4 * This module documents the main interface with the OpenID consumer
5 * library. The only part of the library which has to be used and
6 * isn't documented in full here is the store required to create an
7 * Auth_OpenID_Consumer instance. More on the abstract store type and
8 * concrete implementations of it that are provided in the
9 * documentation for the Auth_OpenID_Consumer constructor.
13 * The OpenID identity verification process most commonly uses the
14 * following steps, as visible to the user of this library:
16 * 1. The user enters their OpenID into a field on the consumer's
17 * site, and hits a login button.
18 * 2. The consumer site discovers the user's OpenID server using the
20 * 3. The consumer site sends the browser a redirect to the identity
21 * server. This is the authentication request as described in
22 * the OpenID specification.
23 * 4. The identity server's site sends the browser a redirect back
24 * to the consumer site. This redirect contains the server's
25 * response to the authentication request.
27 * The most important part of the flow to note is the consumer's site
28 * must handle two separate HTTP requests in order to perform the full
33 * This consumer library is designed with that flow in mind. The goal
34 * is to make it as easy as possible to perform the above steps
37 * At a high level, there are two important parts in the consumer
38 * library. The first important part is this module, which contains
39 * the interface to actually use this library. The second is the
40 * Auth_OpenID_Interface class, which describes the interface to use
41 * if you need to create a custom method for storing the state this
42 * library needs to maintain between requests.
44 * In general, the second part is less important for users of the
45 * library to know about, as several implementations are provided
46 * which cover a wide variety of situations in which consumers may use
49 * This module contains a class, Auth_OpenID_Consumer, with methods
50 * corresponding to the actions necessary in each of steps 2, 3, and 4
51 * described in the overview. Use of this library should be as easy
52 * as creating an Auth_OpenID_Consumer instance and calling the
53 * methods appropriate for the action the site wants to take.
55 * STORES AND DUMB MODE
57 * OpenID is a protocol that works best when the consumer site is able
58 * to store some state. This is the normal mode of operation for the
59 * protocol, and is sometimes referred to as smart mode. There is
60 * also a fallback mode, known as dumb mode, which is available when
61 * the consumer site is not able to store state. This mode should be
62 * avoided when possible, as it leaves the implementation more
63 * vulnerable to replay attacks.
65 * The mode the library works in for normal operation is determined by
66 * the store that it is given. The store is an abstraction that
67 * handles the data that the consumer needs to manage between http
68 * requests in order to operate efficiently and securely.
70 * Several store implementation are provided, and the interface is
71 * fully documented so that custom stores can be used as well. See
72 * the documentation for the Auth_OpenID_Consumer class for more
73 * information on the interface for stores. The implementations that
74 * are provided allow the consumer site to store the necessary data in
75 * several different ways, including several SQL databases and normal
78 * There is an additional concrete store provided that puts the system
79 * in dumb mode. This is not recommended, as it removes the library's
80 * ability to stop replay attacks reliably. It still uses time-based
81 * checking to make replay attacks only possible within a small
82 * window, but they remain possible within that window. This store
83 * should only be used if the consumer site has no way to retain data
84 * between requests at all.
88 * In the flow described above, the user may need to confirm to the
89 * lidentity server that it's ok to authorize his or her identity.
90 * The server may draw pages asking for information from the user
91 * before it redirects the browser back to the consumer's site. This
92 * is generally transparent to the consumer site, so it is typically
93 * ignored as an implementation detail.
95 * There can be times, however, where the consumer site wants to get a
96 * response immediately. When this is the case, the consumer can put
97 * the library in immediate mode. In immediate mode, there is an
98 * extra response possible from the server, which is essentially the
99 * server reporting that it doesn't have enough information to answer
104 * Integrating this library into an application is usually a
105 * relatively straightforward process. The process should basically
108 * Add an OpenID login field somewhere on your site. When an OpenID
109 * is entered in that field and the form is submitted, it should make
110 * a request to the your site which includes that OpenID URL.
112 * First, the application should instantiate the Auth_OpenID_Consumer
113 * class using the store of choice (Auth_OpenID_FileStore or one of
114 * the SQL-based stores). If the application has a custom
115 * session-management implementation, an object implementing the
116 * {@link Auth_Yadis_PHPSession} interface should be passed as the
117 * second parameter. Otherwise, the default uses $_SESSION.
119 * Next, the application should call the Auth_OpenID_Consumer object's
120 * 'begin' method. This method takes the OpenID URL. The 'begin'
121 * method returns an Auth_OpenID_AuthRequest object.
123 * Next, the application should call the 'redirectURL' method of the
124 * Auth_OpenID_AuthRequest object. The 'return_to' URL parameter is
125 * the URL that the OpenID server will send the user back to after
126 * attempting to verify his or her identity. The 'trust_root' is the
127 * URL (or URL pattern) that identifies your web site to the user when
128 * he or she is authorizing it. Send a redirect to the resulting URL
129 * to the user's browser.
131 * That's the first half of the authentication process. The second
132 * half of the process is done after the user's ID server sends the
133 * user's browser a redirect back to your site to complete their
136 * When that happens, the user will contact your site at the URL given
137 * as the 'return_to' URL to the Auth_OpenID_AuthRequest::redirectURL
138 * call made above. The request will have several query parameters
139 * added to the URL by the identity server as the information
140 * necessary to finish the request.
142 * Lastly, instantiate an Auth_OpenID_Consumer instance as above and
143 * call its 'complete' method, passing in all the received query
146 * There are multiple possible return types possible from that
147 * method. These indicate the whether or not the login was successful,
148 * and include any additional information appropriate for their type.
150 * PHP versions 4 and 5
152 * LICENSE: See the COPYING file included in this distribution.
155 * @author JanRain, Inc. <openid@janrain.com>
156 * @copyright 2005-2008 Janrain, Inc.
157 * @license http://www.apache.org/licenses/LICENSE-2.0 Apache
161 * Require utility classes and functions for the consumer.
163 require_once "Auth/OpenID.php";
164 require_once "Auth/OpenID/Message.php";
165 require_once "Auth/OpenID/HMAC.php";
166 require_once "Auth/OpenID/Association.php";
167 require_once "Auth/OpenID/CryptUtil.php";
168 require_once "Auth/OpenID/DiffieHellman.php";
169 require_once "Auth/OpenID/KVForm.php";
170 require_once "Auth/OpenID/Nonce.php";
171 require_once "Auth/OpenID/Discover.php";
172 require_once "Auth/OpenID/URINorm.php";
173 require_once "Auth/Yadis/Manager.php";
174 require_once "Auth/Yadis/XRI.php";
177 * This is the status code returned when the complete method returns
180 define('Auth_OpenID_SUCCESS', 'success');
183 * Status to indicate cancellation of OpenID authentication.
185 define('Auth_OpenID_CANCEL', 'cancel');
188 * This is the status code completeAuth returns when the value it
189 * received indicated an invalid login.
191 define('Auth_OpenID_FAILURE', 'failure');
194 * This is the status code completeAuth returns when the
195 * {@link Auth_OpenID_Consumer} instance is in immediate mode, and the
196 * identity server sends back a URL to send the user to to complete his
199 define('Auth_OpenID_SETUP_NEEDED', 'setup needed');
202 * This is the status code beginAuth returns when the page fetched
203 * from the entered OpenID URL doesn't contain the necessary link tags
204 * to function as an identity page.
206 define('Auth_OpenID_PARSE_ERROR', 'parse error');
209 * An OpenID consumer implementation that performs discovery and does
210 * session management. See the Consumer.php file documentation for
215 class Auth_OpenID_Consumer {
220 var $discoverMethod = 'Auth_OpenID_discover';
225 var $session_key_prefix = "_openid_consumer_";
230 var $_token_suffix = "last_token";
233 * Initialize a Consumer instance.
235 * You should create a new instance of the Consumer object with
236 * every HTTP request that handles OpenID transactions.
