openid4java-0.9.6.662/ 0000755 0015012 0015012 00000000000 11627733442 013575 5 ustar miguel miguel openid4java-0.9.6.662/src/ 0000755 0015012 0015012 00000000000 11627733442 014364 5 ustar miguel miguel openid4java-0.9.6.662/src/overview.html 0000644 0015012 0015012 00000016037 11034531517 017116 0 ustar miguel miguel
OpenID4Java library offers support for OpenID-enabling a consumer site or
implementing an OpenID Provider server.
Consumer Site / Relying Party:
The main interaction points between a web application acting as a
Relying Party (Consumer) and the library are the
{@link org.openid4java.consumer.ConsumerManager ConsumerManager} and
{@link org.openid4java.discovery.Discovery Discovery} classes.
A reference {@link org.openid4java.consumer.SampleConsumer SampleConsumer}
implementation is provided in the consumer package.
See the general usage pattern below.
OpenID Provider / Server:
The main interaction point between a web application acting as a
OpenID Provider (Server) and the library is the
{@link org.openid4java.server.ServerManager ServerManager} class.
A reference {@link org.openid4java.server.SampleServer SampleServer}
implementation is provided in the server package.
See the general usage pattern below.
Relying Party / Consumer Usage Pattern:
// instantiate a ConsumerManager object
public static manager = new ConsumerManager();
// --- placing the authentication request ---
// determine a return_to URL where your application will receive
// the authentication responses from the OpenID provider
String returnToUrl = "http://example.com/openid";
// build an Identifier instance from the user-supplied identifier
Identifier identifier = Discovery.parseIdentifier(userSuppliedString);
// perform discovery on the user-supplied identifier
List discoveries = Discovery.discover(identifier);
// attempt to associate with an OpenID provider
// and retrieve one service endpoint for authentication
DiscoveryInformation discovered = manager.associate(discoveries);
// store the discovery information in the user's session
session.setAttribute("openid-disco", discovered);
// Attribute Exchange example: fetching the 'email' attribute
FetchRequest fetch = new FetchRequest();
fetch.addAttribute("email", // attribute alias
"http://schema.openid.net/contact/email", // type URI
true); // required
// obtain a AuthRequest message to be sent to the OpenID provider
AuthRequest authReq = manager.authenticate(discovered, returnToUrl);
// attach the extension to the authentication request
authReq.addExtensionParams(fetch);
if (! discovered.isVersion2() )
{
// Option 1: GET HTTP-redirect to the OpenID Provider endpoint
// The only method supported in OpenID 1.x
// redirect-URL usually limited to 255 bytes
return authReq.getRedirectUrl();
}
else
{
// Option 2: HTML FORM Redirection
// Allows payloads > 255 bytes
// <FORM action="OpenID Provider's service endpoint">
// see samples/formredirection.jsp for a JSP example
authReq.getOPEndpoint();
// build a HTML FORM with the message parameters
authReq.getParameterMap();
}
// --- processing the authentication response
// extract the parameters from the authentication response
// (which comes in as a HTTP request from the OpenID provider)
ParameterList response = new ParameterList(httpReq.getParameterMap());
// retrieve the previously stored discovery information
DiscoveryInformation discovered
= (DiscoveryInformation) session.getAttribute("openid-disco");
// extract the receiving URL from the HTTP request
StringBuffer receivingURL = httpReq.getRequestURL();
String queryString = httpReq.getQueryString();
if (queryString != null && queryString.length() > 0)
receivingURL.append("?").append(httpReq.getQueryString());
// verify the response; ConsumerManager needs to be the same
// (static) instance used to place the authentication request
VerificationResult verification = manager.verify(
receivingURL.toString(),
response, discovered);
// examine the verification result and extract the verified identifier
Identifier verified = verification.getVerifiedId();
if (verified != null)
{
// Attribute Exchange: retrieving the fetched "email" attribute
AuthSuccess authSuccess = AuthSuccess.createAuthSuccess(response);
MessageExtension ext =
authSuccess.getExtension(AxMessage.OPENID_NS_AX);
if (ext != null)
{
FetchResponse fetchResp =
new FetchResponse(ext.getParameters());
String email = fetchResp.getParameter("email");
}
return verified; // success
}
OpenID Provider / Server Usage Pattern:
// instantiate a ServerManager object
public static ServerManager manager = new ServerManager();
// configure the OpenID Provider's endpoint URL
static
{
manager.setOPEndpointUrl("Http://my.openidprovider.com/server");
}
// extract the parameters from the request
ParameterList request = new ParameterList(httpReq.getParameterMap());
String mode = request.hasParameter("openid.mode") ?
request.getParameterValue("openid.mode") : null;
Message response;
String responseText;
if ("associate".equals(mode))
{
// --- process an association request ---
response = manager.associationResponse(request);
responseText = response.keyValueFormEncoding();
}
else if ("checkid_setup".equals(mode)
|| "checkid_immediate".equals(mode))
{
// interact with the user and obtain data needed to continue
List userData = userInteraction(request);
String userSelectedId = (String) userData.get(0);
String userSelectedClaimedId = (String) userData.get(1);
Boolean authenticatedAndApproved = (Boolean) userData.get(2);
// --- process an authentication request ---
response = manager.authResponse(request,
userSelectedId,
userSelectedClaimedId,
authenticatedAndApproved.booleanValue());
// caller will need to decide which of the following to use:
// - GET HTTP-redirect to the return_to URL
// - HTML FORM Redirection
responseText = response.wwwFormEncoding();
}
else if ("check_authentication".equals(mode))
{
// --- processing a verification request ---
response = manager.verify(request);
responseText = response.keyValueFormEncoding();
}
else
{
// --- error response ---
response = DirectError.createDirectError("Unknown request");
responseText = response.keyValueFormEncoding();
}
// return the result to the user
return responseText;
openid4java-0.9.6.662/src/org/ 0000755 0015012 0015012 00000000000 11034531510 015133 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/ 0000755 0015012 0015012 00000000000 11627733442 017357 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/consumer/ 0000755 0015012 0015012 00000000000 11627733442 021212 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/consumer/InMemoryConsumerAssociationStore.java 0000644 0015012 0015012 00000010334 11034531517 030532 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import org.openid4java.association.Association;
import java.util.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class InMemoryConsumerAssociationStore implements ConsumerAssociationStore
{
private static Log _log = LogFactory.getLog(InMemoryConsumerAssociationStore.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private Map _opMap = new HashMap();
public synchronized void save(String opUrl, Association association)
{
removeExpired();
Map handleMap = (Map) _opMap.get(opUrl);
if (handleMap == null)
{
handleMap = new HashMap();
_opMap.put(opUrl, handleMap);
}
String handle = association.getHandle();
if(DEBUG)
_log.debug("Adding association to the in-memory store: " + handle +
" with OP: " + opUrl);
handleMap.put(association.getHandle(), association);
}
public synchronized Association load(String opUrl, String handle)
{
removeExpired();
if (_opMap.containsKey(opUrl))
{
Map handleMap = (Map) _opMap.get(opUrl);
if (handleMap.containsKey(handle))
{
return (Association) handleMap.get(handle);
}
}
return null;
}
public synchronized Association load(String opUrl)
{
removeExpired();
Association latest = null;
if (_opMap.containsKey(opUrl))
{
Map handleMap = (Map) _opMap.get(opUrl);
Iterator handles = handleMap.keySet().iterator();
while (handles.hasNext())
{
String handle = (String) handles.next();
Association association = (Association) handleMap.get(handle);
if (latest == null ||
latest.getExpiry().before(association.getExpiry()))
latest = association;
}
}
return latest;
}
public synchronized void remove(String opUrl, String handle)
{
removeExpired();
if (_opMap.containsKey(opUrl))
{
Map handleMap = (Map) _opMap.get(opUrl);
_log.info("Removing association: " + handle + " widh OP: " + opUrl);
handleMap.remove(handle);
if (handleMap.size() == 0)
_opMap.remove(opUrl);
}
}
private synchronized void removeExpired()
{
Set opToRemove = new HashSet();
Iterator opUrls = _opMap.keySet().iterator();
while (opUrls.hasNext())
{
String opUrl = (String) opUrls.next();
Map handleMap = (Map) _opMap.get(opUrl);
Set handleToRemove = new HashSet();
Iterator handles = handleMap.keySet().iterator();
while (handles.hasNext())
{
String handle = (String) handles.next();
Association association = (Association) handleMap.get(handle);
if (association.hasExpired())
{
handleToRemove.add(handle);
}
}
handles = handleToRemove.iterator();
while (handles.hasNext())
{
String handle = (String) handles.next();
_log.info("Removing expired association: " + handle +
" with OP: " + opUrl);
handleMap.remove(handle);
}
if (handleMap.size() == 0)
opToRemove.add(opUrl);
}
opUrls = opToRemove.iterator();
while (opUrls.hasNext())
{
String opUrl = (String) opUrls.next();
_opMap.remove(opUrl);
}
}
protected synchronized int size()
{
int total = 0;
Iterator opUrls = _opMap.keySet().iterator();
while (opUrls.hasNext())
{
String opUrl = (String) opUrls.next();
Map handleMap = (Map) _opMap.get(opUrl);
total += handleMap.size();
}
return total;
}
}
openid4java-0.9.6.662/src/org/openid4java/consumer/ConsumerException.java 0000644 0015012 0015012 00000001551 11034531517 025520 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import org.openid4java.OpenIDException;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class ConsumerException extends OpenIDException
{
public ConsumerException(String message)
{
super(message, CONSUMER_ERROR);
}
public ConsumerException(String message, int code)
{
super(message, code);
}
public ConsumerException(String message, Throwable cause)
{
super(message, CONSUMER_ERROR, cause);
}
public ConsumerException(String message, int code, Throwable cause)
{
super(message, code, cause);
}
public ConsumerException(Throwable cause)
{
super(SERVER_ERROR, cause);
}
public ConsumerException(int code, Throwable cause)
{
super(code, cause);
}
}
openid4java-0.9.6.662/src/org/openid4java/consumer/AbstractNonceVerifier.java 0000644 0015012 0015012 00000004355 11130536343 026274 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import org.openid4java.util.InternetDateFormat;
import java.util.Date;
import java.text.ParseException;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public abstract class AbstractNonceVerifier implements NonceVerifier
{
private static Log _log = LogFactory.getLog(AbstractNonceVerifier.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected static InternetDateFormat _dateFormat = new InternetDateFormat();
protected int _maxAgeSeconds;
/**
* @param maxAge maximum token age in seconds
*/
protected AbstractNonceVerifier(int maxAge)
{
_maxAgeSeconds = maxAge;
}
public int getMaxAge()
{
return _maxAgeSeconds;
}
public void setMaxAge(int ageSeconds)
{
_maxAgeSeconds = ageSeconds;
}
/**
* Checks if nonce date is valid and if it is in the max age boundary. Other checks are delegated to {@link #seen(java.util.Date, String, String)}
*/
public synchronized int seen(String opUrl, String nonce)
{
if (DEBUG) _log.debug("Verifying nonce: " + nonce);
Date now = new Date();
try
{
Date nonceDate = _dateFormat.parse(nonce);
if (isTooOld(now, nonceDate))
{
_log.warn("Nonce is too old: " + nonce);
return TOO_OLD;
}
return seen(now, opUrl, nonce);
}
catch (ParseException e)
{
_log.error("Error verifying the nonce: " + nonce, e);
return INVALID_TIMESTAMP;
}
}
/**
* Subclasses should implement this method and check if the nonce was seen before.
* The nonce timestamp was verified at this point, it is valid and it is in the max age boudary.
*
* @param now The timestamp used to check the max age boudary.
*/
protected abstract int seen(Date now, String opUrl, String nonce);
protected boolean isTooOld(Date now, Date nonce)
{
long age = now.getTime() - nonce.getTime();
return age > _maxAgeSeconds * 1000;
}
}
openid4java-0.9.6.662/src/org/openid4java/consumer/VerificationResult.java 0000644 0015012 0015012 00000004603 11034531517 025670 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import org.openid4java.discovery.Identifier;
import org.openid4java.message.MessageException;
import org.openid4java.message.Message;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class VerificationResult
{
/**
* Identifier on which authentication and verification were performed
* succesfully and which can be used henceforth by Relying Parties to
* identify the user.
*
* Null if authentication or verification on the claimed identifier failed.
*/
private Identifier _verifiedId;
/**
* Optional parameter returned in a failure response to a immediate
* authentication request (AuthImmediateFailure).
*/
private String _opSetupUrl;
/**
* The authentication response received from the server.
*/
private Message _authResponse;
/**
* An unstructured status / error message.
*/
private String _statusMsg;
/**
* Gets the verified identifier.
*/
public Identifier getVerifiedId()
{
return _verifiedId;
}
/**
* Sets the verified identifier.
*/
public void setVerifiedId(Identifier verifiedId)
{
this._verifiedId = verifiedId;
}
/**
* Gets the optional OP user_setup_url parameter, if one was returned in a
* failure response to a immediate authentication request.
*
* Null if the response did not include the user_setup_url parameter.
*/
public String getOPSetupUrl()
{
return _opSetupUrl;
}
/**
* Sets the OP user_setup_url parameter, if one was returned in a failure
* response to a immediate authentication request.
*/
public void setOPSetupUrl(String opSetupUrl) throws MessageException
{
this._opSetupUrl = opSetupUrl;
}
/**
* Gets the authentication response message received from the server.
*/
public Message getAuthResponse()
{
return _authResponse;
}
/**
* Sets the authentication response message received from the server.
*/
public void setAuthResponse(Message authResponse)
{
this._authResponse = authResponse;
}
public String getStatusMsg()
{
return _statusMsg;
}
public void setStatusMsg(String statusMsg)
{
this._statusMsg = statusMsg;
}
}
openid4java-0.9.6.662/src/org/openid4java/consumer/SampleConsumer.java 0000644 0015012 0015012 00000016055 11034531517 025010 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import org.openid4java.discovery.Identifier;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.message.ax.FetchRequest;
import org.openid4java.message.ax.FetchResponse;
import org.openid4java.message.ax.AxMessage;
import org.openid4java.message.sreg.SRegMessage;
import org.openid4java.message.sreg.SRegRequest;
import org.openid4java.message.sreg.SRegResponse;
import org.openid4java.message.*;
import org.openid4java.OpenIDException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.util.List;
import java.io.IOException;
/**
* Sample Consumer (Relying Party) implementation.
*/
public class SampleConsumer
{
private ConsumerManager manager;
private String returnToUrl;
public SampleConsumer() throws ConsumerException
{
this("http://example.com/openid");
}
public SampleConsumer(String returnToUrl) throws ConsumerException
{
// configure the return_to URL where your application will receive
// the authentication responses from the OpenID provider
this.returnToUrl = returnToUrl;
// instantiate a ConsumerManager object
manager = new ConsumerManager();
manager.setAssociations(new InMemoryConsumerAssociationStore());
manager.setNonceVerifier(new InMemoryNonceVerifier(5000));
// for a working demo, not enforcing RP realm discovery
// since this new feature is not deployed
manager.getRealmVerifier().setEnforceRpId(false);
}
// --- placing the authentication request ---
public String authRequest(String userSuppliedString,
HttpServletRequest httpReq,
HttpServletResponse httpResp)
throws IOException
{
try
{
// --- Forward proxy setup (only if needed) ---
// ProxyProperties proxyProps = new ProxyProperties();
// proxyProps.setProxyName("proxy.example.com");
// proxyProps.setProxyPort(8080);
// HttpClientFactory.setProxyProperties(proxyProps);
// perform discovery on the user-supplied identifier
List discoveries = manager.discover(userSuppliedString);
// attempt to associate with the OpenID provider
// and retrieve one service endpoint for authentication
DiscoveryInformation discovered = manager.associate(discoveries);
// store the discovery information in the user's session
httpReq.getSession().setAttribute("openid-disc", discovered);
// obtain a AuthRequest message to be sent to the OpenID provider
AuthRequest authReq = manager.authenticate(discovered, returnToUrl);
// Attribute Exchange example: fetching the 'email' attribute
FetchRequest fetch = FetchRequest.createFetchRequest();
fetch.addAttribute("email", // attribute alias
"http://schema.openid.net/contact/email", // type URI
true); // required
// attach the extension to the authentication request
authReq.addExtension(fetch);
// example using Simple Registration to fetching the 'email' attribute
SRegRequest sregReq = SRegRequest.createFetchRequest();
sregReq.addAttribute("email", true);
authReq.addExtension(sregReq);
if (! discovered.isVersion2() )
{
// Option 1: GET HTTP-redirect to the OpenID Provider endpoint
// The only method supported in OpenID 1.x
// redirect-URL usually limited ~2048 bytes
httpResp.sendRedirect(authReq.getDestinationUrl(true));
return null;
}
else
{
// Option 2: HTML FORM Redirection (Allows payloads >2048 bytes)
//RequestDispatcher dispatcher =
// getServletContext().getRequestDispatcher("formredirection.jsp");
//httpReq.setAttribute("prameterMap", response.getParameterMap());
//httpReq.setAttribute("destinationUrl", response.getDestinationUrl(false));
//dispatcher.forward(request, response);
}
}
catch (OpenIDException e)
{
// present error to the user
throw new RuntimeException("wrap:" + e.getMessage(), e);
}
return null;
}
// --- processing the authentication response ---
public Identifier verifyResponse(HttpServletRequest httpReq)
{
try
{
// extract the parameters from the authentication response
// (which comes in as a HTTP request from the OpenID provider)
ParameterList response =
new ParameterList(httpReq.getParameterMap());
// retrieve the previously stored discovery information
DiscoveryInformation discovered = (DiscoveryInformation)
httpReq.getSession().getAttribute("openid-disc");
// extract the receiving URL from the HTTP request
StringBuffer receivingURL = httpReq.getRequestURL();
String queryString = httpReq.getQueryString();
if (queryString != null && queryString.length() > 0)
receivingURL.append("?").append(httpReq.getQueryString());
// verify the response; ConsumerManager needs to be the same
// (static) instance used to place the authentication request
VerificationResult verification = manager.verify(
receivingURL.toString(),
response, discovered);
// examine the verification result and extract the verified identifier
Identifier verified = verification.getVerifiedId();
if (verified != null)
{
AuthSuccess authSuccess = (AuthSuccess) verification.getAuthResponse();
HttpSession session = httpReq.getSession(true);
session.setAttribute("openid_identifier", authSuccess.getIdentity());
if (authSuccess.hasExtension(AxMessage.OPENID_NS_AX))
{
FetchResponse fetchResp = (FetchResponse) authSuccess.getExtension(AxMessage.OPENID_NS_AX);
session.setAttribute("emailFromFetch", fetchResp.getAttributeValues("email").get(0));
}
if (authSuccess.hasExtension(SRegMessage.OPENID_NS_SREG))
{
SRegResponse sregResp = (SRegResponse) authSuccess.getExtension(SRegMessage.OPENID_NS_SREG);
session.setAttribute("emailFromSReg", sregResp.getAttributeValue("email"));
}
return verified; // success
}
}
catch (OpenIDException e)
{
// present error to the user
throw new RuntimeException("wrap:" + e.getMessage(), e);
}
return null;
}
}
openid4java-0.9.6.662/src/org/openid4java/consumer/package.html 0000644 0015012 0015012 00000014172 11034531517 023467 0 ustar miguel miguel
Provides functionality for OpenID-enabling Consumer (Relying Party) sites.
The general usage pattern for a Consumer site is outlined below:
/*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import org.openid4java.discovery.Identifier;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.message.ax.FetchRequest;
import org.openid4java.message.ax.FetchResponse;
import org.openid4java.message.ax.AxMessage;
import org.openid4java.message.*;
import org.openid4java.OpenIDException;
import javax.servlet.http.HttpSession;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.List;
import java.io.IOException;
/**
* Sample Consumer (Relying Party) implementation.
*/
public class SampleConsumer
{
public ConsumerManager manager;
public SampleConsumer() throws ConsumerException
{
// instantiate a ConsumerManager object
manager = new ConsumerManager();
}
// --- placing the authentication request ---
public String authRequest(String userSuppliedString,
HttpServletRequest httpReq,
HttpServletResponse httpResp)
throws IOException
{
try
{
// configure the return_to URL where your application will receive
// the authentication responses from the OpenID provider
String returnToUrl = "http://example.com/openid";
// --- Forward proxy setup (only if needed) ---
// ProxyProperties proxyProps = new ProxyProperties();
// proxyProps.setProxyName("proxy.example.com");
// proxyProps.setProxyPort(8080);
// HttpClientFactory.setProxyProperties(proxyProps);
// perform discovery on the user-supplied identifier
List discoveries = manager.discover(userSuppliedString);
// attempt to associate with the OpenID provider
// and retrieve one service endpoint for authentication
DiscoveryInformation discovered = manager.associate(discoveries);
// store the discovery information in the user's session
httpReq.getSession().setAttribute("openid-disc", discovered);
// obtain a AuthRequest message to be sent to the OpenID provider
AuthRequest authReq = manager.authenticate(discovered, returnToUrl);
// Attribute Exchange example: fetching the 'email' attribute
FetchRequest fetch = FetchRequest.createFetchRequest();
fetch.addAttribute("email",
// attribute alias
"http://schema.openid.net/contact/email", // type URI
true); // required
// attach the extension to the authentication request
authReq.addExtension(fetch);
if (! discovered.isVersion2() )
{
// Option 1: GET HTTP-redirect to the OpenID Provider endpoint
// The only method supported in OpenID 1.x
// redirect-URL usually limited ~2048 bytes
httpResp.sendRedirect(authReq.getDestinationUrl(true));
return null;
}
else
{
// Option 2: HTML FORM Redirection (Allows payloads >2048 bytes)
//RequestDispatcher dispatcher =
// getServletContext().getRequestDispatcher("formredirection.jsp");
//httpReq.setAttribute("parameterMap", response.getParameterMap());
//httpReq.setAttribute("destinationUrl", response.getDestinationUrl(false));
//dispatcher.forward(request, response);
}
}
catch (OpenIDException e)
{
// present error to the user
}
return null;
}
// --- processing the authentication response ---
public Identifier verifyResponse(HttpServletRequest httpReq)
{
try
{
// extract the parameters from the authentication response
// (which comes in as a HTTP request from the OpenID provider)
ParameterList response =
new ParameterList(httpReq.getParameterMap());
// retrieve the previously stored discovery information
DiscoveryInformation discovered = (DiscoveryInformation)
httpReq.getSession().getAttribute("openid-disc");
// extract the receiving URL from the HTTP request
StringBuffer receivingURL = httpReq.getRequestURL();
String queryString = httpReq.getQueryString();
if (queryString != null && queryString.length() > 0)
receivingURL.append("?").append(httpReq.getQueryString());
// verify the response; ConsumerManager needs to be the same
// (static) instance used to place the authentication request
VerificationResult verification = manager.verify(
receivingURL.toString(),
response, discovered);
// examine the verification result and extract the verified identifier
Identifier verified = verification.getVerifiedId();
if (verified != null)
{
AuthSuccess authSuccess =
(AuthSuccess) verification.getAuthResponse();
if (authSuccess.hasExtension(AxMessage.OPENID_NS_AX))
{
FetchResponse fetchResp = (FetchResponse) authSuccess
.getExtension(AxMessage.OPENID_NS_AX);
List emails = fetchResp.getAttributeValues("email");
String email = (String) emails.get(0);
}
return verified; // success
}
}
catch (OpenIDException e)
{
// present error to the user
}
return null;
}
}
openid4java-0.9.6.662/src/org/openid4java/consumer/ConsumerAssociationStore.java 0000644 0015012 0015012 00000001046 11352263621 027053 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import com.google.inject.ImplementedBy;
import org.openid4java.association.Association;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
@ImplementedBy(InMemoryConsumerAssociationStore.class)
public interface ConsumerAssociationStore
{
public void save(String opUrl, Association association);
public Association load(String opUrl, String handle);
public Association load(String opUrl);
public void remove(String opUrl, String handle);
}
openid4java-0.9.6.662/src/org/openid4java/consumer/JdbcConsumerAssociationStore.java 0000644 0015012 0015012 00000016673 11155267317 027661 0 ustar miguel miguel
package org.openid4java.consumer ;
import java.util.Date;
import java.util.Map;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.association.Association;
import org.openid4java.association.AssociationException;
import org.springframework.dao.DataAccessException;
import org.springframework.dao.IncorrectResultSizeDataAccessException;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.support.JdbcDaoSupport;
/**
*
* The specified table must have the following structure:
*
*
opurl : string
*
handle : string : primary key
*
type : string
*
mackey : string
*
expdate : date
*
*
* @author Andrew Evenson, Graff Haley
* @created May 19, 2008
*/
public class JdbcConsumerAssociationStore
extends JdbcDaoSupport
implements ConsumerAssociationStore
{
private static Log _log = LogFactory.getLog ( JdbcConsumerAssociationStore.class ) ;
private String _tableName ;
private String _sqlInsert ;
private String _sqlDelete ;
private String _sqlCleanup ;
private String _sqlSelect ;
private String _sqlSelectAlt ;
public JdbcConsumerAssociationStore ( )
{
}
public JdbcConsumerAssociationStore ( String tableName )
{
setTableName ( tableName ) ;
}
public String getTableName ( )
{
return _tableName ;
}
public void setTableName ( String tableName )
{
this._tableName = tableName ;
this._sqlInsert = "INSERT INTO " + _tableName + " VALUES (?,?,?,?,?)" ;
this._sqlDelete = "DELETE FROM " + _tableName
+ " WHERE opurl=? AND handle=?" ;
this._sqlCleanup = "DELETE FROM " + _tableName + " WHERE expdate < ?" ;
this._sqlSelect = "SELECT * FROM " + _tableName
+ " WHERE opurl=? AND handle=?" ;
this._sqlSelectAlt = "SELECT * FROM " + _tableName
+ " T1 JOIN (SELECT opurl, max(expdate) AS expdate FROM " + _tableName
+ " WHERE opurl=? GROUP BY opurl) T2 ON (T1.expdate = T2.expdate AND T1.opurl = T2.opurl)" ;
}
public Association load ( String opUrl, String handle )
{
try
{
JdbcTemplate jdbcTemplate = getJdbcTemplate ( ) ;
Map res = jdbcTemplate.queryForMap ( _sqlSelect, new Object[]
{ opUrl, handle } ) ;
String type = (String) res.get ( "type" ) ;
String macKey = (String) res.get ( "mackey" ) ;
Date expDate = (Date) res.get ( "expdate" ) ;
if ( type == null || macKey == null || expDate == null )
throw new AssociationException (
"Invalid association data retrived from database; cannot create Association "
+ "object for handle: "
+ handle ) ;
Association assoc ;
if ( Association.TYPE_HMAC_SHA1.equals ( type ) )
assoc = Association.createHmacSha1 ( handle,
Base64.decodeBase64 ( macKey.getBytes ( ) ),
expDate ) ;
else if ( Association.TYPE_HMAC_SHA256.equals ( type ) )
assoc = Association.createHmacSha256 ( handle,
Base64.decodeBase64 ( macKey.getBytes ( ) ),
expDate ) ;
else
throw new AssociationException (
"Invalid association type "
+ "retrieved from database: "
+ type ) ;
if ( _log.isDebugEnabled ( ) )
_log.debug ( "Retrieved association for handle: " + handle
+ " from table: " + _tableName ) ;
return assoc ;
}
catch ( AssociationException ase )
{
_log.error ( "Error retrieving association from table: "
+ _tableName, ase ) ;
return null ;
}
catch ( IncorrectResultSizeDataAccessException rse )
{
_log.warn ( "Association not found for handle: " + handle
+ " in the table: " + _tableName ) ;
return null ;
}
catch ( DataAccessException dae )
{
_log.error ( "Error retrieving association for handle: " + handle
+ "from table: " + _tableName, dae ) ;
return null ;
}
}
public Association load ( String opUrl )
{
try
{
JdbcTemplate jdbcTemplate = getJdbcTemplate ( ) ;
Map res = jdbcTemplate.queryForMap ( _sqlSelectAlt, new Object[]
{ opUrl } ) ;
String handle = (String) res.get ( "handle" ) ;
String type = (String) res.get ( "type" ) ;
String macKey = (String) res.get ( "mackey" ) ;
Date expDate = (Date) res.get ( "expdate" ) ;
Association assoc ;
if ( expDate == null || ( type == null || macKey == null ) &&
! Association.FAILED_ASSOC_HANDLE.equals(handle) ) {
throw new AssociationException (
"Invalid expiry date retrived from database; cannot create Association "
+ "object for handle: "
+ handle ) ;
} else if (Association.FAILED_ASSOC_HANDLE.equals(handle)) {
assoc = Association.getFailedAssociation(expDate);
} else if ( Association.TYPE_HMAC_SHA1.equals ( type ) ) {
assoc = Association.createHmacSha1 ( handle,
Base64.decodeBase64 ( macKey.getBytes ( ) ),
expDate ) ;
} else if ( Association.TYPE_HMAC_SHA256.equals ( type ) ) {
assoc = Association.createHmacSha256 ( handle,
Base64.decodeBase64 ( macKey.getBytes ( ) ),
expDate ) ;
} else {
throw new AssociationException (
"Invalid association type "
+ "retrieved from database: "
+ type ) ;
}
if ( _log.isDebugEnabled ( ) )
_log.debug ( "Retrieved association for handle: " + handle
+ " from table: " + _tableName ) ;
return assoc ;
}
catch ( AssociationException ase )
{
_log.error ( "Error retrieving association from table: "
+ _tableName, ase ) ;
return null ;
}
catch ( IncorrectResultSizeDataAccessException rse )
{
_log.warn ( "Association not found for opUrl: " + opUrl
+ " in the table: " + _tableName ) ;
return null ;
}
catch ( DataAccessException dae )
{
_log.error ( "Error retrieving association for opUrl: " + opUrl
+ "from table: " + _tableName, dae ) ;
return null ;
}
}
public void remove ( String opUrl, String handle )
{
try
{
JdbcTemplate jdbcTemplate = getJdbcTemplate ( ) ;
int cnt = jdbcTemplate.update ( _sqlDelete, new Object[]
{ opUrl, handle } ) ;
}
catch ( Exception e )
{
_log.error ( "Error removing association from table: "
+ _tableName,
e ) ;
}
}
public void save ( String opUrl, Association association )
{
cleanupExpired ( ) ;
try
{
JdbcTemplate jdbcTemplate = getJdbcTemplate ( ) ;
int cnt = jdbcTemplate.update ( _sqlInsert,
new Object[]
{
opUrl,
association.getHandle ( ),
association.getType ( ),
association.getMacKey ( ) == null ? null :
new String (
Base64.encodeBase64 ( association.getMacKey ( ).getEncoded ( ) ) ),
association.getExpiry ( ) } ) ;
}
catch ( Exception e )
{
_log.error ( "Error saving association to table: " + _tableName, e ) ;
}
}
private void cleanupExpired ( )
{
try
{
Date boundary = new Date ( ) ;
JdbcTemplate jdbcTemplate = getJdbcTemplate ( ) ;
int cnt = jdbcTemplate.update ( _sqlCleanup, new Object[]
{ boundary } ) ;
if ( _log.isDebugEnabled ( ) )
_log.debug ( "Client associations cleanup removed " + cnt
+ " entries" ) ;
}
catch ( Exception e )
{
_log.error ( "Error cleaning up client associations from table: "
+ _tableName, e ) ;
}
}
}
openid4java-0.9.6.662/src/org/openid4java/consumer/NonceVerifier.java 0000644 0015012 0015012 00000002722 11352263621 024606 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import com.google.inject.ImplementedBy;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
@ImplementedBy(InMemoryNonceVerifier.class)
public interface NonceVerifier
{
/**
* This noce is valid and it was not seen before. Nonce should be accepted.
