Support Joomla!

Packages

Package: OpenID

License

Content on this site is copyright © 2005 - 2008 Open Source Matters Inc and can be used in accordance with the Joomla! Electronic Documentation License. Some parts of this website may be subject to other licenses.
Source code for file /openid/Auth/OpenID/Server.php

Documentation is available at Server.php

  1. <?php
  2.  
  3. /**
  4.  * OpenID server protocol and logic.
  5.  * 
  6.  * Overview
  7.  *
  8.  * An OpenID server must perform three tasks:
  9.  *
  10.  *  1. Examine the incoming request to determine its nature and validity.
  11.  *  2. Make a decision about how to respond to this request.
  12.  *  3. Format the response according to the protocol.
  13.  * 
  14.  * The first and last of these tasks may performed by the {@link }
  15.  * Auth_OpenID_Server::decodeRequest()} and {@link }
  16.  * Auth_OpenID_Server::encodeResponse} methods.  Who gets to do the
  17.  * intermediate task -- deciding how to respond to the request -- will
  18.  * depend on what type of request it is.
  19.  *
  20.  * If it's a request to authenticate a user (a 'checkid_setup' or
  21.  * 'checkid_immediate' request), you need to decide if you will assert
  22.  * that this user may claim the identity in question.  Exactly how you
  23.  * do that is a matter of application policy, but it generally
  24.  * involves making sure the user has an account with your system and
  25.  * is logged in, checking to see if that identity is hers to claim,
  26.  * and verifying with the user that she does consent to releasing that
  27.  * information to the party making the request.
  28.  *
  29.  * Examine the properties of the {@link Auth_OpenID_CheckIDRequest}
  30.  * object, and if and when you've come to a decision, form a response
  31.  * by calling {@link Auth_OpenID_CheckIDRequest::answer()}.
  32.  *
  33.  * Other types of requests relate to establishing associations between
  34.  * client and server and verifing the authenticity of previous
  35.  * communications.  {@link Auth_OpenID_Server} contains all the logic
  36.  * and data necessary to respond to such requests; just pass it to
  37.  * {@link Auth_OpenID_Server::handleRequest()}.
  38.  *
  39.  * OpenID Extensions
  40.  * 
  41.  * Do you want to provide other information for your users in addition
  42.  * to authentication?  Version 1.2 of the OpenID protocol allows
  43.  * consumers to add extensions to their requests.  For example, with
  44.  * sites using the Simple Registration
  45.  * Extension
  46.  * (http://www.openidenabled.com/openid/simple-registration-extension/),
  47.  * a user can agree to have their nickname and e-mail address sent to
  48.  * a site when they sign up.
  49.  *
  50.  * Since extensions do not change the way OpenID authentication works,
  51.  * code to handle extension requests may be completely separate from
  52.  * the {@link Auth_OpenID_Request} class here.  But you'll likely want
  53.  * data sent back by your extension to be signed.  {@link }
  54.  * Auth_OpenID_ServerResponse} provides methods with which you can add
  55.  * data to it which can be signed with the other data in the OpenID
  56.  * signature.
  57.  *
  58.  * For example:
  59.  *
  60.  * <pre>  // when request is a checkid_* request
  61.  *  $response = $request->answer(true);
  62.  *  // this will a signed 'openid.sreg.timezone' parameter to the response
  63.  *  response.addField('sreg', 'timezone', 'America/Los_Angeles')</pre>
  64.  *
  65.  * Stores
  66.  *
  67.  * The OpenID server needs to maintain state between requests in order
  68.  * to function.  Its mechanism for doing this is called a store.  The
  69.  * store interface is defined in Interface.php.  Additionally, several
  70.  * concrete store implementations are provided, so that most sites
  71.  * won't need to implement a custom store.  For a store backed by flat
  72.  * files on disk, see {@link Auth_OpenID_FileStore}.  For stores based
  73.  * on MySQL, SQLite, or PostgreSQL, see the {@link }
  74.  * Auth_OpenID_SQLStore} subclasses.
  75.  *
  76.  * Upgrading
  77.  *
  78.  * The keys by which a server looks up associations in its store have
  79.  * changed in version 1.2 of this library.  If your store has entries
  80.  * created from version 1.0 code, you should empty it.
  81.  *
  82.  * PHP versions 4 and 5
  83.  *
  84.  * LICENSE: See the COPYING file included in this distribution.
  85.  *
  86.  * @package OpenID
  87.  * @author JanRain, Inc. <openid@janrain.com>
  88.  * @copyright 2005-2008 Janrain, Inc.
  89.  * @license http://www.apache.org/licenses/LICENSE-2.0 Apache
  90.  */
  91.  
  92. // Do not allow direct access
  93. defined( '_JEXEC' ) or die( 'Restricted access' );
  94.  
  95. /**
  96.  * Required imports
  97.  */
  98. require_once "Auth/OpenID.php";
  99. require_once "Auth/OpenID/Association.php";
  100. require_once "Auth/OpenID/CryptUtil.php";
  101. require_once "Auth/OpenID/BigMath.php";
  102. require_once "Auth/OpenID/DiffieHellman.php";
  103. require_once "Auth/OpenID/KVForm.php";
  104. require_once "Auth/OpenID/TrustRoot.php";
  105. require_once "Auth/OpenID/ServerRequest.php";
  106. require_once "Auth/OpenID/Message.php";
  107. require_once "Auth/OpenID/Nonce.php";
  108.  
  109. define('AUTH_OPENID_HTTP_OK', 200);
  110. define('AUTH_OPENID_HTTP_REDIRECT', 302);
  111. define('AUTH_OPENID_HTTP_ERROR', 400);
  112.  
  113. /**
  114.  * @access private
  115.  */
  116. global $_Auth_OpenID_Request_Modes;
  117. $_Auth_OpenID_Request_Modes = array('checkid_setup',
  118.                                     'checkid_immediate');
  119.  
  120. /**
  121.  * @access private
  122.  */
  123. define('Auth_OpenID_ENCODE_KVFORM', 'kfvorm');
  124.  
  125. /**
  126.  * @access private
  127.  */
  128. define('Auth_OpenID_ENCODE_URL', 'URL/redirect');
  129.  
  130. /**
  131.  * @access private
  132.  */
  133. define('Auth_OpenID_ENCODE_HTML_FORM', 'HTML form');
  134.  
  135. /**
  136.  * @access private
  137.  */
  138. function Auth_OpenID_isError($obj, $cls = 'Auth_OpenID_ServerError')
  139. {
  140.     return is_a($obj, $cls);
  141. }
  142.  
  143. /**
  144.  * An error class which gets instantiated and returned whenever an
  145.  * OpenID protocol error occurs.  Be prepared to use this in place of
  146.  * an ordinary server response.
  147.  *
  148.  * @package OpenID
  149.  */
  150. class Auth_OpenID_ServerError {
  151.     /**
  152.      * @access private
  153.      */
  154.     function Auth_OpenID_ServerError($message = null, $text = null,
  155.                                      $reference = null, $contact = null)
  156.     {
  157.         $this->message = $message;
  158.         $this->text = $text;
  159.         $this->contact = $contact;
  160.         $this->reference = $reference;
  161.     }
  162.  
  163.     function getReturnTo()
  164.     {
  165.         if ($this->message &&
  166.             $this->message->hasKey(Auth_OpenID_OPENID_NS, 'return_to')) {
  167.             return $this->message->getArg(Auth_OpenID_OPENID_NS,
  168.                                           'return_to');
  169.         } else {
  170.             return null;
  171.         }
  172.     }
  173.  
  174.     /**
  175.      * Returns the return_to URL for the request which caused this
  176.      * error.
  177.      */
  178.     function hasReturnTo()
  179.     {
  180.         return $this->getReturnTo() !== null;
  181.     }
  182.  
  183.     /**
  184.      * Encodes this error's response as a URL suitable for
  185.      * redirection.  If the response has no return_to, another
  186.      * Auth_OpenID_ServerError is returned.
  187.      */
  188.     function encodeToURL()
  189.     {
  190.         if (!$this->message) {
  191.             return null;
  192.         }
  193.  
  194.         $msg = $this->toMessage();
  195.         return $msg->toURL($this->getReturnTo());
  196.     }
  197.  
  198.     /**
  199.      * Encodes the response to key-value form.  This is a
  200.      * machine-readable format used to respond to messages which came
  201.      * directly from the consumer and not through the user-agent.  See
  202.      * the OpenID specification.
  203.      */
  204.     function encodeToKVForm()
  205.     {
  206.         return Auth_OpenID_KVForm::fromArray(
  207.                                       array('mode' => 'error',
  208.                                             'error' => $this->toString()));
  209.     }
  210.  