238 * @param Auth_OpenID_OpenIDStore $store This must be an object
239 * that implements the interface in {@link
240 * Auth_OpenID_OpenIDStore}. Several concrete implementations are
241 * provided, to cover most common use cases. For stores backed by
242 * MySQL, PostgreSQL, or SQLite, see the {@link
243 * Auth_OpenID_SQLStore} class and its sublcasses. For a
244 * filesystem-backed store, see the {@link Auth_OpenID_FileStore}
245 * module. As a last resort, if it isn't possible for the server
246 * to store state at all, an instance of {@link
247 * Auth_OpenID_DumbStore} can be used.
249 * @param mixed $session An object which implements the interface
250 * of the {@link Auth_Yadis_PHPSession} class. Particularly, this
251 * object is expected to have these methods: get($key), set($key),
252 * $value), and del($key). This defaults to a session object
253 * which wraps PHP's native session machinery. You should only
254 * need to pass something here if you have your own sessioning
257 * @param str $consumer_cls The name of the class to instantiate
258 * when creating the internal consumer object. This is used for
261 function Auth_OpenID_Consumer($store, $session = null,
262 $consumer_cls = null)
264 if ($session === null) {
265 $session = new Auth_Yadis_PHPSession();
268 $this->session = $session;
270 if ($consumer_cls !== null) {
271 $this->consumer = new $consumer_cls($store);
273 $this->consumer = new Auth_OpenID_GenericConsumer($store);
276 $this->_token_key = $this->session_key_prefix . $this->_token_suffix;
280 * Used in testing to define the discovery mechanism.
284 function getDiscoveryObject($session, $openid_url,
287 return new Auth_Yadis_Discovery($session, $openid_url,
288 $session_key_prefix);
292 * Start the OpenID authentication process. See steps 1-2 in the
293 * overview at the top of this file.
295 * @param string $user_url Identity URL given by the user. This
296 * method performs a textual transformation of the URL to try and
297 * make sure it is normalized. For example, a user_url of
298 * example.com will be normalized to http://example.com/
299 * normalizing and resolving any redirects the server might issue.
301 * @param bool $anonymous True if the OpenID request is to be sent
302 * to the server without any identifier information. Use this
303 * when you want to transport data but don't want to do OpenID
304 * authentication with identifiers.
306 * @return Auth_OpenID_AuthRequest $auth_request An object
307 * containing the discovered information will be returned, with a
308 * method for building a redirect URL to the server, as described
309 * in step 3 of the overview. This object may also be used to add
310 * extension arguments to the request, using its 'addExtensionArg'
313 function begin($user_url, $anonymous=false)
315 $openid_url = $user_url;
317 $disco = $this->getDiscoveryObject($this->session,
319 $this->session_key_prefix);
321 // Set the 'stale' attribute of the manager. If discovery
322 // fails in a fatal way, the stale flag will cause the manager
323 // to be cleaned up next time discovery is attempted.
325 $m = $disco->getManager();
326 $loader = new Auth_Yadis_ManagerLoader();
330 $disco->destroyManager();
333 $disco->session->set($disco->session_key,
334 serialize($loader->toSession($m)));
338 $endpoint = $disco->getNextService($this->discoverMethod,
339 $this->consumer->fetcher);
341 // Reset the 'stale' attribute of the manager.
342 $m = $disco->getManager();
345 $disco->session->set($disco->session_key,
346 serialize($loader->toSession($m)));
349 if ($endpoint === null) {
352 return $this->beginWithoutDiscovery($endpoint,
358 * Start OpenID verification without doing OpenID server
359 * discovery. This method is used internally by Consumer.begin
360 * after discovery is performed, and exists to provide an
361 * interface for library users needing to perform their own
364 * @param Auth_OpenID_ServiceEndpoint $endpoint an OpenID service
365 * endpoint descriptor.
367 * @param bool anonymous Set to true if you want to perform OpenID
368 * without identifiers.
370 * @return Auth_OpenID_AuthRequest $auth_request An OpenID
371 * authentication request object.
373 function beginWithoutDiscovery($endpoint, $anonymous=false)
375 $loader = new Auth_OpenID_ServiceEndpointLoader();
376 $auth_req = $this->consumer->begin($endpoint);
377 $this->session->set($this->_token_key,
378 $loader->toSession($auth_req->endpoint));
379 if (!$auth_req->setAnonymous($anonymous)) {
380 return new Auth_OpenID_FailureResponse(null,
381 "OpenID 1 requests MUST include the identifier " .
388 * Called to interpret the server's response to an OpenID
389 * request. It is called in step 4 of the flow described in the
392 * @param string $current_url The URL used to invoke the application.
393 * Extract the URL from your application's web
394 * request framework and specify it here to have it checked
395 * against the openid.current_url value in the response. If
396 * the current_url URL check fails, the status of the
397 * completion will be FAILURE.
399 * @param array $query An array of the query parameters (key =>
400 * value pairs) for this HTTP request. Defaults to null. If
401 * null, the GET or POST data are automatically gotten from the
402 * PHP environment. It is only useful to override $query for
405 * @return Auth_OpenID_ConsumerResponse $response A instance of an
406 * Auth_OpenID_ConsumerResponse subclass. The type of response is
407 * indicated by the status attribute, which will be one of
408 * SUCCESS, CANCEL, FAILURE, or SETUP_NEEDED.
410 function complete($current_url, $query=null)
412 if ($current_url && !is_string($current_url)) {
413 // This is ugly, but we need to complain loudly when
414 // someone uses the API incorrectly.
415 trigger_error("current_url must be a string; see NEWS file " .
416 "for upgrading notes.",
420 if ($query === null) {
421 $query = Auth_OpenID::getQuery();
424 $loader = new Auth_OpenID_ServiceEndpointLoader();
425 $endpoint_data = $this->session->get($this->_token_key);
427 $loader->fromSession($endpoint_data);
429 $message = Auth_OpenID_Message::fromPostArgs($query);
430 $response = $this->consumer->complete($message, $endpoint,
432 $this->session->del($this->_token_key);
434 if (in_array($response->status, array(Auth_OpenID_SUCCESS,
435 Auth_OpenID_CANCEL))) {
436 if ($response->identity_url !== null) {
437 $disco = $this->getDiscoveryObject($this->session,
438 $response->identity_url,
439 $this->session_key_prefix);
440 $disco->cleanup(true);
449 * A class implementing HMAC/DH-SHA1 consumer sessions.
453 class Auth_OpenID_DiffieHellmanSHA1ConsumerSession {
454 var $session_type = 'DH-SHA1';
455 var $hash_func = 'Auth_OpenID_SHA1';
456 var $secret_size = 20;
457 var $allowed_assoc_types = array('HMAC-SHA1');
459 function Auth_OpenID_DiffieHellmanSHA1ConsumerSession($dh = null)
462 $dh = new Auth_OpenID_DiffieHellman();
468 function getRequest()
470 $math = Auth_OpenID_getMathLib();
472 $cpub = $math->longToBase64($this->dh->public);
474 $args = array('dh_consumer_public' => $cpub);
476 if (!$this->dh->usingDefaultValues()) {
477 $args = array_merge($args, array(
479 $math->longToBase64($this->dh->mod),
481 $math->longToBase64($this->dh->gen)));
487 function extractSecret($response)
489 if (!$response->hasKey(Auth_OpenID_OPENID_NS,
490 'dh_server_public')) {
494 if (!$response->hasKey(Auth_OpenID_OPENID_NS,
499 $math = Auth_OpenID_getMathLib();
501 $spub = $math->base64ToLong($response->getArg(Auth_OpenID_OPENID_NS,
502 'dh_server_public'));
503 $enc_mac_key = base64_decode($response->getArg(Auth_OpenID_OPENID_NS,
506 return $this->dh->xorSecret($spub, $enc_mac_key, $this->hash_func);
511 * A class implementing HMAC/DH-SHA256 consumer sessions.