*/
public static final int OK = 0;
/**
* The nonce was seen before. Nonce should be rejected.
*/
public static final int SEEN = 1;
/**
* The timestamp of the nonce is invalid, it cannot be parsed. Nonce should be rejected.
*/
public static final int INVALID_TIMESTAMP = 2;
/**
* The timestamp of the nonce is too old and it is not tracked anymore. Nonce should be rejected.
*/
public static final int TOO_OLD = 3;
/**
* Checks if a nonce was seen before. It also checks if the time stamp at the beginning of the noce is valid.
* Also, if old nonces are discarded the it should check if the time stamp for this noce is still valid.
*
* @return {@link #OK} only if this nonce has a valid time stamp, the time stamp did not age and the nonce was not
* seen before.
*/
public int seen(String opUrl, String nonce);
/**
* Returns the expiration timeout for nonces, in seconds.
*/
public int getMaxAge();
/**
* Sets the expiration timeout for nonces, in seconds.
*/
public void setMaxAge(int ageSeconds);
}
openid4java-0.9.6.662/src/org/openid4java/consumer/InMemoryNonceVerifier.java 0000644 0015012 0015012 00000006156 11352263621 026273 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import java.util.*;
import java.text.ParseException;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class InMemoryNonceVerifier extends AbstractNonceVerifier
{
private static Log _log = LogFactory.getLog(InMemoryNonceVerifier.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private Map _opMap = new HashMap();
public InMemoryNonceVerifier() {
this(60);
}
public InMemoryNonceVerifier(int maxAge)
{
super(maxAge);
}
protected synchronized int seen(Date now, String opUrl, String nonce)
{
removeAged(now);
Set seenSet = (Set) _opMap.get(opUrl);
if (seenSet == null)
{
seenSet = new HashSet();
_opMap.put(opUrl, seenSet);
}
if (seenSet.contains(nonce))
{
_log.error("Possible replay attack! Already seen nonce: " + nonce);
return SEEN;
}
seenSet.add(nonce);
if (DEBUG) _log.debug("Nonce verified: " + nonce);
return OK;
}
private synchronized void removeAged(Date now)
{
Set opToRemove = new HashSet();
Iterator opUrls = _opMap.keySet().iterator();
while (opUrls.hasNext())
{
String opUrl = (String) opUrls.next();
Set seenSet = (Set) _opMap.get(opUrl);
Set nonceToRemove = new HashSet();
Iterator nonces = seenSet.iterator();
while (nonces.hasNext())
{
String nonce = (String) nonces.next();
try
{
Date nonceDate = _dateFormat.parse(nonce);
if (isTooOld(now, nonceDate))
{
nonceToRemove.add(nonce);
}
}
catch (ParseException e)
{
nonceToRemove.add(nonce);
}
}
nonces = nonceToRemove.iterator();
while (nonces.hasNext())
{
String nonce = (String) nonces.next();
if (DEBUG)
_log.debug("Removing nonce: " + nonce +
" from OP: " + opUrl);
seenSet.remove(nonce);
}
if (seenSet.size() == 0)
opToRemove.add(opUrl);
}
opUrls = opToRemove.iterator();
while (opUrls.hasNext())
{
String opUrl = (String) opUrls.next();
if (DEBUG) _log.debug("Removed all nonces from OP: " + opUrl);
_opMap.remove(opUrl);
}
}
protected synchronized int size()
{
int total = 0;
Iterator opUrls = _opMap.keySet().iterator();
while (opUrls.hasNext())
{
String opUrl = (String) opUrls.next();
Set seenSet = (Set) _opMap.get(opUrl);
total += seenSet.size();
}
return total;
}
}
openid4java-0.9.6.662/src/org/openid4java/consumer/ConsumerManager.java 0000644 0015012 0015012 00000210250 11352263621 025133 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import com.google.inject.Inject;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.http.HttpStatus;
import org.openid4java.OpenIDException;
import org.openid4java.association.Association;
import org.openid4java.association.AssociationException;
import org.openid4java.association.AssociationSessionType;
import org.openid4java.association.DiffieHellmanSession;
import org.openid4java.discovery.Discovery;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.discovery.Identifier;
import org.openid4java.discovery.yadis.YadisResolver;
import org.openid4java.message.AssociationError;
import org.openid4java.message.AssociationRequest;
import org.openid4java.message.AssociationResponse;
import org.openid4java.message.AuthFailure;
import org.openid4java.message.AuthImmediateFailure;
import org.openid4java.message.AuthRequest;
import org.openid4java.message.AuthSuccess;
import org.openid4java.message.DirectError;
import org.openid4java.message.Message;
import org.openid4java.message.MessageException;
import org.openid4java.message.ParameterList;
import org.openid4java.message.VerifyRequest;
import org.openid4java.message.VerifyResponse;
import org.openid4java.server.IncrementalNonceGenerator;
import org.openid4java.server.NonceGenerator;
import org.openid4java.server.RealmVerifier;
import org.openid4java.server.RealmVerifierFactory;
import org.openid4java.util.HttpFetcher;
import org.openid4java.util.HttpFetcherFactory;
import org.openid4java.util.HttpRequestOptions;
import org.openid4java.util.HttpResponse;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLDecoder;
import java.net.URLEncoder;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Iterator;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.Stack;
import javax.crypto.spec.DHParameterSpec;
/**
* Manages OpenID communications with an OpenID Provider (Server).
*
* The Consumer site needs to have the same instance of this class throughout
* the lifecycle of a OpenID authentication session.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class ConsumerManager
{
private static Log _log = LogFactory.getLog(ConsumerManager.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/**
* Discovery process manager.
*/
private Discovery _discovery;
/**
* Direct pointer to HttpFetcher, for association and signature
* verification requests.
*/
private HttpFetcher _httpFetcher;
/**
* Store for keeping track of the established associations.
*/
private ConsumerAssociationStore _associations = new InMemoryConsumerAssociationStore();
/**
* Consumer-side nonce generator, needed for compatibility with OpenID 1.1.
*/
private NonceGenerator _consumerNonceGenerator = new IncrementalNonceGenerator();
/**
* Private association store used for signing consumer nonces when operating
* in compatibility (v1.x) mode.
*/
private ConsumerAssociationStore _privateAssociations = new InMemoryConsumerAssociationStore();
/**
* Verifier for the nonces in authentication responses;
* prevents replay attacks.
*/
private NonceVerifier _nonceVerifier = new InMemoryNonceVerifier(60);
// --- association preferences ---
/**
* Maximum number of attmpts for establishing an association.
*/
private int _maxAssocAttempts = 4;
/**
* Flag for enabling or disabling stateless mode.
*/
private boolean _allowStateless = true;
/**
* The lowest encryption level session accepted for association sessions.
*/
private AssociationSessionType _minAssocSessEnc
= AssociationSessionType.NO_ENCRYPTION_SHA1MAC;
/**
* The preferred association session type; will be attempted first.
*/
private AssociationSessionType _prefAssocSessEnc;
/**
* Parameters (modulus and generator) for the Diffie-Hellman sessions.
*/
private DHParameterSpec _dhParams = DiffieHellmanSession.getDefaultParameter();
/**
* Timeout (in seconds) for keeping track of failed association attempts.
* Default 5 minutes.
*/
private int _failedAssocExpire = 300;
/**
* Interval before the expiration of an association (in seconds)
* in which the association should not be used, in order to avoid
* the expiration from occurring in the middle of an authentication
* transaction. Default: 300s.
*/
private int _preExpiryAssocLockInterval = 300;
// --- authentication preferences ---
/**
* Flag for generating checkid_immediate authentication requests.
*/
private boolean _immediateAuth = false;
/**
* Used to perform verify realms against return_to URLs.
*/
private RealmVerifier _realmVerifier;
/**
* Instantiates a ConsumerManager with default settings.
*/
public ConsumerManager()
{
this(
new RealmVerifierFactory(new YadisResolver(new HttpFetcherFactory())),
new Discovery(), // uses HttpCache internally
new HttpFetcherFactory());
}
@Inject
public ConsumerManager(RealmVerifierFactory realmFactory, Discovery discovery,
HttpFetcherFactory httpFetcherFactory)
{
_realmVerifier = realmFactory.getRealmVerifierForConsumer();
// don't verify own (RP) identity, disable RP discovery
_realmVerifier.setEnforceRpId(false);
_discovery = discovery;
_httpFetcher = httpFetcherFactory.createFetcher(HttpRequestOptions.getDefaultOptionsForOpCalls());
if (Association.isHmacSha256Supported())
_prefAssocSessEnc = AssociationSessionType.DH_SHA256;
else
_prefAssocSessEnc = AssociationSessionType.DH_SHA1;
}
/**
* Returns discovery process manager.
*
* @return discovery process manager.
*/
public Discovery getDiscovery()
{
return _discovery;
}
/**
* Sets discovery process manager.
*
* @param discovery discovery process manager.
*/
public void setDiscovery(Discovery discovery)
{
_discovery = discovery;
}
/**
* Gets the association store that holds established associations with
* OpenID providers.
*
* @see ConsumerAssociationStore
*/
public ConsumerAssociationStore getAssociations()
{
return _associations;
}
/**
* Configures the ConsumerAssociationStore that will be used to store the
* associations established with OpenID providers.
*
* @param associations ConsumerAssociationStore implementation
* @see ConsumerAssociationStore
*/
@Inject
public void setAssociations(ConsumerAssociationStore associations)
{
this._associations = associations;
}
/**
* Gets the NonceVerifier implementation used to keep track of the nonces
* that have been seen in authentication response messages.
*
* @see NonceVerifier
*/
public NonceVerifier getNonceVerifier()
{
return _nonceVerifier;
}
/**
* Configures the NonceVerifier that will be used to keep track of the
* nonces in the authentication response messages.
*
* @param nonceVerifier NonceVerifier implementation
* @see NonceVerifier
*/
@Inject
public void setNonceVerifier(NonceVerifier nonceVerifier)
{
this._nonceVerifier = nonceVerifier;
}
/**
* Sets the Diffie-Hellman base parameters that will be used for encoding
* the MAC key exchange.
*
* If not provided the default set specified by the Diffie-Hellman algorithm
* will be used.
*
* @param dhParams Object encapsulating modulus and generator numbers
* @see DHParameterSpec DiffieHellmanSession
*/
public void setDHParams(DHParameterSpec dhParams)
{
this._dhParams = dhParams;
}
/**
* Gets the Diffie-Hellman base parameters (modulus and generator).
*
* @see DHParameterSpec DiffieHellmanSession
*/
public DHParameterSpec getDHParams()
{
return _dhParams;
}
/**
* Maximum number of attempts (HTTP calls) the RP is willing to make
* for trying to establish an association with the OP.
*
* Default: 4;
* 0 = don't use associations
*
* Associations and stateless mode cannot be both disabled at the same time.
*/
public void setMaxAssocAttempts(int maxAssocAttempts)
{
if (maxAssocAttempts > 0 || _allowStateless)
this._maxAssocAttempts = maxAssocAttempts;
else
throw new IllegalArgumentException(
"Associations and stateless mode " +
"cannot be both disabled at the same time.");
if (_maxAssocAttempts == 0) _log.info("Associations disabled.");
}
/**
* Gets the value configured for the maximum number of association attempts
* that will be performed for a given OpenID provider.
*
* If an association cannot be established after this number of attempts the
* ConsumerManager will fallback to stateless mode, provided the
* #allowStateless preference is enabled.
*
* See also: {@link #allowStateless(boolean)} {@link #statelessAllowed()}
*/
public int getMaxAssocAttempts()
{
return _maxAssocAttempts;
}
/**
* Flag used to enable / disable the use of stateless mode.
*
* Default: enabled.
*
* Associations and stateless mode cannot be both disabled at the same time.
* @deprecated
* @see #setAllowStateless(boolean)
*/
public void allowStateless(boolean allowStateless)
{
setAllowStateless(allowStateless);
}
/**
* Flag used to enable / disable the use of stateless mode.
*
* Default: enabled.
*
* Associations and stateless mode cannot be both disabled at the same time.
*/
public void setAllowStateless(boolean allowStateless)
{
if (_allowStateless || _maxAssocAttempts > 0)
this._allowStateless = allowStateless;
else
throw new IllegalArgumentException(
"Associations and stateless mode " +
"cannot be both disabled at the same time.");
}
/**
* Returns true if the ConsumerManager is configured to fallback to
* stateless mode when failing to associate with an OpenID Provider.
*
* @deprecated
* @see #isAllowStateless()
*/
public boolean statelessAllowed()
{
return _allowStateless;
}
/**
* Returns true if the ConsumerManager is configured to fallback to
* stateless mode when failing to associate with an OpenID Provider.
*/
public boolean isAllowStateless()
{
return _allowStateless;
}
/**
* Configures the minimum level of encryption accepted for association
* sessions.
*
* Default: no-encryption session, SHA1 MAC association.
*
* See also: {@link #allowStateless(boolean)}
*/
public void setMinAssocSessEnc(AssociationSessionType minAssocSessEnc)
{
this._minAssocSessEnc = minAssocSessEnc;
}
/**
* Gets the minimum level of encryption that will be accepted for
* association sessions.
*
* Default: no-encryption session, SHA1 MAC association
*
*/
public AssociationSessionType getMinAssocSessEnc()
{
return _minAssocSessEnc;
}
/**
* Sets the preferred encryption type for the association sessions.
*
* Default: DH-SHA256
*/
public void setPrefAssocSessEnc(AssociationSessionType prefAssocSessEnc)
{
this._prefAssocSessEnc = prefAssocSessEnc;
}
/**
* Gets the preferred encryption type for the association sessions.
*/
public AssociationSessionType getPrefAssocSessEnc()
{
return _prefAssocSessEnc;
}
/**
* Sets the expiration timeout (in seconds) for keeping track of failed
* association attempts.
*
* If an association cannot be establish with an OP, subsequesnt
* authentication request to that OP will not try to establish an
* association within the timeout period configured here.
*
* Default: 300s
* 0 = disabled (attempt to establish an association with every
* authentication request)
*
* @param _failedAssocExpire time in seconds to remember failed
* association attempts
*/
public void setFailedAssocExpire(int _failedAssocExpire)
{
this._failedAssocExpire = _failedAssocExpire;
}
/**
* Gets the timeout (in seconds) configured for keeping track of failed
* association attempts.
*
* See also: {@link #setFailedAssocExpire(int)}
*/
public int getFailedAssocExpire()
{
return _failedAssocExpire;
}
/**
* Gets the interval before the expiration of an association
* (in seconds) in which the association should not be used,
* in order to avoid the expiration from occurring in the middle
* of a authentication transaction. Default: 300s.
*/
public int getPreExpiryAssocLockInterval()
{
return _preExpiryAssocLockInterval;
}
/**
* Sets the interval before the expiration of an association
* (in seconds) in which the association should not be used,
* in order to avoid the expiration from occurring in the middle
* of a authentication transaction. Default: 300s.
*
* @param preExpiryAssocLockInterval The number of seconds for the
* pre-expiry lock inteval.
*/
public void setPreExpiryAssocLockInterval(int preExpiryAssocLockInterval)
{
this._preExpiryAssocLockInterval = preExpiryAssocLockInterval;
}
/**
* Configures the authentication request mode:
* checkid_immediate (true) or checkid_setup (false).
*
* Default: false / checkid_setup
*/
public void setImmediateAuth(boolean _immediateAuth)
{
this._immediateAuth = _immediateAuth;
}
/**
* Returns true if the ConsumerManager is configured to attempt
* checkid_immediate authentication requests.
*
* Default: false
*/
public boolean isImmediateAuth()
{
return _immediateAuth;
}
/**
* Gets the RealmVerifier used to verify realms against return_to URLs.
*/
public RealmVerifier getRealmVerifier()
{
return _realmVerifier;
}
/**
* Sets the RealmVerifier used to verify realms against return_to URLs.
*/
public void setRealmVerifier(RealmVerifier realmVerifier)
{
this._realmVerifier = realmVerifier;
}
/**
* Gets the max age (in seconds) configured for keeping track of nonces.
*
* Nonces older than the max age will be removed from the store and
* authentication responses will be considered failures.
*/
public int getMaxNonceAge()
{
return _nonceVerifier.getMaxAge();
}
/**
* Sets the max age (in seconds) configured for keeping track of nonces.
*
* Nonces older than the max age will be removed from the store and
* authentication responses will be considered failures.
*/
public void setMaxNonceAge(int ageSeconds)
{
_nonceVerifier.setMaxAge(ageSeconds);
}
/**
* Does discovery on an identifier. It delegates the call to its
* discovery manager.
*
* @return A List of {@link DiscoveryInformation} objects.
* The list could be empty if no discovery information can
* be retrieved.
*
* @throws DiscoveryException if the discovery process runs into errors.
*/
public List discover(String identifier) throws DiscoveryException
{
return _discovery.discover(identifier);
}
/**
* Configures a private association store for signing consumer nonces.
*
* Consumer nonces are needed to prevent replay attacks in compatibility
* mode, because OpenID 1.x Providers to not attach nonces to
* authentication responses.
*
* One way for the Consumer to know that a consumer nonce in an
* authentication response was indeed issued by itself (and thus prevent
* denial of service attacks), is by signing them.
*
* @param associations The association store to be used for signing consumer nonces;
* signing can be deactivated by setting this to null.
* Signing is enabled by default.
*/
public void setPrivateAssociationStore(ConsumerAssociationStore associations)
throws ConsumerException
{
if (associations == null)
throw new ConsumerException(
"Cannot set null private association store, " +
"needed for consumer nonces.");
_privateAssociations = associations;
}
/**
* Gets the private association store used for signing consumer nonces.
*
* @see #setPrivateAssociationStore(ConsumerAssociationStore)
*/
public ConsumerAssociationStore getPrivateAssociationStore()
{
return _privateAssociations;
}
public void setConnectTimeout(int connectTimeout)
{
_httpFetcher.getDefaultRequestOptions()
.setConnTimeout(connectTimeout);
}
public void setSocketTimeout(int socketTimeout)
{
_httpFetcher.getDefaultRequestOptions()
.setSocketTimeout(socketTimeout);
}
public void setMaxRedirects(int maxRedirects)
{
_httpFetcher.getDefaultRequestOptions()
.setMaxRedirects(maxRedirects);
}
/**
* Makes a HTTP call to the specified URL with the parameters specified
* in the Message.
*
* @param url URL endpoint for the HTTP call
* @param request Message containing the parameters
* @param response ParameterList that will hold the parameters received in
* the HTTP response
* @return the status code of the HTTP call
*/
private int call(String url, Message request, ParameterList response)
throws MessageException
{
int responseCode = -1;
try
{
if (DEBUG) _log.debug("Performing HTTP POST on " + url);
HttpResponse resp = _httpFetcher.post(url, request.getParameterMap());
responseCode = resp.getStatusCode();
String postResponse = resp.getBody();
response.copyOf(ParameterList.createFromKeyValueForm(postResponse));
if (DEBUG) _log.debug("Retrived response:\n" + postResponse);
}
catch (IOException e)
{
_log.error("Error talking to " + url +
" response code: " + responseCode, e);
}
return responseCode;
}
/**
* Tries to establish an association with on of the service endpoints in
* the list of DiscoveryInformation.
*
* Iterates over the items in the discoveries parameter a maximum of
* #_maxAssocAttempts times trying to esablish an association.
*
* @param discoveries The DiscoveryInformation list obtained by
* performing dicovery on the User-supplied OpenID
* identifier. Should be ordered by the priority
* of the service endpoints.
* @return The DiscoveryInformation instance with which
* an association was established, or the one
* with the highest priority if association failed.
*
* @see Discovery#discover(org.openid4java.discovery.Identifier)
*/
public DiscoveryInformation associate(List discoveries)
{
DiscoveryInformation discovered;
Association assoc;
int attemptsLeft = _maxAssocAttempts;
Iterator itr = discoveries.iterator();
while (itr.hasNext() && attemptsLeft > 0)
{
discovered = (DiscoveryInformation) itr.next();
attemptsLeft -= associate(discovered, attemptsLeft);
// check if an association was established
assoc = _associations.load(discovered.getOPEndpoint().toString());
if ( assoc != null &&
! Association.FAILED_ASSOC_HANDLE.equals(assoc.getHandle()))
return discovered;
}
if (discoveries.size() > 0)
{
// no association established, return the first service endpoint
DiscoveryInformation d0 = (DiscoveryInformation) discoveries.get(0);
_log.warn("Association failed; using first entry: " +
d0.getOPEndpoint());
return d0;
}
else
{
_log.error("Association attempt, but no discovey endpoints provided.");
return null;
}
}
/**
* Tries to establish an association with the OpenID Provider.
*
* The resulting association information will be kept on storage for later
* use at verification stage. If there exists an association for the opUrl
* that is not near expiration, will not construct new association.
*
* @param discovered DiscoveryInformation obtained during the discovery
* @return The number of association attempts performed.
*/
private int associate(DiscoveryInformation discovered, int maxAttempts)
{
if (_maxAssocAttempts == 0) return 0; // associations disabled
URL opUrl = discovered.getOPEndpoint();
String opEndpoint = opUrl.toString();
_log.info("Trying to associate with " + opEndpoint +
" attempts left: " + maxAttempts);
// check if there's an already established association
Association a = _associations.load(opEndpoint);
if ( a != null &&
(Association.FAILED_ASSOC_HANDLE.equals(a.getHandle()) ||
a.getExpiry().getTime() - System.currentTimeMillis() > _preExpiryAssocLockInterval * 1000) )
{
_log.info("Found an existing association: " + a.getHandle());
return 0;
}
String handle = Association.FAILED_ASSOC_HANDLE;
// build a list of association types, with the preferred one at the end
LinkedHashMap requests = new LinkedHashMap();
if (discovered.isVersion2())
{
requests.put(AssociationSessionType.NO_ENCRYPTION_SHA1MAC, null);
requests.put(AssociationSessionType.NO_ENCRYPTION_SHA256MAC, null);
requests.put(AssociationSessionType.DH_SHA1, null);
requests.put(AssociationSessionType.DH_SHA256, null);
}
else
{
requests.put(AssociationSessionType.NO_ENCRYPTION_COMPAT_SHA1MAC, null);
requests.put(AssociationSessionType.DH_COMPAT_SHA1, null);
}
if (_prefAssocSessEnc.isVersion2() == discovered.isVersion2())
requests.put(_prefAssocSessEnc, null);
// build a stack of Association Request objects
// and keep only the allowed by the configured preferences
// the most-desirable entry is always at the top of the stack
Stack reqStack = new Stack();
Iterator iter = requests.keySet().iterator();
while(iter.hasNext())
{
AssociationSessionType type = (AssociationSessionType) iter.next();
// create the appropriate Association Request
AssociationRequest newReq = createAssociationRequest(type, opUrl);
if (newReq != null) reqStack.push(newReq);
}
// perform the association attempts
int attemptsLeft = maxAttempts;
LinkedHashMap alreadyTried = new LinkedHashMap();
while (attemptsLeft > 0 && ! reqStack.empty())
{
try
{
attemptsLeft--;
AssociationRequest assocReq =
(AssociationRequest) reqStack.pop();
if (DEBUG)
_log.debug("Trying association type: " + assocReq.getType());
// was this association / session type attempted already?
if (alreadyTried.keySet().contains(assocReq.getType()))
{
if (DEBUG) _log.debug("Already tried.");
continue;
}
// mark the current request type as already tried
alreadyTried.put(assocReq.getType(), null);
ParameterList respParams = new ParameterList();
int status = call(opEndpoint, assocReq, respParams);
// process the response
if (status == HttpStatus.SC_OK) // success response
{
AssociationResponse assocResp;
assocResp = AssociationResponse
.createAssociationResponse(respParams);
// valid association response
Association assoc =
assocResp.getAssociation(assocReq.getDHSess());
handle = assoc.getHandle();
AssociationSessionType respType = assocResp.getType();
if ( respType.equals(assocReq.getType()) ||
// v1 OPs may return a success no-encryption resp
( ! discovered.isVersion2() &&
respType.getHAlgorithm() == null &&
createAssociationRequest(respType,opUrl) != null))
{
// store the association and do no try alternatives
_associations.save(opEndpoint, assoc);
_log.info("Associated with " + discovered.getOPEndpoint()
+ " handle: " + assoc.getHandle());
break;
}
else
_log.info("Discarding association response, " +
"not matching consumer criteria");
}
else if (status == HttpStatus.SC_BAD_REQUEST) // error response
{
_log.info("Association attempt failed.");
// retrieve fallback sess/assoc/encryption params set by OP
// and queue a new attempt
AssociationError assocErr =
AssociationError.createAssociationError(respParams);
AssociationSessionType opType =
AssociationSessionType.create(
assocErr.getSessionType(),
assocErr.getAssocType());
if (alreadyTried.keySet().contains(opType))
continue;
// create the appropriate Association Request
AssociationRequest newReq =
createAssociationRequest(opType, opUrl);
if (newReq != null)
{
if (DEBUG) _log.debug("Retrieved association type " +
"from the association error: " +
newReq.getType());
reqStack.push(newReq);
}
}
}
catch (OpenIDException e)
{
_log.error("Error encountered during association attempt.", e);
}
}
// store OPs with which an association could not be established
// so that association attempts are not performed with each auth request
if (Association.FAILED_ASSOC_HANDLE.equals(handle)
&& _failedAssocExpire > 0)
_associations.save(opEndpoint,
Association.getFailedAssociation(_failedAssocExpire));
return maxAttempts - attemptsLeft;
}
/**
* Constructs an Association Request message of the specified session and
* association type, taking into account the user preferences (encryption
* level, default Diffie-Hellman parameters).
*
* @param type The type of the association (session and association)
* @param opUrl The OP for which the association request is created
* @return An AssociationRequest message ready to be sent back
* to the OpenID Provider, or null if an association
* of the requested type cannot be built.
*/
private AssociationRequest createAssociationRequest(
AssociationSessionType type, URL opUrl)
{
try
{
if (_minAssocSessEnc.isBetter(type))
return null;
AssociationRequest assocReq = null;
DiffieHellmanSession dhSess;
if (type.getHAlgorithm() != null) // DH session
{
dhSess = DiffieHellmanSession.create(type, _dhParams);
if (DiffieHellmanSession.isDhSupported(type)
&& Association.isHmacSupported(type.getAssociationType()))
assocReq = AssociationRequest.createAssociationRequest(type, dhSess);
}
else if ( opUrl.getProtocol().equals("https") && // no-enc sess
Association.isHmacSupported(type.getAssociationType()))
assocReq = AssociationRequest.createAssociationRequest(type);
if (assocReq == null)
_log.warn("Could not create association of type: " + type);
return assocReq;
}
catch (OpenIDException e)
{
_log.error("Error trying to create association request.", e);
return null;
}
}
/**
* Builds a authentication request message for the user specified in the
* discovery information provided as a parameter.
*
* If the discoveries parameter contains more than one entry, it will
* iterate over them trying to establish an association. If an association
* cannot be established, the first entry is used with stateless mode.
*
* @see #associate(java.util.List)
* @param discoveries The DiscoveryInformation list obtained by
* performing dicovery on the User-supplied OpenID
* identifier. Should be ordered by the priority
* of the service endpoints.
* @param returnToUrl The URL on the Consumer site where the OpenID
* Provider will return the user after generating
* the authentication response.
* Null if the Consumer does not with to for the
* End User to be returned to it (something else
* useful will have been performed via an
* extension).
* Must not be null in OpenID 1.x compatibility
* mode.
* @return Authentication request message to be sent to the
* OpenID Provider.
*/
public AuthRequest authenticate(List discoveries,
String returnToUrl)
throws ConsumerException, MessageException
{
return authenticate(discoveries, returnToUrl, returnToUrl);
}
/**
* Builds a authentication request message for the user specified in the
* discovery information provided as a parameter.
*
* If the discoveries parameter contains more than one entry, it will
* iterate over them trying to establish an association. If an association
* cannot be established, the first entry is used with stateless mode.
*
* @see #associate(java.util.List)
* @param discoveries The DiscoveryInformation list obtained by
* performing dicovery on the User-supplied OpenID
* identifier. Should be ordered by the priority
* of the service endpoints.
* @param returnToUrl The URL on the Consumer site where the OpenID
* Provider will return the user after generating
* the authentication response.
* Null if the Consumer does not with to for the
* End User to be returned to it (something else
* useful will have been performed via an
* extension).
* Must not be null in OpenID 1.x compatibility
* mode.
* @param realm The URL pattern that will be presented to the
* user when he/she will be asked to authorize the
* authentication transaction. Must be a super-set
* of the @returnToUrl.
* @return Authentication request message to be sent to the
* OpenID Provider.
*/
public AuthRequest authenticate(List discoveries,
String returnToUrl, String realm)
throws ConsumerException, MessageException
{
// try to associate with one OP in the discovered list
DiscoveryInformation discovered = associate(discoveries);
return authenticate(discovered, returnToUrl, realm);
}
/**
* Builds a authentication request message for the user specified in the
* discovery information provided as a parameter.
*
* @param discovered A DiscoveryInformation endpoint from the list
* obtained by performing dicovery on the
* User-supplied OpenID identifier.
* @param returnToUrl The URL on the Consumer site where the OpenID
* Provider will return the user after generating
* the authentication response.
* Null if the Consumer does not with to for the
* End User to be returned to it (something else
* useful will have been performed via an
* extension).
* Must not be null in OpenID 1.x compatibility
* mode.
* @return Authentication request message to be sent to the
* OpenID Provider.
*/
public AuthRequest authenticate(DiscoveryInformation discovered,
String returnToUrl)
throws MessageException, ConsumerException
{
return authenticate(discovered, returnToUrl, returnToUrl);
}
/**
* Builds a authentication request message for the user specified in the
* discovery information provided as a parameter.