  211.     function toFormMarkup($form_tag_attrs=null)
  212.     {
  213.         $msg = $this->toMessage();
  214.         return $msg->toFormMarkup($this->getReturnTo(), $form_tag_attrs);
  215.     }
  216.  
  217.     function toHTML($form_tag_attrs=null)
  218.     {
  219.         return Auth_OpenID::autoSubmitHTML(
  220.                       $this->toFormMarkup($form_tag_attrs));
  221.     }
  222.  
  223.     function toMessage()
  224.     {
  225.         // Generate a Message object for sending to the relying party,
  226.         // after encoding.
  227.         $namespace = $this->message->getOpenIDNamespace();
  228.         $reply = new Auth_OpenID_Message($namespace);
  229.         $reply->setArg(Auth_OpenID_OPENID_NS, 'mode', 'error');
  230.         $reply->setArg(Auth_OpenID_OPENID_NS, 'error', $this->toString());
  231.  
  232.         if ($this->contact !== null) {
  233.             $reply->setArg(Auth_OpenID_OPENID_NS, 'contact', $this->contact);
  234.         }
  235.  
  236.         if ($this->reference !== null) {
  237.             $reply->setArg(Auth_OpenID_OPENID_NS, 'reference',
  238.                            $this->reference);
  239.         }
  240.  
  241.         return $reply;
  242.     }
  243.  
  244.     /**
  245.      * Returns one of Auth_OpenID_ENCODE_URL,
  246.      * Auth_OpenID_ENCODE_KVFORM, or null, depending on the type of
  247.      * encoding expected for this error's payload.
  248.      */
  249.     function whichEncoding()
  250.     {
  251.         global $_Auth_OpenID_Request_Modes;
  252.  
  253.         if ($this->hasReturnTo()) {
  254.             if ($this->message->isOpenID2() &&
  255.                 (strlen($this->encodeToURL()) >
  256.                    Auth_OpenID_OPENID1_URL_LIMIT)) {
  257.                 return Auth_OpenID_ENCODE_HTML_FORM;
  258.             } else {
  259.                 return Auth_OpenID_ENCODE_URL;
  260.             }
  261.         }
  262.  
  263.         if (!$this->message) {
  264.             return null;
  265.         }
  266.  
  267.         $mode = $this->message->getArg(Auth_OpenID_OPENID_NS,
  268.                                        'mode');
  269.  
  270.         if ($mode) {
  271.             if (!in_array($mode, $_Auth_OpenID_Request_Modes)) {
  272.                 return Auth_OpenID_ENCODE_KVFORM;
  273.             }
  274.         }
  275.         return null;
  276.     }
  277.  
  278.     /**
  279.      * Returns this error message.
  280.      */
  281.     function toString()
  282.     {
  283.         if ($this->text) {
  284.             return $this->text;
  285.         } else {
  286.             return get_class($this) . " error";
  287.         }
  288.     }
  289. }
  290.  
  291. /**
  292.  * Error returned by the server code when a return_to is absent from a
  293.  * request.
  294.  *
  295.  * @package OpenID
  296.  */
  297. class Auth_OpenID_NoReturnToError extends Auth_OpenID_ServerError {
  298.     function Auth_OpenID_NoReturnToError($message = null,
  299.                                          $text = "No return_to URL available")
  300.     {
  301.         parent::Auth_OpenID_ServerError($message, $text);
  302.     }
  303.  
  304.     function toString()
  305.     {
  306.         return "No return_to available";
  307.     }
  308. }
  309.  
  310. /**
  311.  * An error indicating that the return_to URL is malformed.
  312.  *
  313.  * @package OpenID
  314.  */
  315. class Auth_OpenID_MalformedReturnURL extends Auth_OpenID_ServerError {
  316.     function Auth_OpenID_MalformedReturnURL($message, $return_to)
  317.     {
  318.         $this->return_to = $return_to;
  319.         parent::Auth_OpenID_ServerError($message, "malformed return_to URL");
  320.     }
  321. }
  322.  
  323. /**
  324.  * This error is returned when the trust_root value is malformed.
  325.  *
  326.  * @package OpenID
  327.  */
  328. class Auth_OpenID_MalformedTrustRoot extends Auth_OpenID_ServerError {
  329.     function Auth_OpenID_MalformedTrustRoot($message = null,
  330.                                             $text = "Malformed trust root")
  331.     {
  332.         parent::Auth_OpenID_ServerError($message, $text);
  333.     }
  334.  
  335.     function toString()
  336.     {
  337.         return "Malformed trust root";
  338.     }
  339. }
  340.  
  341. /**
  342.  * The base class for all server request classes.
  343.  *
  344.  * @package OpenID
  345.  */
  346. class Auth_OpenID_Request {
  347.     var $mode = null;
  348. }
  349.  
  350. /**
  351.  * A request to verify the validity of a previous response.
  352.  *
  353.  * @package OpenID
  354.  */
  355. class Auth_OpenID_CheckAuthRequest extends Auth_OpenID_Request {
  356.     var $mode = "check_authentication";
  357.     var $invalidate_handle = null;
  358.  
  359.     function Auth_OpenID_CheckAuthRequest($assoc_handle, $signed,
  360.                                           $invalidate_handle = null)
  361.     {
  362.         $this->assoc_handle = $assoc_handle;
  363.         $this->signed = $signed;
  364.         if ($invalidate_handle !== null) {
  365.             $this->invalidate_handle = $invalidate_handle;
  366.         }
  367.         $this->namespace = Auth_OpenID_OPENID2_NS;
  368.         $this->message = null;
  369.     }
  370.  
  371.     function fromMessage($message, $server=null)
  372.     {
  373.         $required_keys = array('assoc_handle', 'sig', 'signed');
  374.  
  375.         foreach ($required_keys as $k) {
  376.             if (!$message->getArg(Auth_OpenID_OPENID_NS, $k)) {
  377.                 return new Auth_OpenID_ServerError($message,
  378.                     sprintf("%s request missing required parameter %s from \
  379.                             query", "check_authentication", $k));
  380.             }
  381.         }
  382.  
  383.         $assoc_handle = $message->getArg(Auth_OpenID_OPENID_NS, 'assoc_handle');
  384.         $sig = $message->getArg(Auth_OpenID_OPENID_NS, 'sig');
  385.  
  386.         $signed_list = $message->getArg(Auth_OpenID_OPENID_NS, 'signed');
  387.         $signed_list = explode(",", $signed_list);
  388.  
  389.         $signed = $message;
  390.         if ($signed->hasKey(Auth_OpenID_OPENID_NS, 'mode')) {
  391.             $signed->setArg(Auth_OpenID_OPENID_NS, 'mode', 'id_res');
  392.         }
  393.  
  394.         $result = new Auth_OpenID_CheckAuthRequest($assoc_handle, $signed);
  395.         $result->message = $message;
  396.         $result->sig = $sig;
  397.         $result->invalidate_handle = $message->getArg(Auth_OpenID_OPENID_NS,
  398.                                                       'invalidate_handle');
  399.         return $result;
  400.     }
  401.  
  402.     function answer(&$signatory)
  403.     {
  404.         $is_valid = $signatory->verify($this->assoc_handle, $this->signed);
  405.  
  406.         // Now invalidate that assoc_handle so it this checkAuth
  407.         // message cannot be replayed.
  408.         $signatory->invalidate($this->assoc_handle, true);
  409.         $response = new Auth_OpenID_ServerResponse($this);
  410.  
  411.         $response->fields->setArg(Auth_OpenID_OPENID_NS,
  412.                                   'is_valid',
  413.                                   ($is_valid ? "true" : "false"));
  414.  
  415.         if ($this->invalidate_handle) {
  416.             $assoc = $signatory->getAssociation($this->invalidate_handle,
  417.                                                 false);
  418.             if (!$assoc) {
  419.                 $response->fields->setArg(Auth_OpenID_OPENID_NS,
  420.                                           'invalidate_handle',
  421.                                           $this->invalidate_handle);
  422.             }
  423.         }
  424.         return $response;
  425.     }
  426. }
  427.  
  428. /**
  429.  * A class implementing plaintext server sessions.
  430.  *
  431.  * @package OpenID
  432.  */
  433. class Auth_OpenID_PlainTextServerSession {
  434.     /**
  435.      * An object that knows how to handle association requests with no
  436.      * session type.
  437.      */
  438.     var $session_type = 'no-encryption';
  439.     var $needs_math = false;
  440.     var $allowed_assoc_types = array('HMAC-SHA1', 'HMAC-SHA256');
  441.  