515 class Auth_OpenID_DiffieHellmanSHA256ConsumerSession extends
516 Auth_OpenID_DiffieHellmanSHA1ConsumerSession {
517 var $session_type = 'DH-SHA256';
518 var $hash_func = 'Auth_OpenID_SHA256';
519 var $secret_size = 32;
520 var $allowed_assoc_types = array('HMAC-SHA256');
524 * A class implementing plaintext consumer sessions.
528 class Auth_OpenID_PlainTextConsumerSession {
529 var $session_type = 'no-encryption';
530 var $allowed_assoc_types = array('HMAC-SHA1', 'HMAC-SHA256');
532 function getRequest()
537 function extractSecret($response)
539 if (!$response->hasKey(Auth_OpenID_OPENID_NS, 'mac_key')) {
543 return base64_decode($response->getArg(Auth_OpenID_OPENID_NS,
549 * Returns available session types.
551 function Auth_OpenID_getAvailableSessionTypes()
554 'no-encryption' => 'Auth_OpenID_PlainTextConsumerSession',
555 'DH-SHA1' => 'Auth_OpenID_DiffieHellmanSHA1ConsumerSession',
556 'DH-SHA256' => 'Auth_OpenID_DiffieHellmanSHA256ConsumerSession');
562 * This class is the interface to the OpenID consumer logic.
563 * Instances of it maintain no per-request state, so they can be
564 * reused (or even used by multiple threads concurrently) as needed.
568 class Auth_OpenID_GenericConsumer {
572 var $discoverMethod = 'Auth_OpenID_discover';
575 * This consumer's store object.
587 var $openid1_nonce_query_arg_name = 'janrain_nonce';
590 * Another query parameter that gets added to the return_to for
591 * OpenID 1; if the user's session state is lost, use this claimed
592 * identifier to do discovery when verifying the response.
594 var $openid1_return_to_identifier_name = 'openid1_claimed_id';
597 * This method initializes a new {@link Auth_OpenID_Consumer}
598 * instance to access the library.
600 * @param Auth_OpenID_OpenIDStore $store This must be an object
601 * that implements the interface in {@link Auth_OpenID_OpenIDStore}.
602 * Several concrete implementations are provided, to cover most common use
603 * cases. For stores backed by MySQL, PostgreSQL, or SQLite, see
604 * the {@link Auth_OpenID_SQLStore} class and its sublcasses. For a
605 * filesystem-backed store, see the {@link Auth_OpenID_FileStore} module.
606 * As a last resort, if it isn't possible for the server to store
607 * state at all, an instance of {@link Auth_OpenID_DumbStore} can be used.
609 * @param bool $immediate This is an optional boolean value. It
610 * controls whether the library uses immediate mode, as explained
611 * in the module description. The default value is False, which
612 * disables immediate mode.
614 function Auth_OpenID_GenericConsumer($store)
616 $this->store = $store;
617 $this->negotiator = Auth_OpenID_getDefaultNegotiator();
618 $this->_use_assocs = (is_null($this->store) ? false : true);
620 $this->fetcher = Auth_Yadis_Yadis::getHTTPFetcher();
622 $this->session_types = Auth_OpenID_getAvailableSessionTypes();
626 * Called to begin OpenID authentication using the specified
627 * {@link Auth_OpenID_ServiceEndpoint}.
631 function begin($service_endpoint)
633 $assoc = $this->_getAssociation($service_endpoint);
634 $r = new Auth_OpenID_AuthRequest($service_endpoint, $assoc);
635 $r->return_to_args[$this->openid1_nonce_query_arg_name] =
636 Auth_OpenID_mkNonce();
638 if ($r->message->isOpenID1()) {
639 $r->return_to_args[$this->openid1_return_to_identifier_name] =
640 $r->endpoint->claimed_id;
647 * Given an {@link Auth_OpenID_Message}, {@link
648 * Auth_OpenID_ServiceEndpoint} and optional return_to URL,
649 * complete OpenID authentication.
653 function complete($message, $endpoint, $return_to)
655 $mode = $message->getArg(Auth_OpenID_OPENID_NS, 'mode',
658 $mode_methods = array(
659 'cancel' => '_complete_cancel',
660 'error' => '_complete_error',
661 'setup_needed' => '_complete_setup_needed',
662 'id_res' => '_complete_id_res',
665 $method = Auth_OpenID::arrayGet($mode_methods, $mode,
668 return call_user_func_array(array($this, $method),
669 array($message, $endpoint, $return_to));
675 function _completeInvalid($message, $endpoint, $unused)
677 $mode = $message->getArg(Auth_OpenID_OPENID_NS, 'mode',
680 return new Auth_OpenID_FailureResponse($endpoint,
681 sprintf("Invalid openid.mode '%s'", $mode));
687 function _complete_cancel($message, $endpoint, $unused)
689 return new Auth_OpenID_CancelResponse($endpoint);
695 function _complete_error($message, $endpoint, $unused)
697 $error = $message->getArg(Auth_OpenID_OPENID_NS, 'error');
698 $contact = $message->getArg(Auth_OpenID_OPENID_NS, 'contact');
699 $reference = $message->getArg(Auth_OpenID_OPENID_NS, 'reference');
701 return new Auth_OpenID_FailureResponse($endpoint, $error,
702 $contact, $reference);
708 function _complete_setup_needed($message, $endpoint, $unused)
710 if (!$message->isOpenID2()) {
711 return $this->_completeInvalid($message, $endpoint);
714 $user_setup_url = $message->getArg(Auth_OpenID_OPENID2_NS,
716 return new Auth_OpenID_SetupNeededResponse($endpoint, $user_setup_url);
722 function _complete_id_res($message, $endpoint, $return_to)
724 $user_setup_url = $message->getArg(Auth_OpenID_OPENID1_NS,
727 if ($this->_checkSetupNeeded($message)) {
728 return new Auth_OpenID_SetupNeededResponse(
729 $endpoint, $user_setup_url);
731 return $this->_doIdRes($message, $endpoint, $return_to);
738 function _checkSetupNeeded($message)
740 // In OpenID 1, we check to see if this is a cancel from
741 // immediate mode by the presence of the user_setup_url
743 if ($message->isOpenID1()) {
744 $user_setup_url = $message->getArg(Auth_OpenID_OPENID1_NS,
746 if ($user_setup_url !== null) {
757 function _doIdRes($message, $endpoint, $return_to)
759 // Checks for presence of appropriate fields (and checks
760 // signed list fields)
761 $result = $this->_idResCheckForFields($message);
763 if (Auth_OpenID::isFailure($result)) {
767 if (!$this->_checkReturnTo($message, $return_to)) {
768 return new Auth_OpenID_FailureResponse(null,
769 sprintf("return_to does not match return URL. Expected %s, got %s",
771 $message->getArg(Auth_OpenID_OPENID_NS, 'return_to')));
774 // Verify discovery information:
775 $result = $this->_verifyDiscoveryResults($message, $endpoint);
777 if (Auth_OpenID::isFailure($result)) {
783 $result = $this->_idResCheckSignature($message,
784 $endpoint->server_url);
786 if (Auth_OpenID::isFailure($result)) {
790 $result = $this->_idResCheckNonce($message, $endpoint);
792 if (Auth_OpenID::isFailure($result)) {
796 $signed_list_str = $message->getArg(Auth_OpenID_OPENID_NS, 'signed',
797 Auth_OpenID_NO_DEFAULT);
798 if (Auth_OpenID::isFailure($signed_list_str)) {
799 return $signed_list_str;
801 $signed_list = explode(',', $signed_list_str);
803 $signed_fields = Auth_OpenID::addPrefix($signed_list, "openid.");
805 return new Auth_OpenID_SuccessResponse($endpoint, $message,
813 function _checkReturnTo($message, $return_to)
815 // Check an OpenID message and its openid.return_to value
816 // against a return_to URL from an application. Return True
817 // on success, False on failure.