*
* @param discovered A DiscoveryInformation endpoint from the list
* obtained by performing dicovery on the
* User-supplied OpenID identifier.
* @param returnToUrl The URL on the Consumer site where the OpenID
* Provider will return the user after generating
* the authentication response.
* Null if the Consumer does not with to for the
* End User to be returned to it (something else
* useful will have been performed via an
* extension).
* Must not be null in OpenID 1.x compatibility
* mode.
* @param realm The URL pattern that will be presented to the
* user when he/she will be asked to authorize the
* authentication transaction. Must be a super-set
* of the @returnToUrl.
* @return Authentication request message to be sent to the
* OpenID Provider.
*/
public AuthRequest authenticate(DiscoveryInformation discovered,
String returnToUrl, String realm)
throws MessageException, ConsumerException
{
if (discovered == null)
throw new ConsumerException("Authentication cannot continue: " +
"no discovery information provided.");
Association assoc =
_associations.load(discovered.getOPEndpoint().toString());
if (assoc == null)
{
associate(discovered, _maxAssocAttempts);
assoc = _associations.load(discovered.getOPEndpoint().toString());
}
String handle = assoc != null ?
assoc.getHandle() : Association.FAILED_ASSOC_HANDLE;
// get the Claimed ID and Delegate ID (aka OP-specific identifier)
String claimedId, delegate;
if (discovered.hasClaimedIdentifier())
{
claimedId = discovered.getClaimedIdentifier().getIdentifier();
delegate = discovered.hasDelegateIdentifier() ?
discovered.getDelegateIdentifier() : claimedId;
}
else
{
claimedId = AuthRequest.SELECT_ID;
delegate = AuthRequest.SELECT_ID;
}
// stateless mode disabled ?
if ( !_allowStateless && Association.FAILED_ASSOC_HANDLE.equals(handle))
throw new ConsumerException("Authentication cannot be performed: " +
"no association available and stateless mode is disabled");
_log.info("Creating authentication request for" +
" OP-endpoint: " + discovered.getOPEndpoint() +
" claimedID: " + claimedId +
" OP-specific ID: " + delegate);
if (! discovered.isVersion2())
returnToUrl = insertConsumerNonce(discovered.getOPEndpoint().toString(), returnToUrl);
AuthRequest authReq = AuthRequest.createAuthRequest(claimedId, delegate,
! discovered.isVersion2(), returnToUrl, handle, realm, _realmVerifier);
authReq.setOPEndpoint(discovered.getOPEndpoint());
// ignore the immediate flag for OP-directed identifier selection
if (! AuthRequest.SELECT_ID.equals(claimedId))
authReq.setImmediate(_immediateAuth);
return authReq;
}
/**
* Performs verification on the Authentication Response (assertion)
* received from the OpenID Provider.
*
* Three verification steps are performed:
*
*
nonce: the same assertion will not be accepted more
* than once
*
signatures: verifies that the message was indeed sent
* by the OpenID Provider that was contacted
* earlier after discovery
*
discovered information: the information contained in the assertion
* matches the one obtained during the
* discovery (the OpenID Provider is
* authoritative for the claimed identifier;
* the received assertion is not meaningful
* otherwise
*
*
* @param receivingUrl The URL where the Consumer (Relying Party) has
* accepted the incoming message.
* @param response ParameterList of the authentication response
* being verified.
* @param discovered Previously discovered information (which can
* therefore be trusted) obtained during the discovery
* phase; this should be stored and retrieved by the RP
* in the user's session.
*
* @return A VerificationResult, containing a verified
* identifier; the verified identifier is null if
* the verification failed).
*/
public VerificationResult verify(String receivingUrl,
ParameterList response,
DiscoveryInformation discovered)
throws MessageException, DiscoveryException, AssociationException
{
VerificationResult result = new VerificationResult();
_log.info("Verifying authentication response...");
// non-immediate negative response
if ( "cancel".equals(response.getParameterValue("openid.mode")) )
{
result.setAuthResponse(AuthFailure.createAuthFailure(response));
_log.info("Received auth failure.");
return result;
}
// immediate negative response
if ( "setup_needed".equals(response.getParameterValue("openid.mode")) ||
("id_res".equals(response.getParameterValue("openid.mode"))
&& response.hasParameter("openid.user_setup_url") ) )
{
AuthImmediateFailure fail =
AuthImmediateFailure.createAuthImmediateFailure(response);
result.setAuthResponse(fail);
result.setOPSetupUrl(fail.getUserSetupUrl());
_log.info("Received auth immediate failure.");
return result;
}
AuthSuccess authResp = AuthSuccess.createAuthSuccess(response);
_log.info("Received positive auth response.");
authResp.validate();
result.setAuthResponse(authResp);
// [1/4] return_to verification
if (! verifyReturnTo(receivingUrl, authResp))
{
result.setStatusMsg("Return_To URL verification failed.");
_log.error("Return_To URL verification failed.");
return result;
}
// [2/4] : discovered info verification
discovered = verifyDiscovered(authResp, discovered);
if (discovered == null || ! discovered.hasClaimedIdentifier())
{
result.setStatusMsg("Discovered information verification failed.");
_log.error("Discovered information verification failed.");
return result;
}
// [3/4] : nonce verification
if (! verifyNonce(authResp, discovered))
{
result.setStatusMsg("Nonce verification failed.");
_log.error("Nonce verification failed.");
return result;
}
// [4/4] : signature verification
return (verifySignature(authResp, discovered, result));
}
/**
* Verifies that the URL where the Consumer (Relying Party) received the
* authentication response matches the value of the "openid.return_to"
* parameter in the authentication response.
*
* @param receivingUrl The URL where the Consumer received the
* authentication response.
* @param response The authentication response.
* @return True if the two URLs match, false otherwise.
*/
public boolean verifyReturnTo(String receivingUrl, AuthSuccess response)
{
if (DEBUG)
_log.debug("Verifying return URL; receiving: " + receivingUrl +
"\nmessage: " + response.getReturnTo());
URL receiving;
URL returnTo;
try
{
receiving = new URL(receivingUrl);
returnTo = new URL(response.getReturnTo());
}
catch (MalformedURLException e)
{
_log.error("Invalid return URL.", e);
return false;
}
// [1/2] schema, authority (includes port) and path
// deal manually with the trailing slash in the path
StringBuffer receivingPath = new StringBuffer(receiving.getPath());
if ( receivingPath.length() > 0 &&
receivingPath.charAt(receivingPath.length() -1) != '/')
receivingPath.append('/');
StringBuffer returnToPath = new StringBuffer(returnTo.getPath());
if ( returnToPath.length() > 0 &&
returnToPath.charAt(returnToPath.length() -1) != '/')
returnToPath.append('/');
if ( ! receiving.getProtocol().equals(returnTo.getProtocol()) ||
! receiving.getAuthority().equals(returnTo.getAuthority()) ||
! receivingPath.toString().equals(returnToPath.toString()) )
{
if (DEBUG)
_log.debug("Return URL schema, authority or " +
"path verification failed.");
return false;
}
// [2/2] query parameters
try
{
Map returnToParams = extractQueryParams(returnTo);
Map receivingParams = extractQueryParams(receiving);
if (returnToParams == null) return true;
if (receivingParams == null)
{
if (DEBUG)
_log.debug("Return URL query parameters verification failed.");
return false;
}
Iterator iter = returnToParams.keySet().iterator();
while (iter.hasNext())
{
String key = (String) iter.next();
List receivingValues = (List) receivingParams.get(key);
List returnToValues = (List) returnToParams.get(key);
if ( receivingValues == null ||
receivingValues.size() != returnToValues.size() ||
! receivingValues.containsAll( returnToValues ) )
{
if (DEBUG)
_log.debug("Return URL query parameters verification failed.");
return false;
}
}
}
catch (UnsupportedEncodingException e)
{
_log.error("Error verifying return URL query parameters.", e);
return false;
}
return true;
}
/**
* Returns a Map(key, List(values)) with the URL's query params, or null if
* the URL doesn't have a query string.
*/
public Map extractQueryParams(URL url) throws UnsupportedEncodingException
{
if (url.getQuery() == null) return null;
Map paramsMap = new HashMap();
List paramList = Arrays.asList(url.getQuery().split("&"));
Iterator iter = paramList.iterator();
while (iter.hasNext())
{
String keyValue = (String) iter.next();
int equalPos = keyValue.indexOf("=");
String key = equalPos > -1 ?
URLDecoder.decode(keyValue.substring(0, equalPos), "UTF-8") :
URLDecoder.decode(keyValue, "UTF-8");
String value;
if (equalPos <= -1)
value = null;
else if (equalPos + 1 > keyValue.length())
value = "";
else
value = URLDecoder.decode(keyValue.substring(equalPos + 1), "UTF-8");
List existingValues = (List) paramsMap.get(key);
if (existingValues == null)
{
List newValues = new ArrayList();
newValues.add(value);
paramsMap.put(key, newValues);
}
else
existingValues.add(value);
}
return paramsMap;
}
/**
* Verifies the nonce in an authentication response.
*
* @param authResp The authentication response containing the nonce
* to be verified.
* @param discovered The discovery information associated with the
* authentication transaction.
* @return True if the nonce is valid, false otherwise.
*/
public boolean verifyNonce(AuthSuccess authResp,
DiscoveryInformation discovered)
{
String nonce = authResp.getNonce();
if (nonce == null) // compatibility mode
nonce = extractConsumerNonce(authResp.getReturnTo(),
discovered.getOPEndpoint().toString());
if (nonce == null) return false;
// using the same nonce verifier for both server and consumer nonces
return (NonceVerifier.OK == _nonceVerifier.seen(
discovered.getOPEndpoint().toString(), nonce));
}
/**
* Inserts a consumer-side nonce as a custom parameter in the return_to
* parameter of the authentication request.
*
* Needed for preventing replay attack when running compatibility mode.
* OpenID 1.1 OpenID Providers do not generate nonces in authentication
* responses.
*
* @param opUrl The endpoint to be used for private association.
* @param returnTo The return_to URL to which a custom nonce
* parameter will be added.
* @return The return_to URL containing the nonce.
*/
public String insertConsumerNonce(String opUrl, String returnTo)
{
String nonce = _consumerNonceGenerator.next();
returnTo += (returnTo.indexOf('?') != -1) ? '&' : '?';
Association privateAssoc = _privateAssociations.load(opUrl);
if( privateAssoc == null )
{
try
{
if (DEBUG) _log.debug( "Creating private association for opUrl " + opUrl);
privateAssoc = Association.generate(
getPrefAssocSessEnc().getAssociationType(), "", _failedAssocExpire);
_privateAssociations.save( opUrl, privateAssoc );
}
catch ( AssociationException e )
{
_log.error("Cannot initialize private association.", e);
return null;
}
}
try
{
returnTo += "openid.rpnonce=" + URLEncoder.encode(nonce, "UTF-8");
returnTo += "&openid.rpsig=" +
URLEncoder.encode(privateAssoc.sign(returnTo),
"UTF-8");
_log.info("Inserted consumer nonce: " + nonce);
if (DEBUG) _log.debug("return_to:" + returnTo);
}
catch (Exception e)
{
_log.error("Error inserting consumre nonce.", e);
return null;
}
return returnTo;
}
/**
* Extracts the consumer-side nonce from the return_to parameter in
* authentication response from a OpenID 1.1 Provider.
*
* @param returnTo return_to URL from the authentication response
* @param opUrl URL for the appropriate OP endpoint
* @return The nonce found in the return_to URL, or null if
* it wasn't found.
*/
public String extractConsumerNonce(String returnTo, String opUrl)
{
if (DEBUG)
_log.debug("Extracting consumer nonce...");
String nonce = null;
String signature = null;
URL returnToUrl;
try
{
returnToUrl = new URL(returnTo);
}
catch (MalformedURLException e)
{
_log.error("Invalid return_to: " + returnTo, e);
return null;
}
String query = returnToUrl.getQuery();
String[] params = query.split("&");
for (int i=0; i < params.length; i++)
{
String keyVal[] = params[i].split("=", 2);
try
{
if (keyVal.length == 2 && "openid.rpnonce".equals(keyVal[0]))
{
nonce = URLDecoder.decode(keyVal[1], "UTF-8");
if (DEBUG) _log.debug("Extracted consumer nonce: " + nonce);
}
if (keyVal.length == 2 && "openid.rpsig".equals(keyVal[0]))
{
signature = URLDecoder.decode(keyVal[1], "UTF-8");
if (DEBUG) _log.debug("Extracted consumer nonce signature: "
+ signature);
}
}
catch (UnsupportedEncodingException e)
{
_log.error("Error extracting consumer nonce / signarure.", e);
return null;
}
}
// check the signature
if (signature == null)
{
_log.error("Null consumer nonce signature.");
return null;
}
String signed = returnTo.substring(0, returnTo.indexOf("&openid.rpsig="));
if (DEBUG) _log.debug("Consumer signed text:\n" + signed);
try
{
if (DEBUG) _log.debug( "Loading private association for opUrl " + opUrl );
Association privateAssoc = _privateAssociations.load(opUrl);
if( privateAssoc == null )
{
_log.error("Null private association.");
return null;
}
if (privateAssoc.verifySignature(signed, signature))
{
_log.info("Consumer nonce signature verified.");
return nonce;
}
else
{
_log.error("Consumer nonce signature failed.");
return null;
}
}
catch (AssociationException e)
{
_log.error("Error verifying consumer nonce signature.", e);
return null;
}
}
/**
* Verifies the dicovery information matches the data received in a
* authentication response from an OpenID Provider.
*
* @param authResp The authentication response to be verified.
* @param discovered The discovery information obtained earlier during
* the discovery stage, associated with the
* identifier(s) in the request. Stateless operation
* is assumed if null.
* @return The discovery information associated with the
* claimed identifier, that can be used further in
* the verification process. Null if the discovery
* on the claimed identifier does not match the data
* in the assertion.
*/
private DiscoveryInformation verifyDiscovered(AuthSuccess authResp,
DiscoveryInformation discovered)
throws DiscoveryException
{
if (authResp == null || authResp.getIdentity() == null)
{
_log.info("Assertion is not about an identifier");
return null;
}
if (authResp.isVersion2())
return verifyDiscovered2(authResp, discovered);
else
return verifyDiscovered1(authResp, discovered);
}
/**
* Verifies the discovered information associated with a OpenID 1.x
* response.
*
* @param authResp The authentication response to be verified.
* @param discovered The discovery information obtained earlier during
* the discovery stage, associated with the
* identifier(s) in the request. Stateless operation
* is assumed if null.
* @return The discovery information associated with the
* claimed identifier, that can be used further in
* the verification process. Null if the discovery
* on the claimed identifier does not match the data
* in the assertion.
*/
private DiscoveryInformation verifyDiscovered1(AuthSuccess authResp,
DiscoveryInformation discovered)
throws DiscoveryException
{
if ( authResp == null || authResp.isVersion2() ||
authResp.getIdentity() == null )
{
if (DEBUG)
_log.error("Invalid authentication response: " +
"cannot verify v1 discovered information");
return null;
}
// asserted identifier in the AuthResponse
String assertId = authResp.getIdentity();
if ( discovered != null && ! discovered.isVersion2() &&
discovered.getClaimedIdentifier() != null )
{
// statefull mode
if (DEBUG)
_log.debug("Verifying discovered information " +
"for OpenID1 assertion about ClaimedID: " +
discovered.getClaimedIdentifier().getIdentifier());
String discoveredId = discovered.hasDelegateIdentifier() ?
discovered.getDelegateIdentifier() :
discovered.getClaimedIdentifier().getIdentifier();
if (assertId.equals(discoveredId))
return discovered;
}
// stateless, bare response, or the user changed the ID at the OP
_log.info("Proceeding with stateless mode / bare response verification...");
DiscoveryInformation firstServiceMatch = null;
// assuming openid.identity is the claimedId
// (delegation can't work with stateless/bare resp v1 operation)
if (DEBUG) _log.debug(
"Performing discovery on the ClaimedID in the assertion: " + assertId);
List discoveries = _discovery.discover(assertId);
Iterator iter = discoveries.iterator();
while (iter.hasNext())
{
DiscoveryInformation service = (DiscoveryInformation) iter.next();
if (service.isVersion2() || // only interested in v1
! service.hasClaimedIdentifier() || // need a claimedId
service.hasDelegateIdentifier() || // not allowing delegates
! assertId.equals(service.getClaimedIdentifier().getIdentifier()))
continue;
if (DEBUG) _log.debug("Found matching service: " + service);
// keep the first endpoint that matches
if (firstServiceMatch == null)
firstServiceMatch = service;
Association assoc = _associations.load(
service.getOPEndpoint().toString(),
authResp.getHandle());
// don't look further if there is an association with this endpoint
if (assoc != null)
{
if (DEBUG)
_log.debug("Found existing association for " + service +
" Not looking for another service endpoint.");
return service;
}
}
if (firstServiceMatch == null)
_log.error("No service element found to match " +
"the identifier in the assertion.");
return firstServiceMatch;
}
/**
* Verifies the discovered information associated with a OpenID 2.0
* response.
*
* @param authResp The authentication response to be verified.
* @param discovered The discovery information obtained earlier during
* the discovery stage, associated with the
* identifier(s) in the request. Stateless operation
* is assumed if null.
* @return The discovery information associated with the
* claimed identifier, that can be used further in
* the verification process. Null if the discovery
* on the claimed identifier does not match the data
* in the assertion.
*/
private DiscoveryInformation verifyDiscovered2(AuthSuccess authResp,
DiscoveryInformation discovered)
throws DiscoveryException
{
if (authResp == null || ! authResp.isVersion2() ||
authResp.getIdentity() == null || authResp.getClaimed() == null)
{
if (DEBUG)
_log.debug("Discovered information doesn't match " +
"auth response / version");
return null;
}
// asserted identifier in the AuthResponse
String assertId = authResp.getIdentity();
// claimed identifier in the AuthResponse
Identifier respClaimed =
_discovery.parseIdentifier(authResp.getClaimed(), true);
// the OP endpoint sent in the response
String respEndpoint = authResp.getOpEndpoint();
if (DEBUG)
_log.debug("Verifying discovered information for OpenID2 assertion " +
"about ClaimedID: " + respClaimed.getIdentifier());
// was the claimed identifier in the assertion previously discovered?
if (discovered != null && discovered.hasClaimedIdentifier() &&
discovered.getClaimedIdentifier().equals(respClaimed) )
{
// OP-endpoint, OP-specific ID and protocol version must match
String opSpecific = discovered.hasDelegateIdentifier() ?
discovered.getDelegateIdentifier() :
discovered.getClaimedIdentifier().getIdentifier();
if ( opSpecific.equals(assertId) &&
discovered.isVersion2() &&
discovered.getOPEndpoint().toString().equals(respEndpoint))
{
if (DEBUG) _log.debug(
"ClaimedID in the assertion was previously discovered: "
+ respClaimed);
return discovered;
}
}
// stateless, bare response, or the user changed the ID at the OP
DiscoveryInformation firstServiceMatch = null;
// perform discovery on the claim identifier in the assertion
if(DEBUG) _log.debug(
"Performing discovery on the ClaimedID in the assertion: "
+ respClaimed);
List discoveries = _discovery.discover(respClaimed);
// find the newly discovered service endpoint that matches the assertion
// - OP endpoint, OP-specific ID and protocol version must match
// - prefer (first = highest priority) endpoint with an association
if (DEBUG)
_log.debug("Looking for a service element to match " +
"the ClaimedID and OP endpoint in the assertion...");
Iterator iter = discoveries.iterator();
while (iter.hasNext())
{
DiscoveryInformation service = (DiscoveryInformation) iter.next();
if (DiscoveryInformation.OPENID2_OP.equals(service.getVersion()))
continue;
String opSpecific = service.hasDelegateIdentifier() ?
service.getDelegateIdentifier() :
service.getClaimedIdentifier().getIdentifier();
if ( ! opSpecific.equals(assertId) ||
! service.isVersion2() ||
! service.getOPEndpoint().toString().equals(respEndpoint) )
continue;
// keep the first endpoint that matches
if (firstServiceMatch == null)
{
if (DEBUG) _log.debug("Found matching service: " + service);
firstServiceMatch = service;
}
Association assoc = _associations.load(
service.getOPEndpoint().toString(),
authResp.getHandle());
// don't look further if there is an association with this endpoint
if (assoc != null)
{
if (DEBUG)
_log.debug("Found existing association, " +
"not looking for another service endpoint.");
return service;
}
}
if (firstServiceMatch == null)
_log.error("No service element found to match " +
"the ClaimedID / OP-endpoint in the assertion.");
return firstServiceMatch;
}
/**
* Verifies the signature in a authentication response message.
*
* @param authResp Authentication response to be verified.
* @param discovered The discovery information obtained earlier during
* the discovery stage.
* @return True if the verification succeeded, false otherwise.
*/
private VerificationResult verifySignature(AuthSuccess authResp,
DiscoveryInformation discovered,
VerificationResult result)
throws AssociationException, MessageException, DiscoveryException
{
if (discovered == null || authResp == null)
{
_log.error("Can't verify signature: " +
"null assertion or discovered information.");
result.setStatusMsg("Can't verify signature: " +
"null assertion or discovered information.");
return result;
}
Identifier claimedId = discovered.isVersion2() ?
_discovery.parseIdentifier(authResp.getClaimed()) : //may have frag
discovered.getClaimedIdentifier(); //assert id may be delegate in v1
String handle = authResp.getHandle();
URL op = discovered.getOPEndpoint();
Association assoc = _associations.load(op.toString(), handle);
if (assoc != null) // association available, local verification
{
_log.info("Found association: " + assoc.getHandle() +
" verifying signature locally...");
String text = authResp.getSignedText();
String signature = authResp.getSignature();
if (assoc.verifySignature(text, signature))
{
result.setVerifiedId(claimedId);
if (DEBUG) _log.debug("Local signature verification succeeded.");
}
else if (DEBUG)
{
_log.debug("Local signature verification failed.");
result.setStatusMsg("Local signature verification failed");
}
}
else // no association, verify with the OP
{
_log.info("No association found, " +
"contacting the OP for direct verification...");
VerifyRequest vrfy = VerifyRequest.createVerifyRequest(authResp);
ParameterList responseParams = new ParameterList();
int respCode = call(op.toString(), vrfy, responseParams);
if (HttpStatus.SC_OK == respCode)
{
VerifyResponse vrfyResp =
VerifyResponse.createVerifyResponse(responseParams);
vrfyResp.validate();
if (vrfyResp.isSignatureVerified())
{
// process the optional invalidate_handle first
String invalidateHandle = vrfyResp.getInvalidateHandle();
if (invalidateHandle != null)
_associations.remove(op.toString(), invalidateHandle);
result.setVerifiedId(claimedId);
if (DEBUG)
_log.debug("Direct signature verification succeeded " +
"with OP: " + op);
}
else
{
if (DEBUG)
_log.debug("Direct signature verification failed " +
"with OP: " + op);
result.setStatusMsg("Direct signature verification failed.");
}
}
else
{
DirectError err = DirectError.createDirectError(responseParams);
if (DEBUG) _log.debug("Error verifying signature with the OP: "
+ op + " error message: " + err.keyValueFormEncoding());
result.setStatusMsg("Error verifying signature with the OP: "
+ err.getErrorMsg());
}
}
Identifier verifiedID = result.getVerifiedId();
if (verifiedID != null)
_log.info("Verification succeeded for: " + verifiedID);
else
_log.error("Verification failed for: " + authResp.getClaimed()
+ " reason: " + result.getStatusMsg());
return result;
}
/* visible for testing */
HttpFetcher getHttpFetcher()
{
return _httpFetcher;
}
}
openid4java-0.9.6.662/src/org/openid4java/consumer/JdbcNonceVerifier.java 0000644 0015012 0015012 00000007261 11040142265 025366 0 ustar miguel miguel
package org.openid4java.consumer ;
import java.util.Date ;
import org.apache.commons.logging.Log ;
import org.apache.commons.logging.LogFactory ;
import org.springframework.dao.DataIntegrityViolationException ;
import org.springframework.jdbc.core.JdbcTemplate ;
import org.springframework.jdbc.core.support.JdbcDaoSupport ;
/**
*
* JDBC implementation of a NonceVerifier.
*
* The JdbcNonceVerifier requires a a javax.sql.DataSource to be configured
* and passed in to it with the setDataSource setter method. The table name
* also needs to be specified, either through the constructor, or through the
* setTableName setter.
*
*
* Since the nonces are constructed on the web server and not on the shared
* database server, they may accidentally collide. Also, if the machines
* clocks are out of sync, the nonces from the machine that is behind may be
* removed prematurely from the database by the other machine.
*
*
* The specified table must have the following structure:
*
*
opurl : string
*
nonce : string
*
date : date
*
primary key : opurl, nonce
*
*
*
* @author Andrew Evenson, Graff Haley
* @created May 19, 2008
*/
public class JdbcNonceVerifier
extends JdbcDaoSupport
implements NonceVerifier
{
private static Log _log = LogFactory.getLog ( JdbcNonceVerifier.class ) ;
private NonceVerifier _verifier ;
private String _tableName ;
private String _deleteSQL ;
private String _insertSQL ;
public JdbcNonceVerifier ( int maxAge )
{
_verifier = new GenericNonceVerifier ( maxAge ) ;
}
public JdbcNonceVerifier ( int maxAge, String tableName )
{
this ( maxAge ) ;
setTableName ( tableName ) ;
}
public int getMaxAge ( )
{
return _verifier.getMaxAge ( ) ;
}
public void setMaxAge(int ageSeconds)
{
_verifier.setMaxAge(ageSeconds);
}
public int seen ( String opUrl, String nonce )
{
return _verifier.seen ( opUrl, nonce ) ;
}
public String getTableName ( )
{
return _tableName ;
}
public void setTableName ( String tableName )
{
this._tableName = tableName ;
this._deleteSQL = "DELETE FROM " + tableName + " WHERE date>?" ;
this._insertSQL = "INSERT INTO " + tableName + " (opurl, nonce, date) VALUES (?,?,?)" ;
}
private class GenericNonceVerifier
extends AbstractNonceVerifier
{
public GenericNonceVerifier ( int maxAge )
{
super ( maxAge ) ;
}
/**
*
* Implementation of the abstract nonce verifier. Uses the primary key
* integrity constraint to evaluate nonces. This prevents a gap
* between check and insert. Also, triggers the cleanup of old nonces.
*
* @param now
* @param opUrl
* @param nonce
* @return
*/
protected int seen ( Date now, String opUrl, String nonce )
{
cleanupAged ( ) ;
JdbcTemplate jdbcTemplate = getJdbcTemplate ( ) ;
try
{
jdbcTemplate.update ( _insertSQL, new Object[]
{ opUrl, nonce, now } ) ;
return OK ;
}
catch ( DataIntegrityViolationException e )
{
_log.warn ( "Nonce already seen. Possible replay attack!" ) ;
}
catch ( Exception e )
{
_log.error ( "Problem executing database method", e ) ;
}
return SEEN ;
}
private void cleanupAged ( )
{
try
{
Date boundary = new Date ( System.currentTimeMillis ( ) - _maxAgeSeconds * 1000 ) ;
JdbcTemplate jdbcTemplate = getJdbcTemplate ( ) ;
int cnt = jdbcTemplate.update ( _deleteSQL, new Object[]
{ boundary } ) ;
if ( _log.isDebugEnabled ( ) ) _log.debug ( "Client nonce cleanup removed " + cnt + " entries" ) ;
}
catch ( Exception e )
{
_log.error ( "Error cleaning up client nonces from table: " + _tableName, e ) ;
}
}
}
}
openid4java-0.9.6.662/src/org/openid4java/consumer/EhcacheNonceVerifier.java 0000644 0015012 0015012 00000003160 11034531517 026043 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.consumer;
import net.sf.ehcache.Cache;
import net.sf.ehcache.Element;
import java.util.Date;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class EhcacheNonceVerifier extends AbstractNonceVerifier
{
private static Log _log = LogFactory.getLog(EhcacheNonceVerifier.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private Cache _cache;
public EhcacheNonceVerifier(int maxAge)
{
super(maxAge);
}
public void setCache(Cache cache)
{
if (cache.getTimeToLiveSeconds() != _maxAgeSeconds)
{
throw new IllegalArgumentException("Max Age: " + _maxAgeSeconds + ", same expected for cache, but found: " + cache.getTimeToLiveSeconds());
}
if (cache.getTimeToLiveSeconds() != cache.getTimeToIdleSeconds())
{
throw new IllegalArgumentException("Cache must have same timeToLive (" + cache.getTimeToLiveSeconds() + ") as timeToIdle (" + cache.getTimeToIdleSeconds() + ")");
}
_cache = cache;
}
protected int seen(Date now, String opUrl, String nonce)
{
String pair = opUrl + '#' + nonce;
Element element = new Element(pair, pair);
if (_cache.get(pair) != null)
{
_log.error("Possible replay attack! Already seen nonce: " + nonce);
return SEEN;
}
_cache.put(element);
if (DEBUG) _log.debug("Nonce verified: " + nonce);
return OK;
}
}
openid4java-0.9.6.662/src/org/openid4java/message/ 0000755 0015012 0015012 00000000000 11627733442 021003 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/message/sreg/ 0000755 0015012 0015012 00000000000 11627733442 021743 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/message/sreg/SRegRequest.java 0000644 0015012 0015012 00000014270 11034531512 025005 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.sreg;
import org.openid4java.message.MessageException;
import org.openid4java.message.Parameter;
import org.openid4java.message.ParameterList;
import java.net.URL;
import java.net.MalformedURLException;
import java.util.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements the extension for Simple Registration fetch requests.
*
* @see SRegMessage Message
* @author Marius Scurtescu, Johnny Bufu
*/
public class SRegRequest extends SRegMessage
{
private static Log _log = LogFactory.getLog(SRegRequest.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/**
* Constructs a SReg Request with an empty parameter list.
*/
protected SRegRequest()
{
if (DEBUG) _log.debug("Created empty SReg request.");
}
/**
* Constructs a SReg Request with an empty parameter list.
*/
public static SRegRequest createFetchRequest()
{
return new SRegRequest();
}
/**
* Constructs a SRegRequest from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
protected SRegRequest(ParameterList params)
{
_parameters = params;
}
/**
* Constructs a SRegRequest from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
public static SRegRequest createSRegRequest(ParameterList params)
throws MessageException
{
SRegRequest req = new SRegRequest(params);
if (! req.isValid())
throw new MessageException("Invalid parameters for a SReg request");
if (DEBUG)
_log.debug("Created SReg request from parameter list:\n" + params);
return req;
}
/**
* Adds an attribute to the SReg request.
*
* @param attr A requested attribute name.
* @param required If true, marks the attribute as 'required';
* 'if_available' otherwise.