  442.     function fromMessage($unused_request)
  443.     {
  444.         return new Auth_OpenID_PlainTextServerSession();
  445.     }
  446.  
  447.     function answer($secret)
  448.     {
  449.         return array('mac_key' => base64_encode($secret));
  450.     }
  451. }
  452.  
  453. /**
  454.  * A class implementing DH-SHA1 server sessions.
  455.  *
  456.  * @package OpenID
  457.  */
  458. class Auth_OpenID_DiffieHellmanSHA1ServerSession {
  459.     /**
  460.      * An object that knows how to handle association requests with
  461.      * the Diffie-Hellman session type.
  462.      */
  463.  
  464.     var $session_type = 'DH-SHA1';
  465.     var $needs_math = true;
  466.     var $allowed_assoc_types = array('HMAC-SHA1');
  467.     var $hash_func = 'Auth_OpenID_SHA1';
  468.  
  469.     function Auth_OpenID_DiffieHellmanSHA1ServerSession($dh, $consumer_pubkey)
  470.     {
  471.         $this->dh = $dh;
  472.         $this->consumer_pubkey = $consumer_pubkey;
  473.     }
  474.  
  475.     function getDH($message)
  476.     {
  477.         $dh_modulus = $message->getArg(Auth_OpenID_OPENID_NS, 'dh_modulus');
  478.         $dh_gen = $message->getArg(Auth_OpenID_OPENID_NS, 'dh_gen');
  479.  
  480.         if ((($dh_modulus === null) && ($dh_gen !== null)) ||
  481.             (($dh_gen === null) && ($dh_modulus !== null))) {
  482.  
  483.             if ($dh_modulus === null) {
  484.                 $missing = 'modulus';
  485.             } else {
  486.                 $missing = 'generator';
  487.             }
  488.  
  489.             return new Auth_OpenID_ServerError($message,
  490.                                 'If non-default modulus or generator is '.
  491.                                 'supplied, both must be supplied.  Missing '.
  492.                                 $missing);
  493.         }
  494.  
  495.         $lib =& Auth_OpenID_getMathLib();
  496.  
  497.         if ($dh_modulus || $dh_gen) {
  498.             $dh_modulus = $lib->base64ToLong($dh_modulus);
  499.             $dh_gen = $lib->base64ToLong($dh_gen);
  500.             if ($lib->cmp($dh_modulus, 0) == 0 ||
  501.                 $lib->cmp($dh_gen, 0) == 0) {
  502.                 return new Auth_OpenID_ServerError(
  503.                   $message, "Failed to parse dh_mod or dh_gen");
  504.             }
  505.             $dh = new Auth_OpenID_DiffieHellman($dh_modulus, $dh_gen);
  506.         } else {
  507.             $dh = new Auth_OpenID_DiffieHellman();
  508.         }
  509.  
  510.         $consumer_pubkey = $message->getArg(Auth_OpenID_OPENID_NS,
  511.                                             'dh_consumer_public');
  512.         if ($consumer_pubkey === null) {
  513.             return new Auth_OpenID_ServerError($message,
  514.                                   'Public key for DH-SHA1 session '.
  515.                                   'not found in query');
  516.         }
  517.  
  518.         $consumer_pubkey =
  519.             $lib->base64ToLong($consumer_pubkey);
  520.  
  521.         if ($consumer_pubkey === false) {
  522.             return new Auth_OpenID_ServerError($message,
  523.                                        "dh_consumer_public is not base64");
  524.         }
  525.  
  526.         return array($dh, $consumer_pubkey);
  527.     }
  528.  
  529.     function fromMessage($message)
  530.     {
  531.         $result = Auth_OpenID_DiffieHellmanSHA1ServerSession::getDH($message);
  532.  
  533.         if (is_a($result, 'Auth_OpenID_ServerError')) {
  534.             return $result;
  535.         } else {
  536.             list($dh, $consumer_pubkey) = $result;
  537.             return new Auth_OpenID_DiffieHellmanSHA1ServerSession($dh,
  538.                                                     $consumer_pubkey);
  539.         }
  540.     }
  541.  
  542.     function answer($secret)
  543.     {
  544.         $lib =& Auth_OpenID_getMathLib();
  545.         $mac_key = $this->dh->xorSecret($this->consumer_pubkey, $secret,
  546.                                         $this->hash_func);
  547.         return array(
  548.            'dh_server_public' =>
  549.                 $lib->longToBase64($this->dh->public),
  550.            'enc_mac_key' => base64_encode($mac_key));
  551.     }
  552. }
  553.  
  554. /**
  555.  * A class implementing DH-SHA256 server sessions.
  556.  *
  557.  * @package OpenID
  558.  */
  559. class Auth_OpenID_DiffieHellmanSHA256ServerSession
  560.       extends Auth_OpenID_DiffieHellmanSHA1ServerSession {
  561.  
  562.     var $session_type = 'DH-SHA256';
  563.     var $hash_func = 'Auth_OpenID_SHA256';
  564.     var $allowed_assoc_types = array('HMAC-SHA256');
  565.  
  566.     function fromMessage($message)
  567.     {
  568.         $result = Auth_OpenID_DiffieHellmanSHA1ServerSession::getDH($message);
  569.  
  570.         if (is_a($result, 'Auth_OpenID_ServerError')) {
  571.             return $result;
  572.         } else {
  573.             list($dh, $consumer_pubkey) = $result;
  574.             return new Auth_OpenID_DiffieHellmanSHA256ServerSession($dh,
  575.                                                       $consumer_pubkey);
  576.         }
  577.     }
  578. }
  579.  
  580. /**
  581.  * A request to associate with the server.
  582.  *
  583.  * @package OpenID
  584.  */
  585. class Auth_OpenID_AssociateRequest extends Auth_OpenID_Request {
  586.     var $mode = "associate";
  587.  
  588.     function getSessionClasses()
  589.     {
  590.         return array(
  591.           'no-encryption' => 'Auth_OpenID_PlainTextServerSession',
  592.           'DH-SHA1' => 'Auth_OpenID_DiffieHellmanSHA1ServerSession',
  593.           'DH-SHA256' => 'Auth_OpenID_DiffieHellmanSHA256ServerSession');
  594.     }
  595.  
  596.     function Auth_OpenID_AssociateRequest(&$session, $assoc_type)
  597.     {
  598.         $this->session =& $session;
  599.         $this->namespace = Auth_OpenID_OPENID2_NS;
  600.         $this->assoc_type = $assoc_type;
  601.     }
  602.  
  603.     function fromMessage($message, $server=null)
  604.     {
  605.         if ($message->isOpenID1()) {
  606.             $session_type = $message->getArg(Auth_OpenID_OPENID_NS,
  607.                                              'session_type');
  608.  
  609.             if ($session_type == 'no-encryption') {
  610.                 // oidutil.log('Received OpenID 1 request with a no-encryption '
  611.                 //             'assocaition session type. Continuing anyway.')
  612.             } else if (!$session_type) {
  613.                 $session_type = 'no-encryption';
  614.             }
  615.         } else {
  616.             $session_type = $message->getArg(Auth_OpenID_OPENID_NS,
  617.                                              'session_type');
  618.             if ($session_type === null) {
  619.                 return new Auth_OpenID_ServerError($message,
  620.                   "session_type missing from request");
  621.             }
  622.         }
  623.  
  624.         $session_class = Auth_OpenID::arrayGet(
  625.            Auth_OpenID_AssociateRequest::getSessionClasses(),
  626.            $session_type);
  627.  
  628.         if ($session_class === null) {
  629.             return new Auth_OpenID_ServerError($message,
  630.                                                "Unknown session type " .
  631.                                                $session_type);
  632.         }
  633.  
  634.         $session = call_user_func(array($session_class, 'fromMessage'),
  635.                                   $message);
  636.         if (is_a($session, 'Auth_OpenID_ServerError')) {
  637.             return $session;
  638.         }
  639.  
  640.         $assoc_type = $message->getArg(Auth_OpenID_OPENID_NS,
  641.                                        'assoc_type', 'HMAC-SHA1');
  642.  
  643.         if (!in_array($assoc_type, $session->allowed_assoc_types)) {
  644.             $fmt = "Session type %s does not support association type %s";
  645.             return new Auth_OpenID_ServerError($message,
  646.               sprintf($fmt, $session_type, $assoc_type));
  647.         }
  648.  
  649.         $obj = new Auth_OpenID_AssociateRequest($session, $assoc_type);
  650.         $obj->message = $message;
  651.         $obj->namespace = $message->getOpenIDNamespace();
  652.         return $obj;
  653.     }
  654.  