819 // Check the openid.return_to args against args in the
821 $result = Auth_OpenID_GenericConsumer::_verifyReturnToArgs(
822 $message->toPostArgs());
823 if (Auth_OpenID::isFailure($result)) {
827 // Check the return_to base URL against the one in the
829 $msg_return_to = $message->getArg(Auth_OpenID_OPENID_NS,
831 if (Auth_OpenID::isFailure($return_to)) {
836 $return_to_parts = parse_url(Auth_OpenID_urinorm($return_to));
837 $msg_return_to_parts = parse_url(Auth_OpenID_urinorm($msg_return_to));
839 // If port is absent from both, add it so it's equal in the
841 if ((!array_key_exists('port', $return_to_parts)) &&
842 (!array_key_exists('port', $msg_return_to_parts))) {
843 $return_to_parts['port'] = null;
844 $msg_return_to_parts['port'] = null;
847 // If path is absent from both, add it so it's equal in the
849 if ((!array_key_exists('path', $return_to_parts)) &&
850 (!array_key_exists('path', $msg_return_to_parts))) {
851 $return_to_parts['path'] = null;
852 $msg_return_to_parts['path'] = null;
855 // The URL scheme, authority, and path MUST be the same
856 // between the two URLs.
857 foreach (array('scheme', 'host', 'port', 'path') as $component) {
858 // If the url component is absent in either URL, fail.
859 // There should always be a scheme, host, port, and path.
860 if (!array_key_exists($component, $return_to_parts)) {
864 if (!array_key_exists($component, $msg_return_to_parts)) {
868 if (Auth_OpenID::arrayGet($return_to_parts, $component) !==
869 Auth_OpenID::arrayGet($msg_return_to_parts, $component)) {
880 function _verifyReturnToArgs($query)
882 // Verify that the arguments in the return_to URL are present in this
885 $message = Auth_OpenID_Message::fromPostArgs($query);
886 $return_to = $message->getArg(Auth_OpenID_OPENID_NS, 'return_to');
888 if (Auth_OpenID::isFailure($return_to)) {
891 // XXX: this should be checked by _idResCheckForFields
893 return new Auth_OpenID_FailureResponse(null,
894 "Response has no return_to");
897 $parsed_url = parse_url($return_to);
900 if (array_key_exists('query', $parsed_url)) {
901 $rt_query = $parsed_url['query'];
902 $q = Auth_OpenID::parse_str($rt_query);
905 foreach ($q as $rt_key => $rt_value) {
906 if (!array_key_exists($rt_key, $query)) {
907 return new Auth_OpenID_FailureResponse(null,
908 sprintf("return_to parameter %s absent from query", $rt_key));
910 $value = $query[$rt_key];
911 if ($rt_value != $value) {
912 return new Auth_OpenID_FailureResponse(null,
913 sprintf("parameter %s value %s does not match " .
914 "return_to value %s", $rt_key,
920 // Make sure all non-OpenID arguments in the response are also
921 // in the signed return_to.
922 $bare_args = $message->getArgs(Auth_OpenID_BARE_NS);
923 foreach ($bare_args as $key => $value) {
924 if (Auth_OpenID::arrayGet($q, $key) != $value) {
925 return new Auth_OpenID_FailureResponse(null,
926 sprintf("Parameter %s = %s not in return_to URL",
937 function _idResCheckSignature($message, $server_url)
939 $assoc_handle = $message->getArg(Auth_OpenID_OPENID_NS,
941 if (Auth_OpenID::isFailure($assoc_handle)) {
942 return $assoc_handle;
945 $assoc = $this->store->getAssociation($server_url, $assoc_handle);
948 if ($assoc->getExpiresIn() <= 0) {
949 // XXX: It might be a good idea sometimes to re-start
950 // the authentication with a new association. Doing it
951 // automatically opens the possibility for
952 // denial-of-service by a server that just returns
953 // expired associations (or really short-lived
955 return new Auth_OpenID_FailureResponse(null,
956 'Association with ' . $server_url . ' expired');
959 if (!$assoc->checkMessageSignature($message)) {
960 // If we get a "bad signature" here, it means that the association
961 // is unrecoverabley corrupted in some way. Any futher attempts
962 // to login with this association is likely to fail. Drop it.
963 $this->store->removeAssociation($server_url, $assoc_handle);
964 return new Auth_OpenID_FailureResponse(null,
968 // It's not an association we know about. Stateless mode
969 // is our only possible path for recovery. XXX - async
970 // framework will not want to block on this call to
972 if (!$this->_checkAuth($message, $server_url)) {
973 return new Auth_OpenID_FailureResponse(null,
974 "Server denied check_authentication");
984 function _verifyDiscoveryResults($message, $endpoint=null)
986 if ($message->getOpenIDNamespace() == Auth_OpenID_OPENID2_NS) {
987 return $this->_verifyDiscoveryResultsOpenID2($message,
990 return $this->_verifyDiscoveryResultsOpenID1($message,
998 function _verifyDiscoveryResultsOpenID1($message, $endpoint)
1000 $claimed_id = $message->getArg(Auth_OpenID_BARE_NS,
1001 $this->openid1_return_to_identifier_name);
1003 if (($endpoint === null) && ($claimed_id === null)) {
1004 return new Auth_OpenID_FailureResponse($endpoint,
1005 'When using OpenID 1, the claimed ID must be supplied, ' .
1006 'either by passing it through as a return_to parameter ' .
1007 'or by using a session, and supplied to the GenericConsumer ' .
1008 'as the argument to complete()');
1009 } else if (($endpoint !== null) && ($claimed_id === null)) {
1010 $claimed_id = $endpoint->claimed_id;
1013 $to_match = new Auth_OpenID_ServiceEndpoint();
1014 $to_match->type_uris = array(Auth_OpenID_TYPE_1_1);
1015 $to_match->local_id = $message->getArg(Auth_OpenID_OPENID1_NS,
1018 // Restore delegate information from the initiation phase
1019 $to_match->claimed_id = $claimed_id;
1021 if ($to_match->local_id === null) {
1022 return new Auth_OpenID_FailureResponse($endpoint,
1023 "Missing required field openid.identity");
1026 $to_match_1_0 = $to_match->copy();
1027 $to_match_1_0->type_uris = array(Auth_OpenID_TYPE_1_0);
1029 if ($endpoint !== null) {
1030 $result = $this->_verifyDiscoverySingle($endpoint, $to_match);
1032 if (is_a($result, 'Auth_OpenID_TypeURIMismatch')) {
1033 $result = $this->_verifyDiscoverySingle($endpoint,
1037 if (Auth_OpenID::isFailure($result)) {
1038 // oidutil.log("Error attempting to use stored
1039 // discovery information: " + str(e))
1040 // oidutil.log("Attempting discovery to
1041 // verify endpoint")
1047 // Endpoint is either bad (failed verification) or None
1048 return $this->_discoverAndVerify($to_match->claimed_id,
1049 array($to_match, $to_match_1_0));
1055 function _verifyDiscoverySingle($endpoint, $to_match)
1057 // Every type URI that's in the to_match endpoint has to be
1058 // present in the discovered endpoint.
1059 foreach ($to_match->type_uris as $type_uri) {
1060 if (!$endpoint->usesExtension($type_uri)) {
1061 return new Auth_OpenID_TypeURIMismatch($endpoint,
1062 "Required type ".$type_uri." not present");
1066 // Fragments do not influence discovery, so we can't compare a
1067 // claimed identifier with a fragment to discovered
1069 list($defragged_claimed_id, $_) =
1070 Auth_OpenID::urldefrag($to_match->claimed_id);
1072 if ($defragged_claimed_id != $endpoint->claimed_id) {
1073 return new Auth_OpenID_FailureResponse($endpoint,
1074 sprintf('Claimed ID does not match (different subjects!), ' .