*/
public void addAttribute(String attr, boolean required)
{
String level = required ? "required" : "optional";
Parameter levelParam = _parameters.getParameter(level);
Parameter newParam;
if (levelParam == null)
{
newParam = new Parameter(level, multivalEncode(attr));
}
else
{
newParam = new Parameter(level,
levelParam.getValue() + "," + multivalEncode(attr));
_parameters.removeParameters(level);
}
_parameters.set(newParam);
if (DEBUG) _log.debug("Added new attribute to SReg request: " + attr +
" required: " + required);
}
/**
* Returns a map with the requested attributes.
*
* @param required If set to true the list of 'required' attributes
* is returned, otherwise the list of 'optional'
* attributes.
* @return List of attribute names.
*/
public List getAttributes(boolean required)
{
List attributes = new ArrayList();
String level = required ? "required" : "optional";
Parameter param = _parameters.getParameter(level);
if (param != null)
{
String[] values = param.getValue().split(",");
for (int i = 0; i < values.length; i++)
{
String attr = multivalDecode(values[i]);
attributes.add(attr);
}
}
return attributes;
}
/**
* Gets all requested attributes (required and optional).
*
* @return List of attribute names.
*/
public List getAttributes()
{
List attributes = getAttributes(true);
attributes.addAll(getAttributes(false));
return attributes;
}
/**
* Sets the optional policy URL.
*
* @param policyUrl A URL which the Consumer provides to give the
* End User a place to read about the how the profile
* data will be used. The Identity Provider SHOULD
* display this URL to the End User if it is given.
*/
public void setPolicyUrl(String policyUrl) throws MessageException {
try
{
new URL(policyUrl);
} catch (MalformedURLException e)
{
throw new MessageException("Invalid policy_url: " + policyUrl);
}
if (DEBUG) _log.debug("Setting SReg request policy_url: " + policyUrl);
_parameters.set(new Parameter("policy_url", policyUrl));
}
/**
* Gets the optional policy URL parameter if available, or null otherwise.
*/
public String getUpdateUrl()
{
return _parameters.hasParameter("policy_url") ?
_parameters.getParameterValue("policy_url") : null;
}
/**
* Checks the validity of the extension.
*
* Used when constructing a extension from a parameter list.
*
* @return True if the extension is valid, false otherwise.
*/
public boolean isValid()
{
if ( ! _parameters.hasParameter("required") &&
! _parameters.hasParameter("optional") )
{
_log.warn("One of 'required' or 'optional' parameters must be present.");
return false;
}
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
String paramName = ((Parameter) it.next()).getKey();
if (! paramName.equals("required") &&
! paramName.equals("optional") &&
! paramName.equals("policy_url"))
{
_log.warn("Invalid parameter name in SReg request: " + paramName);
// return false;
}
}
return true;
}
}
openid4java-0.9.6.662/src/org/openid4java/message/sreg/SRegMessage.java 0000644 0015012 0015012 00000015257 11207020752 024750 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.sreg;
import org.openid4java.message.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Base class for the Simple Registration implementation.
*
* Encapsulates:
*
*
the Type URI that identifies the Simple Registration extension
*
a list of extension-specific parameters, with the
* openid. prefix removed
*
methods for handling the extension-specific support of parameters with
* multpile values
*
*
* Considering that:
*
*
SREG 1.0 and SREG 1.1 use the same type URI
* ("http://openid.net/sreg/1.0") in XRDS documents
*
The only differences between the two are the hardcoded "sreg" extension
* alias in SREG1.0 and the openid.ns. namespace declaration
* in SREG1.1
*
*
* Support for Simple Registration is implemented as follows:
*
*
Both SREG1.0 and SREG1.1 are implemented using the same extension
* framework
*
In OpenID2 messages only SREG1.1 is accepted, i.e. the namespace
* declaration (openid.ns.) MUST be present
*
For seamless inteoperation, the extension alias is forced to "sreg" for
* OpenID 2 messages / SREG1.1
*
*
* @see Message MessageExtension
* @author Marius Scurtescu, Johnny Bufu
*/
public class SRegMessage implements MessageExtension, MessageExtensionFactory
{
private static Log _log = LogFactory.getLog(SRegMessage.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/**
* The Simple Registration 1.0 namespace URI.
*/
public static final String OPENID_NS_SREG = "http://openid.net/sreg/1.0";
/**
* The Simple Registration 1.1 namespace URI.
*/
public static final String OPENID_NS_SREG11 = "http://openid.net/extensions/sreg/1.1";
/**
* The Simple Registration extension-specific parameters.
*
* The openid. prefix is not part of the parameter names
*/
protected ParameterList _parameters;
private String _typeUri = OPENID_NS_SREG;
/**
* Constructs an empty (no parameters) Simple Registration extension.
*/
public SRegMessage()
{
_parameters = new ParameterList();
if (DEBUG) _log.debug("Created empty SRegMessage.");
}
/**
* Constructs an Simple Registration extension with a specified list of
* parameters.
*
* The parameter names in the list should not contain the
* openid..
*/
public SRegMessage(ParameterList params)
{
_parameters = params;
if (DEBUG)
_log.debug("Created SRegMessage from parameter list:\n" + params);
}
/**
* Gets the Type URI that identifies the Simple Registration extension.
*/
public String getTypeUri()
{
return _typeUri;
}
/**
* Sets the SREG type URI. Hack to support both SREG 1.0 and 1.1,
* until 1.1 spec gets fixed.
*/
public void setTypeUri(String typeUri)
{
_typeUri = typeUri;
}
/**
* Gets ParameterList containing the Simple Registration extension-specific
* parameters.
*
* The openid. prefix is not part of the parameter names,
* as it is handled internally by the Message class.
*
* The openid.ns. parameter is also handled by
* the Message class.
*
* @see Message
*/
public ParameterList getParameters()
{
return _parameters;
}
/**
* Gets a the value of the parameter with the specified name.
*
* @param name The name of the parameter,
* without the openid. prefix.
* @return The parameter value, or null if not found.
*/
public String getParameterValue(String name)
{
return _parameters.getParameterValue(name);
}
/**
* Sets the extension's parameters to the supplied list.
*
* The parameter names in the list should not contain the
* openid. prefix.
*/
public void setParameters(ParameterList params)
{
_parameters = params;
}
/**
* Encodes a string value according to the conventions for supporting
* multiple values for a parameter (commas and backslashes are escaped).
*
* @param value String value to be encoded.
* @return The encoded value.
*/
public String multivalEncode(String value)
{
return value.replaceAll("\\\\", "\\\\\\\\").replaceAll(",","\\\\,");
}
/**
* Decodes a string value according to the conventions for supporting
* multiple values for a parameter (commas and backslashes are escaped).
*
* @param value String value to be decoded.
* @return The dencoded value.
*/
public String multivalDecode(String value)
{
return value.replaceAll("\\\\,", ",").replaceAll("\\\\\\\\","\\\\");
}
/**
* Simple Registration doesn't implement authentication services.
*
* @return false
*/
public boolean providesIdentifier()
{
return false;
}
/**
* Simple registration parameters are REQUIRED to be signed.
*
* @return true
*/
public boolean signRequired()
{
return true;
}
/**
* Instantiates the apropriate Simple Registration object
* (request / response) for the supplied parameter list.
*
* @param parameterList The Simple Registration specific parameters
* (without the openid. prefix)
* extracted from the openid message.
* @param isRequest Indicates whether the parameters were
* extracted from an OpenID request (true),
* or from an OpenID response.
* @return MessageExtension implementation for
* the supplied extension parameters.
* @throws MessageException If a Simple Registration object could not be
* instantiated from the supplied parameter list.
*/
public MessageExtension getExtension(
ParameterList parameterList, boolean isRequest)
throws MessageException
{
if ( parameterList.hasParameter("required") ||
parameterList.hasParameter("optional"))
return SRegRequest.createSRegRequest(parameterList);
else
return SRegResponse.createSRegResponse(parameterList);
}
}
openid4java-0.9.6.662/src/org/openid4java/message/sreg/SReg11ExtensionFactory.java 0000644 0015012 0015012 00000004326 11034531512 027024 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.sreg;
import org.openid4java.message.MessageExtensionFactory;
import org.openid4java.message.MessageExtension;
import org.openid4java.message.ParameterList;
import org.openid4java.message.MessageException;
/**
* Custom Extension Factory for SREG 1.1 messages. Creates SRegMessage
* objects, but sets the type URI to http://openid.net/extensions/sreg/1.1
* for SREG 1.1.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class SReg11ExtensionFactory implements MessageExtensionFactory
{
/**
* Gets the Type URI that identifies the Simple Registration 1.1 extension.
*/
public String getTypeUri()
{
return SRegMessage.OPENID_NS_SREG11;
}
/**
* Instantiates the apropriate Simple Registration object
* (request / response) for the supplied parameter list.
*
* Similar to SRegMessage.getExtension(), but sets the SREG 1.1 type URI.
*
* @param parameterList The Simple Registration specific parameters
* (without the openid. prefix)
* extracted from the openid message.
* @param isRequest Indicates whether the parameters were
* extracted from an OpenID request (true),
* or from an OpenID response.
* @return MessageExtension implementation for
* the supplied extension parameters.
* @throws MessageException If a Simple Registration object could not be
* instantiated from the supplied parameter list.
*/
public MessageExtension getExtension(
ParameterList parameterList, boolean isRequest)
throws MessageException
{
SRegMessage sreg;
if ( parameterList.hasParameter("required") ||
parameterList.hasParameter("optional"))
sreg = SRegRequest.createSRegRequest(parameterList);
else
sreg = SRegResponse.createSRegResponse(parameterList);
sreg.setTypeUri(SRegMessage.OPENID_NS_SREG11);
return sreg;
}
}
openid4java-0.9.6.662/src/org/openid4java/message/sreg/SRegResponse.java 0000644 0015012 0015012 00000012603 11034531512 025151 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.sreg;
import org.openid4java.message.ParameterList;
import org.openid4java.message.MessageException;
import org.openid4java.message.Parameter;
import java.util.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements the extension for Simple Registration fetch responses.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class SRegResponse extends SRegMessage
{
private static Log _log = LogFactory.getLog(SRegResponse.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected final static List SREG_FIELDS = Arrays.asList( new String[] {
"nickname", "email", "fullname", "dob", "gender",
"postcode", "country", "language", "timezone"
});
/**
* Constructs a SReg Response with an empty parameter list.
*/
protected SRegResponse()
{
if (DEBUG) _log.debug("Created empty fetch response.");
}
/**
* Constructs a SReg Response with an empty parameter list.
*/
public static SRegResponse createFetchResponse()
{
return new SRegResponse();
}
/**
* Constructs a SReg Response from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
protected SRegResponse(ParameterList params)
{
_parameters = params;
}
public static SRegResponse createSRegResponse(ParameterList params)
throws MessageException
{
SRegResponse resp = new SRegResponse(params);
if (! resp.isValid())
throw new MessageException("Invalid parameters for a SReg response");
if (DEBUG)
_log.debug("Created SReg response from parameter list:\n" + params);
return resp;
}
/**
* Creates a SRegResponse from a SRegRequest message and the data released
* by the user.
*
* @param req SRegRequest message.
* @param userData Map with the
* data released by the user.
* @return Properly formed SRegResponse.
* @throws MessageException if any attribute-name in the userData map does not
* correspond to an SREG field-name.
*/
public static SRegResponse createSRegResponse(SRegRequest req, Map userData)
throws MessageException
{
SRegResponse resp = new SRegResponse();
List attributes = req.getAttributes();
Iterator iter = attributes.iterator();
while (iter.hasNext())
{
String attr = (String) iter.next();
String value = (String) userData.get(attr);
if (value != null)
resp.addAttribute(attr, value);
}
return resp;
}
/**
* Adds an attribute to the SReg response. The allowed attribute names are
* the ones defined in the SReg specification: nickname, email, fullname,
* dob, gender, postcode, country, language, timezone.
*
* @param attr An attribute name.
* @param value The value of the attribute.
*/
public void addAttribute(String attr, String value) throws MessageException
{
_parameters.set(new Parameter(attr, value));
if (! SREG_FIELDS.contains(attr))
throw new MessageException("Invalid attribute for SReg: " + attr);
if (DEBUG)
_log.debug("Added new attribute to SReg response: " + attr +
" value: " + value);
}
/**
* Returns the value of an attribute.
*
* @param attr The attribute name.
* @return The attribute value.
*/
public String getAttributeValue(String attr)
{
return getParameterValue(attr);
}
/**
* Gets a list of attribute names in the SReg response.
*/
public List getAttributeNames()
{
List attributes = new ArrayList();
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
attributes.add(((Parameter) it.next()).getKey());
}
return attributes;
}
/**
* Gets a map with attribute names -> values.
*/
public Map getAttributes()
{
Map attributes = new HashMap();
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
String attr = ((Parameter) it.next()).getKey();
attributes.put(attr, getAttributeValue(attr));
}
return attributes;
}
/**
* Checks the validity of the extension.
*
* Used when constructing a extension from a parameter list.
*
* @return True if the extension is valid, false otherwise.
*/
private boolean isValid()
{
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
String paramName = ((Parameter) it.next()).getKey();
if (! SREG_FIELDS.contains(paramName))
{
_log.warn("Invalid parameter name in SReg response: " + paramName);
return false;
}
}
return true;
}
}
openid4java-0.9.6.662/src/org/openid4java/message/AuthImmediateFailure.java 0000644 0015012 0015012 00000006745 11034531513 025675 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.OpenIDException;
import java.util.List;
import java.util.Arrays;
import java.net.URL;
import java.net.MalformedURLException;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class AuthImmediateFailure extends Message
{
private static Log _log = LogFactory.getLog(AuthImmediateFailure.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected final static List requiredFields = Arrays.asList( new String[] {
"openid.mode"
});
protected final static List optionalFields = Arrays.asList( new String[] {
"openid.ns",
"openid.user_setup_url"
});
protected AuthImmediateFailure(String url, String returnTo,
boolean compatibility)
{
if (compatibility)
{
set("openid.mode", MODE_IDRES);
set("openid.user_setup_url", url);
}
else
{
set("openid.mode", MODE_SETUP_NEEDED);
set("openid.ns", OPENID2_NS);
}
_destinationUrl = returnTo;
}
protected AuthImmediateFailure(ParameterList params)
{
super(params);
}
public static AuthImmediateFailure createAuthImmediateFailure(
String url, String returnTo, boolean compatibility)
throws MessageException
{
AuthImmediateFailure fail = new AuthImmediateFailure(url, returnTo, compatibility);
fail.validate();
return fail;
}
public static AuthImmediateFailure createAuthImmediateFailure(ParameterList params)
throws MessageException
{
AuthImmediateFailure fail = new AuthImmediateFailure(params);
fail.validate();
if (DEBUG)
_log.debug("Retrieved auth immediate failure from message parameters:\n"
+ fail.keyValueFormEncoding());
return fail;
}
public List getRequiredFields()
{
return requiredFields;
}
public boolean isVersion2()
{
return hasParameter("openid.ns") &&
OPENID2_NS.equals(getParameterValue("openid.ns"));
}
public String getUserSetupUrl()
{
return getParameterValue("openid.user_setup_url");
}
public void validate() throws MessageException
{
super.validate();
boolean compatibility = ! isVersion2();
String mode = getParameterValue("openid.mode");
if (compatibility)
{
try
{
new URL(getUserSetupUrl());
}
catch (MalformedURLException e)
{
throw new MessageException(
"Invalid user_setup_url in auth failure response.",
OpenIDException.AUTH_ERROR, e);
}
if (! MODE_IDRES.equals(mode))
throw new MessageException(
"Invalid openid.mode in auth failure response; " +
"expected " + MODE_IDRES + " found: " + mode,
OpenIDException.AUTH_ERROR);
}
else if (! MODE_SETUP_NEEDED.equals(mode))
throw new MessageException(
"Invalid openid.mode in auth failure response; " +
"expected " + MODE_SETUP_NEEDED + "found: " + mode,
OpenIDException.AUTH_ERROR);
}
}
openid4java-0.9.6.662/src/org/openid4java/message/pape/ 0000755 0015012 0015012 00000000000 11627733442 021730 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/message/pape/PapeRequest.java 0000644 0015012 0015012 00000013750 11202136552 025023 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.pape;
import org.openid4java.message.MessageException;
import org.openid4java.message.Parameter;
import org.openid4java.message.ParameterList;
import org.openid4java.OpenIDException;
import java.util.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements the extension for OpenID Provider Authentication Policy requests.
*
* @see PapeMessage Message
* @author Marius Scurtescu, Johnny Bufu
*/
public class PapeRequest extends PapeMessage
{
private static Log _log = LogFactory.getLog(PapeRequest.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected final static List PAPE_FIELDS = Arrays.asList( new String[] {
"preferred_auth_policies", "preferred_auth_level_types", "max_auth_age"
});
/**
* Constructs a Pape Request with an empty parameter list.
*/
protected PapeRequest()
{
set("preferred_auth_policies", "");
if (DEBUG) _log.debug("Created empty Pape request.");
}
/**
* Constructs a Pape Request with an empty parameter list.
*/
public static PapeRequest createPapeRequest()
{
return new PapeRequest();
}
/**
* Constructs a PapeRequest from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
protected PapeRequest(ParameterList params)
{
super(params);
}
/**
* Constructs a PapeRequest from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
public static PapeRequest createPapeRequest(ParameterList params)
throws MessageException
{
PapeRequest req = new PapeRequest(params);
req.validate();
if (DEBUG)
_log.debug("Created PAPE request from parameter list:\n" + params);
return req;
}
/**
* Gets the preferred_auth_policies parameter value.
*/
public String getPreferredAuthPolicies()
{
return getParameterValue("preferred_auth_policies");
}
/**
* Sets a new value for the preferred_auth_policies parameter.
*
* The previous value of the parameter will be owerwritten.
*
* @param policyUris Space separated list of authentication policy
* URIs to be set.
* @see #addPreferredAuthPolicy(String)
*/
public void setPreferredAuthPolicies(String policyUris)
{
// todo: enforce that policyUri is a valid URI?
set("preferred_auth_policies", policyUris);
}
/**
* Adds an authentication policy URI to the preferred_auth_policies
* parameter.
*
* @param policyUri The authentication policy URI to be set.
* @see #setPreferredAuthPolicies(String)
*/
public void addPreferredAuthPolicy(String policyUri)
{
// todo: check that policyUri isn't already in the list?
String policies = getPreferredAuthPolicies();
if (policies == null || policies.length() == 0)
setPreferredAuthPolicies(policyUri);
else
setPreferredAuthPolicies(policies + " " + policyUri);
}
/**
* Gets a list with the preferred_auth_policies. An empty list is
* returned if no authentication policies exist.
*
*/
public List getPreferredAuthPoliciesList()
{
String policies = getParameterValue("preferred_auth_policies");
if (policies != null)
return Arrays.asList(policies.split(" "));
else
return new ArrayList();
}
/**
* Sets the max_auth_age parameter.
*
* @param seconds The number of seconds within which the OP is
* requested to have actively authenticated the user.
*/
public void setMaxAuthAge(int seconds)
{
set("max_auth_age", Integer.toString(seconds));
}
/**
* Gets the max_auth_age parameter.
*
* @return The number of seconds within which the OP is
* requested to have actively authenticated the user,
* or -1 if max_auth_age is not present in the request.
*/
public int getMaxAuthAge()
{
String maxAuthAge = getParameterValue("max_auth_age");
if (maxAuthAge != null)
return Integer.parseInt(maxAuthAge);
else
return -1;
}
/**
* Checks the validity of the extension.
*
* Used when constructing a extension from a parameter list.
*
* @throws MessageException if the PapeRequest is not valid.
*/
public void validate() throws MessageException
{
if (! _parameters.hasParameter("preferred_auth_policies"))
{
throw new MessageException(
"preferred_auth_policies is required in a PAPE request.",
OpenIDException.PAPE_ERROR);
}
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
String paramName = ((Parameter) it.next()).getKey();
if (! PAPE_FIELDS.contains(paramName) && ! paramName.startsWith(PapeMessage.AUTH_LEVEL_NS_PREFIX))
{
throw new MessageException(
"Invalid parameter name in PAPE request: " + paramName,
OpenIDException.PAPE_ERROR);
}
}
}
public void addPreferredCustomAuthLevel(String authLevelTypeUri)
{
String alias = addAuthLevelExtension(authLevelTypeUri);
String preferred = getParameterValue("preferred_auth_level_types");
set("preferred_auth_level_types", preferred == null ? alias : preferred + " " + alias);
}
}
openid4java-0.9.6.662/src/org/openid4java/message/pape/PapeResponse.java 0000644 0015012 0015012 00000016761 11202137743 025201 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.pape;
import org.openid4java.message.ParameterList;
import org.openid4java.message.MessageException;
import org.openid4java.message.Parameter;
import org.openid4java.util.InternetDateFormat;
import org.openid4java.OpenIDException;
import java.util.*;
import java.text.ParseException;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements the extension for OpenID Provider Authentication Policy responses.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class PapeResponse extends PapeMessage
{
private static Log _log = LogFactory.getLog(PapeResponse.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected final static List PAPE_FIELDS = Arrays.asList( new String[] {
"auth_policies", "auth_time",
});
private static final String AUTH_POLICY_NONE = "http://schemas.openid.net/pape/policies/2007/06/none";
private static InternetDateFormat _dateFormat = new InternetDateFormat();
/**
* Constructs a Pape Response with an empty parameter list.
*/
protected PapeResponse()
{
set("auth_policies", AUTH_POLICY_NONE);
if (DEBUG) _log.debug("Created empty PAPE response.");
}
/**
* Constructs a Pape Response with an empty parameter list.
*/
public static PapeResponse createPapeResponse()
{
return new PapeResponse();
}
/**
* Constructs a Pape Response from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
protected PapeResponse(ParameterList params)
{
super(params);
}
public static PapeResponse createPapeResponse(ParameterList params)
throws MessageException
{
PapeResponse resp = new PapeResponse(params);
resp.validate();
if (DEBUG)
_log.debug("Created PAPE response from parameter list:\n" + params);
return resp;
}
/**
* Gets the auth_policies parameter value.
*/
public String getAuthPolicies()
{
return getParameterValue("auth_policies");
}
/**
* Sets a new value for the auth_policies parameter.
*
* The previous value of the parameter will be owerwritten.
*
* @param policyUris Space separated list of authentication policy
* URIs to be set.
* @see #addAuthPolicy(String)
*/
public void setAuthPolicies(String policyUris)
{
// todo: enforce that policyUri is a valid URI?
set("auth_policies", policyUris);
}
/**
* Adds an authentication policy URI to the auth_policies
* parameter.
*
* @param policyUri The authentication policy URI to be set.
* @see #setAuthPolicies(String)
*/
public void addAuthPolicy(String policyUri)
{
// todo: check that policyUri isn't already in the list?
String policies = getAuthPolicies();
if (policies == null || AUTH_POLICY_NONE.equals(policies)) // should never be null
setAuthPolicies(policyUri);
else
setAuthPolicies(policies + " " + policyUri);
}
/**
* Gets a list with the auth_policies. An empty list is
* returned if no authentication policies exist.
*/
public List getAuthPoliciesList()
{
String policies = getParameterValue("auth_policies");
if (policies == null || AUTH_POLICY_NONE.equals(policies)) // should never be null
return new ArrayList();
else
return Arrays.asList(policies.split(" "));
}
/**
* Sets the auth_time parameter.
*
* @param timestamp The most recent timestamp when the End User has
* actively authenticated to the OP in a manner
* fitting the asserted policies.
*/
public void setAuthTime(Date timestamp)
{
set("auth_time", _dateFormat.format(timestamp));
}
/**
* Gets the timestamp when the End User has most recentnly authenticated
* to the OpenID Provider in a manner fitting the asserted policies.
*
* @return The verbatim value of the auth_time parameter.
* Null is returned if the parameter is not present
* in the PapeResponse.
*
* @see #getAuthDate()
*/
public String getAuthTime()
{
return getParameterValue("auth_time");
}
/**
* Gets the timestamp when the End User has most recentnly authenticated
* to the OpenID Provider in a manner fitting the asserted policies.
*
* @return The value of the auth_time parameter parsed into
* a java.util.Date. Null is returned if the parameter
* is not present in the PapeResponse, or if the
* parameter value is invalid.
*
* @see #getAuthTime()
*/
public Date getAuthDate()
{
String authTime = getParameterValue("auth_time");
if (authTime != null)
{
try
{
return _dateFormat.parse(authTime);
}
catch (ParseException e)
{
_log.warn("Invalid auth_time: " + authTime +
"; returning null.");
}
}
return null;
}
/**
* Checks the validity of the extension.
*
* Used when constructing a extension from a parameter list.
*
* @throws MessageException if the PapeResponse is not valid.
*/
private void validate() throws MessageException
{
if (! _parameters.hasParameter("auth_policies"))
{
throw new MessageException(
"auth_policies is required in a PAPE response.",
OpenIDException.PAPE_ERROR);
}
String authTime = getAuthTime();
if (authTime != null)
{
try
{
_dateFormat.parse(authTime);
}
catch (ParseException e)
{
throw new MessageException(
"Invalid auth_time in PAPE response: " + authTime,
OpenIDException.PAPE_ERROR, e);
}
}
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
String paramName = ((Parameter) it.next()).getKey();
if (PAPE_FIELDS.contains(paramName) || paramName.startsWith(PapeMessage.AUTH_LEVEL_NS_PREFIX))
continue;
if ( paramName.startsWith(AUTH_LEVEL_PREFIX) &&
(authLevelAliases.values().contains(paramName.substring(AUTH_LEVEL_PREFIX.length()))))
continue;
throw new MessageException(
"Invalid parameter in PAPE response: " + paramName,
OpenIDException.PAPE_ERROR);
}
}
public void setCustomAuthLevel(String authLevelTypeUri, String level)
{
String alias = addAuthLevelExtension(authLevelTypeUri);
set(AUTH_LEVEL_PREFIX + alias, level);
}
public String getCustomAuthLevel(String authLevelTypeUri)
{
if (hasCustomAuthLevel(authLevelTypeUri))
return getParameterValue(AUTH_LEVEL_PREFIX + getCustomAuthLevelAlias(authLevelTypeUri));
else
return null;
}
}
openid4java-0.9.6.662/src/org/openid4java/message/pape/PapeMessage.java 0000644 0015012 0015012 00000021221 11202137743 024752 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.pape;
import org.openid4java.message.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import java.util.Map;
import java.util.HashMap;
import java.util.Iterator;
/**
* Base class for the OpenID Provider Authentication Policy extension
* implementation.
*
* Encapsulates:
*
*
the Type URI that identifies the OpenID Provider Authentication Policy
* extension
*
a list of extension-specific parameters, with the
* openid. prefix removed
*
*
* @see Message MessageExtension
* @author Marius Scurtescu, Johnny Bufu
*/
public class PapeMessage implements MessageExtension, MessageExtensionFactory
{
private static Log _log = LogFactory.getLog(PapeMessage.class);
private static final boolean DEBUG = _log.isDebugEnabled();
public static final String PAPE_POLICY_PHISHING_RESISTANT =
"http://schemas.openid.net/pape/policies/2007/06/phishing-resistant";
public static final String PAPE_POLICY_MULTI_FACTOR =
"http://schemas.openid.net/pape/policies/2007/06/multi-factor";
public static final String PAPE_POLICY_MULTI_FACTOR_PHYSICAL =
"http://schemas.openid.net/pape/policies/2007/06/multi-factor-physical";
protected static final String AUTH_LEVEL_PREFIX = "auth_level.";
protected static final String AUTH_LEVEL_NS_PREFIX = "auth_level.ns.";
private static final String AUTH_LEVEL_ALIAS_PREFIX = "papeauthlevel";
protected Map authLevelAliases = new HashMap(); // auth level URL -> alias
private int authLevelAliasCounter = 0;
/**
* The OpenID Provider Authentication Policy extension URI.
*/
public static final String OPENID_NS_PAPE = "http://specs.openid.net/extensions/pape/1.0";
/**
* The OpenID Provider Authentication Policy extension-specific parameters.
*
* The openid. prefix is not part of the parameter names
*/
protected ParameterList _parameters;
/**
* Constructs an empty (no parameters) OpenID Provider Authentication
* Policy extension.
*/
public PapeMessage()
{
_parameters = new ParameterList();
if (DEBUG) _log.debug("Created empty PapeMessage.");
}
/**
* Constructs an OpenID Provider Authentication Policy extension
* with a specified list of parameters.
*
* The parameter names in the list should not contain the
* openid..
*/
public PapeMessage(ParameterList params)
{
setParameters(params);
if (DEBUG)
_log.debug("Created PapeMessage from parameter list:\n" + params);
}
/**
* Gets the Type URI that identifies the OpenID Provider Authentication
* Policy extension.
*/
public String getTypeUri()
{
return OPENID_NS_PAPE;
}
/**
* Gets ParameterList containing the OpenID Provider Authentication
* Policy extension-specific parameters.
*
* The openid. prefix is not part of the parameter names,
* as it is handled internally by the Message class.
*
* The openid.ns. parameter is also handled by
* the Message class.
*
* @see Message
*/
public ParameterList getParameters()
{
return _parameters;
}
/**
* Sets the extension's parameters to the supplied list.
*
* The parameter names in the list should not contain the
* openid. prefix.
*/
public void setParameters(ParameterList params)
{
_parameters = params;
Iterator iter = params.getParameters().iterator();
while(iter.hasNext())
checkAddAuthLevelExtension((Parameter) iter.next());
}
/**
* Checks if the extension contains a parameter.
*
* @param name The name of the parameter,
* without the openid. prefix.
* @return True if a parameter with the specified name exists,
* false otherwise.
*/
public boolean hasParameter(String name)
{
return _parameters.hasParameter(name);
}
/**
* Sets the value for the parameter with the specified name.
*
* @param name The name of the parameter,
* without the openid. prefix.
*/
protected void set(String name, String value)
{
Parameter param = new Parameter(name, value);
_parameters.set(param);
checkAddAuthLevelExtension(param);
}
private void checkAddAuthLevelExtension(Parameter param) {
String key = param == null ? null : param.getKey();
String value = param == null ? null : param.getValue();
if (key != null && key.startsWith(AUTH_LEVEL_NS_PREFIX))
addAuthLevelExtension(value, key.substring(AUTH_LEVEL_NS_PREFIX.length()));
}
private synchronized String newAuthLevelAlias()
{
return AUTH_LEVEL_ALIAS_PREFIX + ++authLevelAliasCounter;
}
protected String addAuthLevelExtension(String authLevelTypeUri)
{
return addAuthLevelExtension(authLevelTypeUri, null);
}
private String addAuthLevelExtension(String authLevelTypeUri, String alias)
{
if (!authLevelAliases.containsKey(authLevelTypeUri)) {
String authLevelAlias = alias == null ? newAuthLevelAlias() : alias;
authLevelAliases.put(authLevelTypeUri, authLevelAlias);
}
return (String) authLevelAliases.get(authLevelTypeUri);
}
public boolean hasCustomAuthLevel(String authLevelTypeUri)
{
return authLevelAliases.containsKey(authLevelTypeUri);
}
protected String getCustomAuthLevelAlias(String authLevelTypeUri)
{
return (String) authLevelAliases.get(authLevelTypeUri);
}
/**
* Gets a the value of the parameter with the specified name.