  655.     function answer($assoc)
  656.     {
  657.         $response = new Auth_OpenID_ServerResponse($this);
  658.         $response->fields->updateArgs(Auth_OpenID_OPENID_NS,
  659.            array(
  660.                  'expires_in' => sprintf('%d', $assoc->getExpiresIn()),
  661.                  'assoc_type' => $this->assoc_type,
  662.                  'assoc_handle' => $assoc->handle));
  663.  
  664.         $response->fields->updateArgs(Auth_OpenID_OPENID_NS,
  665.            $this->session->answer($assoc->secret));
  666.  
  667.         if (! ($this->session->session_type == 'no-encryption' 
  668.                && $this->message->isOpenID1())) {
  669.             $response->fields->setArg(Auth_OpenID_OPENID_NS,
  670.                                       'session_type',
  671.                                       $this->session->session_type);
  672.         }
  673.  
  674.         return $response;
  675.     }
  676.  
  677.     function answerUnsupported($text_message,
  678.                                $preferred_association_type=null,
  679.                                $preferred_session_type=null)
  680.     {
  681.         if ($this->message->isOpenID1()) {
  682.             return new Auth_OpenID_ServerError($this->message);
  683.         }
  684.  
  685.         $response = new Auth_OpenID_ServerResponse($this);
  686.         $response->fields->setArg(Auth_OpenID_OPENID_NS,
  687.                                   'error_code', 'unsupported-type');
  688.         $response->fields->setArg(Auth_OpenID_OPENID_NS,
  689.                                   'error', $text_message);
  690.  
  691.         if ($preferred_association_type) {
  692.             $response->fields->setArg(Auth_OpenID_OPENID_NS,
  693.                                       'assoc_type',
  694.                                       $preferred_association_type);
  695.         }
  696.  
  697.         if ($preferred_session_type) {
  698.             $response->fields->setArg(Auth_OpenID_OPENID_NS,
  699.                                       'session_type',
  700.                                       $preferred_session_type);
  701.         }
  702.  
  703.         return $response;
  704.     }
  705. }
  706.  
  707. /**
  708.  * A request to confirm the identity of a user.
  709.  *
  710.  * @package OpenID
  711.  */
  712. class Auth_OpenID_CheckIDRequest extends Auth_OpenID_Request {
  713.     /**
  714.      * Return-to verification callback.  Default is
  715.      * Auth_OpenID_verifyReturnTo from TrustRoot.php.
  716.      */
  717.     var $verifyReturnTo = 'Auth_OpenID_verifyReturnTo';
  718.  
  719.     /**
  720.      * The mode of this request.
  721.      */
  722.     var $mode = "checkid_setup"; // or "checkid_immediate"
  723.  
  724.     
  725.     /**
  726.      * Whether this request is for immediate mode.
  727.      */
  728.     var $immediate = false;
  729.  
  730.     /**
  731.      * The trust_root value for this request.
  732.      */
  733.     var $trust_root = null;
  734.  
  735.     /**
  736.      * The OpenID namespace for this request.
  737.      * deprecated since version 2.0.2
  738.      */
  739.     var $namespace;
  740.     
  741.     function make(&$message, $identity, $return_to, $trust_root = null,
  742.                   $immediate = false, $assoc_handle = null, $server = null)
  743.     {
  744.         if ($server === null) {
  745.             return new Auth_OpenID_ServerError($message,
  746.                                                "server must not be null");
  747.         }
  748.  
  749.         if ($return_to &&
  750.             !Auth_OpenID_TrustRoot::_parse($return_to)) {
  751.             return new Auth_OpenID_MalformedReturnURL($message, $return_to);
  752.         }
  753.  
  754.         $r = new Auth_OpenID_CheckIDRequest($identity, $return_to,
  755.                                             $trust_root, $immediate,
  756.                                             $assoc_handle, $server);
  757.  
  758.         $r->namespace = $message->getOpenIDNamespace();
  759.         $r->message =& $message;
  760.  
  761.         if (!$r->trustRootValid()) {
  762.             return new Auth_OpenID_UntrustedReturnURL($message,
  763.                                                       $return_to,
  764.                                                       $trust_root);
  765.         } else {
  766.             return $r;
  767.         }
  768.     }
  769.  
  770.     function Auth_OpenID_CheckIDRequest($identity, $return_to,
  771.                                         $trust_root = null, $immediate = false,
  772.                                         $assoc_handle = null, $server = null,
  773.                                         $claimed_id = null)
  774.     {
  775.         $this->namespace = Auth_OpenID_OPENID2_NS;
  776.         $this->assoc_handle = $assoc_handle;
  777.         $this->identity = $identity;
  778.         if ($claimed_id === null) {
  779.             $this->claimed_id = $identity;
  780.         } else {
  781.             $this->claimed_id = $claimed_id;
  782.         }
  783.         $this->return_to = $return_to;
  784.         $this->trust_root = $trust_root;
  785.         $this->server =& $server;
  786.  
  787.         if ($immediate) {
  788.             $this->immediate = true;
  789.             $this->mode = "checkid_immediate";
  790.         } else {
  791.             $this->immediate = false;
  792.             $this->mode = "checkid_setup";
  793.         }
  794.     }
  795.  
  796.     function equals($other)
  797.     {
  798.         return (
  799.                 (is_a($other, 'Auth_OpenID_CheckIDRequest')) &&
  800.                 ($this->namespace == $other->namespace) &&
  801.                 ($this->assoc_handle == $other->assoc_handle) &&
  802.                 ($this->identity == $other->identity) &&
  803.                 ($this->claimed_id == $other->claimed_id) &&
  804.                 ($this->return_to == $other->return_to) &&
  805.                 ($this->trust_root == $other->trust_root));
  806.     }
  807.  
  808.     /*
  809.      * Does the relying party publish the return_to URL for this
  810.      * response under the realm? It is up to the provider to set a
  811.      * policy for what kinds of realms should be allowed. This
  812.      * return_to URL verification reduces vulnerability to data-theft
  813.      * attacks based on open proxies, corss-site-scripting, or open
  814.      * redirectors.
  815.      *
  816.      * This check should only be performed after making sure that the
  817.      * return_to URL matches the realm.
  818.      *
  819.      * @return true if the realm publishes a document with the
  820.      * return_to URL listed, false if not or if discovery fails
  821.      */
  822.     function returnToVerified()
  823.     {
  824.         return call_user_func_array($this->verifyReturnTo,
  825.                                     array($this->trust_root, $this->return_to));
  826.     }
  827.  
  828.     function fromMessage(&$message, $server)
  829.     {
  830.         $mode = $message->getArg(Auth_OpenID_OPENID_NS, 'mode');
  831.         $immediate = null;
  832.  
  833.         if ($mode == "checkid_immediate") {
  834.             $immediate = true;
  835.             $mode = "checkid_immediate";
  836.         } else {
  837.             $immediate = false;
  838.             $mode = "checkid_setup";
  839.         }
  840.  
  841.         $return_to = $message->getArg(Auth_OpenID_OPENID_NS,
  842.                                       'return_to');
  843.  
  844.         if (($message->isOpenID1()) &&
  845.             (!$return_to)) {
  846.             $fmt = "Missing required field 'return_to' from checkid request";
  847.             return new Auth_OpenID_ServerError($message, $fmt);
  848.         }
  849.  
  850.         $identity = $message->getArg(Auth_OpenID_OPENID_NS,
  851.                                      'identity');
  852.         $claimed_id = $message->getArg(Auth_OpenID_OPENID_NS, 'claimed_id');
  853.         if ($message->isOpenID1()) {
  854.             if ($identity === null) {
  855.                 $s = "OpenID 1 message did not contain openid.identity";
  856.                 return new Auth_OpenID_ServerError($message, $s);
  857.             }
  858.         } else {
  859.             if ($identity && !$claimed_id) {
  860.                 $s = "OpenID 2.0 message contained openid.identity but not " .
  861.                   "claimed_id";
  862.                 return new Auth_OpenID_ServerError($message, $s);
  863.             } else if ($claimed_id && !$identity) {
  864.                 $s = "OpenID 2.0 message contained openid.claimed_id " .
  865.                   "but not identity";
  866.                 return new Auth_OpenID_ServerError($message, $s);
  867.             }
  868.         }
  869.  
  870.         // There's a case for making self.trust_root be a TrustRoot
  871.         // here.  But if TrustRoot isn't currently part of the
  872.         // "public" API, I'm not sure it's worth doing.
  873.         if ($message->isOpenID1()) {
  874.             $trust_root_param = 'trust_root';
  875.         } else {
  876.             $trust_root_param = 'realm';
  877.         }
  878.         $trust_root = $message->getArg(Auth_OpenID_OPENID_NS, 
  879.                                        $trust_root_param);
  880.         if (! $trust_root) {
  881.             $trust_root = $return_to;
  882.         }
  883.  