1075 'Expected %s, got %s', $defragged_claimed_id,
1076 $endpoint->claimed_id));
1079 if ($to_match->getLocalID() != $endpoint->getLocalID()) {
1080 return new Auth_OpenID_FailureResponse($endpoint,
1081 sprintf('local_id mismatch. Expected %s, got %s',
1082 $to_match->getLocalID(), $endpoint->getLocalID()));
1085 // If the server URL is None, this must be an OpenID 1
1086 // response, because op_endpoint is a required parameter in
1087 // OpenID 2. In that case, we don't actually care what the
1088 // discovered server_url is, because signature checking or
1089 // check_auth should take care of that check for us.
1090 if ($to_match->server_url === null) {
1091 if ($to_match->preferredNamespace() != Auth_OpenID_OPENID1_NS) {
1092 return new Auth_OpenID_FailureResponse($endpoint,
1093 "Preferred namespace mismatch (bug)");
1095 } else if ($to_match->server_url != $endpoint->server_url) {
1096 return new Auth_OpenID_FailureResponse($endpoint,
1097 sprintf('OP Endpoint mismatch. Expected %s, got %s',
1098 $to_match->server_url, $endpoint->server_url));
1107 function _verifyDiscoveryResultsOpenID2($message, $endpoint)
1109 $to_match = new Auth_OpenID_ServiceEndpoint();
1110 $to_match->type_uris = array(Auth_OpenID_TYPE_2_0);
1111 $to_match->claimed_id = $message->getArg(Auth_OpenID_OPENID2_NS,
1114 $to_match->local_id = $message->getArg(Auth_OpenID_OPENID2_NS,
1117 $to_match->server_url = $message->getArg(Auth_OpenID_OPENID2_NS,
1120 if ($to_match->server_url === null) {
1121 return new Auth_OpenID_FailureResponse($endpoint,
1122 "OP Endpoint URL missing");
1125 // claimed_id and identifier must both be present or both be
1127 if (($to_match->claimed_id === null) &&
1128 ($to_match->local_id !== null)) {
1129 return new Auth_OpenID_FailureResponse($endpoint,
1130 'openid.identity is present without openid.claimed_id');
1133 if (($to_match->claimed_id !== null) &&
1134 ($to_match->local_id === null)) {
1135 return new Auth_OpenID_FailureResponse($endpoint,
1136 'openid.claimed_id is present without openid.identity');
1139 if ($to_match->claimed_id === null) {
1140 // This is a response without identifiers, so there's
1141 // really no checking that we can do, so return an
1142 // endpoint that's for the specified `openid.op_endpoint'
1143 return Auth_OpenID_ServiceEndpoint::fromOPEndpointURL(
1144 $to_match->server_url);
1148 // The claimed ID doesn't match, so we have to do
1149 // discovery again. This covers not using sessions, OP
1150 // identifier endpoints and responses that didn't match
1151 // the original request.
1152 // oidutil.log('No pre-discovered information supplied.')
1153 return $this->_discoverAndVerify($to_match->claimed_id,
1157 // The claimed ID matches, so we use the endpoint that we
1158 // discovered in initiation. This should be the most
1160 $result = $this->_verifyDiscoverySingle($endpoint, $to_match);
1162 if (Auth_OpenID::isFailure($result)) {
1163 $endpoint = $this->_discoverAndVerify($to_match->claimed_id,
1165 if (Auth_OpenID::isFailure($endpoint)) {
1171 // The endpoint we return should have the claimed ID from the
1172 // message we just verified, fragment and all.
1173 if ($endpoint->claimed_id != $to_match->claimed_id) {
1174 $endpoint->claimed_id = $to_match->claimed_id;
1183 function _discoverAndVerify($claimed_id, $to_match_endpoints)
1185 // oidutil.log('Performing discovery on %s' % (claimed_id,))
1186 list($unused, $services) = call_user_func($this->discoverMethod,
1191 return new Auth_OpenID_FailureResponse(null,
1192 sprintf("No OpenID information found at %s",
1196 return $this->_verifyDiscoveryServices($claimed_id, $services,
1197 $to_match_endpoints);
1203 function _verifyDiscoveryServices($claimed_id,
1204 $services, $to_match_endpoints)
1206 // Search the services resulting from discovery to find one
1207 // that matches the information from the assertion
1209 foreach ($services as $endpoint) {
1210 foreach ($to_match_endpoints as $to_match_endpoint) {
1211 $result = $this->_verifyDiscoverySingle($endpoint,
1212 $to_match_endpoint);
1214 if (!Auth_OpenID::isFailure($result)) {
1215 // It matches, so discover verification has
1216 // succeeded. Return this endpoint.
1222 return new Auth_OpenID_FailureResponse(null,
1223 sprintf('No matching endpoint found after discovering %s: %s',
1224 $claimed_id, $result->message));
1228 * Extract the nonce from an OpenID 1 response. Return the nonce
1229 * from the BARE_NS since we independently check the return_to
1230 * arguments are the same as those in the response message.
1232 * See the openid1_nonce_query_arg_name class variable
1234 * @returns $nonce The nonce as a string or null
1238 function _idResGetNonceOpenID1($message, $endpoint)
1240 return $message->getArg(Auth_OpenID_BARE_NS,
1241 $this->openid1_nonce_query_arg_name);
1247 function _idResCheckNonce($message, $endpoint)
1249 if ($message->isOpenID1()) {
1250 // This indicates that the nonce was generated by the consumer
1251 $nonce = $this->_idResGetNonceOpenID1($message, $endpoint);
1254 $nonce = $message->getArg(Auth_OpenID_OPENID2_NS,
1257 $server_url = $endpoint->server_url;
1260 if ($nonce === null) {
1261 return new Auth_OpenID_FailureResponse($endpoint,
1262 "Nonce missing from response");
1265 $parts = Auth_OpenID_splitNonce($nonce);
1267 if ($parts === null) {
1268 return new Auth_OpenID_FailureResponse($endpoint,
1269 "Malformed nonce in response");
1272 list($timestamp, $salt) = $parts;
1274 if (!$this->store->useNonce($server_url, $timestamp, $salt)) {
1275 return new Auth_OpenID_FailureResponse($endpoint,
1276 "Nonce already used or out of range");
1285 function _idResCheckForFields($message)
1287 $basic_fields = array('return_to', 'assoc_handle', 'sig', 'signed');
1288 $basic_sig_fields = array('return_to', 'identity');
1290 $require_fields = array(
1291 Auth_OpenID_OPENID2_NS => array_merge($basic_fields,
1292 array('op_endpoint')),
1294 Auth_OpenID_OPENID1_NS => array_merge($basic_fields,
1298 $require_sigs = array(
1299 Auth_OpenID_OPENID2_NS => array_merge($basic_sig_fields,
1300 array('response_nonce',
1304 Auth_OpenID_OPENID1_NS => array_merge($basic_sig_fields,
1308 foreach ($require_fields[$message->getOpenIDNamespace()] as $field) {
1309 if (!$message->hasKey(Auth_OpenID_OPENID_NS, $field)) {
1310 return new Auth_OpenID_FailureResponse(null,
1311 "Missing required field '".$field."'");
1315 $signed_list_str = $message->getArg(Auth_OpenID_OPENID_NS,
1317 Auth_OpenID_NO_DEFAULT);
1318 if (Auth_OpenID::isFailure($signed_list_str)) {
1319 return $signed_list_str;
1321 $signed_list = explode(',', $signed_list_str);
1323 foreach ($require_sigs[$message->getOpenIDNamespace()] as $field) {
1324 // Field is present and not in signed list
1325 if ($message->hasKey(Auth_OpenID_OPENID_NS, $field) &&
1326 (!in_array($field, $signed_list))) {
1327 return new Auth_OpenID_FailureResponse(null,
1328 "'".$field."' not signed");
1338 function _checkAuth($message, $server_url)
1340 $request = $this->_createCheckAuthRequest($message);
1341 if ($request === null) {
1345 $resp_message = $this->_makeKVPost($request, $server_url);
1346 if (($resp_message === null) ||
1347 (is_a($resp_message, 'Auth_OpenID_ServerErrorContainer'))) {
1351 return $this->_processCheckAuthResponse($resp_message, $server_url);
1357 function _createCheckAuthRequest($message)
1359 $signed = $message->getArg(Auth_OpenID_OPENID_NS, 'signed');
1361 foreach (explode(',', $signed) as $k) {
1362 $value = $message->getAliasedArg($k);
1363 if ($value === null) {
1368 $ca_message = $message->copy();
1369 $ca_message->setArg(Auth_OpenID_OPENID_NS, 'mode',
1370 'check_authentication');
1377 function _processCheckAuthResponse($response, $server_url)
1379 $is_valid = $response->getArg(Auth_OpenID_OPENID_NS, 'is_valid',
1382 $invalidate_handle = $response->getArg(Auth_OpenID_OPENID_NS,
1383 'invalidate_handle');
1385 if ($invalidate_handle !== null) {
1386 $this->store->removeAssociation($server_url,
1387 $invalidate_handle);
1390 if ($is_valid == 'true') {
1398 * Adapt a POST response to a Message.