*
* @param name The name of the parameter,
* without the openid. prefix.
* @return The parameter value, or null if not found.
*/
protected Parameter getParameter(String name)
{
return _parameters.getParameter(name);
}
/**
* Gets a the value of the parameter with the specified name.
*
* @param name The name of the parameter,
* without the openid. prefix.
* @return The parameter value, or null if not found.
*/
public String getParameterValue(String name)
{
return _parameters.getParameterValue(name);
}
/**
* OpenID Provider Authentication Policy extension doesn't implement
* authentication services.
*
* @return false
*/
public boolean providesIdentifier()
{
return false;
}
/**
* PAPE parameters are REQUIRED to be signed.
*
* @return
*/
public boolean signRequired()
{
return true;
}
/**
* Instantiates the apropriate OpenID Provider Authentication Policy
* extension object (request / response) for the supplied parameter
* list.
*
* @param parameterList The OpenID Provider Authentication Policy
* extension specific parameters
* (without the openid. prefix)
* extracted from the openid message.
* @param isRequest Indicates whether the parameters were
* extracted from an OpenID request (true),
* or from an OpenID response.
* @return MessageExtension implementation for
* the supplied extension parameters.
* @throws MessageException If a OpenID Provider Authentication Policy
* extension object could not be
* instantiated from the supplied parameter list.
*/
public MessageExtension getExtension(
ParameterList parameterList, boolean isRequest)
throws MessageException
{
if ( parameterList.hasParameter("preferred_auth_policies") ||
parameterList.hasParameter("max_auth_age"))
return PapeRequest.createPapeRequest(parameterList);
else if ( parameterList.hasParameter("auth_policies") ||
parameterList.hasParameter("auth_time"))
return PapeResponse.createPapeResponse(parameterList);
else
throw new MessageException("Invalid parameters for a PAPE message.");
}
}
openid4java-0.9.6.662/src/org/openid4java/message/DirectError.java 0000644 0015012 0015012 00000007352 11034531513 024064 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.OpenIDException;
import java.util.List;
import java.util.Arrays;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class DirectError extends Message
{
private static Log _log = LogFactory.getLog(DirectError.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected final static List requiredFields = Arrays.asList( new String[] {
"error"
});
protected final static List optionalFields = Arrays.asList( new String[] {
"ns",
"contact",
"reference"
});
// exception that generated the error, if any
private OpenIDException _exception;
protected DirectError(String msg)
{
this(msg, false);
}
protected DirectError(String msg, boolean compatibility)
{
this(null, msg, compatibility);
}
protected DirectError(OpenIDException e, boolean compatibility)
{
this(e, e.getMessage(), compatibility);
}
protected DirectError(OpenIDException e, String msg, boolean compatibility)
{
set("error", msg);
_exception = e;
if ( ! compatibility )
set("ns", OPENID2_NS);
}
protected DirectError(ParameterList params)
{
super(params);
}
public static DirectError createDirectError(OpenIDException e)
{
return createDirectError(e, false);
}
public static DirectError createDirectError(String msg)
{
return createDirectError(null, msg, false);
}
public static DirectError createDirectError(String msg, boolean compatibility)
{
return createDirectError(null, msg, compatibility);
}
public static DirectError createDirectError(OpenIDException e, boolean compatibility)
{
return createDirectError(e, e.getMessage(), compatibility);
}
public static DirectError createDirectError(OpenIDException e, String msg, boolean compatibility)
{
DirectError err = new DirectError(e, msg, compatibility);
try
{
err.validate();
}
catch (MessageException ex)
{
_log.error("Invalid " + (compatibility? "OpenID1" : "OpenID2") +
" direct error message created for message: " + msg);
}
_log.debug("Created direct error message:\n" + err.keyValueFormEncoding());
return err;
}
public static DirectError createDirectError(ParameterList params)
{
DirectError err = new DirectError(params);
try
{
err.validate();
}
catch (MessageException e)
{
_log.error("Invalid direct error message created: "
+ err.keyValueFormEncoding() );
}
_log.debug("Created direct error message:\n" + err.keyValueFormEncoding());
return err;
}
public OpenIDException getException()
{
return _exception;
}
public void setException(OpenIDException e)
{
this._exception = e;
}
public List getRequiredFields()
{
return requiredFields;
}
public boolean isVersion2()
{
return hasParameter("ns") &&
OPENID2_NS.equals(getParameterValue("ns"));
}
public void setErrorMsg(String msg)
{
set("error", msg);
}
public String getErrorMsg()
{
return getParameterValue("error");
}
public void setContact(String contact)
{
set("contact", contact);
}
public void setReference(String reference)
{
set("reference", reference);
}
}
openid4java-0.9.6.662/src/org/openid4java/message/ParameterList.java 0000644 0015012 0015012 00000015420 11250064010 024400 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import java.io.Serializable;
import java.io.UnsupportedEncodingException;
import java.util.*;
import java.util.List;
import java.net.URLDecoder;
/**
* A list of parameters that are part of an OpenID message. Please note that you can have multiple parameters with
* the same name.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class ParameterList implements Serializable
{
private static Log _log = LogFactory.getLog(ParameterList.class);
private static final boolean DEBUG = _log.isDebugEnabled();
Map _parameterMap;
public ParameterList()
{
_parameterMap = new LinkedHashMap();
if (DEBUG) _log.debug("Created empty parameter list.");
}
public ParameterList(ParameterList that)
{
if (DEBUG) _log.debug("Cloning parameter list:\n" + that);
this._parameterMap = new LinkedHashMap(that._parameterMap);
}
/**
* Constructs a ParameterList from a Map of parameters, ideally obtained
* with ServletRequest.getParameterMap(). The parameter keys and values
* must be in URL-decoded format.
*
* @param parameterMap Map or Map
*/
public ParameterList(Map parameterMap)
{
_parameterMap = new LinkedHashMap();
Iterator keysIter = parameterMap.keySet().iterator();
while (keysIter.hasNext())
{
String name = (String) keysIter.next();
Object v = parameterMap.get(name);
String value;
if (v instanceof String[])
{
String[] values = (String[]) v;
if (values.length > 1 && name.startsWith("openid."))
throw new IllegalArgumentException(
"Multiple parameters with the same name: " + values);
value = values.length > 0 ? values[0] : null;
}
else if (v instanceof String)
{
value = (String) v;
}
else
{
value="";
_log.error("Can extract parameter value; unexpected type: " +
v.getClass().getName());
}
set(new Parameter(name, value));
}
if (DEBUG) _log.debug("Creating parameter list:\n" + this);
}
public void copyOf(ParameterList that)
{
if (DEBUG) _log.debug("Copying parameter list:\n" + that);
this._parameterMap = new LinkedHashMap(that._parameterMap);
}
public boolean equals(Object obj)
{
if (this == obj)
return true;
if (obj == null || getClass() != obj.getClass())
return false;
final ParameterList that = (ParameterList) obj;
return _parameterMap.equals(that._parameterMap);
}
public int hashCode()
{
return _parameterMap.hashCode();
}
public void set(Parameter parameter)
{
_parameterMap.put(parameter.getKey(), parameter);
}
public void addParams(ParameterList params)
{
Iterator iter = params.getParameters().iterator();
while (iter.hasNext())
set((Parameter) iter.next());
}
public Parameter getParameter(String name)
{
return (Parameter) _parameterMap.get(name);
}
public String getParameterValue(String name)
{
Parameter param = getParameter(name);
return param != null ? param.getValue() : null;
}
public List getParameters()
{
return new ArrayList(_parameterMap.values());
}
public void removeParameters(String name)
{
_parameterMap.remove(name);
}
public boolean hasParameter(String name)
{
return _parameterMap.containsKey(name);
}
public boolean hasParameterPrefix(String prefix) {
Iterator keysIter = _parameterMap.keySet().iterator();
while (keysIter.hasNext())
{
if (((String)keysIter.next()).startsWith(prefix))
return true;
}
return false;
}
/**
* Create a parameter list based on a URL encoded HTTP query string.
*/
public static ParameterList createFromQueryString(String queryString) throws MessageException
{
if (DEBUG) _log.debug("Creating parameter list from query string: " + queryString);
ParameterList parameterList = new ParameterList();
StringTokenizer tokenizer = new StringTokenizer(queryString, "&");
while (tokenizer.hasMoreTokens())
{
String keyValue = tokenizer.nextToken();
int posEqual = keyValue.indexOf('=');
if (posEqual == -1)
throw new MessageException("Invalid query parameter, = missing: " + keyValue);
try
{
String key = URLDecoder.decode(keyValue.substring(0, posEqual), "UTF-8");
String value = URLDecoder.decode(keyValue.substring(posEqual + 1), "UTF-8");
parameterList.set(new Parameter(key, value));
}
catch (UnsupportedEncodingException e)
{
throw new MessageException("Cannot URL decode query parameter: " + keyValue, e);
}
}
return parameterList;
}
public static ParameterList createFromKeyValueForm(String keyValueForm) throws MessageException
{
if (DEBUG) _log.debug("Creating parameter list from key-value form:\n" + keyValueForm);
ParameterList parameterList = new ParameterList();
StringTokenizer tokenizer = new StringTokenizer(keyValueForm, "\n");
while (tokenizer.hasMoreTokens())
{
String keyValue = tokenizer.nextToken();
int posColon = keyValue.indexOf(':');
if (posColon == -1)
throw new MessageException("Invalid Key-Value form, colon missing: " + keyValue);
String key = keyValue.substring(0, posColon);
String value = keyValue.substring(posColon + 1);
parameterList.set(new Parameter(key, value));
}
return parameterList;
}
/**
* @return The key-value form encoding of for this ParameterList.
*/
public String toString()
{
StringBuffer allParams = new StringBuffer("");
List parameters = getParameters();
Iterator iterator = parameters.iterator();
while (iterator.hasNext())
{
Parameter parameter = (Parameter) iterator.next();
allParams.append(parameter.getKey());
allParams.append(':');
allParams.append(parameter.getValue());
allParams.append('\n');
}
return allParams.toString();
}
}
openid4java-0.9.6.662/src/org/openid4java/message/Message.java 0000644 0015012 0015012 00000041441 11275165042 023230 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.openid4java.message.ax.AxMessage;
import org.openid4java.message.sreg.SRegMessage;
import org.openid4java.message.sreg.SReg11ExtensionFactory;
import org.openid4java.message.pape.PapeMessage;
import java.io.UnsupportedEncodingException;
import java.util.*;
import java.net.URLEncoder;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class Message
{
private static Log _log = LogFactory.getLog(Message.class);
private static final boolean DEBUG = _log.isDebugEnabled();
// message constants
public static final String MODE_IDRES = "id_res";
public static final String MODE_CANCEL = "cancel";
public static final String MODE_SETUP_NEEDED = "setup_needed";
public static final String OPENID2_NS = "http://specs.openid.net/auth/2.0";
private ParameterList _params;
private int _extCounter;
// extention type URI -> extension alias : extension present in the message
private Map _extAliases;
// extension type URI -> MessageExtensions : extracted extension objects
private Map _extesion;
// the URL where this message should be sent, where applicable
// should remain null for received messages (created from param lists)
protected String _destinationUrl;
// type URI -> message extension factory : supported extensions
private static Map _extensionFactories = new HashMap();
static
{
_extensionFactories.put(AxMessage.OPENID_NS_AX, AxMessage.class);
_extensionFactories.put(SRegMessage.OPENID_NS_SREG, SRegMessage.class);
_extensionFactories.put(SRegMessage.OPENID_NS_SREG11, SReg11ExtensionFactory.class);
_extensionFactories.put(PapeMessage.OPENID_NS_PAPE, PapeMessage.class);
}
protected Message()
{
_params = new ParameterList();
_extCounter = 0;
_extAliases = new HashMap();
_extesion = new HashMap();
}
protected Message (ParameterList params)
{
this();
this._params = params;
//build the extension list when creating a message from a param list
Iterator iter = _params.getParameters().iterator();
// simple registration is a special case; we support only:
// SREG1.0 (no namespace, "sreg" alias hardcoded) in :
// - OpenID1 messages
// - OpenID2 messages (against the 2.0 spec),
// to accomodate Yahoo's non-2.0-compliant implementation
// SREG1.1 (namespace, any possible alias) in OpenID2 messages
boolean hasOpenidDotSreg = false;
while (iter.hasNext())
{
String key = ((Parameter) iter.next()).getKey();
if (key.startsWith("openid.ns.") && key.length() > 10)
_extAliases.put(_params.getParameter(key).getValue(),
key.substring(10));
if (key.startsWith("openid.sreg."))
hasOpenidDotSreg = true;
}
// only do the workaround for OpenID1 messages
if ( hasOpenidDotSreg && ! _extAliases.values().contains("sreg")
/*! todo: revert this: hasParameter("openid.ns")*/ )
_extAliases.put(SRegMessage.OPENID_NS_SREG, "sreg");
_extCounter = _extAliases.size();
}
public static Message createMessage() throws MessageException
{
Message message = new Message();
message.validate();
if (DEBUG) _log.debug("Created message:\n"
+ message.keyValueFormEncoding());
return message;
}
public static Message createMessage(ParameterList params)
throws MessageException
{
Message message = new Message(params);
message.validate();
if (DEBUG) _log.debug("Created message from parameter list:\n"
+ message.keyValueFormEncoding());
return message;
}
protected Parameter getParameter(String name)
{
return _params.getParameter(name);
}
public String getParameterValue(String name)
{
return _params.getParameterValue(name);
}
public boolean hasParameter(String name)
{
return _params.hasParameter(name);
}
protected void set(String name, String value)
{
_params.set(new Parameter(name, value));
}
protected List getParameters()
{
return _params.getParameters();
}
public Map getParameterMap()
{
Map params = new LinkedHashMap();
Iterator iter = _params.getParameters().iterator();
while (iter.hasNext())
{
Parameter p = (Parameter) iter.next();
params.put( p.getKey(), p.getValue() );
}
return params;
}
/**
* Checks that all required parameters are present
*/
public void validate() throws MessageException
{
List requiredFields = getRequiredFields();
Iterator paramIter = _params.getParameters().iterator();
while (paramIter.hasNext())
{
Parameter param = (Parameter) paramIter.next();
if (!param.isValid())
throw new MessageException("Invalid parameter: " + param);
}
if (requiredFields == null)
return;
Iterator reqIter = requiredFields.iterator();
while(reqIter.hasNext())
{
String required = (String) reqIter.next();
if (! hasParameter(required))
throw new MessageException(
"Required parameter missing: " + required);
}
}
public List getRequiredFields()
{
return null;
}
public String keyValueFormEncoding()
{
return _params.toString();
}
public String wwwFormEncoding()
{
StringBuffer allParams = new StringBuffer("");
List parameters = _params.getParameters();
Iterator iterator = parameters.iterator();
while (iterator.hasNext())
{
Parameter parameter = (Parameter) iterator.next();
// All of the keys in the request message MUST be prefixed with "openid."
if ( ! parameter.getKey().startsWith("openid."))
allParams.append("openid.");
try
{
allParams.append(URLEncoder.encode(parameter.getKey(), "UTF-8"));
allParams.append('=');
allParams.append(URLEncoder.encode(parameter.getValue(), "UTF-8"));
allParams.append('&');
}
catch (UnsupportedEncodingException e)
{
return null;
}
}
// remove the trailing '&'
if (allParams.length() > 0)
allParams.deleteCharAt(allParams.length() -1);
return allParams.toString();
}
/**
* Gets the URL where the message should be sent, where applicable.
* Null for received messages.
*
* @param httpGet If true, the wwwFormEncoding() is appended to the
* destination URL; the return value should be used
* with a GET-redirect.
* If false, the verbatim destination URL is returned,
* which should be used with a FORM POST redirect.
*
* @see #wwwFormEncoding()
*/
public String getDestinationUrl(boolean httpGet)
{
if (_destinationUrl == null)
throw new IllegalStateException("Destination URL not set; " +
"is this a received message?");
if (httpGet) // append wwwFormEncoding to the destination URL
{
boolean hasQuery = _destinationUrl.indexOf("?") > 0;
String initialChar = hasQuery ? "&" : "?";
return _destinationUrl + initialChar + wwwFormEncoding();
}
else // should send the keyValueFormEncoding in POST data
return _destinationUrl;
}
// ------------ extensions implementation ------------
/**
* Adds a new extension factory.
*
* @param clazz The implementation class for the extension factory,
* must implement {@link MessageExtensionFactory}.
*/
public static void addExtensionFactory(Class clazz) throws MessageException
{
try
{
MessageExtensionFactory extensionFactory =
(MessageExtensionFactory) clazz.newInstance();
if (DEBUG) _log.debug("Adding extension factory for " +
extensionFactory.getTypeUri());
_extensionFactories.put(extensionFactory.getTypeUri(), clazz);
}
catch (Exception e)
{
throw new MessageException(
"Cannot instantiante message extension factory class: " +
clazz.getName());
}
}
/**
* Returns true if there is an extension factory available for extension
* identified by the specified Type URI, or false otherwise.
*
* @param typeUri The Type URI that identifies an extension.
*/
public static boolean hasExtensionFactory(String typeUri)
{
return _extensionFactories.containsKey(typeUri);
}
/**
* Gets a MessageExtensionFactory for the specified Type URI
* if an implementation is available, or null otherwise.
*
* @param typeUri The Type URI that identifies a extension.
* @see MessageExtensionFactory Message
*/
public static MessageExtensionFactory getExtensionFactory(String typeUri)
{
if (! hasExtensionFactory(typeUri))
return null;
MessageExtensionFactory extensionFactory;
try
{
Class extensionClass = (Class) _extensionFactories.get(typeUri);
extensionFactory = (MessageExtensionFactory) extensionClass.newInstance();
}
catch (Exception e)
{
_log.error("Error getting extension factory for " + typeUri);
return null;
}
return extensionFactory;
}
/**
* Returns true if the message has parameters for the specified
* extension type URI.
*
* @param typeUri The URI that identifies the extension.
*/
public boolean hasExtension(String typeUri)
{
return _extAliases.containsKey(typeUri);
}
/**
* Gets a set of extension Type URIs that are present in the message.
*/
public Set getExtensions()
{
return _extAliases.keySet();
}
/**
* Retrieves the extension alias that will be used for the extension
* identified by the supplied extension type URI.
*
* If the message contains no parameters for the specified extension,
* null will be returned.
*
* @param extensionTypeUri The URI that identifies the extension
* @return The extension alias associated with the
* extension specifid by the Type URI
*/
public String getExtensionAlias(String extensionTypeUri)
{
return (_extAliases.get(extensionTypeUri) != null) ?
(String) _extAliases.get(extensionTypeUri) : null;
}
/**
* Adds a set of extension-specific parameters to a message.
*
* The parameter names must NOT contain the "openid."
* prefix; it will be generated dynamically, ensuring there are no conflicts
* between extensions.
*
* @param extension A MessageExtension containing parameters
* to be added to the message
*/
public void addExtension(MessageExtension extension) throws MessageException
{
String typeUri = extension.getTypeUri();
if (hasExtension(typeUri))
throw new MessageException("Extension already present: " + typeUri);
String alias = "ext" + Integer.toString(++ _extCounter);
// use the hardcoded "sreg" alias for SREG, for seamless interoperation
// between SREG10/OpenID1 and SREG11/OpenID2
if (SRegMessage.OPENID_NS_SREG.equals(typeUri))
alias = "sreg";
_extAliases.put(typeUri, alias);
if (DEBUG) _log.debug("Adding extension; type URI: "
+ typeUri + " alias: " +alias);
set("openid.ns." + alias, typeUri);
Iterator iter = extension.getParameters().getParameters().iterator();
while (iter.hasNext())
{
Parameter param = (Parameter) iter.next();
String paramName = param.getKey().length() > 0 ?
"openid." + alias + "." + param.getKey() :
"openid." + alias;
set(paramName, param.getValue());
}
if (this instanceof AuthSuccess)
{
if (extension.signRequired())
((AuthSuccess)this).addSignExtension(typeUri);
if ( ((AuthSuccess)this).getSignExtensions().contains(typeUri) )
((AuthSuccess)this).buildSignedList();
}
}
/**
* Retrieves the parameters associated with a protocol extension,
* specified by the given extension type URI.
*
* The "openid.ns." parameter is NOT included in the
* returned list. Also, the returned parameter names will have the
* "openid.." prefix removed.
*
* @param extensionTypeUri The type URI that identifies the extension
* @return A ParameterList with all parameters
* associated with the specified extension
*/
private ParameterList getExtensionParams(String extensionTypeUri)
{
ParameterList extension = new ParameterList();
if (hasExtension(extensionTypeUri))
{
String extensionAlias = getExtensionAlias(extensionTypeUri);
Iterator iter = getParameters().iterator();
while (iter.hasNext())
{
Parameter param = (Parameter) iter.next();
String paramName = null;
if (param.getKey().startsWith("openid." + extensionAlias + "."))
paramName = param.getKey()
.substring(8 + extensionAlias.length());
if (param.getKey().equals("openid." + extensionAlias))
paramName = "";
if (paramName != null)
extension.set(new Parameter(paramName, param.getValue()));
}
}
return extension;
}
/**
* Gets a MessageExtension for the specified Type URI if an implementation
* is available, or null otherwise.
*
* The returned object will contain the parameters from the message
* belonging to the specified extension.
*
* @param typeUri The Type URI that identifies a extension.
*/
public MessageExtension getExtension(String typeUri) throws MessageException
{
if (!_extesion.containsKey(typeUri))
{
if (hasExtensionFactory(typeUri))
{
MessageExtensionFactory extensionFactory = getExtensionFactory(typeUri);
String mode = getParameterValue("openid.mode");
MessageExtension extension = extensionFactory.getExtension(
getExtensionParams(typeUri), mode.startsWith("checkid_"));
if (this instanceof AuthSuccess && extension.signRequired())
{
List signedParams = Arrays.asList(
((AuthSuccess)this).getSignList().split(",") );
String alias = getExtensionAlias(typeUri);
if (! signedParams.contains("ns." + alias))
throw new MessageException("Namespace declaration for extension "
+ typeUri + " MUST be signed");
Iterator iter = extension.getParameters().getParameters().iterator();
while (iter.hasNext())
{
Parameter param = (Parameter) iter.next();
if (! signedParams.contains(alias + "." + param.getKey()))
{
throw new MessageException(
"Extension " + typeUri + " MUST be signed; " +
"field " + param.getKey() + " is NOT signed.");
}
}
}
_extesion.put(typeUri, extension);
}
else
throw new MessageException("Cannot instantiate extension: " + typeUri);
}
if (DEBUG) _log.debug("Extracting " + typeUri +" extension from message...");
return (MessageExtension) _extesion.get(typeUri);
}
}
openid4java-0.9.6.662/src/org/openid4java/message/MessageExtension.java 0000644 0015012 0015012 00000003737 11034531513 025124 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
/**
* Interface for building OpenID extensions.
*
* Classes that implement this interface should provide a default constructor
* and register their Type URIs with the MessageExtensionFactory.
*
* @see MessageExtensionFactory Message
* @author Marius Scurtescu, Johnny Bufu
*/
public interface MessageExtension
{
/**
* Gets the TypeURI that identifies a extension to the OpenID protocol.
*/
public String getTypeUri();
/**
* Gets the extension-specific parameters.
*
* Implementations MUST NOT prefix the parameter names with
* "openid.". The alias is managed internally by the Message class,
* when a extension is attached to an OpenID messaage.
*
* @see Message
*/
public ParameterList getParameters();
/**
* Sets the extension-specific parameters.
*
* Implementations MUST NOT prefix the parameter names with
* "openid.". The alias is managed internally by the Message class,
* when a extension is attached to an OpenID messaage.
* @param params
* @see Message
*/
public void setParameters(ParameterList params);
/**
* Used by the core OpenID authentication implementation to learn whether
* an extension provies authentication services.
*
* If the extension provides authentication services,
* the 'openid.identity' and 'openid.signed' parameters are optional.
*
* @return True if the extension provides authentication services,
* false otherwise.
*/
public boolean providesIdentifier();
/**
* Flag for indicating that an extension must be signed.
*
* @return True if all the extension's parameters MUST be signed
* in positive assertions, or false if there isn't such a
* requirement.
*/
public boolean signRequired();
}
openid4java-0.9.6.662/src/org/openid4java/message/AuthRequest.java 0000644 0015012 0015012 00000024674 11102646027 024123 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.openid4java.association.Association;
import org.openid4java.server.RealmVerifier;
import org.openid4java.OpenIDException;
import java.util.List;
import java.util.Arrays;
import java.util.Iterator;
import java.net.URL;
import java.net.MalformedURLException;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class AuthRequest extends Message
{
private static Log _log = LogFactory.getLog(AuthRequest.class);
private static final boolean DEBUG = _log.isDebugEnabled();
public static final String MODE_SETUP = "checkid_setup";
public static final String MODE_IMMEDIATE = "checkid_immediate";
public static final String SELECT_ID =
"http://specs.openid.net/auth/2.0/identifier_select";
protected final static List requiredFields = Arrays.asList( new String[] {
"openid.mode"
});
protected final static List optionalFields = Arrays.asList( new String[] {
"openid.ns",
"openid.claimed_id",
"openid.identity",
"openid.assoc_handle",
"openid.realm",
"openid.trust_root",
"openid.return_to"
});
private RealmVerifier _realmVerifier;
protected AuthRequest(String claimedId, String delegate, boolean compatibility,
String returnToUrl, String handle, RealmVerifier verifier)
{
this(claimedId, delegate, compatibility,
returnToUrl, handle, returnToUrl, verifier);
}
protected AuthRequest(String claimedId, String delegate, boolean compatibility,
String returnToUrl, String handle, String realm,
RealmVerifier verifier)
{
if (! compatibility)
{
set("openid.ns", OPENID2_NS);
setClaimed(claimedId);
}
setIdentity(delegate);
if ( returnToUrl != null ) setReturnTo(returnToUrl);
if ( realm != null ) setRealm(realm);
if (! Association.FAILED_ASSOC_HANDLE.equals(handle)) setHandle(handle);
setImmediate(false);
_realmVerifier = verifier;
}
protected AuthRequest(ParameterList params)
{
super(params);
}
public static AuthRequest createAuthRequest(String claimedId, String delegate,
boolean compatibility, String returnToUrl,
String handle, RealmVerifier verifier)
throws MessageException
{
return createAuthRequest(claimedId, delegate, compatibility,
returnToUrl, handle, returnToUrl, verifier);
}
public static AuthRequest createAuthRequest(String claimedId, String delegate,
boolean compatibility, String returnToUrl,
String handle, String realm, RealmVerifier verifier)
throws MessageException
{
AuthRequest req = new AuthRequest(claimedId, delegate, compatibility,
returnToUrl, handle, realm, verifier);
req.validate();
if (DEBUG) _log.debug("Created auth request:\n" + req.keyValueFormEncoding());
return req;
}
public static AuthRequest createAuthRequest(ParameterList params,
RealmVerifier realmVerifier)
throws MessageException
{
AuthRequest req = new AuthRequest(params);
req.setRealmVerifier(realmVerifier);
req.validate();
if (DEBUG) _log.debug("Created auth request:\n" + req.keyValueFormEncoding());
return req;
}
public List getRequiredFields()
{
return requiredFields;
}
public void setOPEndpoint(URL opEndpoint)
{
if (opEndpoint != null)
_destinationUrl = opEndpoint.toString();
}
public String getOPEndpoint()
{
return _destinationUrl;
}
public void setImmediate(boolean immediate)
{
set("openid.mode", immediate ? MODE_IMMEDIATE : MODE_SETUP);
if (DEBUG && immediate)
_log.debug("Setting checkid_immediate auth request.");
}
public boolean isImmediate()
{
return MODE_IMMEDIATE.equals(getParameterValue("openid.mode"));
}
public boolean isVersion2()
{
return hasParameter("openid.ns") &&
OPENID2_NS.equals(getParameterValue("openid.ns"));
}
public void setIdentity(String id)
{
set("openid.identity", id);
}
public String getIdentity()
{
return getParameterValue("openid.identity");
}
public void setClaimed(String claimed)
{
set("openid.claimed_id", claimed);
}
public String getClaimed()
{
return getParameterValue("openid.claimed_id");
}
public void setHandle(String handle)
{
set("openid.assoc_handle", handle);
}
public String getHandle()
{
return getParameterValue("openid.assoc_handle");
}
public void setReturnTo(String returnTo)
{
set("openid.return_to", returnTo);
}
public String getReturnTo()
{
return getParameterValue("openid.return_to");
}
public void setRealm(String realm)
{
set(isVersion2() ? "openid.realm" : "openid.trust_root", realm);
}
public String getRealm()
{
if (isVersion2())
return getParameterValue("openid.realm");
else
return getParameterValue("openid.trust_root");
}
/**
* Gets the RealmVerifier used to verify realms against return_to URLs.
*/
public RealmVerifier getRealmVerifier()
{
return _realmVerifier;
}
/**
* Sets the RealmVerifier used to verify realms against return_to URLs.