  884.         if (! $message->isOpenID1() && 
  885.             ($return_to === null) &&
  886.             ($trust_root === null)) {
  887.             return new Auth_OpenID_ServerError($message,
  888.               "openid.realm required when openid.return_to absent");
  889.         }
  890.  
  891.         $assoc_handle = $message->getArg(Auth_OpenID_OPENID_NS,
  892.                                          'assoc_handle');
  893.  
  894.         $obj = Auth_OpenID_CheckIDRequest::make($message,
  895.                                                 $identity,
  896.                                                 $return_to,
  897.                                                 $trust_root,
  898.                                                 $immediate,
  899.                                                 $assoc_handle,
  900.                                                 $server);
  901.  
  902.         if (is_a($obj, 'Auth_OpenID_ServerError')) {
  903.             return $obj;
  904.         }
  905.  
  906.         $obj->claimed_id = $claimed_id;
  907.  
  908.         return $obj;
  909.     }
  910.  
  911.     function idSelect()
  912.     {
  913.         // Is the identifier to be selected by the IDP?
  914.         // So IDPs don't have to import the constant
  915.         return $this->identity == Auth_OpenID_IDENTIFIER_SELECT;
  916.     }
  917.  
  918.     function trustRootValid()
  919.     {
  920.         if (!$this->trust_root) {
  921.             return true;
  922.         }
  923.  
  924.         $tr = Auth_OpenID_TrustRoot::_parse($this->trust_root);
  925.         if ($tr === false) {
  926.             return new Auth_OpenID_MalformedTrustRoot($this->message,
  927.                                                       $this->trust_root);
  928.         }
  929.  
  930.         if ($this->return_to !== null) {
  931.             return Auth_OpenID_TrustRoot::match($this->trust_root,
  932.                                                 $this->return_to);
  933.         } else {
  934.             return true;
  935.         }
  936.     }
  937.  
  938.     /**
  939.      * Respond to this request.  Return either an
  940.      * {@link Auth_OpenID_ServerResponse} or
  941.      * {@link Auth_OpenID_ServerError}.
  942.      *
  943.      * @param bool $allow Allow this user to claim this identity, and
  944.      *  allow the consumer to have this information?
  945.      *
  946.      * @param string $server_url DEPRECATED.  Passing $op_endpoint to
  947.      *  the {@link Auth_OpenID_Server} constructor makes this optional.
  948.      *
  949.      *  When an OpenID 1.x immediate mode request does not succeed, it
  950.      *  gets back a URL where the request may be carried out in a
  951.      *  not-so-immediate fashion.  Pass my URL in here (the fully
  952.      *  qualified address of this server's endpoint, i.e.
  953.      *  http://example.com/server), and I will use it as a base for the
  954.      *  URL for a new request.
  955.      *
  956.      *  Optional for requests where {@link $immediate} is false or
  957.      *  $allow is true.
  958.      *
  959.      * @param string $identity The OP-local identifier to answer with.
  960.      *  Only for use when the relying party requested identifier
  961.      *  selection.
  962.      *
  963.      * @param string $claimed_id The claimed identifier to answer
  964.      *  with, for use with identifier selection in the case where the
  965.      *  claimed identifier and the OP-local identifier differ,
  966.      *  i.e. when the claimed_id uses delegation.
  967.      *
  968.      *  If $identity is provided but this is not, $claimed_id will
  969.      *  default to the value of $identity.  When answering requests
  970.      *  that did not ask for identifier selection, the response
  971.      *  $claimed_id will default to that of the request.
  972.      *
  973.      *  This parameter is new in OpenID 2.0.
  974.      *
  975.      * @return mixed 
  976.      */
  977.     function answer($allow, $server_url = null, $identity = null,
  978.                     $claimed_id = null)
  979.     {
  980.         if (!$this->return_to) {
  981.             return new Auth_OpenID_NoReturnToError();
  982.         }
  983.  
  984.         if (!$server_url) {
  985.             if ((!$this->message->isOpenID1()) &&
  986.                 (!$this->server->op_endpoint)) {
  987.                 return new Auth_OpenID_ServerError(null,
  988.                   "server should be constructed with op_endpoint to " .
  989.                   "respond to OpenID 2.0 messages.");
  990.             }
  991.  
  992.             $server_url = $this->server->op_endpoint;
  993.         }
  994.  
  995.         if ($allow) {
  996.             $mode = 'id_res';
  997.         } else if ($this->message->isOpenID1()) {
  998.             if ($this->immediate) {
  999.                 $mode = 'id_res';
  1000.             } else {
  1001.                 $mode = 'cancel';
  1002.             }
  1003.         } else {
  1004.             if ($this->immediate) {
  1005.                 $mode = 'setup_needed';
  1006.             } else {
  1007.                 $mode = 'cancel';
  1008.             }
  1009.         }
  1010.  
  1011.         if (!$this->trustRootValid()) {
  1012.             return new Auth_OpenID_UntrustedReturnURL(null,
  1013.                                                       $this->return_to,
  1014.                                                       $this->trust_root);
  1015.         }
  1016.  
  1017.         $response = new Auth_OpenID_ServerResponse($this);
  1018.  
  1019.         if ($claimed_id &&
  1020.             ($this->message->isOpenID1())) {
  1021.             return new Auth_OpenID_ServerError(null,
  1022.               "claimed_id is new in OpenID 2.0 and not " .
  1023.               "available for ".$this->namespace);
  1024.         }
  1025.  
  1026.         if ($identity && !$claimed_id) {
  1027.             $claimed_id = $identity;
  1028.         }
  1029.  
  1030.         if ($allow) {
  1031.  
  1032.             if ($this->identity == Auth_OpenID_IDENTIFIER_SELECT) {
  1033.                 if (!$identity) {
  1034.                     return new Auth_OpenID_ServerError(null,
  1035.                       "This request uses IdP-driven identifier selection.  " .
  1036.                       "You must supply an identifier in the response.");
  1037.                 }
  1038.  
  1039.                 $response_identity = $identity;
  1040.                 $response_claimed_id = $claimed_id;
  1041.  
  1042.             } else if ($this->identity) {
  1043.                 if ($identity &&
  1044.                     ($this->identity != $identity)) {
  1045.                     $fmt = "Request was for %s, cannot reply with identity %s";
  1046.                     return new Auth_OpenID_ServerError(null,
  1047.                       sprintf($fmt, $this->identity, $identity));
  1048.                 }
  1049.  
  1050.                 $response_identity = $this->identity;
  1051.                 $response_claimed_id = $this->claimed_id;
  1052.             } else {
  1053.                 if ($identity) {
  1054.                     return new Auth_OpenID_ServerError(null,
  1055.                       "This request specified no identity and " .
  1056.                       "you supplied ".$identity);
  1057.                 }
  1058.  
  1059.                 $response_identity = null;
  1060.             }
  1061.  
  1062.             if (($this->message->isOpenID1()) &&
  1063.                 ($response_identity === null)) {
  1064.                 return new Auth_OpenID_ServerError(null,
  1065.                   "Request was an OpenID 1 request, so response must " .
  1066.                   "include an identifier.");
  1067.             }
  1068.  
  1069.             $response->fields->updateArgs(Auth_OpenID_OPENID_NS,
  1070.                    array('mode' => $mode,
  1071.                          'return_to' => $this->return_to,
  1072.                          'response_nonce' => Auth_OpenID_mkNonce()));
  1073.  
  1074.             if (!$this->message->isOpenID1()) {
  1075.                 $response->fields->setArg(Auth_OpenID_OPENID_NS,
  1076.                                           'op_endpoint', $server_url);
  1077.             }
  1078.  
  1079.             if ($response_identity !== null) {
  1080.                 $response->fields->setArg(
  1081.                                           Auth_OpenID_OPENID_NS,
  1082.                                           'identity',
  1083.                                           $response_identity);
  1084.                 if ($this->message->isOpenID2()) {
  1085.                     $response->fields->setArg(
  1086.                                               Auth_OpenID_OPENID_NS,
  1087.                                               'claimed_id',
  1088.                                               $response_claimed_id);
  1089.                 }
  1090.             }
  1091.  
  1092.         } else {
  1093.             $response->fields->setArg(Auth_OpenID_OPENID_NS,
  1094.                                       'mode', $mode);
  1095.  
  1096.             if ($this->immediate) {
  1097.                 if (($this->message->isOpenID1()) &&
  1098.                     (!$server_url)) {
  1099.                     return new Auth_OpenID_ServerError(null,
  1100.                                  'setup_url is required for $allow=false \
  1101.                                   in OpenID 1.x immediate mode.');
  1102.                 }
  1103.  