1400 * @param $response Result of a POST to an OpenID endpoint.
1404 static function _httpResponseToMessage($response, $server_url)
1406 // Should this function be named Message.fromHTTPResponse instead?
1407 $response_message = Auth_OpenID_Message::fromKVForm($response->body);
1409 if ($response->status == 400) {
1410 return Auth_OpenID_ServerErrorContainer::fromMessage(
1412 } else if ($response->status != 200 and $response->status != 206) {
1416 return $response_message;
1422 function _makeKVPost($message, $server_url)
1424 $body = $message->toURLEncoded();
1425 $resp = $this->fetcher->post($server_url, $body);
1427 if ($resp === null) {
1431 return $this->_httpResponseToMessage($resp, $server_url);
1437 function _getAssociation($endpoint)
1439 if (!$this->_use_assocs) {
1443 $assoc = $this->store->getAssociation($endpoint->server_url);
1445 if (($assoc === null) ||
1446 ($assoc->getExpiresIn() <= 0)) {
1448 $assoc = $this->_negotiateAssociation($endpoint);
1450 if ($assoc !== null) {
1451 $this->store->storeAssociation($endpoint->server_url,
1460 * Handle ServerErrors resulting from association requests.
1462 * @return $result If server replied with an C{unsupported-type}
1463 * error, return a tuple of supported C{association_type},
1464 * C{session_type}. Otherwise logs the error and returns null.
1468 function _extractSupportedAssociationType($server_error, $endpoint,
1471 // Any error message whose code is not 'unsupported-type'
1472 // should be considered a total failure.
1473 if (($server_error->error_code != 'unsupported-type') ||
1474 ($server_error->message->isOpenID1())) {
1478 // The server didn't like the association/session type that we
1479 // sent, and it sent us back a message that might tell us how
1482 // Extract the session_type and assoc_type from the error
1484 $assoc_type = $server_error->message->getArg(Auth_OpenID_OPENID_NS,
1487 $session_type = $server_error->message->getArg(Auth_OpenID_OPENID_NS,
1490 if (($assoc_type === null) || ($session_type === null)) {
1492 } else if (!$this->negotiator->isAllowed($assoc_type,
1496 return array($assoc_type, $session_type);
1503 function _negotiateAssociation($endpoint)
1505 // Get our preferred session/association type from the negotiatior.
1506 list($assoc_type, $session_type) = $this->negotiator->getAllowedType();
1508 $assoc = $this->_requestAssociation(
1509 $endpoint, $assoc_type, $session_type);
1511 if (Auth_OpenID::isFailure($assoc)) {
1515 if (is_a($assoc, 'Auth_OpenID_ServerErrorContainer')) {
1518 $supportedTypes = $this->_extractSupportedAssociationType(
1519 $why, $endpoint, $assoc_type);
1521 if ($supportedTypes !== null) {
1522 list($assoc_type, $session_type) = $supportedTypes;
1524 // Attempt to create an association from the assoc_type
1525 // and session_type that the server told us it
1527 $assoc = $this->_requestAssociation(
1528 $endpoint, $assoc_type, $session_type);
1530 if (is_a($assoc, 'Auth_OpenID_ServerErrorContainer')) {
1531 // Do not keep trying, since it rejected the
1532 // association type that it told us to use.
1533 // oidutil.log('Server %s refused its suggested association
1534 // 'type: session_type=%s, assoc_type=%s'
1535 // % (endpoint.server_url, session_type,
1552 function _requestAssociation($endpoint, $assoc_type, $session_type)
1554 list($assoc_session, $args) = $this->_createAssociateRequest(
1555 $endpoint, $assoc_type, $session_type);
1557 $response_message = $this->_makeKVPost($args, $endpoint->server_url);
1559 if ($response_message === null) {
1560 // oidutil.log('openid.associate request failed: %s' % (why[0],))
1562 } else if (is_a($response_message,
1563 'Auth_OpenID_ServerErrorContainer')) {
1564 return $response_message;
1567 return $this->_extractAssociation($response_message, $assoc_session);
1573 function _extractAssociation($assoc_response, $assoc_session)
1575 // Extract the common fields from the response, raising an
1576 // exception if they are not found
1577 $assoc_type = $assoc_response->getArg(
1578 Auth_OpenID_OPENID_NS, 'assoc_type',
1579 Auth_OpenID_NO_DEFAULT);
1581 if (Auth_OpenID::isFailure($assoc_type)) {
1585 $assoc_handle = $assoc_response->getArg(
1586 Auth_OpenID_OPENID_NS, 'assoc_handle',
1587 Auth_OpenID_NO_DEFAULT);
1589 if (Auth_OpenID::isFailure($assoc_handle)) {
1590 return $assoc_handle;
1593 // expires_in is a base-10 string. The Python parsing will
1594 // accept literals that have whitespace around them and will
1595 // accept negative values. Neither of these are really in-spec,
1596 // but we think it's OK to accept them.
1597 $expires_in_str = $assoc_response->getArg(
1598 Auth_OpenID_OPENID_NS, 'expires_in',
1599 Auth_OpenID_NO_DEFAULT);
1601 if (Auth_OpenID::isFailure($expires_in_str)) {
1602 return $expires_in_str;
1605 $expires_in = Auth_OpenID::intval($expires_in_str);
1606 if ($expires_in === false) {
1608 $err = sprintf("Could not parse expires_in from association ".
1609 "response %s", print_r($assoc_response, true));
1610 return new Auth_OpenID_FailureResponse(null, $err);
1613 // OpenID 1 has funny association session behaviour.
