. - * - * @return Auth_OpenID_ServerResponse $response A response object - * capable of generating a user-agent reply. - */ - function handleRequest($request) - { - if (method_exists($this, "openid_" . $request->mode)) { - $handler = array($this, "openid_" . $request->mode); - return call_user_func($handler, $request); - } - return null; - } - - /** - * The callback for 'check_authentication' messages. - */ - function openid_check_authentication(&$request) - { - return $request->answer($this->signatory); - } - - /** - * The callback for 'associate' messages. - */ - function openid_associate(&$request) - { - $assoc_type = $request->assoc_type; - $session_type = $request->session->session_type; - if ($this->negotiator->isAllowed($assoc_type, $session_type)) { - $assoc = $this->signatory->createAssociation(false, - $assoc_type); - return $request->answer($assoc); - } else { - $message = sprintf('Association type %s is not supported with '. - 'session type %s', $assoc_type, $session_type); - list($preferred_assoc_type, $preferred_session_type) = - $this->negotiator->getAllowedType(); - return $request->answerUnsupported($message, - $preferred_assoc_type, - $preferred_session_type); - } - } - - /** - * Encodes as response in the appropriate format suitable for - * sending to the user agent. - */ - function encodeResponse(&$response) - { - return $this->encoder->encode($response); - } - - /** - * Decodes a query args array into the appropriate - * {@link Auth_OpenID_Request} object. - */ - function decodeRequest($query=null) - { - if ($query === null) { - $query = Auth_OpenID::getQuery(); - } - - return $this->decoder->decode($query); - } -} - -?> |