  1104.                 $setup_request =& new Auth_OpenID_CheckIDRequest(
  1105.                                                 $this->identity,
  1106.                                                 $this->return_to,
  1107.                                                 $this->trust_root,
  1108.                                                 false,
  1109.                                                 $this->assoc_handle,
  1110.                                                 $this->server,
  1111.                                                 $this->claimed_id);
  1112.                 $setup_request->message = $this->message;
  1113.  
  1114.                 $setup_url = $setup_request->encodeToURL($server_url);
  1115.  
  1116.                 if ($setup_url === null) {
  1117.                     return new Auth_OpenID_NoReturnToError();
  1118.                 }
  1119.  
  1120.                 $response->fields->setArg(Auth_OpenID_OPENID_NS,
  1121.                                           'user_setup_url',
  1122.                                           $setup_url);
  1123.             }
  1124.         }
  1125.  
  1126.         return $response;
  1127.     }
  1128.  
  1129.     function encodeToURL($server_url)
  1130.     {
  1131.         if (!$this->return_to) {
  1132.             return new Auth_OpenID_NoReturnToError();
  1133.         }
  1134.  
  1135.         // Imported from the alternate reality where these classes are
  1136.         // used in both the client and server code, so Requests are
  1137.         // Encodable too.  That's right, code imported from alternate
  1138.         // realities all for the love of you, id_res/user_setup_url.
  1139.  
  1140.         $q = array('mode' => $this->mode,
  1141.                    'identity' => $this->identity,
  1142.                    'claimed_id' => $this->claimed_id,
  1143.                    'return_to' => $this->return_to);
  1144.  
  1145.         if ($this->trust_root) {
  1146.             if ($this->message->isOpenID1()) {
  1147.                 $q['trust_root'] = $this->trust_root;
  1148.             } else {
  1149.                 $q['realm'] = $this->trust_root;
  1150.             }
  1151.         }
  1152.  
  1153.         if ($this->assoc_handle) {
  1154.             $q['assoc_handle'] = $this->assoc_handle;
  1155.         }
  1156.  
  1157.         $response = new Auth_OpenID_Message(
  1158.             $this->message->getOpenIDNamespace());
  1159.         $response->updateArgs(Auth_OpenID_OPENID_NS, $q);
  1160.         return $response->toURL($server_url);
  1161.     }
  1162.  
  1163.     function getCancelURL()
  1164.     {
  1165.         if (!$this->return_to) {
  1166.             return new Auth_OpenID_NoReturnToError();
  1167.         }
  1168.  
  1169.         if ($this->immediate) {
  1170.             return new Auth_OpenID_ServerError(null,
  1171.                                                "Cancel is not an appropriate \
  1172.                                                response to immediate mode \
  1173.                                                requests.");
  1174.         }
  1175.  
  1176.         $response = new Auth_OpenID_Message(
  1177.             $this->message->getOpenIDNamespace());
  1178.         $response->setArg(Auth_OpenID_OPENID_NS, 'mode', 'cancel');
  1179.         return $response->toURL($this->return_to);
  1180.     }
  1181. }
  1182.  
  1183. /**
  1184.  * This class encapsulates the response to an OpenID server request.
  1185.  *
  1186.  * @package OpenID
  1187.  */
  1188. class Auth_OpenID_ServerResponse {
  1189.  
  1190.     function Auth_OpenID_ServerResponse(&$request)
  1191.     {
  1192.         $this->request =& $request;
  1193.         $this->fields = new Auth_OpenID_Message($this->request->namespace);
  1194.     }
  1195.  
  1196.     function whichEncoding()
  1197.     {
  1198.       global $_Auth_OpenID_Request_Modes;
  1199.  
  1200.         if (in_array($this->request->mode, $_Auth_OpenID_Request_Modes)) {
  1201.             if ($this->fields->isOpenID2() &&
  1202.                 (strlen($this->encodeToURL()) >
  1203.                    Auth_OpenID_OPENID1_URL_LIMIT)) {
  1204.                 return Auth_OpenID_ENCODE_HTML_FORM;
  1205.             } else {
  1206.                 return Auth_OpenID_ENCODE_URL;
  1207.             }
  1208.         } else {
  1209.             return Auth_OpenID_ENCODE_KVFORM;
  1210.         }
  1211.     }
  1212.  
  1213.     /*
  1214.      * Returns the form markup for this response.
  1215.      *
  1216.      * @return str
  1217.      */
  1218.     function toFormMarkup($form_tag_attrs=null)
  1219.     {
  1220.         return $this->fields->toFormMarkup($this->request->return_to,
  1221.                                            $form_tag_attrs);
  1222.     }
  1223.  
  1224.     /*
  1225.      * Returns an HTML document containing the form markup for this
  1226.      * response that autosubmits with javascript.
  1227.      */
  1228.     function toHTML()
  1229.     {
  1230.         return Auth_OpenID::autoSubmitHTML($this->toFormMarkup());
  1231.     }
  1232.  
  1233.     /*
  1234.      * Returns True if this response's encoding is ENCODE_HTML_FORM.
  1235.      * Convenience method for server authors.
  1236.      *
  1237.      * @return bool
  1238.      */
  1239.     function renderAsForm()
  1240.     {
  1241.         return $this->whichEncoding() == Auth_OpenID_ENCODE_HTML_FORM;
  1242.     }
  1243.  
  1244.  
  1245.     function encodeToURL()
  1246.     {
  1247.         return $this->fields->toURL($this->request->return_to);
  1248.     }
  1249.  
  1250.     function addExtension($extension_response)
  1251.     {
  1252.         $extension_response->toMessage($this->fields);
  1253.     }
  1254.  
  1255.     function needsSigning()
  1256.     {
  1257.         return $this->fields->getArg(Auth_OpenID_OPENID_NS,
  1258.                                      'mode') == 'id_res';
  1259.     }
  1260.  
  1261.     function encodeToKVForm()
  1262.     {
  1263.         return $this->fields->toKVForm();
  1264.     }
  1265. }
  1266.  
  1267. /**
  1268.  * A web-capable response object which you can use to generate a
  1269.  * user-agent response.
  1270.  *
  1271.  * @package OpenID
  1272.  */
  1273. class Auth_OpenID_WebResponse {
  1274.     var $code = AUTH_OPENID_HTTP_OK;
  1275.     var $body = "";
  1276.  
  1277.     function Auth_OpenID_WebResponse($code = null, $headers = null,
  1278.                                      $body = null)
  1279.     {
  1280.         if ($code) {
  1281.             $this->code = $code;
  1282.         }
  1283.  
  1284.         if ($headers !== null) {
  1285.             $this->headers = $headers;
  1286.         } else {
  1287.             $this->headers = array();
  1288.         }
  1289.  
  1290.         if ($body !== null) {
  1291.             $this->body = $body;
  1292.         }
  1293.     }
  1294. }
  1295.  
  1296. /**
  1297.  * Responsible for the signature of query data and the verification of
  1298.  * OpenID signature values.
  1299.  *
  1300.  * @package OpenID
  1301.  */
  1302. class Auth_OpenID_Signatory {
  1303.  
  1304.     // = 14 * 24 * 60 * 60; # 14 days, in seconds
  1305.         var $SECRET_LIFETIME = 1209600;
  1306.  
  1307.     // keys have a bogus server URL in them because the filestore
  1308.     // really does expect that key to be a URL.  This seems a little
  1309.     // silly for the server store, since I expect there to be only one
  1310.     // server URL.
  1311.         var $normal_key = 'http://localhost/|normal';
  1312.     var $dumb_key = 'http://localhost/|dumb';
  1313.  
  1314.     /**
  1315.      * Create a new signatory using a given store.
  1316.      */
  1317.     function Auth_OpenID_Signatory(&$store)
  1318.     {
  1319.         // assert store is not None
  1320.         $this->store =& $store;
  1321.     }
  1322.  
  1323.     /**
  1324.      * Verify, using a given association handle, a signature with
  1325.      * signed key-value pairs from an HTTP request.
  1326.      */
  1327.     function verify($assoc_handle, $message)
  1328.     {
  1329.         $assoc = $this->getAssociation($assoc_handle, true);
  1330.         if (!$assoc) {
  1331.             // oidutil.log("failed to get assoc with handle %r to verify sig %r"
  1332.             //             % (assoc_handle, sig))
  1333.             return false;
  1334.         }
  1335.  
  1336.         return $assoc->checkMessageSignature($message);
  1337.     }
  1338.  
  1339.     /**
  1340.      * Given a response, sign the fields in the response's 'signed'
  1341.      * list, and insert the signature into the response.