1614 if ($assoc_response->isOpenID1()) {
1615 $session_type = $this->_getOpenID1SessionType($assoc_response);
1617 $session_type = $assoc_response->getArg(
1618 Auth_OpenID_OPENID2_NS, 'session_type',
1619 Auth_OpenID_NO_DEFAULT);
1621 if (Auth_OpenID::isFailure($session_type)) {
1622 return $session_type;
1626 // Session type mismatch
1627 if ($assoc_session->session_type != $session_type) {
1628 if ($assoc_response->isOpenID1() &&
1629 ($session_type == 'no-encryption')) {
1630 // In OpenID 1, any association request can result in
1631 // a 'no-encryption' association response. Setting
1632 // assoc_session to a new no-encryption session should
1633 // make the rest of this function work properly for
1635 $assoc_session = new Auth_OpenID_PlainTextConsumerSession();
1637 // Any other mismatch, regardless of protocol version
1638 // results in the failure of the association session
1644 // Make sure assoc_type is valid for session_type
1645 if (!in_array($assoc_type, $assoc_session->allowed_assoc_types)) {
1649 // Delegate to the association session to extract the secret
1650 // from the response, however is appropriate for that session
1652 $secret = $assoc_session->extractSecret($assoc_response);
1654 if ($secret === null) {
1658 return Auth_OpenID_Association::fromExpiresIn(
1659 $expires_in, $assoc_handle, $secret, $assoc_type);
1665 function _createAssociateRequest($endpoint, $assoc_type, $session_type)
1667 if (array_key_exists($session_type, $this->session_types)) {
1668 $session_type_class = $this->session_types[$session_type];
1670 if (is_callable($session_type_class)) {
1671 $assoc_session = $session_type_class();
1673 $assoc_session = new $session_type_class();
1680 'mode' => 'associate',
1681 'assoc_type' => $assoc_type);
1683 if (!$endpoint->compatibilityMode()) {
1684 $args['ns'] = Auth_OpenID_OPENID2_NS;
1687 // Leave out the session type if we're in compatibility mode
1688 // *and* it's no-encryption.
1689 if ((!$endpoint->compatibilityMode()) ||
1690 ($assoc_session->session_type != 'no-encryption')) {
1691 $args['session_type'] = $assoc_session->session_type;
1694 $args = array_merge($args, $assoc_session->getRequest());
1695 $message = Auth_OpenID_Message::fromOpenIDArgs($args);
1696 return array($assoc_session, $message);
1700 * Given an association response message, extract the OpenID 1.X
1703 * This function mostly takes care of the 'no-encryption' default
1704 * behavior in OpenID 1.
1706 * If the association type is plain-text, this function will
1707 * return 'no-encryption'
1710 * @return $typ The association type for this message
1712 function _getOpenID1SessionType($assoc_response)
1714 // If it's an OpenID 1 message, allow session_type to default
1715 // to None (which signifies "no-encryption")
1716 $session_type = $assoc_response->getArg(Auth_OpenID_OPENID1_NS,
1719 // Handle the differences between no-encryption association
1720 // respones in OpenID 1 and 2:
1722 // no-encryption is not really a valid session type for OpenID
1723 // 1, but we'll accept it anyway, while issuing a warning.
1724 if ($session_type == 'no-encryption') {
1725 // oidutil.log('WARNING: OpenID server sent "no-encryption"'
1726 // 'for OpenID 1.X')
1727 } else if (($session_type == '') || ($session_type === null)) {
1728 // Missing or empty session type is the way to flag a
1729 // 'no-encryption' response. Change the session type to
1730 // 'no-encryption' so that it can be handled in the same
1731 // way as OpenID 2 'no-encryption' respones.
1732 $session_type = 'no-encryption';
1735 return $session_type;
1740 * This class represents an authentication request from a consumer to
1745 class Auth_OpenID_AuthRequest {
1748 * Initialize an authentication request with the specified token,
1749 * association, and endpoint.
1751 * Users of this library should not create instances of this
1752 * class. Instances of this class are created by the library when
1755 function Auth_OpenID_AuthRequest($endpoint, $assoc)
1757 $this->assoc = $assoc;
1758 $this->endpoint = $endpoint;
1759 $this->return_to_args = array();
1760 $this->message = new Auth_OpenID_Message(
1761 $endpoint->preferredNamespace());
1762 $this->_anonymous = false;
1766 * Add an extension to this checkid request.
1768 * $extension_request: An object that implements the extension
1769 * request interface for adding arguments to an OpenID message.
1771 function addExtension($extension_request)
1773 $extension_request->toMessage($this->message);
1777 * Add an extension argument to this OpenID authentication
1780 * Use caution when adding arguments, because they will be
1781 * URL-escaped and appended to the redirect URL, which can easily
1784 * @param string $namespace The namespace for the extension. For
1785 * example, the simple registration extension uses the namespace
1788 * @param string $key The key within the extension namespace. For
1789 * example, the nickname field in the simple registration
1790 * extension's key is 'nickname'.
1792 * @param string $value The value to provide to the server for
1795 function addExtensionArg($namespace, $key, $value)
1797 return $this->message->setArg($namespace, $key, $value);
1801 * Set whether this request should be made anonymously. If a
1802 * request is anonymous, the identifier will not be sent in the
1803 * request. This is only useful if you are making another kind of
1804 * request with an extension in this request.
1806 * Anonymous requests are not allowed when the request is made
1809 function setAnonymous($is_anonymous)
1811 if ($is_anonymous && $this->message->isOpenID1()) {
1814 $this->_anonymous = $is_anonymous;
1820 * Produce a {@link Auth_OpenID_Message} representing this
1823 * @param string $realm The URL (or URL pattern) that identifies
1824 * your web site to the user when she is authorizing it.
1826 * @param string $return_to The URL that the OpenID provider will
1827 * send the user back to after attempting to verify her identity.
1829 * Not specifying a return_to URL means that the user will not be
1830 * returned to the site issuing the request upon its completion.
1832 * @param bool $immediate If true, the OpenID provider is to send
1833 * back a response immediately, useful for behind-the-scenes
1834 * authentication attempts. Otherwise the OpenID provider may
1835 * engage the user before providing a response. This is the
1836 * default case, as the user may need to provide credentials or
1837 * approve the request before a positive response can be sent.
1839 function getMessage($realm, $return_to=null, $immediate=false)
1842 $return_to = Auth_OpenID::appendArgs($return_to,
1843 $this->return_to_args);
1844 } else if ($immediate) {
1845 // raise ValueError(
1846 // '"return_to" is mandatory when
1847 //using "checkid_immediate"')
1848 return new Auth_OpenID_FailureResponse(null,
1849 "'return_to' is mandatory when using checkid_immediate");
1850 } else if ($this->message->isOpenID1()) {
1851 // raise ValueError('"return_to" is
1852 // mandatory for OpenID 1 requests')
1853 return new Auth_OpenID_FailureResponse(null,
1854 "'return_to' is mandatory for OpenID 1 requests");
1855 } else if ($this->return_to_args) {
1856 // raise ValueError('extra "return_to" arguments
1857 // were specified, but no return_to was specified')
1858 return new Auth_OpenID_FailureResponse(null,
1859 "extra 'return_to' arguments where specified, " .
1860 "but no return_to was specified");
1864 $mode = 'checkid_immediate';
1866 $mode = 'checkid_setup';
1869 $message = $this->message->copy();
1870 if ($message->isOpenID1()) {
1871 $realm_key = 'trust_root';
1873 $realm_key = 'realm';
1876 $message->updateArgs(Auth_OpenID_OPENID_NS,
1878 $realm_key => $realm,
1880 'return_to' => $return_to));
1882 if (!$this->_anonymous) {
1883 if ($this->endpoint->isOPIdentifier()) {
1884 // This will never happen when we're in compatibility
1885 // mode, as long as isOPIdentifier() returns False
1886 // whenever preferredNamespace() returns OPENID1_NS.
1887 $claimed_id = $request_identity =
1888 Auth_OpenID_IDENTIFIER_SELECT;
1890 $request_identity = $this->endpoint->getLocalID();
1891 $claimed_id = $this->endpoint->claimed_id;
1894 // This is true for both OpenID 1 and 2
1895 $message->setArg(Auth_OpenID_OPENID_NS, 'identity',
1898 if ($message->isOpenID2()) {
1899 $message->setArg(Auth_OpenID_OPENID2_NS, 'claimed_id',
1905 $message->setArg(Auth_OpenID_OPENID_NS, 'assoc_handle',
1906 $this->assoc->handle);
1912 function redirectURL($realm, $return_to = null,
1915 $message = $this->getMessage($realm, $return_to, $immediate);
1917 if (Auth_OpenID::isFailure($message)) {
1921 return $message->toURL($this->endpoint->server_url);
1925 * Get html for a form to submit this request to the IDP.