*/
public void setRealmVerifier(RealmVerifier realmVerifier)
{
this._realmVerifier = realmVerifier;
}
public void validate() throws MessageException
{
super.validate();
boolean compatibility = ! isVersion2();
if ( compatibility && hasParameter("openid.identity") &&
SELECT_ID.equals(getParameterValue("openid.identity")))
{
throw new MessageException(SELECT_ID + " not supported in OpenID1",
OpenIDException.AUTH_ERROR);
}
if ( hasParameter("openid.mode") &&
! MODE_SETUP.equals(getParameterValue("openid.mode")) &&
! MODE_IMMEDIATE.equals(getParameterValue("openid.mode")))
{
throw new MessageException(
"Invalid openid.mode value in auth request: "
+ getParameterValue("openid.mode"),
OpenIDException.AUTH_ERROR);
}
// return_to must be a valid URL, if present
try
{
if (getReturnTo() != null)
new URL(getReturnTo());
} catch (MalformedURLException e)
{
throw new MessageException(
"Error verifying return URL in auth request.",
OpenIDException.AUTH_ERROR, e);
}
if ( ! hasParameter("openid.return_to") )
{
if (compatibility)
{
throw new MessageException(
"openid.return_to is mandatory in OpenID1 auth requests",
OpenIDException.AUTH_ERROR);
}
else if ( ! hasParameter("openid.realm") )
{
throw new MessageException(
"openid.realm is mandatory if return_to is absent.",
OpenIDException.AUTH_REALM_ERROR);
}
}
if ( compatibility && hasParameter("openid.realm") )
{
_log.warn("openid.realm should not be present in OpenID1 auth requests");
}
if ( !compatibility && hasParameter("openid.trust_root") )
{
_log.warn("openid.trust_root should not be present in OpenID2 auth requests.");
}
// figure out if 'claimed_id' and 'identity' are optional
if ( ! hasParameter("openid.identity") )
{
// not optional in v1
if (compatibility)
{
throw new MessageException(
"openid.identity is required in OpenID1 auth requests",
OpenIDException.AUTH_ERROR);
}
boolean hasAuthProvider = false;
Iterator iter = getExtensions().iterator();
while (iter.hasNext())
{
String typeUri = iter.next().toString();
try
{
MessageExtension extension = getExtension(typeUri);
if (extension.providesIdentifier())
{
hasAuthProvider = true;
break;
}
}
catch (MessageException ignore)
{
// do nothing
}
}
// no extension provides authentication sevices - invalid message
if ( !hasAuthProvider )
{
throw new MessageException(
"no identifier specified in auth request",
OpenIDException.AUTH_ERROR);
}
// claimed_id must be present if and only if identity is present
if ( hasParameter("openid.claimed_id") )
{
throw new MessageException(
"openid.claimed_id must be present if and only if " +
"openid.identity is present.",
OpenIDException.AUTH_ERROR);
}
}
else if ( ! compatibility && ! hasParameter("openid.claimed_id") )
{
throw new MessageException(
"openid.clamied_id must be present in OpenID2 auth requests",
OpenIDException.AUTH_ERROR);
}
if (getRealm() != null)
{
int validation = _realmVerifier.validate(
getRealm(), getReturnTo(), compatibility);
if ( RealmVerifier.OK != validation )
{
throw new MessageException("Realm verification failed (" +
validation + ") for: " + getRealm(),
OpenIDException.AUTH_REALM_ERROR);
}
}
}
}
openid4java-0.9.6.662/src/org/openid4java/message/AuthFailure.java 0000644 0015012 0015012 00000003726 11034531513 024052 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.OpenIDException;
import java.util.List;
import java.util.Arrays;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class AuthFailure extends Message
{
private static Log _log = LogFactory.getLog(AuthFailure.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected final static List requiredFields = Arrays.asList( new String[] {
"openid.mode"
});
protected final static List optionalFields = Arrays.asList( new String[] {
"openid.ns"
});
public AuthFailure(boolean compatibility, String returnTo)
{
set("openid.mode", MODE_CANCEL);
if (! compatibility)
set("openid.ns", OPENID2_NS);
_destinationUrl = returnTo;
}
protected AuthFailure(ParameterList params)
{
super(params);
}
public static AuthFailure createAuthFailure(ParameterList params) throws
MessageException
{
AuthFailure fail = new AuthFailure(params);
fail.validate();
if (DEBUG)
_log.debug("Retrieved auth failure from message parameters:\n"
+ fail.keyValueFormEncoding());
return fail;
}
public List getRequiredFields()
{
return requiredFields;
}
public boolean isVersion2()
{
return hasParameter("openid.ns") &&
OPENID2_NS.equals(getParameterValue("openid.ns"));
}
public void validate() throws MessageException
{
super.validate();
String mode = getParameterValue("openid.mode");
if (! MODE_CANCEL.equals(mode))
throw new MessageException(
"Invalid openid.mode; expected " +
MODE_CANCEL + " found: " + mode,
OpenIDException.AUTH_ERROR);
}
}
openid4java-0.9.6.662/src/org/openid4java/message/MessageExtensionFactory.java 0000644 0015012 0015012 00000002643 11034531513 026447 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
/**
* Factory interface for creating message extension objects for a specific
* message extension type URI.
*
* @see MessageExtension
* @see Message
* @author Marius Scurtescu, Johnny Bufu
*/
public interface MessageExtensionFactory
{
/**
* Gets the extension type URI of the extension factory.
*/
public String getTypeUri();
/**
* Builds a MessageExtension from a parameter list containing the
* extension-specific parameters.
*
* The parameters MUST NOT contain the openid. prefix.
*
* @param parameterList The extension parameters with the
* openid. prefix removed.
* @param isRequest Indicates whether the parameters were extracted
* from an openid request (true), or from an openid
* response (false). This may assist the factory
* implementation in determining what object type
* to instantiate.
* @return MessageExtension implementation for the supplied
* extension parameters.
*/
public MessageExtension getExtension(
ParameterList parameterList, boolean isRequest)
throws MessageException;
}
openid4java-0.9.6.662/src/org/openid4java/message/AssociationError.java 0000644 0015012 0015012 00000005752 11220543150 025125 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.openid4java.association.AssociationSessionType;
import org.openid4java.OpenIDException;
import java.util.List;
import java.util.Arrays;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class AssociationError extends DirectError
{
private static Log _log = LogFactory.getLog(AssociationError.class);
public static final String ASSOC_ERR = "unsupported-type";
protected final static List requiredFields = Arrays.asList( new String[] {
"ns",
"error_code",
"error",
});
protected final static List optionalFields = Arrays.asList( new String[] {
"assoc_type",
"session_type"
});
protected AssociationError(String msg, AssociationSessionType type)
{
super(msg);
set("ns", OPENID2_NS);
set("error_code", ASSOC_ERR);
set("session_type", type.getSessionType());
set("assoc_type", type.getAssociationType());
}
protected AssociationError(ParameterList params)
{
super(params);
}
public static AssociationError createAssociationError(
String msg, AssociationSessionType type)
{
AssociationError err = new AssociationError(msg, type);
try
{
err.validate();
}
catch (MessageException e)
{
_log.error("Invalid association error message created, " +
"type: " + type + " message: " + msg, e);
}
return err;
}
public static AssociationError createAssociationError(ParameterList params)
{
AssociationError err = new AssociationError(params);
try
{
err.validate();
}
catch (MessageException e)
{
_log.error("Invalid association error message created: "
+ err.keyValueFormEncoding(), e );
}
return err;
}
public List getRequiredFields()
{
return requiredFields;
}
public void setAssociationSessionType(AssociationSessionType type)
{
set("session_type", type.getSessionType());
set("assoc_type", type.getAssociationType());
}
public String getSessionType()
{
return getParameterValue("session_type");
}
public String getAssocType()
{
return getParameterValue("assoc_type");
}
private String getErrorCode()
{
return getParameterValue("error_code");
}
public void validate() throws MessageException
{
super.validate();
if ( ! (ASSOC_ERR.equals(getErrorCode()) &&
OPENID2_NS.equals(getParameterValue("ns")) ) )
throw new MessageException("Invalid Association Error: " +
"invalid error_code or missing ns param.",
OpenIDException.ASSOC_ERROR);
}
}
openid4java-0.9.6.662/src/org/openid4java/message/Parameter.java 0000644 0015012 0015012 00000003756 11034531513 023564 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import java.io.Serializable;
/**
* A key / value pair which is part of an OpenID message.
*
* @author Marius Scurtescu, Johnny Bufu
* @see ParameterList
*/
public class Parameter implements Comparable, Serializable
{
private String _key;
private String _value;
public Parameter(String key, String value)
{
_key = key;
_value = value;
}
public boolean isValid()
{
return !((_key != null && _key.indexOf(':') > -1) ||
(_key != null && _key.indexOf('\n') > -1) ||
(_value != null && _value.indexOf('\n') > -1));
//throw new IllegalArgumentException(
// "Invalid characters (colon or newline) found in the " +
// "key and/or value: \nkey=" + _key + "\nvalue=" + _value );
}
public boolean equals(Object obj)
{
if (this == obj)
return true;
if (obj == null || getClass() != obj.getClass())
return false;
final Parameter that = (Parameter) obj;
if (this._key == null ? that._key != null : !this._key.equals(that._key))
return false;
return (this._value == null ? that._value == null : this._value.equals(that._value));
}
public int hashCode()
{
int hash;
hash = (_key != null ? _key.hashCode() : 0);
hash = 29 * hash + (_value != null ? _value.hashCode() : 0);
return hash;
}
public String getKey()
{
return _key;
}
public String getValue()
{
return _value;
}
public int compareTo(Object obj)
{
Parameter that = (Parameter) obj;
int keyComp = this._key.compareTo(that._key);
if (keyComp == 0) {
return this._value.compareTo(that._value);
} else {
return keyComp;
}
}
public String toString()
{
return _key + ":" + _value;
}
}
openid4java-0.9.6.662/src/org/openid4java/message/ax/ 0000755 0015012 0015012 00000000000 11627733442 021413 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/message/ax/FetchRequest.java 0000644 0015012 0015012 00000026261 11130536343 024655 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.ax;
import org.openid4java.message.MessageException;
import org.openid4java.message.Parameter;
import org.openid4java.message.ParameterList;
import java.net.URL;
import java.net.MalformedURLException;
import java.util.Map;
import java.util.HashMap;
import java.util.Iterator;
import java.util.LinkedHashMap;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements the extension for Attribute Exchange fetch requests.
*
* @see AxMessage Message
* @author Marius Scurtescu, Johnny Bufu
*/
public class FetchRequest extends AxMessage
{
private static Log _log = LogFactory.getLog(FetchRequest.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private int _aliasCounter = 0;
/**
* Constructs a Fetch Request with an empty parameter list.
*/
protected FetchRequest()
{
_parameters.set(new Parameter("mode", "fetch_request"));
if (DEBUG) _log.debug("Created empty fetch request.");
}
/**
* Constructs a Fetch Request with an empty parameter list.
*/
public static FetchRequest createFetchRequest()
{
return new FetchRequest();
}
/**
* Constructs a FetchRequest from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
protected FetchRequest(ParameterList params)
{
_parameters = params;
}
/**
* Constructs a FetchRequest from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
public static FetchRequest createFetchRequest(ParameterList params)
throws MessageException
{
FetchRequest req = new FetchRequest(params);
if (! req.isValid())
throw new MessageException("Invalid parameters for a fetch request");
if (DEBUG)
_log.debug("Created fetch request from parameter list:\n" + params);
return req;
}
/**
* Adds an attribute to the fetch request.
*
* @param alias The attribute alias that will be associated
* with the attribute type URI
* @param typeUri The attribute type URI
* @param required If true, marks the attribute as 'required';
* 'if_available' otherwise.
* @param count The number of attribute values requested.
* 0 for the special value "unlimited".
*/
public void addAttribute(String alias, String typeUri,
boolean required, int count)
throws MessageException
{
if ( alias.indexOf(',') > -1 || alias.indexOf('.') > -1 ||
alias.indexOf(':') > -1 || alias.indexOf('\n') > -1 )
throw new MessageException(
"Characters [.,:\\n] are not allowed in attribute aliases: " + alias);
_parameters.set(new Parameter("type." + alias, typeUri));
String level = required ? "required" : "if_available";
Parameter levelParam = _parameters.getParameter(level);
Parameter newParam;
if (levelParam == null)
{
newParam = new Parameter(level, alias);
}
else
{
newParam = new Parameter(level,
levelParam.getValue() + "," + alias);
_parameters.removeParameters(level);
}
_parameters.set(newParam);
setCount(alias, count);
if (DEBUG) _log.debug("Added new attribute to fetch request; type: "
+ typeUri + " alias: " + alias + " count: "
+ count + " required: " + required);
}
/**
* Adds an attribute to the fetch request, with a default value-count of 1.
*
* @see #addAttribute(String, String, boolean, int)
*/
public void addAttribute(String alias, String typeUri, boolean required)
throws MessageException
{
addAttribute(alias, typeUri, required, 1);
}
/**
* Adds an attribute to the fetch request, with a default value-count of 1.
* An alias is generated for the provided type URI.
*
* @see #addAttribute(String, String, boolean, int)
*/
public String addAttribute(String typeUri, boolean required)
throws MessageException
{
String alias = generateAlias();
addAttribute(alias, typeUri, required, 1);
return alias;
}
/**
* Sets the desired number of attribute vaules requested for the specified
* attribute alias. Special value 0 means "unlimited".
*
* @param alias The attribute alias.
*/
public void setCount(String alias, int count)
{
if (count == 0)
_parameters.set(new Parameter("count." + alias, "unlimited"));
else if (count > 1)
_parameters.set(
new Parameter("count." + alias, Integer.toString(count)));
}
/**
* Returns the number of values requested for the specified attribute alias.
* 1 (the default number) is returned if the count parameter is absent.
* 0 is returned if the special value "unlimited" was requested.
*
* @param alias The attribute alias.
*/
public int getCount(String alias)
{
if ("unlimited".equals(_parameters.getParameterValue("count." + alias)))
return 0;
else if (_parameters.hasParameter("count." + alias))
return Integer.parseInt(_parameters.getParameterValue("count." + alias));
else
return 1;
}
/**
* Sets the optional 'update_url' parameter where the OP can later re-post
* fetch-response updates to the values of the requested attributes.
*
* @param updateUrl The URL where the RP accepts later updates
* to the requested attributes.
*/
public void setUpdateUrl(String updateUrl) throws MessageException
{
try
{
new URL(updateUrl);
} catch (MalformedURLException e)
{
throw new MessageException("Invalid update_url: " + updateUrl);
}
if (DEBUG) _log.debug("Setting fetch request update_url: " + updateUrl);
_parameters.set(new Parameter("update_url", updateUrl));
}
/**
* Gets the optional 'update_url' parameter if available, or null otherwise.
*/
public String getUpdateUrl()
{
return _parameters.hasParameter("update_url") ?
_parameters.getParameterValue("update_url") : null;
}
/**
* Returns a map with the requested attributes.
*
* @param required If set to true the list of 'required' attributes
* is returned, otherwise the list of 'if_available'
* attributes.
* @return Map of attribute aliases -> attribute type URIs.
*/
public Map getAttributes(boolean required)
{
HashMap attributes = new LinkedHashMap();
String level = required ? "required" : "if_available";
Parameter param = _parameters.getParameter(level);
if (param != null)
{
String[] values = param.getValue().split(",");
for (int i = 0; i < values.length; i++)
{
String alias = values[i];
attributes.put(alias,
_parameters.getParameterValue("type." + alias));
}
}
return attributes;
}
/**
* Gets all requested attributes (required and optional).
*
* @return Map of attribute aliases -> attribute type URIs.
*/
public Map getAttributes()
{
Map attributes = getAttributes(true);
attributes.putAll(getAttributes(false));
return attributes;
}
/**
* Checks the validity of the extension.
*
* Used when constructing a extension from a parameter list.
*
* @return True if the extension is valid, false otherwise.
*/
public boolean isValid()
{
if ( ! _parameters.hasParameter("required") &&
! _parameters.hasParameter("if_available") )
{
_log.warn("One of 'required' or 'if_available' parameters must be present.");
return false;
}
if ( ! _parameters.hasParameter("mode") ||
! "fetch_request".equals(_parameters.getParameterValue("mode")))
{
_log.warn("Invalid mode value in fetch_request: "
+ _parameters.getParameterValue("mode"));
return false;
}
if (_parameters.hasParameter("required"))
{
String[] aliases = _parameters.getParameterValue("required").split(",");
for (int i = 0; i < aliases.length; i++)
{
String alias = aliases[i];
if ( ! _parameters.hasParameter("type." + alias) )
{
_log.warn("Type missing for attribute alias: " + alias);
return false;
}
if (! checkCount(alias)) return false;
}
}
if ( _parameters.hasParameter("if_available"))
{
String[] aliases = _parameters.getParameterValue("if_available").split(",");
for (int i = 0; i < aliases.length; i++)
{
String alias = aliases[i];
if ( ! _parameters.hasParameter("type." + alias) )
{
_log.warn("Type missing for attribute alias: " + alias);
return false;
}
if (! checkCount(alias)) return false;
}
}
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
String paramName = ((Parameter) it.next()).getKey();
if (! paramName.equals("mode") &&
! paramName.startsWith("type.") &&
! paramName.startsWith("count.") &&
! paramName.equals("required") &&
! paramName.equals("if_available") &&
! paramName.equals("update_url"))
{
_log.warn("Invalid parameter name in fetch request: " + paramName);
//return false;
}
}
return true;
}
private boolean checkCount(String alias)
{
int count = getCount(alias);
if ( count < 0 ||
( count == 0 &&
! "unlimited".equals(_parameters.getParameterValue("count." + alias))) )
{
_log.warn("Invalid value for count." + alias + ": " +
_parameters.getParameterValue("count." + alias));
return false;
}
return true;
}
private synchronized String generateAlias()
{
return "attr" + Integer.toString(++ _aliasCounter);
}
}
openid4java-0.9.6.662/src/org/openid4java/message/ax/StoreRequest.java 0000644 0015012 0015012 00000005222 11130536343 024712 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.ax;
import org.openid4java.message.MessageException;
import org.openid4java.message.Parameter;
import org.openid4java.message.ParameterList;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements the extension for Attribute Exchange store requests.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class StoreRequest extends AxPayload
{
private static Log _log = LogFactory.getLog(StoreRequest.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/**
* Constructs a Store Request with an empty parameter list.
*/
protected StoreRequest()
{
_parameters.set(new Parameter("mode", "store_request"));
if (DEBUG) _log.debug("Created empty store request.");
}
/**
* Constructs a Store Request with an empty parameter list.
*/
public static StoreRequest createStoreRequest()
{
return new StoreRequest();
}
/**
* Constructs a StoreRequest from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
protected StoreRequest(ParameterList params)
{
_parameters = params;
}
/**
* Constructs a StoreRequest from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
public static StoreRequest createStoreRequest(ParameterList params)
throws MessageException
{
StoreRequest req = new StoreRequest(params);
if (! req.isValid())
throw new MessageException("Invalid parameters for a store request");
if (DEBUG)
_log.debug("Created store request from parameter list:\n" + params);
return req;
}
/**
* Checks the validity of the extension.
*
* Used when constructing a extension from a parameter list.
*
* @return True if the extension is valid, false otherwise.
*/
public boolean isValid()
{
if ( ! _parameters.hasParameter("mode") ||
! "store_request".equals(_parameters.getParameterValue("mode")))
{
_log.warn("Invalid mode value in store_request: "
+ _parameters.getParameterValue("mode"));
return false;
}
return super.isValid();
}
}
openid4java-0.9.6.662/src/org/openid4java/message/ax/StoreResponse.java 0000644 0015012 0015012 00000010316 11102646027 025060 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.ax;
import org.openid4java.message.ParameterList;
import org.openid4java.message.MessageException;
import org.openid4java.message.Parameter;
import java.util.Iterator;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements the extension for Attribute Exchange store responses.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class StoreResponse extends AxMessage
{
private static Log _log = LogFactory.getLog(StoreResponse.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/**
* Constructs a Store Response with an empty parameter list.
*/
protected StoreResponse()
{
_parameters.set(new Parameter("mode", "store_response_success"));
if (DEBUG) _log.debug("Created empty store request.");
}
/**
* Constructs a Store Response with an empty parameter list.
*/
public static StoreResponse createStoreResponse()
{
return new StoreResponse();
}
/**
* Constructs a StoreResponse from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
protected StoreResponse(ParameterList params)
{
super(params);
}
/**
* Constructs a StoreResponse from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
public static StoreResponse createStoreResponse(ParameterList params)
throws MessageException
{
StoreResponse resp = new StoreResponse(params);
if (! resp.isValid())
throw new MessageException("Invalid parameters for a store response");
if (DEBUG)
_log.debug("Created store response from parameter list:\n" + params);
return resp;
}
/**
* Marks the Store Response as a failure, by setting the appropirate
* parameters.
*
* @param description Describes the error condition leading to
* the failure response
*/
public void setFailure(String description)
{
_parameters.set(new Parameter("mode", "store_response_failure"));
if (description != null)
_parameters.set(new Parameter("error", description));
}
/**
* Returns true if the Store Response is a failure message, true if it is
* a success response.
*/
public boolean hasFailed()
{
return "store_response_failure".equals(
_parameters.getParameterValue("mode") );
}
/**
* Gets the status of the Store Response if the 'status' parameter is part
* of the response, or null otherwise.
*/
public String getErrorDescription()
{
return _parameters.getParameterValue("error");
}
/**
* Checks the validity of the extension.
*
* Used when constructing a extension from a parameter list.
*
* @return True if the extension is valid, false otherwise.
*/
private boolean isValid()
{
if ( ! _parameters.hasParameter("mode") ||
( ! "store_response_success".equals(_parameters.getParameterValue("mode")) &&
! "store_response_failure".equals(_parameters.getParameterValue("mode")) ) )
{
_log.warn("Invalid mode value in store response: "
+ _parameters.getParameterValue("mode"));
return false;
}
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
Parameter param = (Parameter) it.next();
String paramName = param.getKey();
if (! paramName.equals("mode") &&
! paramName.equals("error"))
{
_log.warn("Invalid parameter name in store response: " + paramName);
return false;
}
}
return true;
}
}
openid4java-0.9.6.662/src/org/openid4java/message/ax/AxPayload.java 0000644 0015012 0015012 00000026261 11250064010 024123 0 ustar miguel miguel package org.openid4java.message.ax;
import org.openid4java.message.MessageException;
import org.openid4java.message.Parameter;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import java.util.*;
/**
* @author jbufu
*/
public abstract class AxPayload extends AxMessage {
private static Log _log = LogFactory.getLog(AxPayload.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private int _attrAliasCounter = 0;
private synchronized String generateAlias()
{
return "attr" + Integer.toString(++ _attrAliasCounter);
}
/**
* Adds an attribute to the attribute payload.
*
* @param alias The alias identifier that will be associated
* with the attribute type URI.
* @param typeUri The attribute type URI.
* @param value The value of the attribute.
*/
public void addAttribute(String alias, String typeUri, String value)
throws MessageException
{
if ( alias.indexOf(',') > -1 || alias.indexOf('.') > -1 ||
alias.indexOf(':') > -1 || alias.indexOf('\n') > -1 )
throw new MessageException(
"Characters [.,:\\n] are not allowed in attribute aliases: " + alias);
int count = getCount(alias);
String index = "";
switch(count)
{
case 0:
_parameters.set(new Parameter("type." + alias, typeUri));
break;
case 1:
// rename the existing one
_parameters.set(new Parameter("value." + alias + ".1",
getParameterValue("value." + alias)));
_parameters.removeParameters("value." + alias);
index = ".2";
break;
default:
index = "." +Integer.toString(count + 1);
}
_parameters.set(new Parameter("value." + alias + index, value));
setCount(alias, ++count);
if (DEBUG)
_log.debug("Added new attribute to AX payload; type: " + typeUri
+ " alias: " + alias + " count: " + count);
}
/**
* Adds an attribute to the attribute payload, without the caller having to
* specify an alias. An alias in the form "attrNN" will be automatically
* generated.
*
* @param typeUri The attribute type URI.
* @param value The attribute value.
* @return The generated attribute alias.
*/
public String addAttribute(String typeUri, String value)
{
String alias = generateAlias();
// not calling the other addAttribute - extra overhead in checks there
_parameters.set(new Parameter("type." + alias, typeUri));
_parameters.set(new Parameter("value." + alias, value));
if (DEBUG)
_log.debug("Added new attribute to the AX payload; type: " + typeUri
+ " alias: " + alias);
return alias;
}
/**
* Adds the attributes in the supplied Map to the attribute payload.
* A requested count of 1 is assumed for each attribute in the map.
*
* @param attributes Map.
*/
public void addAttributes(Map attributes)
{
String typeUri;
Iterator iter = attributes.keySet().iterator();
while (iter.hasNext())
{
typeUri = (String) iter.next();
addAttribute(typeUri, (String) attributes.get(typeUri));
}
}
/**
* Returns a list with the attribute value(s) associated for the specified
* attribute alias.
*
* @param alias The attribute alias.
* @return List of attribute values.
*/
public List getAttributeValues(String alias)
{
List values = new ArrayList();
if (! _parameters.hasParameter("count." + alias))
values.add(getParameterValue("value." + alias));
else
for (int i = 1; i <= getCount(alias); i++)
values.add(getParameterValue("value." + alias + "." + Integer.toString(i)));
return values;
}
/**
* Get typeURI value for the specified attribute alias.
*/
public String getAttributeTypeUri(String alias) {
return _parameters.getParameterValue("type." + alias);
}
/**
* Gets the alias for an attribute type URI, if present.
*
* @param typeUri the attribyte type URI for which the alias is looked up
* @return the attribute alias if present in the message, or null otherwise
*/
public String getAttributeAlias(String typeUri)
{
if (typeUri == null)
return null;
Parameter param;
Iterator it = _parameters.getParameters().iterator();
while(it.hasNext())
{
param = (Parameter) it.next();
if (param.getKey().startsWith("type.") && typeUri.equals(param.getValue()))
return param.getKey().substring(5);
}
return null;
}
/**
* Gets the (first) value for the specified attribute type URI.
*
* @param typeUri
* @return
*/
public String getAttributeValueByTypeUri(String typeUri)
{
return getAttributeValue(getAttributeAlias(typeUri));
}
/**
* Returns a list with the attribute value(s) associated for the specified
* attribute type URI.
*
* @param typeUri The attribute type URI.
* @return List of attribute values.
*/
public List getAttributeValuesByTypeUri(String typeUri)
{
return getAttributeValues(getAttributeAlias(typeUri));
}
/**
* Gets the (first) value for the specified attribute alias.
*/
public String getAttributeValue(String alias)
{
return (_parameters.hasParameter("count." + alias) && getCount(alias) > 0) ?
getParameterValue("value." + alias + ".1") :
getParameterValue("value." + alias);
}
/**
* Gets a list of attribute aliases.
*/
public List getAttributeAliases()
{
List aliases = new ArrayList();
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
String paramName = ((Parameter) it.next()).getKey();
if (paramName.startsWith("type."))
{
String alias = paramName.substring(5);
if ( ! aliases.contains(alias) )
aliases.add(alias);
}
}
return aliases;
}
/**
* Gets a map with attribute aliases -> list of values.
*/
public Map getAttributes()
{
Map attributes = new HashMap();
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
String paramName = ((Parameter) it.next()).getKey();
if (paramName.startsWith("type."))
{
String alias = paramName.substring(5);
if ( ! attributes.containsKey(alias) )
attributes.put(alias, getAttributeValues(alias));
}
}
return attributes;
}
/**
* Gets a map with attribute aliases -> attribute type URI.
*/
public Map getAttributeTypes()
{
Map typeUris = new HashMap();
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
Parameter param = (Parameter) it.next();
String paramName = param.getKey();
String paramType = param.getValue();
if (paramName.startsWith("type."))
{
String alias = paramName.substring(5);
if ( ! typeUris.containsKey(alias) )
typeUris.put(alias, paramType);
}
}
return typeUris;
}
/**
* Gets the number of values provided in the attribute payload for the
* specified attribute alias.
*
* @param alias The attribute alias.
*/
public int getCount(String alias)
{
if (_parameters.hasParameter("count." + alias))
return Integer.parseInt(_parameters.getParameterValue("count." + alias));
else if (_parameters.hasParameter("value." + alias))
return 1;
else
return 0;
}
/**
* Sets the number of values provided in the attribute payload for the
* specified attribute alias. The value must be greater than 1.
*
* @param alias The attribute alias.
* @param count The number of values.
*/
private void setCount(String alias, int count)
{
if (count > 1)
_parameters.set(
new Parameter("count." + alias, Integer.toString(count)));
}
protected boolean isValid()
{
Iterator it = _parameters.getParameters().iterator();
while (it.hasNext())
{
String paramName = ((Parameter) it.next()).getKey();
if (! paramName.equals("mode") &&
! paramName.startsWith("type.") &&
! paramName.startsWith("count.") &&
! paramName.startsWith("value.") &&
! paramName.equals("update_url"))
{
_log.warn("Invalid parameter name in AX payload: " + paramName);
//return false;
}
}
return checkAttributes();
}
private boolean checkAttributes()
{
List aliases = getAttributeAliases();
Iterator it = aliases.iterator();
while (it.hasNext())
{
String alias = (String) it.next();
if (! _parameters.hasParameter("type." + alias))
{
_log.warn("Type missing for attribute alias: " + alias);
return false;
}
if ( ! _parameters.hasParameter("count." + alias) )
{
if (_parameters.hasParameterPrefix("value." + alias + "."))
{
_log.warn("Count parameter not present for alias: " + alias
+ "; value." + alias + ".[index] format is not allowed.");
return false;
}
}
else // count.alias present
{
if (_parameters.hasParameter("value." + alias))
{
_log.warn("Count parameter present for alias: " + alias
+ "; should use value." + alias + ".[index] format.");
return false;
}
int count = getCount(alias);
if (count < 0)
{
_log.warn("Invalid value for count." + alias + ": " + count);
return false;
}
for (int i = 1; i <= count; i++)
{
if (! _parameters.hasParameter("value." + alias + "." +
Integer.toString(i)))
{
_log.warn("Value missing for alias: "
+ alias + "." + Integer.toString(i));
return false;
}
}
}
}
return true;
}
}
openid4java-0.9.6.662/src/org/openid4java/message/ax/FetchResponse.java 0000644 0015012 0015012 00000013631 11130536343 025020 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.ax;
import org.openid4java.message.ParameterList;
import org.openid4java.message.MessageException;
import org.openid4java.message.Parameter;
import java.net.URL;
import java.net.MalformedURLException;
import java.util.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements the extension for Attribute Exchange fetch responses.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class FetchResponse extends AxPayload
{
private static Log _log = LogFactory.getLog(FetchResponse.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/**
* Constructs a Fetch Response with an empty parameter list.
*/
protected FetchResponse()
{
_parameters.set(new Parameter("mode", "fetch_response"));
if (DEBUG) _log.debug("Created empty fetch response.");
}
/**
* Constructs a Fetch Response with an empty parameter list.
*/
public static FetchResponse createFetchResponse()
{
return new FetchResponse();
}
/**
* Constructs a FetchResponse from a parameter list.
*
* The parameter list can be extracted from a received message with the
* getExtensionParams method of the Message class, and MUST NOT contain
* the "openid.." prefix.
*/
protected FetchResponse(ParameterList params)
{
_parameters = params;
}
public static FetchResponse createFetchResponse(ParameterList params)
throws MessageException
{
FetchResponse resp = new FetchResponse(params);
if (! resp.isValid())
throw new MessageException("Invalid parameters for a fetch response");
if (DEBUG)
_log.debug("Created fetch response from parameter list:\n" + params);
return resp;
}
/**
* Creates a FetchResponse from a FetchRequest message and the data released
* by the user.
*
* @param req FetchRequest message.