  1342.      */
  1343.     function sign($response)
  1344.     {
  1345.         $signed_response = $response;
  1346.         $assoc_handle = $response->request->assoc_handle;
  1347.  
  1348.         if ($assoc_handle) {
  1349.             // normal mode
  1350.             $assoc = $this->getAssociation($assoc_handle, false, false);
  1351.             if (!$assoc || ($assoc->getExpiresIn() <= 0)) {
  1352.                 // fall back to dumb mode
  1353.                 $signed_response->fields->setArg(Auth_OpenID_OPENID_NS,
  1354.                              'invalidate_handle', $assoc_handle);
  1355.                 $assoc_type = ($assoc ? $assoc->assoc_type : 'HMAC-SHA1');
  1356.  
  1357.                 if ($assoc && ($assoc->getExpiresIn() <= 0)) {
  1358.                     $this->invalidate($assoc_handle, false);
  1359.                 }
  1360.  
  1361.                 $assoc = $this->createAssociation(true, $assoc_type);
  1362.             }
  1363.         } else {
  1364.             // dumb mode.
  1365.             $assoc = $this->createAssociation(true);
  1366.         }
  1367.  
  1368.         $signed_response->fields = $assoc->signMessage(
  1369.                                       $signed_response->fields);
  1370.         return $signed_response;
  1371.     }
  1372.  
  1373.     /**
  1374.      * Make a new association.
  1375.      */
  1376.     function createAssociation($dumb = true, $assoc_type = 'HMAC-SHA1')
  1377.     {
  1378.         $secret = Auth_OpenID_CryptUtil::getBytes(
  1379.                     Auth_OpenID_getSecretSize($assoc_type));
  1380.  
  1381.         $uniq = base64_encode(Auth_OpenID_CryptUtil::getBytes(4));
  1382.         $handle = sprintf('{%s}{%x}{%s}', $assoc_type, intval(time()), $uniq);
  1383.  
  1384.         $assoc = Auth_OpenID_Association::fromExpiresIn(
  1385.                       $this->SECRET_LIFETIME, $handle, $secret, $assoc_type);
  1386.  
  1387.         if ($dumb) {
  1388.             $key = $this->dumb_key;
  1389.         } else {
  1390.             $key = $this->normal_key;
  1391.         }
  1392.  
  1393.         $this->store->storeAssociation($key, $assoc);
  1394.         return $assoc;
  1395.     }
  1396.  
  1397.     /**
  1398.      * Given an association handle, get the association from the
  1399.      * store, or return a ServerError or null if something goes wrong.
  1400.      */
  1401.     function getAssociation($assoc_handle, $dumb, $check_expiration=true)
  1402.     {
  1403.         if ($assoc_handle === null) {
  1404.             return new Auth_OpenID_ServerError(null,
  1405.                                      "assoc_handle must not be null");
  1406.         }
  1407.  
  1408.         if ($dumb) {
  1409.             $key = $this->dumb_key;
  1410.         } else {
  1411.             $key = $this->normal_key;
  1412.         }
  1413.  
  1414.         $assoc = $this->store->getAssociation($key, $assoc_handle);
  1415.  
  1416.         if (($assoc !== null) && ($assoc->getExpiresIn() <= 0)) {
  1417.             if ($check_expiration) {
  1418.                 $this->store->removeAssociation($key, $assoc_handle);
  1419.                 $assoc = null;
  1420.             }
  1421.         }
  1422.  
  1423.         return $assoc;
  1424.     }
  1425.  
  1426.     /**
  1427.      * Invalidate a given association handle.
  1428.      */
  1429.     function invalidate($assoc_handle, $dumb)
  1430.     {
  1431.         if ($dumb) {
  1432.             $key = $this->dumb_key;
  1433.         } else {
  1434.             $key = $this->normal_key;
  1435.         }
  1436.         $this->store->removeAssociation($key, $assoc_handle);
  1437.     }
  1438. }
  1439.  
  1440. /**
  1441.  * Encode an {@link Auth_OpenID_ServerResponse} to an
  1442.  * {@link Auth_OpenID_WebResponse}.
  1443.  *
  1444.  * @package OpenID
  1445.  */
  1446. class Auth_OpenID_Encoder {
  1447.  
  1448.     var $responseFactory = 'Auth_OpenID_WebResponse';
  1449.  
  1450.     /**
  1451.      * Encode an {@link Auth_OpenID_ServerResponse} and return an
  1452.      * {@link Auth_OpenID_WebResponse}.
  1453.      */
  1454.     function encode(&$response)
  1455.     {
  1456.         $cls = $this->responseFactory;
  1457.  
  1458.         $encode_as = $response->whichEncoding();
  1459.         if ($encode_as == Auth_OpenID_ENCODE_KVFORM) {
  1460.             $wr = new $cls(null, null, $response->encodeToKVForm());
  1461.             if (is_a($response, 'Auth_OpenID_ServerError')) {
  1462.                 $wr->code = AUTH_OPENID_HTTP_ERROR;
  1463.             }
  1464.         } else if ($encode_as == Auth_OpenID_ENCODE_URL) {
  1465.             $location = $response->encodeToURL();
  1466.             $wr = new $cls(AUTH_OPENID_HTTP_REDIRECT,
  1467.                            array('location' => $location));
  1468.         } else if ($encode_as == Auth_OpenID_ENCODE_HTML_FORM) {
  1469.           $wr = new $cls(AUTH_OPENID_HTTP_OK, array(),
  1470.                          $response->toFormMarkup());
  1471.         } else {
  1472.             return new Auth_OpenID_EncodingError($response);
  1473.         }
  1474.         return $wr;
  1475.     }
  1476. }
  1477.  
  1478. /**
  1479.  * An encoder which also takes care of signing fields when required.
  1480.  *
  1481.  * @package OpenID
  1482.  */
  1483. class Auth_OpenID_SigningEncoder extends Auth_OpenID_Encoder {
  1484.  
  1485.     function Auth_OpenID_SigningEncoder(&$signatory)
  1486.     {
  1487.         $this->signatory =& $signatory;
  1488.     }
  1489.  
  1490.     /**
  1491.      * Sign an {@link Auth_OpenID_ServerResponse} and return an
  1492.      * {@link Auth_OpenID_WebResponse}.
  1493.      */
  1494.     function encode(&$response)
  1495.     {
  1496.         // the isinstance is a bit of a kludge... it means there isn't
  1497.         // really an adapter to make the interfaces quite match.
  1498.         if (!is_a($response, 'Auth_OpenID_ServerError') &&
  1499.             $response->needsSigning()) {
  1500.  
  1501.             if (!$this->signatory) {
  1502.                 return new Auth_OpenID_ServerError(null,
  1503.                                        "Must have a store to sign request");
  1504.             }
  1505.  
  1506.             if ($response->fields->hasKey(Auth_OpenID_OPENID_NS, 'sig')) {
  1507.                 return new Auth_OpenID_AlreadySigned($response);
  1508.             }
  1509.             $response = $this->signatory->sign($response);
  1510.         }
  1511.  
  1512.         return parent::encode($response);
  1513.     }
  1514. }
  1515.  
  1516. /**
  1517.  * Decode an incoming query into an Auth_OpenID_Request.
  1518.  *
  1519.  * @package OpenID
  1520.  */
  1521. class Auth_OpenID_Decoder {
  1522.  
  1523.     function Auth_OpenID_Decoder(&$server)
  1524.     {
  1525.         $this->server =& $server;
  1526.  
  1527.         $this->handlers = array(
  1528.             'checkid_setup' => 'Auth_OpenID_CheckIDRequest',
  1529.             'checkid_immediate' => 'Auth_OpenID_CheckIDRequest',
  1530.             'check_authentication' => 'Auth_OpenID_CheckAuthRequest',
  1531.             'associate' => 'Auth_OpenID_AssociateRequest'
  1532.             );
  1533.     }
  1534.  
  1535.     /**
  1536.      * Given an HTTP query in an array (key-value pairs), decode it
  1537.      * into an Auth_OpenID_Request object.
  1538.      */
  1539.     function decode($query)
  1540.     {
  1541.         if (!$query) {
  1542.             return null;
  1543.         }
  1544.  
  1545.         $message = Auth_OpenID_Message::fromPostArgs($query);
  1546.  
  1547.         if ($message === null) {
  1548.             /*
  1549.              * It's useful to have a Message attached to a
  1550.              * ProtocolError, so we override the bad ns value to build
  1551.              * a Message out of it.  Kinda kludgy, since it's made of
  1552.              * lies, but the parts that aren't lies are more useful
  1553.              * than a 'None'.