1927 * form_tag_attrs: An array of attributes to be added to the form
1928 * tag. 'accept-charset' and 'enctype' have defaults that can be
1929 * overridden. If a value is supplied for 'action' or 'method', it
1932 function formMarkup($realm, $return_to=null, $immediate=false,
1933 $form_tag_attrs=null)
1935 $message = $this->getMessage($realm, $return_to, $immediate);
1937 if (Auth_OpenID::isFailure($message)) {
1941 return $message->toFormMarkup($this->endpoint->server_url,
1946 * Get a complete html document that will autosubmit the request
1949 * Wraps formMarkup. See the documentation for that function.
1951 function htmlMarkup($realm, $return_to=null, $immediate=false,
1952 $form_tag_attrs=null)
1954 $form = $this->formMarkup($realm, $return_to, $immediate,
1957 if (Auth_OpenID::isFailure($form)) {
1960 return Auth_OpenID::autoSubmitHTML($form);
1963 function shouldSendRedirect()
1965 return $this->endpoint->compatibilityMode();
1970 * The base class for responses from the Auth_OpenID_Consumer.
1974 class Auth_OpenID_ConsumerResponse {
1977 function setEndpoint($endpoint)
1979 $this->endpoint = $endpoint;
1980 if ($endpoint === null) {
1981 $this->identity_url = null;
1983 $this->identity_url = $endpoint->claimed_id;
1988 * Return the display identifier for this response.
1990 * The display identifier is related to the Claimed Identifier, but the
1991 * two are not always identical. The display identifier is something the
1992 * user should recognize as what they entered, whereas the response's
1993 * claimed identifier (in the identity_url attribute) may have extra
1994 * information for better persistence.
1996 * URLs will be stripped of their fragments for display. XRIs will
1997 * display the human-readable identifier (i-name) instead of the
1998 * persistent identifier (i-number).
2000 * Use the display identifier in your user interface. Use
2001 * identity_url for querying your database or authorization server.
2004 function getDisplayIdentifier()
2006 if ($this->endpoint !== null) {
2007 return $this->endpoint->getDisplayIdentifier();
2014 * A response with a status of Auth_OpenID_SUCCESS. Indicates that
2015 * this request is a successful acknowledgement from the OpenID server
2016 * that the supplied URL is, indeed controlled by the requesting
2017 * agent. This has three relevant attributes:
2019 * claimed_id - The identity URL that has been authenticated
2021 * signed_args - The arguments in the server's response that were
2022 * signed and verified.
2024 * status - Auth_OpenID_SUCCESS.
2028 class Auth_OpenID_SuccessResponse extends Auth_OpenID_ConsumerResponse {
2029 var $status = Auth_OpenID_SUCCESS;
2034 function Auth_OpenID_SuccessResponse($endpoint, $message, $signed_args=null)
2036 $this->endpoint = $endpoint;
2037 $this->identity_url = $endpoint->claimed_id;
2038 $this->signed_args = $signed_args;
2039 $this->message = $message;
2041 if ($this->signed_args === null) {
2042 $this->signed_args = array();
2047 * Extract signed extension data from the server's response.
2049 * @param string $prefix The extension namespace from which to
2050 * extract the extension data.
2052 function extensionResponse($namespace_uri, $require_signed)
2054 if ($require_signed) {
2055 return $this->getSignedNS($namespace_uri);
2057 return $this->message->getArgs($namespace_uri);
2061 function isOpenID1()
2063 return $this->message->isOpenID1();
2066 function isSigned($ns_uri, $ns_key)
2068 // Return whether a particular key is signed, regardless of
2069 // its namespace alias
2070 return in_array($this->message->getKey($ns_uri, $ns_key),
2071 $this->signed_args);
2074 function getSigned($ns_uri, $ns_key, $default = null)
2076 // Return the specified signed field if available, otherwise
2078 if ($this->isSigned($ns_uri, $ns_key)) {
2079 return $this->message->getArg($ns_uri, $ns_key, $default);
2085 function getSignedNS($ns_uri)
2089 $msg_args = $this->message->getArgs($ns_uri);
2090 if (Auth_OpenID::isFailure($msg_args)) {
2094 foreach ($msg_args as $key => $value) {
2095 if (!$this->isSigned($ns_uri, $key)) {
2096 unset($msg_args[$key]);
2104 * Get the openid.return_to argument from this response.
2106 * This is useful for verifying that this request was initiated by
2109 * @return string $return_to The return_to URL supplied to the
2110 * server on the initial request, or null if the response did not
2111 * contain an 'openid.return_to' argument.
2113 function getReturnTo()
2115 return $this->getSigned(Auth_OpenID_OPENID_NS, 'return_to');
2120 * A response with a status of Auth_OpenID_FAILURE. Indicates that the
2121 * OpenID protocol has failed. This could be locally or remotely
2122 * triggered. This has three relevant attributes:
2124 * claimed_id - The identity URL for which authentication was
2125 * attempted, if it can be determined. Otherwise, null.
2127 * message - A message indicating why the request failed, if one is
2128 * supplied. Otherwise, null.
2130 * status - Auth_OpenID_FAILURE.
2134 class Auth_OpenID_FailureResponse extends Auth_OpenID_ConsumerResponse {
2135 var $status = Auth_OpenID_FAILURE;
2137 function Auth_OpenID_FailureResponse($endpoint, $message = null,
2138 $contact = null, $reference = null)
2140 $this->setEndpoint($endpoint);
2141 $this->message = $message;
2142 $this->contact = $contact;
2143 $this->reference = $reference;
2148 * A specific, internal failure used to detect type URI mismatch.
2152 class Auth_OpenID_TypeURIMismatch extends Auth_OpenID_FailureResponse {
2156 * Exception that is raised when the server returns a 400 response
2157 * code to a direct request.
2161 class Auth_OpenID_ServerErrorContainer {
2162 function Auth_OpenID_ServerErrorContainer($error_text,
2166 $this->error_text = $error_text;
2167 $this->error_code = $error_code;
2168 $this->message = $message;
2174 static function fromMessage($message)
2176 $error_text = $message->getArg(
2177 Auth_OpenID_OPENID_NS, 'error', '<no error message supplied>');
2178 $error_code = $message->getArg(Auth_OpenID_OPENID_NS, 'error_code');
2179 return new Auth_OpenID_ServerErrorContainer($error_text,
2186 * A response with a status of Auth_OpenID_CANCEL. Indicates that the
2187 * user cancelled the OpenID authentication request. This has two
2188 * relevant attributes:
2190 * claimed_id - The identity URL for which authentication was
2191 * attempted, if it can be determined. Otherwise, null.
2193 * status - Auth_OpenID_SUCCESS.
2197 class Auth_OpenID_CancelResponse extends Auth_OpenID_ConsumerResponse {
2198 var $status = Auth_OpenID_CANCEL;
2200 function Auth_OpenID_CancelResponse($endpoint)
2202 $this->setEndpoint($endpoint);
2207 * A response with a status of Auth_OpenID_SETUP_NEEDED. Indicates
2208 * that the request was in immediate mode, and the server is unable to
2209 * authenticate the user without further interaction.
2211 * claimed_id - The identity URL for which authentication was
2214 * setup_url - A URL that can be used to send the user to the server
2215 * to set up for authentication. The user should be redirected in to
2216 * the setup_url, either in the current window or in a new browser
2217 * window. Null in OpenID 2.
2219 * status - Auth_OpenID_SETUP_NEEDED.
2223 class Auth_OpenID_SetupNeededResponse extends Auth_OpenID_ConsumerResponse {
2224 var $status = Auth_OpenID_SETUP_NEEDED;
2226 function Auth_OpenID_SetupNeededResponse($endpoint,
2229 $this->setEndpoint($endpoint);
2230 $this->setup_url = $setup_url;