* @param userData The userData may be a Map
* or a Map values>. The attribute values
* are provided by the calling application. If a list of values is
* specified per attribute, at most n will be sent, where n is the
* number of attribute values requested in the FetchRequest.
* @return Properly formed FetchResponse.
*/
public static FetchResponse createFetchResponse(FetchRequest req, Map userData)
throws MessageException
{
FetchResponse resp = new FetchResponse();
// go through each requested attribute
Map attributes = req.getAttributes();
for (Iterator i = attributes.keySet().iterator(); i.hasNext(); )
{
String alias = (String) i.next();
// find attribute in userData
Object value = userData.get(alias);
// if the value isn't there, skip over it
if (value == null)
{
continue;
}
// if the value is a string, add the single attribute to the response
if (value instanceof String)
{
resp.addAttribute(alias, (String) attributes.get(alias), (String)value);
}
// if the value is a list (of string) iteratively add each attribute to the response
else if (value instanceof List)
{
Iterator values = ((List)value).iterator();
// only send up the the maximum requested number
int max = req.getCount(alias);
int count;
for (count = 0; count < max && values.hasNext(); count++)
{
// don't add null values to the response
String val = (String)values.next();
if (val == null)
{
count--; // disregard this as a value as we are skipping over it
continue;
}
resp.addAttribute(alias, (String) attributes.get(alias), val);
}
}
}
return resp;
}
/**
* Sets the optional 'update_url' parameter where the OP can later re-post
* fetch-response updates for the values of the requested attributes.
*
* @param updateUrl The URL where the RP accepts later updates
* for the requested attributes.
*/
public void setUpdateUrl(String updateUrl) throws MessageException
{
try
{
new URL(updateUrl);
}
catch (MalformedURLException e)
{
throw new MessageException("Invalid update_url: " + updateUrl);
}
if (DEBUG) _log.debug("Setting fetch response update_url: " + updateUrl);
_parameters.set(new Parameter("update_url", updateUrl));
}
/**
* Gets the optional 'update_url' parameter if available, or null otherwise.
*/
public String getUpdateUrl()
{
return _parameters.hasParameter("update_url") ?
_parameters.getParameterValue("update_url") : null;
}
/**
* Checks the validity of the extension.
*
* Used when constructing a extension from a parameter list.
*
* @return True if the extension is valid, false otherwise.
*/
protected boolean isValid()
{
if ( ! _parameters.hasParameter("mode") ||
! "fetch_response".equals(_parameters.getParameterValue("mode")))
{
_log.warn("Invalid mode value in fetch_reponse: "
+ _parameters.getParameterValue("mode"));
return false;
}
return super.isValid();
}
}
openid4java-0.9.6.662/src/org/openid4java/message/ax/AxMessage.java 0000644 0015012 0015012 00000012505 11553420466 024133 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message.ax;
import org.openid4java.message.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Base class for the Attribute Exchange implementation.
*
* Encapsulates:
*
*
the Type URI that identifies the Attribute Exchange extension
*
a list of extension-specific parameters, with the
* openid. prefix removed
*
methods for handling the extension-specific support of parameters with
* multpile values
*
*
* @see Message MessageExtension
* @author Marius Scurtescu, Johnny Bufu
*/
public class AxMessage implements MessageExtension, MessageExtensionFactory
{
private static Log _log = LogFactory.getLog(AxMessage.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/**
* The Attribute Exchange Type URI.
*/
public static final String OPENID_NS_AX = "http://openid.net/srv/ax/1.0";
/**
* The Attribute Exchange extension-specific parameters.
*
* The openid. prefix is not part of the parameter names
*/
protected ParameterList _parameters;
/**
* Constructs an empty (no parameters) Attribute Exchange extension.
*/
public AxMessage()
{
_parameters = new ParameterList();
if (DEBUG) _log.debug("Created empty AXMessage.");
}
/**
* Constructs an Attribute Exchange extension with a specified list of
* parameters.
*
* The parameter names in the list should not contain the
* openid..
*/
public AxMessage(ParameterList params)
{
_parameters = params;
if (DEBUG)
_log.debug("Created AXMessage from parameter list:\n" + params);
}
/**
* Gets the Type URI that identifies the Attribute Exchange extension.
*/
public String getTypeUri()
{
return OPENID_NS_AX;
}
/**
* Gets ParameterList containing the Attribute Exchange extension-specific
* parameters.
*
* The openid. prefix is not part of the parameter names,
* as it is handled internally by the Message class.
*
* The openid.ns. parameter is also handled by
* the Message class.
*
* @see Message
*/
public ParameterList getParameters()
{
return _parameters;
}
/**
* Gets a the value of the parameter with the specified name.
*
* @param name The name of the parameter,
* without the openid. prefix.
* @return The parameter value, or null if not found.
*/
public String getParameterValue(String name)
{
return _parameters.getParameterValue(name);
}
/**
* Sets the extension's parameters to the supplied list.
*
* The parameter names in the list should not contain the
* openid. prefix.
*/
public void setParameters(ParameterList params)
{
_parameters = params;
}
/**
* Attribute exchange doesn't implement authentication services.
*
* @return false
*/
public boolean providesIdentifier()
{
return false;
}
/**
* Attribute exchange parameters are required to be signed.
*
* @return true
*/
public boolean signRequired()
{
return true;
}
/**
* Instantiates the apropriate Attribute Exchange object (fetch / store -
* request / response) for the supplied parameter list.
*
* @param parameterList The Attribute Exchange specific parameters
* (without the openid. prefix)
* extracted from the openid message.
* @param isRequest Indicates whether the parameters were
* extracted from an OpenID request (true),
* or from an OpenID response.
* @return MessageExtension implementation for
* the supplied extension parameters.
* @throws MessageException If a Attribute Exchange object could not be
* instantiated from the supplied parameter list.
*/
public MessageExtension getExtension(
ParameterList parameterList, boolean isRequest)
throws MessageException
{
String axMode = null;
if (parameterList.hasParameter("mode"))
{
axMode = parameterList.getParameterValue("mode");
if ("fetch_request".equals(axMode))
return FetchRequest.createFetchRequest(parameterList);
else if ("fetch_response".equals(axMode))
return FetchResponse.createFetchResponse(parameterList);
else if ("store_request".equals(axMode))
return StoreRequest.createStoreRequest(parameterList);
else if ("store_response_success".equals(axMode) ||
"store_response_failure".equals(axMode))
return StoreResponse.createStoreResponse(parameterList);
}
throw new MessageException("Invalid value for attribute exchange mode: "
+ axMode);
}
}
openid4java-0.9.6.662/src/org/openid4java/message/IndirectError.java 0000644 0015012 0015012 00000007617 11034531513 024417 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.OpenIDException;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class IndirectError extends Message
{
private static Log _log = LogFactory.getLog(IndirectError.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected IndirectError(String msg, String returnTo)
{
this(msg, returnTo, false);
}
protected IndirectError(String msg, String returnTo, boolean compatibility)
{
this(null, msg, returnTo, compatibility);
}
protected IndirectError(OpenIDException e, String msg, String returnTo, boolean compatibility)
{
set("openid.mode", "error");
set("openid.error", msg);
_destinationUrl = returnTo;
_exception = e;
if (! compatibility)
set("openid.ns", OPENID2_NS);
}
// exception that generated the error, if any
private OpenIDException _exception;
protected IndirectError(ParameterList params)
{
super(params);
}
public static IndirectError createIndirectError(OpenIDException e, String returnTo)
{
return createIndirectError(e, returnTo, false);
}
public static IndirectError createIndirectError(String msg, String returnTo)
{
return createIndirectError(msg, returnTo, false);
}
public static IndirectError createIndirectError(OpenIDException e,
String returnTo,
boolean compatibility)
{
return createIndirectError(e, e.getMessage(), returnTo, compatibility);
}
public static IndirectError createIndirectError(String msg, String returnTo,
boolean compatibility)
{
return createIndirectError(null, msg, returnTo, compatibility);
}
public static IndirectError createIndirectError(OpenIDException e,
String msg, String returnTo,
boolean compatibility)
{
IndirectError err = new IndirectError(e, msg, returnTo, compatibility);
try
{
err.validate();
}
catch (MessageException ex)
{
_log.error("Invalid " + (compatibility? "OpenID1" : "OpenID2") +
" indirect error message created for message: " + msg);
}
_log.debug("Created indirect error message:\n" + err.keyValueFormEncoding());
return err;
}
public static IndirectError createIndirectError(ParameterList params)
{
IndirectError err = new IndirectError(params);
try
{
err.validate();
}
catch (MessageException e)
{
_log.error("Invalid direct error message created: "
+ err.keyValueFormEncoding() );
}
_log.debug("Created indirect error message:\n" + err.keyValueFormEncoding());
return err;
}
public OpenIDException getException()
{
return _exception;
}
public void setException(OpenIDException e)
{
this._exception = e;
}
public void setErrorMsg(String msg)
{
set("openid.error", msg);
}
public String getErrorMsg()
{
return getParameterValue("openid.error");
}
public void setContact(String contact)
{
set("openid.contact", contact);
}
public String getContact()
{
return getParameterValue("openid.contact");
}
public void setReference(String reference)
{
set("openid.reference", reference);
}
public String getReference()
{
return getParameterValue("openid.reference");
}
}
openid4java-0.9.6.662/src/org/openid4java/message/VerifyResponse.java 0000644 0015012 0015012 00000005542 11034531513 024622 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.OpenIDException;
import java.util.List;
import java.util.Arrays;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class VerifyResponse extends Message
{
private static Log _log = LogFactory.getLog(VerifyResponse.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected final static List requiredFields = Arrays.asList(new String[] {
"is_valid"
});
protected final static List optionalFields = Arrays.asList(new String[] {
"ns",
"invalidate_handle"
});
protected VerifyResponse(boolean compatibility)
{
setSignatureVerified(false);
if (! compatibility)
set("ns", OPENID2_NS);
}
protected VerifyResponse(ParameterList params)
{
super(params);
}
public static VerifyResponse createVerifyResponse(boolean compatibility)
throws MessageException
{
VerifyResponse resp = new VerifyResponse(compatibility);
resp.validate();
if (DEBUG) _log.debug("Created verification response:\n"
+ resp.keyValueFormEncoding());
return resp;
}
public static VerifyResponse createVerifyResponse(ParameterList params)
throws MessageException
{
VerifyResponse resp = new VerifyResponse(params);
resp.validate();
if (DEBUG) _log.debug("Created verification response:\n"
+ resp.keyValueFormEncoding());
return resp;
}
public List getRequiredFields()
{
return requiredFields;
}
public boolean isVersion2()
{
return hasParameter("ns") && OPENID2_NS.equals(getParameterValue("ns"));
}
public void setSignatureVerified(boolean verified)
{
if (DEBUG)
_log.debug("Setting is_valid to: " + verified);
set("is_valid", verified ? "true" : "false");
}
public boolean isSignatureVerified()
{
return "true".equals(getParameterValue("is_valid"));
}
public void setInvalidateHandle(String handle)
{
set("invalidate_handle", handle);
}
public String getInvalidateHandle()
{
return getParameterValue("invalidate_handle");
}
public void validate() throws MessageException
{
super.validate();
if (! "true".equals(getParameterValue("is_valid")) &&
! "false".equals(getParameterValue("is_valid")) )
{
throw new MessageException(
"Invalid is_valid value in verification response: "
+ getParameterValue("is_valid"),
OpenIDException.VERIFY_ERROR);
}
}
}
openid4java-0.9.6.662/src/org/openid4java/message/AssociationRequest.java 0000644 0015012 0015012 00000022417 11034531513 025464 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.openid4java.association.DiffieHellmanSession;
import org.openid4java.association.AssociationSessionType;
import org.openid4java.association.AssociationException;
import org.openid4java.OpenIDException;
import java.util.List;
import java.util.Arrays;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* The OpenID Association Request message.
*
* Handles OpenID 2.0 and OpenID 1.x messages.
*
* @see AssociationSessionType
* @author Marius Scurtescu, Johnny Bufu
*/
public class AssociationRequest extends Message
{
private static Log _log = LogFactory.getLog(AssociationRequest.class);
private static final boolean DEBUG = _log.isDebugEnabled();
public static final String MODE_ASSOC = "associate";
protected final static List requiredFields = Arrays.asList( new String[] {
"openid.mode",
"openid.session_type",
});
protected final static List optionalFields = Arrays.asList( new String[] {
"openid.ns", // not in v1 messages
"openid.assoc_type", // can be missing in v1
"openid.dh_modulus",
"openid.dh_gen",
"openid.dh_consumer_public"
});
/**
* The Diffie-Hellman session containing the cryptografic data needed for
* encrypting the MAC key exchange.
*
* Null for no-encryption sessions.
*/
private DiffieHellmanSession _dhSess;
/**
* Creates an Association Request message with the
* specified association type and "no-encryption" session.
*
* The supplied type must be one of the "no-encryption" types, otherwise
* a DiffieHellman session is required.
*
* @see #AssociationRequest(AssociationSessionType, DiffieHellmanSession)
*/
protected AssociationRequest(AssociationSessionType type)
{
this(type, null);
}
/**
* Constructs an AssociationRequest message with the
* specified association type and Diffie-Hellman session.
*
* @param dhSess Diffie-Hellman session to be used for this association;
* if null, a "no-encryption" session is created.
*/
protected AssociationRequest(AssociationSessionType type,
DiffieHellmanSession dhSess)
{
if (DEBUG)
_log.debug("Creating association request, type: " + type +
"DH session: " + dhSess);
if (type.isVersion2())
set("openid.ns", OPENID2_NS);
set("openid.mode", MODE_ASSOC);
set("openid.session_type", type.getSessionType());
set("openid.assoc_type", type.getAssociationType());
_dhSess = dhSess;
if (dhSess != null )
{
set("openid.dh_consumer_public", _dhSess.getPublicKey());
// send both diffie-hellman generator and modulus if either are not the default values
// (this meets v1.1 spec and is compatible with v2.0 spec)
if (!DiffieHellmanSession.DEFAULT_GENERATOR_BASE64.equals(_dhSess.getGenerator())
|| !DiffieHellmanSession.DEFAULT_MODULUS_BASE64.equals(_dhSess.getModulus()))
{
set("openid.dh_gen", _dhSess.getGenerator());
set("openid.dh_modulus", _dhSess.getModulus());
}
}
}
/**
* Constructs an AssociationRequest message from a parameter list.
*
* Useful for processing incoming messages.
*/
protected AssociationRequest(ParameterList params)
{
super(params);
}
public static AssociationRequest createAssociationRequest(
AssociationSessionType type) throws MessageException
{
return createAssociationRequest(type, null);
}
public static AssociationRequest createAssociationRequest(
AssociationSessionType type, DiffieHellmanSession dhSess)
throws MessageException
{
AssociationRequest req = new AssociationRequest(type, dhSess);
// make sure the association / session type matches the dhSess
if ( type == null ||
(dhSess == null && type.getHAlgorithm() != null) ||
(dhSess != null && ! dhSess.getType().equals(type) ) )
throw new MessageException(
"Invalid association / session combination specified: " +
type + "DH session: " + dhSess);
req.validate();
if (DEBUG) _log.debug("Created association request:\n"
+ req.keyValueFormEncoding());
return req;
}
public static AssociationRequest createAssociationRequest(
ParameterList params) throws MessageException
{
AssociationRequest req = new AssociationRequest(params);
req.validate();
if (DEBUG)
_log.debug("Created association request from message parameters:\n"
+ req.keyValueFormEncoding());
return req;
}
public List getRequiredFields()
{
return requiredFields;
}
/**
* Returns true for OpenID 2.0 messages, false otherwise.
*/
public boolean isVersion2()
{
return hasParameter("openid.ns") &&
OPENID2_NS.equals(getParameterValue("openid.ns"));
}
/**
* Gets the association type parameter of the message.
*/
private String getAssociationType()
{
return getParameterValue("openid.assoc_type");
}
/**
* Gets the session type parameter of the message.
*/
private String getSessionType()
{
return getParameterValue("openid.session_type");
}
/**
* Gets the association / session type of the association request.
*
* @throws AssociationException
*/
public AssociationSessionType getType() throws AssociationException
{
return AssociationSessionType.create(
getSessionType(), getAssociationType(), ! isVersion2() );
}
/**
* Gets the Diffie-Hellman session
* Null for no-encryption association requests.
*/
public DiffieHellmanSession getDHSess()
{
return _dhSess;
}
/**
* Gets the Diffie-Hellman modulus parameter of the message, or null for
* messages with no-encryption sessions.
*/
public String getDhModulus()
{
String modulus = getParameterValue("openid.dh_modulus");
return modulus != null ?
modulus : hasParameter("openid.dh_consumer_public") ?
DiffieHellmanSession.DEFAULT_MODULUS_BASE64 : null;
}
/**
* Gets the Diffie-Hellman generator parameter of the message, or null for
* messages with no-encryption sessions.
*/
public String getDhGen()
{
String gen = getParameterValue("openid.dh_gen");
return gen != null ?
gen : hasParameter("openid.dh_consumer_public") ?
DiffieHellmanSession.DEFAULT_GENERATOR_BASE64 : null;
}
/**
* Gets the Relying Party's (consumer) Diffie-Hellman public key, or null
* for messages with no-encryption sessions.
*/
public String getDhPublicKey()
{
return getParameterValue("openid.dh_consumer_public");
}
/**
* Checks if the message is a valid OpenID Association Request.
*
* @throws MessageException if message validation failed.
*/
public void validate() throws MessageException
{
// basic checks
super.validate();
// association / session type checks
// (includes most of the compatibility stuff)
AssociationSessionType type;
try
{
// throws exception for invalid session / association types
type = getType();
// make sure compatibility mode is the same for type and message
if (type.isVersion2() != isVersion2())
{
throw new MessageException("Protocol verison mismatch " +
"between association session type: " + type +
" and AssociationRequest message type.",
OpenIDException.ASSOC_ERROR);
}
}
catch (AssociationException e)
{
throw new MessageException(
"Error verifying association request validity.",
OpenIDException.ASSOC_ERROR, e);
}
// additional compatibility checks
if (! isVersion2() && getSessionType() == null)
{
throw new MessageException(
"sess_type cannot be omitted in OpenID1 association requests",
OpenIDException.ASSOC_ERROR);
}
// DH seesion parameters
if ( type.getHAlgorithm() != null && getDhPublicKey() == null)
{
throw new MessageException("DH consumer public key not specified.",
OpenIDException.ASSOC_ERROR);
}
// no-enc session
if (type.getHAlgorithm() == null && (getDhGen() != null ||
getDhModulus() != null || getDhPublicKey() != null) )
{
throw new MessageException(
"No-encryption session, but DH parameters specified.",
OpenIDException.ASSOC_ERROR);
}
}
}
openid4java-0.9.6.662/src/org/openid4java/message/AuthSuccess.java 0000644 0015012 0015012 00000043372 11551247205 024102 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.util.InternetDateFormat;
import org.openid4java.association.Association;
import org.openid4java.association.AssociationException;
import org.openid4java.OpenIDException;
import java.util.*;
import java.text.ParseException;
import java.net.URL;
import java.net.MalformedURLException;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class AuthSuccess extends Message
{
private static Log _log = LogFactory.getLog(AuthSuccess.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected final static List requiredFields = Arrays.asList( new String[] {
"openid.mode",
"openid.return_to",
"openid.assoc_handle",
"openid.signed",
"openid.sig"
});
protected final static List optionalFields = Arrays.asList( new String[] {
"openid.ns",
"openid.op_endpoint",
"openid.claimed_id",
"openid.identity",
"openid.response_nonce",
"openid.invalidate_handle"
});
// required signed list in OpenID 1.x
protected final static String signRequired1 = "return_to,identity";
// required signed list in OpenID 2.0 with claimed identifier
protected final static String signRequired2 =
"op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle";
// required signed list in OpenID 2.0 with no claimed identifier
protected final static String signRequired3 =
"op_endpoint,return_to,response_nonce,assoc_handle";
protected List _signFields = new ArrayList();
protected List _signExtensions = new ArrayList();
protected AuthSuccess(String opEndpoint, String claimedId, String delegate,
boolean compatibility,
String returnTo, String nonce,
String invalidateHandle, Association assoc,
boolean signNow)
throws AssociationException
{
if (! compatibility)
{
set("openid.ns", OPENID2_NS);
setOpEndpoint(opEndpoint);
setClaimed(claimedId);
setNonce(nonce);
}
set("openid.mode", MODE_IDRES);
setIdentity(delegate);
setReturnTo(returnTo);
if (invalidateHandle != null) setInvalidateHandle(invalidateHandle);
setHandle(assoc.getHandle());
buildSignedList();
setSignature(signNow ? assoc.sign(getSignedText()) : "");
}
protected AuthSuccess(ParameterList params)
{
super(params);
}
public static AuthSuccess createAuthSuccess(
String opEndpoint, String claimedId, String delegate,
boolean compatibility,
String returnTo, String nonce,
String invalidateHandle, Association assoc,
boolean signNow)
throws MessageException, AssociationException
{
AuthSuccess resp = new AuthSuccess(opEndpoint, claimedId, delegate,
compatibility, returnTo, nonce,
invalidateHandle, assoc, signNow);
resp.validate();
if (DEBUG) _log.debug("Created positive auth response:\n"
+ resp.keyValueFormEncoding());
return resp;
}
public static AuthSuccess createAuthSuccess(ParameterList params)
throws MessageException
{
AuthSuccess resp = new AuthSuccess(params);
resp.validate();
if (DEBUG) _log.debug("Created positive auth response:\n"
+ resp.keyValueFormEncoding());
return resp;
}
public List getRequiredFields()
{
return requiredFields;
}
public boolean isVersion2()
{
return hasParameter("openid.ns")
&& OPENID2_NS.equals(getParameterValue("openid.ns"));
}
public void setMode(String mode) throws MessageException
{
if (! mode.equals(MODE_IDRES) && ! mode.equals(MODE_CANCEL))
throw new MessageException("Unknown authentication mode: " + mode);
set("openid.mode", mode);
}
public String getMode()
{
return getParameterValue("openid.mode");
}
public void setOpEndpoint(String opEndpoint)
{
set("openid.op_endpoint", opEndpoint);
}
public String getOpEndpoint()
{
return getParameterValue("openid.op_endpoint");
}
public void setIdentity(String id)
{
set("openid.identity", id);
}
public String getIdentity() throws DiscoveryException
{
return getParameterValue("openid.identity");
}
public void setClaimed(String claimed)
{
set("openid.claimed_id", claimed);
}
public String getClaimed()
{
return getParameterValue("openid.claimed_id");
}
public void setReturnTo(String returnTo)
{
set("openid.return_to", returnTo);
_destinationUrl = returnTo;
}
public String getReturnTo()
{
return getParameterValue("openid.return_to");
}
public void setNonce(String nonce)
{
set("openid.response_nonce", nonce);
}
public String getNonce()
{
return getParameterValue("openid.response_nonce");
}
public void setInvalidateHandle(String handle)
{
set("openid.invalidate_handle", handle);
}
public String getInvalidateHandle()
{
return getParameterValue("openid.invalidate_handle");
}
public void setHandle(String handle)
{
set("openid.assoc_handle", handle);
}
public String getHandle()
{
return getParameterValue("openid.assoc_handle");
}
/**
* Builds the list of fields that will be signed. Three input sources are
* considered for this:
*
*
fields required to be signed by the OpenID protocol
*
the user defined list of fields to be signed
* {@link #setSignFields(String)}
*
fields belonging to extensions to be signed
* {@link #setSignExtensions(String[])}
*
*
* This method should be called after any field additions/deletions to/from
* the message.
*/
public void buildSignedList()
{
StringBuffer toSign = ! isVersion2() ? new StringBuffer(signRequired1) :
hasParameter("openid.identity") ? new StringBuffer(signRequired2)
: new StringBuffer(signRequired3);
List signList = new ArrayList(Arrays.asList(toSign.toString().split(",")));
Iterator iter = _signFields.iterator();
while (iter.hasNext())
{
String field = (String) iter.next();
if ( ! signList.contains(field) )
{
toSign.append(",").append(field);
signList.add(field);
}
}
// build list of field prefixes belonging to extensions
List extensionPrefixes = new ArrayList();
iter = _signExtensions.iterator();
while(iter.hasNext())
{
String alias = getExtensionAlias((String) iter.next());
if (alias != null)
{
// openid.ns. needs to be signed
String nsSign = "ns." + alias;
toSign.append(",").append(nsSign);
signList.add(nsSign);
extensionPrefixes.add(alias);
}
}
// add exension fields to the signed list
iter = getParameters().iterator();
while(iter.hasNext())
{
String paramName = ((Parameter) iter.next()).getKey();
if (! paramName.startsWith("openid.")) continue;
String signName = paramName.substring(7);
int dotIndex = signName.indexOf(".");
if (dotIndex > 0 &&
extensionPrefixes.contains(signName.substring(0,dotIndex)) &&
! signList.contains(signName) )
{
toSign.append(",").append(signName);
signList.add(signName);
}
}
if (DEBUG) _log.debug("Setting fields to be signed: " + toSign);
set("openid.signed", toSign.toString());
//todo: if signature is alread set, recompute it
}
/**
* Sets the messages fields that will be signed, in addition to the ones
* required by the protocol to be signed. The OpenID signature will
* only be applied to OpenID fields, starting with the "openid." prefix.
*
* @param userSuppliedList Comma-separated list of fields to be signed,
* without the "openid." prefix
* @see #setSignExtensions(String[])
*/
public void setSignFields(String userSuppliedList)
{
if (userSuppliedList != null)
{
_signFields = Arrays.asList(userSuppliedList.split(","));
buildSignedList();
}
}
/**
* Sets the list of messages fields that will be signed, in addition to
* the ones required by the protocol to be signed and any additional
* fields already configured to be signed. The OpenID signature will
* only be applied to OpenID fields, starting with the "openid." prefix.
* Should be called after all relevant extension fields have been
* added to the message.
*
* @param extensions Array of extension namespace URIs to be signed.
* @see #setSignFields(String) #setSignExtension
*/
public void setSignExtensions(String[] extensions)
{
if (extensions != null)
{
_signExtensions = new ArrayList(Arrays.asList(extensions));
buildSignedList();
}
}
/**
* Adds the list of messages fields that will be signed, in addition to
* the ones required by the protocol to be signed and any additional
* fields already configured to be signed. The OpenID signature will
* only be applied to OpenID fields, starting with the "openid." prefix.
* Should be called after all relevant extension fields have been
* added to the message.
*
* @param extensionNamespace Extension namespace URI to be signed.
* @see #setSignFields(String) #setSignExtensions
*/
public void addSignExtension(String extensionNamespace)
{
if (! _signExtensions.contains(extensionNamespace))
{
_signExtensions.add(extensionNamespace);
buildSignedList();
}
}
public List getSignExtensions()
{
return _signExtensions;
}
public void setSignature(String sig)
{
set("openid.sig", sig);
if(DEBUG) _log.debug("Added signature: " + sig);
}
public String getSignature()
{
return getParameterValue("openid.sig");
}
public String getSignList()
{
return getParameterValue("openid.signed");
}
/**
* Return the text on which the signature is applied.
*/
public String getSignedText()
{
StringBuffer signedText = new StringBuffer("");
String[] signedParams = getParameterValue("openid.signed").split(",");
for (int i = 0; i < signedParams.length; i++)
{
signedText.append(signedParams[i]);
signedText.append(':');
String value = getParameterValue("openid." + signedParams[i]);
if (value != null) signedText.append(value);
signedText.append('\n');
}
return signedText.toString();
}
public void validate() throws MessageException
{
super.validate();
boolean compatibility = ! isVersion2();
if ( ! compatibility && ! hasParameter("openid.op_endpoint"))
{
throw new MessageException(
"openid.op_endpoint is required in OpenID auth responses",
OpenIDException.AUTH_ERROR);
}
try
{
// return_to must be a valid URL, if present
if (getReturnTo() != null)
new URL(getReturnTo());
}
catch (MalformedURLException e)
{
throw new MessageException(
"Invalid return_to: " + getReturnTo(),
OpenIDException.AUTH_ERROR, e);
}
try
{
// op_endpoint must be a valid URL, if present
if (isVersion2() && getOpEndpoint() != null)
new URL(getOpEndpoint());
}
catch (MalformedURLException e)
{
throw new MessageException(
"Invalid op_endpoint: " + getOpEndpoint(),
OpenIDException.AUTH_ERROR, e);
}
if (! MODE_IDRES.equals(getMode()))
{
throw new MessageException(
"Invalid openid.mode value in auth response: " + getMode(),
OpenIDException.AUTH_ERROR);
}
// figure out if 'identity' is optional
if ( ! hasParameter("openid.identity") )
{
// not optional in v1
if (compatibility)
{
throw new MessageException(
"openid.identity is required in OpenID1 auth responses",
OpenIDException.AUTH_ERROR);
}
boolean hasAuthExt = false;
Iterator iter = getExtensions().iterator();
while (iter.hasNext())
{
String typeUri = iter.next().toString();
try
{
MessageExtension extension = getExtension(typeUri);
if (extension.providesIdentifier())
{
hasAuthExt = true;
break;
}
}
catch (MessageException ignore)
{
// do nothing
}
}
if (! hasAuthExt)
{
// no extension provides authentication sevices, invalid message
throw new MessageException(
"no identifier specified in auth request",
OpenIDException.AUTH_ERROR);
}
// claimed_id must be present if and only if identity is present
if ( hasParameter("openid.claimed_id") )
{
throw new MessageException(
"openid.claimed_id must be present if and only if " +
"openid.identity is present.", OpenIDException.AUTH_ERROR);
}
}
else if ( ! compatibility && ! hasParameter("openid.claimed_id") )
{
throw new MessageException(
"openid.clamied_id must be present in OpenID2 auth responses",
OpenIDException.AUTH_ERROR);
}
// nonce optional or not?