  1554.              */
  1555.             $old_ns = $query['openid.ns'];
  1556.  
  1557.             $query['openid.ns'] = Auth_OpenID_OPENID2_NS;
  1558.             $message = Auth_OpenID_Message::fromPostArgs($query);
  1559.             return new Auth_OpenID_ServerError(
  1560.                   $message,
  1561.                   sprintf("Invalid OpenID namespace URI: %s", $old_ns));
  1562.         }
  1563.  
  1564.         $mode = $message->getArg(Auth_OpenID_OPENID_NS, 'mode');
  1565.         if (!$mode) {
  1566.             return new Auth_OpenID_ServerError($message,
  1567.                                                "No mode value in message");
  1568.         }
  1569.  
  1570.         if (Auth_OpenID::isFailure($mode)) {
  1571.             return new Auth_OpenID_ServerError($message,
  1572.                                                $mode->message);
  1573.         }
  1574.  
  1575.         $handlerCls = Auth_OpenID::arrayGet($this->handlers, $mode,
  1576.                                             $this->defaultDecoder($message));
  1577.  
  1578.         if (!is_a($handlerCls, 'Auth_OpenID_ServerError')) {
  1579.             return call_user_func_array(array($handlerCls, 'fromMessage'),
  1580.                                         array($message, $this->server));
  1581.         } else {
  1582.             return $handlerCls;
  1583.         }
  1584.     }
  1585.  
  1586.     function defaultDecoder($message)
  1587.     {
  1588.         $mode = $message->getArg(Auth_OpenID_OPENID_NS, 'mode');
  1589.  
  1590.         if (Auth_OpenID::isFailure($mode)) {
  1591.             return new Auth_OpenID_ServerError($message,
  1592.                                                $mode->message);
  1593.         }
  1594.  
  1595.         return new Auth_OpenID_ServerError($message,
  1596.                        sprintf("Unrecognized OpenID mode %s", $mode));
  1597.     }
  1598. }
  1599.  
  1600. /**
  1601.  * An error that indicates an encoding problem occurred.
  1602.  *
  1603.  * @package OpenID
  1604.  */
  1605. class Auth_OpenID_EncodingError {
  1606.     function Auth_OpenID_EncodingError(&$response)
  1607.     {
  1608.         $this->response =& $response;
  1609.     }
  1610. }
  1611.  
  1612. /**
  1613.  * An error that indicates that a response was already signed.
  1614.  *
  1615.  * @package OpenID
  1616.  */
  1617. class Auth_OpenID_AlreadySigned extends Auth_OpenID_EncodingError {
  1618.     // This response is already signed.
  1619. }
  1620.  
  1621. /**
  1622.  * An error that indicates that the given return_to is not under the
  1623.  * given trust_root.
  1624.  *
  1625.  * @package OpenID
  1626.  */
  1627. class Auth_OpenID_UntrustedReturnURL extends Auth_OpenID_ServerError {
  1628.     function Auth_OpenID_UntrustedReturnURL($message, $return_to,
  1629.                                             $trust_root)
  1630.     {
  1631.         parent::Auth_OpenID_ServerError($message, "Untrusted return_to URL");
  1632.         $this->return_to = $return_to;
  1633.         $this->trust_root = $trust_root;
  1634.     }
  1635.  
  1636.     function toString()
  1637.     {
  1638.         return sprintf("return_to %s not under trust_root %s",
  1639.                        $this->return_to, $this->trust_root);
  1640.     }
  1641. }
  1642.  
  1643. /**
  1644.  * I handle requests for an OpenID server.
  1645.  *
  1646.  * Some types of requests (those which are not checkid requests) may
  1647.  * be handed to my {@link handleRequest} method, and I will take care
  1648.  * of it and return a response.
  1649.  *
  1650.  * For your convenience, I also provide an interface to {@link }
  1651.  * Auth_OpenID_Decoder::decode()} and {@link }
  1652.  * Auth_OpenID_SigningEncoder::encode()} through my methods {@link }
  1653.  * decodeRequest} and {@link encodeResponse}.
  1654.  *
  1655.  * All my state is encapsulated in an {@link Auth_OpenID_OpenIDStore}.
  1656.  *
  1657.  * Example:
  1658.  *
  1659.  * <pre> $oserver = new Auth_OpenID_Server(Auth_OpenID_FileStore($data_path),
  1660.  *                                   "http://example.com/op");
  1661.  * $request = $oserver->decodeRequest();
  1662.  * if (in_array($request->mode, array('checkid_immediate',
  1663.  *                                    'checkid_setup'))) {
  1664.  *     if ($app->isAuthorized($request->identity, $request->trust_root)) {
  1665.  *         $response = $request->answer(true);
  1666.  *     } else if ($request->immediate) {
  1667.  *         $response = $request->answer(false);
  1668.  *     } else {
  1669.  *         $app->showDecidePage($request);
  1670.  *         return;
  1671.  *     }
  1672.  * } else {
  1673.  *     $response = $oserver->handleRequest($request);
  1674.  * }
  1675.  *
  1676.  * $webresponse = $oserver->encode($response);</pre>
  1677.  *
  1678.  * @package OpenID
  1679.  */
  1680. class Auth_OpenID_Server {
  1681.     function Auth_OpenID_Server(&$store, $op_endpoint=null)
  1682.     {
  1683.         $this->store =& $store;
  1684.         $this->signatory =& new Auth_OpenID_Signatory($this->store);
  1685.         $this->encoder =& new Auth_OpenID_SigningEncoder($this->signatory);
  1686.         $this->decoder =& new Auth_OpenID_Decoder($this);
  1687.         $this->op_endpoint = $op_endpoint;
  1688.         $this->negotiator =& Auth_OpenID_getDefaultNegotiator();
  1689.     }
  1690.  
  1691.     /**
  1692.      * Handle a request.  Given an {@link Auth_OpenID_Request} object,
  1693.      * call the appropriate {@link Auth_OpenID_Server} method to
  1694.      * process the request and generate a response.
  1695.      *
  1696.      * @param Auth_OpenID_Request $request An {@link Auth_OpenID_Request}
  1697.      *  returned by {@link Auth_OpenID_Server::decodeRequest()}.
  1698.      *
  1699.      * @return Auth_OpenID_ServerResponse $response A response object
  1700.      *  capable of generating a user-agent reply.
  1701.      */
  1702.     function handleRequest($request)
  1703.     {
  1704.         if (method_exists($this, "openid_" . $request->mode)) {
  1705.             $handler = array($this, "openid_" . $request->mode);
  1706.             return call_user_func($handler, $request);
  1707.         }
  1708.         return null;
  1709.     }
  1710.  
  1711.     /**
  1712.      * The callback for 'check_authentication' messages.
  1713.      */
  1714.     function openid_check_authentication(&$request)
  1715.     {
  1716.         return $request->answer($this->signatory);
  1717.     }
  1718.  
  1719.     /**
  1720.      * The callback for 'associate' messages.
  1721.      */
  1722.     function openid_associate(&$request)
  1723.     {
  1724.         $assoc_type = $request->assoc_type;
  1725.         $session_type = $request->session->session_type;
  1726.         if ($this->negotiator->isAllowed($assoc_type, $session_type)) {
  1727.             $assoc = $this->signatory->createAssociation(false,
  1728.                                                          $assoc_type);
  1729.             return $request->answer($assoc);
  1730.         } else {
  1731.             $message = sprintf('Association type %s is not supported with '.
  1732.                                'session type %s', $assoc_type, $session_type);
  1733.             list($preferred_assoc_type, $preferred_session_type) =
  1734.                 $this->negotiator->getAllowedType();
  1735.             return $request->answerUnsupported($message,
  1736.                                                $preferred_assoc_type,
  1737.                                                $preferred_session_type);
  1738.         }
  1739.     }
  1740.  
  1741.     /**
  1742.      * Encodes as response in the appropriate format suitable for
  1743.      * sending to the user agent.
  1744.      */
  1745.     function encodeResponse(&$response)
  1746.     {
  1747.         return $this->encoder->encode($response);
  1748.     }
  1749.  
  1750.     /**
  1751.      * Decodes a query args array into the appropriate
  1752.      * {@link Auth_OpenID_Request} object.
  1753.      */
  1754.     function decodeRequest($query=null)
  1755.     {
  1756.         if ($query === null) {
  1757.             $query = Auth_OpenID::getQuery();
  1758.         }
  1759.  
  1760.         return $this->decoder->decode($query);
  1761.     }
  1762. }
  1763.  
  1764. ?>
Documentation generated on Sat, 14 Nov 2009 11:18:49 +0000 by phpDocumentor 1.3.1