String nonce = getNonce();
if ( !compatibility )
{
if (nonce == null)
{
throw new MessageException(
"openid.response_nonce is required in OpenID2 auth responses",
OpenIDException.AUTH_ERROR);
}
// nonce format
InternetDateFormat _dateFormat = new InternetDateFormat();
try
{
_dateFormat.parse(nonce.substring(0, 20));
}
catch (ParseException e)
{
throw new MessageException(
"Error parsing nonce in auth response.",
OpenIDException.AUTH_ERROR, e);
}
if (nonce.length() >255)
{
throw new MessageException(
"nonce length must not exceed 255 characters",
OpenIDException.AUTH_ERROR);
}
} else if (nonce != null)
{
_log.warn("openid.response_nonce present in OpenID1 auth response");
// return false;
}
List signedFields = Arrays.asList(
getParameterValue("openid.signed").split(","));
// return_to must be signed
if (!signedFields.contains("return_to"))
{
throw new MessageException("return_to must be signed",
OpenIDException.AUTH_ERROR);
}
// either compatibility mode or nonce signed
if ( compatibility == signedFields.contains("response_nonce") )
{
_log.warn("response_nonce must be present and signed only in OpenID2 auth responses");
// return false;
}
// either compatibility mode or op_endpoint signed
if ( compatibility == signedFields.contains("op_endpoint") )
{
_log.warn("op_endpoint must be present and signed only in OpenID2 auth responses");
// return false;
}
// assoc_handle must be signed in v2
if ( ! compatibility && ! signedFields.contains("assoc_handle") )
{
throw new MessageException(
"assoc_handle must be signed in OpenID2 auth responses",
OpenIDException.AUTH_ERROR);
}
// 'identity' and 'claimed_id' must be signed if present
if (hasParameter("openid.identity") &&
! signedFields.contains("identity"))
{
throw new MessageException(
"openid.identity must be signed if present",
OpenIDException.AUTH_ERROR);
}
if (hasParameter("openid.claimed_id") &&
! signedFields.contains("claimed_id"))
{
throw new MessageException(
"openid.claimed_id must be signed if present",
OpenIDException.AUTH_ERROR);
}
}
}
openid4java-0.9.6.662/src/org/openid4java/message/VerifyRequest.java 0000644 0015012 0015012 00000005074 11034531513 024454 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.OpenIDException;
/**
* VerifyRequest is a AuthSuccess with the openid.mode
* switched to check_authentication.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class VerifyRequest extends AuthSuccess
{
private static Log _log = LogFactory.getLog(VerifyRequest.class);
private static final boolean DEBUG = _log.isDebugEnabled();
public static final String MODE_CHKAUTH = "check_authentication";
protected VerifyRequest(AuthSuccess authResp)
{
super(convertAuthSuccessParams(authResp));
}
private static ParameterList convertAuthSuccessParams(AuthSuccess authResp)
{
ParameterList params = new ParameterList(authResp.getParameterMap());
params.set(new Parameter("openid.mode", MODE_CHKAUTH));
return params;
}
protected VerifyRequest(ParameterList params)
{
super(params);
}
public static VerifyRequest createVerifyRequest(AuthSuccess authResp)
throws MessageException
{
VerifyRequest req = new VerifyRequest(authResp);
req.validate();
if (DEBUG) _log.debug("Created verification request " +
"from a positive auth response:\n" + req.keyValueFormEncoding());
return req;
}
public static VerifyRequest createVerifyRequest(ParameterList params)
throws MessageException
{
VerifyRequest req = new VerifyRequest(params);
req.validate();
if (DEBUG) _log.debug("Created verification request:\n"
+ req.keyValueFormEncoding());
return req;
}
public String getHandle()
{
return getParameterValue("openid.assoc_handle");
}
public String getInvalidateHandle()
{
return getParameterValue("openid.invalidate_handle");
}
public void validate() throws MessageException
{
if (! MODE_CHKAUTH.equals(getParameterValue("openid.mode")))
{
throw new MessageException(
"Invalid openid.mode in verification request: "
+ getParameterValue("openid.mode"),
OpenIDException.VERIFY_ERROR);
}
set("openid.mode", MODE_IDRES);
if (DEBUG) _log.debug("Delegating verification request validity check " +
"to auth response...");
super.validate();
set("openid.mode", MODE_CHKAUTH);
}
}
openid4java-0.9.6.662/src/org/openid4java/message/AssociationResponse.java 0000644 0015012 0015012 00000025453 11034531513 025635 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.openid4java.association.Association;
import org.openid4java.association.DiffieHellmanSession;
import org.openid4java.association.AssociationException;
import org.openid4java.association.AssociationSessionType;
import org.openid4java.OpenIDException;
import java.util.List;
import java.util.Arrays;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* The OpenID Association Response message.
*
* Handles OpenID 2.0 and OpenID 1.x messages.
*
* @see AssociationSessionType
* @author Marius Scurtescu, Johnny Bufu
*/
public class AssociationResponse extends Message
{
private static Log _log = LogFactory.getLog(AssociationResponse.class);
private static final boolean DEBUG = _log.isDebugEnabled();
protected final static List requiredFields = Arrays.asList( new String[] {
"assoc_type",
"assoc_handle",
"expires_in"
});
protected final static List optionalFields = Arrays.asList( new String[] {
"ns", // not in v1 messages
"session_type", // can be missing in v1
"mac_key",
"enc_mac_key",
"dh_server_public"
});
/**
* Constructs an AssociationResponse for a given association request.
*
* @param assocReq The association request that needs to be responded.
* @param assoc The association which will be used to sign
* authentication responses.
*/
protected AssociationResponse(AssociationRequest assocReq, Association assoc)
throws AssociationException
{
if (DEBUG)
_log.debug("Creating association response, type: " + assocReq.getType()
+ " association handle: " + assoc.getHandle());
if (assocReq.isVersion2()) set("ns", OPENID2_NS);
AssociationSessionType type = assocReq.getType();
setType(type);
setAssocHandle(assoc.getHandle());
Long expiryIn = new Long( ( assoc.getExpiry().getTime() -
System.currentTimeMillis() ) / 1000 );
setExpire(expiryIn);
if (type.getHAlgorithm() != null) // DH session, encrypt the MAC key
{
DiffieHellmanSession dhSess = DiffieHellmanSession.create(
type, assocReq.getDhModulus(), assocReq.getDhGen() );
setPublicKey(dhSess.getPublicKey());
setMacKeyEnc(dhSess.encryptMacKey(
assoc.getMacKey().getEncoded(),
assocReq.getDhPublicKey() ));
}
else // no-encryption session, unecrypted MAC key
{
setMacKey(new String(
Base64.encodeBase64(assoc.getMacKey().getEncoded())));
}
}
/**
* Constructs an AssociationResponse message from a parameter list.
*
* Useful for processing incoming messages.
*/
protected AssociationResponse(ParameterList params)
{
super(params);
}
public static AssociationResponse createAssociationResponse(
AssociationRequest assocReq, Association assoc)
throws MessageException, AssociationException
{
AssociationResponse resp = new AssociationResponse(assocReq, assoc);
resp.validate();
if (DEBUG) _log.debug("Created association response:\n"
+ resp.keyValueFormEncoding());
return resp;
}
public static AssociationResponse createAssociationResponse(ParameterList params)
throws MessageException
{
AssociationResponse resp = new AssociationResponse(params);
resp.validate();
if (DEBUG)
_log.debug("Created association response from message parameters:\n"
+ resp.keyValueFormEncoding() );
return resp;
}
public List getRequiredFields()
{
return requiredFields;
}
/**
* Returns true for OpenID 2.0 messages, false otherwise.
*/
public boolean isVersion2()
{
return hasParameter("ns") && OPENID2_NS.equals(getParameterValue("ns"));
}
/**
* Gets the association type parameter of the message.
*/
private String getAssociationType()
{
return getParameterValue("assoc_type");
}
/**
* Gets the session type parameter of the message.
*/
private String getSessionType()
{
return getParameterValue("session_type");
}
/**
* Sets the association / session type for the association response.
*/
public void setType(AssociationSessionType type)
{
set("session_type", type.getSessionType());
set("assoc_type", type.getAssociationType());
}
/**
* Gets the association / session type of the association response.
*
* @throws AssociationException
*/
public AssociationSessionType getType() throws AssociationException
{
return AssociationSessionType.create(
getSessionType(), getAssociationType(), ! isVersion2() );
}
/**
* Sets the handle of the association.
*/
public void setAssocHandle(String handle)
{
set("assoc_handle", handle);
}
/**
* Sets the lifetime, in seconds, of the association.
*/
public void setExpire(Long seconds)
{
set("expires_in", seconds.toString());
}
/**
* Sets the unecrtypted MAC key of the association.
*
* Should be called only for association responses using no-encryption
* sessions.
*
* @param key The unencrypted MAC key.
*/
public void setMacKey(String key)
{
set("mac_key", key);
}
/**
* Sets the OP's (server's) public key for the association.
*
* @param key The server's public key for the association.
*/
public void setPublicKey(String key)
{
set("dh_server_public", key);
}
/**
* Sets the encrypted MAC key of the association.
*
* Should be called only for association responses using Diffie-Hellman
* sessions.
*
* @param key The encrypted MAC key.
*/
public void setMacKeyEnc(String key)
{
set("enc_mac_key", key);
}
/**
* Checks if the message is a valid OpenID Association Response..
*
* @throws MessageException if message validation failed.
*/
public void validate() throws MessageException
{
// basic checks
super.validate();
// association / session type checks
// (includes most of the compatibility stuff)
AssociationSessionType type;
try
{
// throws exception for invalid session / association types
type = getType();
// make sure compatibility mode is the same for type and message
if (type.isVersion2() ^ isVersion2())
{
throw new MessageException(
"Protocol verison mismatch between association " +
"session type: " + type +
" and AssociationResponse message type.",
OpenIDException.ASSOC_ERROR);
}
}
catch (AssociationException e)
{
throw new MessageException(
"Error verifying association response validity.",
OpenIDException.ASSOC_ERROR, e);
}
// additional compatibility checks
if (! isVersion2() && getAssociationType() == null)
{
throw new MessageException(
"assoc_type cannot be omitted in OpenID1 responses",
OpenIDException.ASSOC_ERROR);
}
String macKey;
if (type.getHAlgorithm() != null) // DH session
{
if ( ! hasParameter("dh_server_public") ||
! hasParameter("enc_mac_key") )
{
throw new MessageException(
"DH public key or encrypted MAC key missing.",
OpenIDException.ASSOC_ERROR);
}
else
macKey = getParameterValue("enc_mac_key");
} else // no-enc session
{
if ( !hasParameter("mac_key") )
{
throw new MessageException("Missing MAC key.",
OpenIDException.ASSOC_ERROR);
}
else
macKey = getParameterValue("mac_key");
}
// mac key size
int macSize = Base64.decodeBase64(macKey.getBytes()).length * 8;
if ( macSize != type.getKeySize())
{
throw new MessageException("MAC key size: " + macSize +
" doesn't match the association/session type: " + type,
OpenIDException.ASSOC_ERROR);
}
}
/**
* Generates an Association object from an Association Response.
*
* @param dhSess The Diffie-Helman session containing the private key
* used to encrypt / decrypt the MAC key exchange.
* Should be null for no-encryption sessions.
*/
public Association getAssociation(DiffieHellmanSession dhSess)
throws AssociationException
{
if (DEBUG) _log.debug("Retrieving MAC key from association response...");
String handle = getParameterValue("assoc_handle");
int expiresIn = Integer.parseInt(
getParameterValue("expires_in") );
// get (and decrypt) the MAC key
byte[] macKey;
AssociationSessionType type = getType();
if ( type.getHAlgorithm() != null )
{
macKey = dhSess.decryptMacKey(
getParameterValue("enc_mac_key"),
getParameterValue("dh_server_public") );
if (DEBUG) _log.debug("Decrypted MAC key (base64): " +
new String(Base64.encodeBase64(macKey)));
}
else
{
macKey = Base64.decodeBase64(
getParameterValue("mac_key").getBytes() );
if (DEBUG) _log.debug("Unencrypted MAC key (base64): "
+ getParameterValue("mac_key"));
}
Association assoc;
if (Association.TYPE_HMAC_SHA1.equals(type.getAssociationType()))
assoc = Association.createHmacSha1(handle, macKey, expiresIn);
else if (Association.TYPE_HMAC_SHA256.equals(type.getAssociationType()))
assoc = Association.createHmacSha256(handle, macKey, expiresIn);
else
throw new AssociationException("Unknown association type: " + type);
if (DEBUG) _log.debug("Created association for handle: " + handle);
return assoc;
}
}
openid4java-0.9.6.662/src/org/openid4java/message/MessageException.java 0000644 0015012 0015012 00000001537 11034531513 025102 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.message;
import org.openid4java.OpenIDException;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class MessageException extends OpenIDException
{
public MessageException(String message)
{
super(message, MESSAGE_ERROR);
}
public MessageException(String message, int code)
{
super(message, code);
}
public MessageException(Throwable cause)
{
super(MESSAGE_ERROR, cause);
}
public MessageException(int code, Throwable cause)
{
super(code, cause);
}
public MessageException(String message, Throwable cause)
{
super(message, MESSAGE_ERROR, cause);
}
public MessageException(String message, int code, Throwable cause)
{
super(message, code, cause);
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/ 0000755 0015012 0015012 00000000000 11627733442 021366 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/discovery/DiscoveryInformation.java 0000644 0015012 0015012 00000010620 11200624345 026371 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery;
import java.net.URL;
import java.io.Serializable;
import java.util.Set;
import java.util.HashSet;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class DiscoveryInformation implements Serializable
{
/**
* The OP endpoint URL.
*/
URL _opEndpoint;
/**
* The claimed identifier, i.e. the user's identity key.
*/
Identifier _claimedIdentifier;
/**
* The delegate, or OP-Local identifier.
* The key through which the OP remembers the user's account.
*/
String _delegate;
/**
* The OpenID protocol version, or target service type discovered through Yadis.
*/
String _version;
/**
* All service types discovered for the endpoint.
*/
Set _types;
public final static String OPENID10 = "http://openid.net/signon/1.0";
public final static String OPENID11 = "http://openid.net/signon/1.1";
public final static String OPENID2 = "http://specs.openid.net/auth/2.0/signon";
public final static String OPENID2_OP = "http://specs.openid.net/auth/2.0/server";
public final static String OPENID2_RP = "http://specs.openid.net/auth/2.0/return_to";
public static final Set OPENID1_SIGNON_TYPES = new HashSet() {{
add(DiscoveryInformation.OPENID10);
add(DiscoveryInformation.OPENID11);
}};
public static final Set OPENID_SIGNON_TYPES = new HashSet() {{
addAll(DiscoveryInformation.OPENID1_SIGNON_TYPES);
add(DiscoveryInformation.OPENID2);
}};
public static final Set OPENID_OP_TYPES = new HashSet() {{
addAll(OPENID_SIGNON_TYPES);
add(DiscoveryInformation.OPENID2_OP);
}};
public static final Set OPENID_TYPES = new HashSet() {{
addAll(OPENID_OP_TYPES);
add(DiscoveryInformation.OPENID2_RP);
}};
public static boolean isOpenIDType(String type)
{
return OPENID_TYPES.contains(type);
}
public DiscoveryInformation(URL opEndpoint) throws DiscoveryException
{
this(opEndpoint, null, OPENID2_OP);
}
public DiscoveryInformation(URL opEndpoint, Identifier claimedIdentifier)
throws DiscoveryException
{
this(opEndpoint, claimedIdentifier, OPENID2);
}
public DiscoveryInformation(URL opEndpoint, Identifier claimedIdentifier,
String version)
throws DiscoveryException
{
this(opEndpoint, claimedIdentifier, null, version);
}
public DiscoveryInformation(URL opEndpoint, Identifier claimedIdentifier,
String delegate, String version)
throws DiscoveryException
{
this(opEndpoint, claimedIdentifier, delegate, version, null);
}
public DiscoveryInformation(URL opEndpoint, Identifier claimedIdentifier,
String delegate, String version, Set types)
throws DiscoveryException
{
if (opEndpoint == null)
throw new DiscoveryException("Null OpenID Provider endpoint.");
_opEndpoint = opEndpoint;
_claimedIdentifier = claimedIdentifier;
_delegate = delegate;
_version = version;
_types = types;
}
public boolean hasClaimedIdentifier()
{
return _claimedIdentifier != null;
}
public boolean hasDelegateIdentifier()
{
return _delegate != null;
}
public URL getOPEndpoint()
{
return _opEndpoint;
}
public Identifier getClaimedIdentifier()
{
return _claimedIdentifier;
}
public String getDelegateIdentifier()
{
return _delegate;
}
public String getVersion()
{
return _version;
}
public void setVersion(String version)
{
this._version = version;
}
public boolean isVersion2()
{
return OPENID2.equals(_version) || OPENID2_OP.equals(_version);
}
public Set getTypes()
{
return _types;
}
public void setTypes(Set types)
{
this._types = types;
}
public boolean hasType(String type)
{
return _types != null && _types.contains(type);
}
public String toString()
{
return (isVersion2() ? "OpenID2" : "OpenID1")
+ "\nOP-endpoint:" + _opEndpoint
+ "\nClaimedID:" + _claimedIdentifier
+ "\nDelegate:" + _delegate;
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/UrlIdentifier.java 0000644 0015012 0015012 00000011316 11034531516 024766 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import java.net.*;
import java.util.Set;
import java.util.HashSet;
import java.io.UnsupportedEncodingException;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class UrlIdentifier implements Identifier
{
private static Log _log = LogFactory.getLog(UrlIdentifier.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private static final Set UNRESERVED_CHARACTERS = new HashSet();
static
{
for (char c = 'a'; c <= 'z'; c++)
UNRESERVED_CHARACTERS.add(new Character(c));
for (char c = 'A'; c <= 'Z'; c++)
UNRESERVED_CHARACTERS.add(new Character(c));
for (char c = '0'; c <= '9'; c++)
UNRESERVED_CHARACTERS.add(new Character(c));
UNRESERVED_CHARACTERS.add(new Character('-'));
UNRESERVED_CHARACTERS.add(new Character('.'));
UNRESERVED_CHARACTERS.add(new Character('_'));
UNRESERVED_CHARACTERS.add(new Character('~'));
}
private URL _urlIdentifier;
public UrlIdentifier(String identifier) throws DiscoveryException
{
this(identifier, false);
}
public UrlIdentifier(String identifier, boolean removeFragment)
throws DiscoveryException
{
_urlIdentifier = normalize(identifier, removeFragment);
}
public boolean equals(Object o)
{
if (this == o)
return true;
if (o == null || getClass() != o.getClass())
return false;
final UrlIdentifier that = (UrlIdentifier) o;
return _urlIdentifier.equals(that._urlIdentifier);
}
public int hashCode()
{
return _urlIdentifier.hashCode();
}
public String getIdentifier()
{
return _urlIdentifier.toExternalForm();
}
public String toString()
{
return _urlIdentifier.toExternalForm();
}
public URL getUrl()
{
return _urlIdentifier;
}
public static URL normalize(String text) throws DiscoveryException
{
return normalize(text, false);
}
public static URL normalize(String text, boolean removeFragment)
throws DiscoveryException
{
try
{
URI uri = new URI(text);
URL url = uri.normalize().toURL();
String protocol = url.getProtocol().toLowerCase();
String host = url.getHost().toLowerCase();
int port = url.getPort();
String path = normalizeUrlEncoding(url.getPath());
String query = normalizeUrlEncoding(url.getQuery());
String fragment = normalizeUrlEncoding(url.getRef());
if (port == url.getDefaultPort())
port = -1;
// start building the 'file' part for the URL constructor...
String file = path;
if ("".equals(file))
file = "/";
if (query != null)
file = file + "?" + query;
if (fragment != null && ! removeFragment)
file = file + "#" + fragment;
URL normalized = new URL(protocol, host, port, file);
if (DEBUG) _log.debug("Normalized: " + text + " to: " + normalized);
return normalized;
}
catch (MalformedURLException e)
{
throw new DiscoveryException("Invalid URL identifier", e);
}
catch (URISyntaxException e)
{
throw new DiscoveryException("Invalid URL identifier", e);
}
}
private static String normalizeUrlEncoding(String text)
{
if (text == null)
return null;
int len = text.length();
StringBuffer normalized = new StringBuffer(len);
for (int i = 0; i < len; i++)
{
char current = text.charAt(i);
if (current == '%' && i < len - 2)
{
String percentCode = text.substring(i, i + 3).toUpperCase();
try
{
String str = URLDecoder.decode(percentCode, "ISO-8859-1");
char chr = str.charAt(0);
if (UNRESERVED_CHARACTERS.contains(new Character(chr)))
normalized.append(chr);
else
normalized.append(percentCode);
}
catch (UnsupportedEncodingException e)
{
normalized.append(percentCode);
}
i += 2;
}
else
{
normalized.append(current);
}
}
return normalized.toString();
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/xri/ 0000755 0015012 0015012 00000000000 11627733442 022170 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/discovery/xri/XriDotNetProxyResolver.java 0000644 0015012 0015012 00000011240 11352263621 027465 0 ustar miguel miguel package org.openid4java.discovery.xri;
import com.google.inject.Inject;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.http.HttpStatus;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.discovery.XriIdentifier;
import org.openid4java.discovery.xrds.XrdsParser;
import org.openid4java.discovery.xrds.XrdsServiceEndpoint;
import org.openid4java.util.HttpCache;
import org.openid4java.util.HttpFetcher;
import org.openid4java.util.HttpFetcherFactory;
import org.openid4java.util.HttpRequestOptions;
import org.openid4java.util.HttpResponse;
import org.openid4java.util.OpenID4JavaUtils;
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
import java.util.Set;
/**
* @author jbufu
*/
public class XriDotNetProxyResolver implements XriResolver
{
private static Log _log = LogFactory.getLog(XriDotNetProxyResolver.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private final HttpFetcher _httpFetcher;
private final static String PROXY_URL = "https://xri.net/";
private static final String XRDS_QUERY = "_xrd_r=application/xrds+xml";
private static final String XRDS_PARSER_CLASS_NAME_KEY = "discovery.xrds.parser";
private static final XrdsParser XRDS_PARSER;
static {
String className = OpenID4JavaUtils.getProperty(XRDS_PARSER_CLASS_NAME_KEY);
if (DEBUG) _log.debug(XRDS_PARSER_CLASS_NAME_KEY + ":" + className);
try
{
XRDS_PARSER = (XrdsParser) Class.forName(className).newInstance();
}
catch (Exception e)
{
throw new RuntimeException(e);
}
}
/**
* Constructor for Guice installations. The default implementation
* of the {@link HttpFetcherFactory} returns {@link HttpCache}s.
*/
@Inject
public XriDotNetProxyResolver(HttpFetcherFactory httpFetcherfactory) {
_httpFetcher = httpFetcherfactory.createFetcher(
HttpRequestOptions.getDefaultOptionsForDiscovery());
}
/**
* Public constructor for non-guice installations. In this case,
* we use the {@link HttpCache}-creating {@link HttpFetcherFactory}.
*/
public XriDotNetProxyResolver()
{
this(new HttpFetcherFactory());
}
public List discover(XriIdentifier xri) throws DiscoveryException
{
String hxri = PROXY_URL + xri.getIdentifier() + "?" + XRDS_QUERY;
_log.info("Performing discovery on HXRI: " + hxri);
try
{
HttpResponse resp = _httpFetcher.get(hxri);
if (resp == null || HttpStatus.SC_OK != resp.getStatusCode())
throw new DiscoveryException("Error retrieving HXRI: " + hxri);
Set targetTypes = DiscoveryInformation.OPENID_OP_TYPES;
List endpoints = XRDS_PARSER.parseXrds(resp.getBody(), targetTypes);
List results = new ArrayList();
Iterator endpointIter = endpoints.iterator();
while (endpointIter.hasNext())
{
XrdsServiceEndpoint endpoint = (XrdsServiceEndpoint) endpointIter.next();
Iterator typesIter = endpoint.getTypes().iterator();
while (typesIter.hasNext()) {
String type = (String) typesIter.next();
if (!targetTypes.contains(type)) continue;
try {
results.add(new DiscoveryInformation(
new URL(endpoint.getUri()),
parseIdentifier(endpoint.getCanonicalId()),
DiscoveryInformation.OPENID2.equals(type) ? endpoint.getLocalId() :
DiscoveryInformation.OPENID1_SIGNON_TYPES.contains(type) ? endpoint.getDelegate() : null,
type));
} catch (MalformedURLException e) {
throw new DiscoveryException("Invalid endpoint URL discovered: " + endpoint.getUri());
}
}
}
return results;
}
catch (IOException e)
{
throw new DiscoveryException("Error performing discovery on HXRI: " + hxri);
}
}
public XriIdentifier parseIdentifier(String identifier) throws DiscoveryException
{
// todo: http://code.google.com/p/openid4java/issues/detail?id=63
_log.warn("Creating XRI identifier with the friendly XRI identifier as the IRI/URI normal forms.");
return new XriIdentifier(identifier, identifier, identifier);
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/xri/LocalXriResolver.java 0000644 0015012 0015012 00000021425 11215306470 026264 0 ustar miguel miguel package org.openid4java.discovery.xri;
import java.net.MalformedURLException;
import java.net.URL;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.discovery.Identifier;
import org.openid4java.discovery.XriIdentifier;
import org.openxri.XRI;
import org.openxri.resolve.Resolver;
import org.openxri.resolve.ResolverFlags;
import org.openxri.resolve.ResolverState;
import org.openxri.resolve.exception.PartialResolutionException;
import org.openxri.xml.CanonicalID;
import org.openxri.xml.SEPUri;
import org.openxri.xml.Service;
import org.openxri.xml.Status;
import org.openxri.xml.XRD;
import org.openxri.xml.XRDS;
public class LocalXriResolver implements XriResolver
{
private static Log _log = LogFactory.getLog(LocalXriResolver.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private Resolver _openXriResolver;
public LocalXriResolver()
{
if (DEBUG) _log.debug("Initializing local XRI resolver...");
try {
_openXriResolver = new Resolver(null);
} catch (Exception e) {
throw new RuntimeException("Cannot initialize OpenXRI Resolver: " + e.getMessage(), e);
}
}
public Resolver getResolver() {
return _openXriResolver;
}
public List discover(XriIdentifier xri) throws DiscoveryException
{
try
{
ResolverFlags flags = new ResolverFlags();
flags.setCid(true);
flags.setRefs(true);
ResolverState state = new ResolverState();
XRDS xrds = _openXriResolver.resolveAuthToXRDS(
new XRI(xri.getIdentifier()), flags, state);
if (DEBUG) _log.debug("Retrieved XRDS:\n" + xrds.dump());
XRD xrd = xrds.getFinalXRD();
if (! xrd.getStatus().getCID().equals(Status.CID_VERIFIED))
{
_log.error("Unverified CanonicalID: " + xrd.getCanonicalID() + " of: " + xri.getIdentifier());
throw new RuntimeException("Unverified CanonicalID: " + xrd.getCanonicalID() + " of: " + xri.getIdentifier());
}
CanonicalID canonical = xrd.getCanonicalID();
if (canonical == null) throw new RuntimeException("Missing CanonicalID of: " + xri.getIdentifier());
_log.info("XRI resolution succeeded on " + xri.toString());
return extractDiscoveryInformation(xrds, xri, _openXriResolver);
}
catch (Exception e)
{
throw new DiscoveryException(
"Cannot resolve XRI: " + xri, e);
}
}
public XriIdentifier parseIdentifier(String identifier) throws DiscoveryException {
XRI xri = new XRI(identifier);
return new XriIdentifier(identifier, xri.toIRINormalForm(), xri.toURINormalForm());
}
// --- XRI discovery patch from William Tan ---
/**
* Extracts OpenID discovery endpoints from a XRDS discovery result
* for XRI identifiers.
*
* @param xrds The discovered XRDS document.
* @param identifier The identifier on which discovery was performed.
* @param xriResolver The XRI resolver to use for extraction of OpenID
* service endpoints.
* @return A list of DiscoveryInformation endpoints.
* @throws DiscoveryException when invalid information is discovered.
*/
protected List extractDiscoveryInformation(XRDS xrds,
XriIdentifier identifier,
Resolver xriResolver)
throws DiscoveryException
{
ArrayList endpoints = new ArrayList();
XRD xrd = xrds.getFinalXRD();
// try OP Identifier
extractDiscoveryInformationOpenID(
xriResolver,
endpoints,
xrd,
identifier,
DiscoveryInformation.OPENID2_OP,
false // no CID
);
// OpenID 2 signon
extractDiscoveryInformationOpenID(
xriResolver,
endpoints,
xrd,
identifier,
DiscoveryInformation.OPENID2, // sepType
true // want CID
);
// OpenID 1.x
extractDiscoveryInformationOpenID(
xriResolver,
endpoints,
xrd,
identifier,
DiscoveryInformation.OPENID11,
true // wantCID
);
extractDiscoveryInformationOpenID(
xriResolver,
endpoints,
xrd,
identifier,
DiscoveryInformation.OPENID10,
true // wantCID
);
if (endpoints.size() == 0)
_log.info("No OpenID service types found in the XRDS.");
return endpoints;
}
protected boolean extractDiscoveryInformationOpenID(
Resolver xriResolver, ArrayList out, XRD baseXRD,
XriIdentifier identifier, String srvType, boolean wantCID)
{
try
{
ResolverFlags flags = new ResolverFlags();
flags.setCid(true);
flags.setRefs(true);
flags.setNoDefaultT(srvType != null); // we don't want default SEPs, only ones that really have the service type we are looking for
ResolverState state = new ResolverState();
List services = xriResolver.selectServiceFromXRD(
new XRDS(),
baseXRD,
new XRI(identifier.getIdentifier()),
srvType,
null, // sepMediaType
flags,
state
);
Identifier claimedIdentifier = null;
URL opEndpointUrl;
CanonicalID canonID;
if (! baseXRD.getStatus().getCID().equals(Status.CID_VERIFIED)) {
_log.error("Unverified CanonicalID: " + baseXRD.getCanonicalID() + " of:" + identifier.getIdentifier());
return false;
}
if (wantCID)
{
canonID = baseXRD.getCanonicalID();
if (canonID == null) {
_log.error("No CanonicalID found for " + srvType +
" after XRI resolution of: "
+ identifier.getIdentifier());
return false;
}
claimedIdentifier = parseIdentifier(canonID.getValue());
_log.info("Using canonicalID as claimedID: " +
claimedIdentifier.getIdentifier() +
" for " + srvType);
}
Iterator it = services.iterator();
while (it.hasNext())
{
Service srv = (Service)it.next();
Iterator itURI = srv.getPrioritizedURIs().iterator();
SEPUri sepURI;
while (itURI.hasNext())
{
sepURI = (SEPUri) itURI.next();
try
{
String urlString = xriResolver.constructURI(
sepURI.getURI(),
sepURI.getAppend(),
new XRI(identifier.toString()));
opEndpointUrl = new URL(urlString);
DiscoveryInformation extracted =
new DiscoveryInformation(
opEndpointUrl,
wantCID ? claimedIdentifier : null,
null,
srvType);
_log.info("Added " + srvType +
" endpoint: " + opEndpointUrl);
out.add(extracted);
}
catch (MalformedURLException mue)
{
_log.warn("Ignoring malformed OP endpoint URL in XRDS file: "
+ sepURI.toString(), mue);
}
catch (IllegalArgumentException ee)
{
_log.warn("Ignoring invalid OP endpoint URL in XRDS file: "
+ sepURI.toString(), ee);
}
}
}
return true;
}
catch (PartialResolutionException e)
{
_log.error("XRI resolution failed for " + srvType, e);
}
catch (DiscoveryException de)
{
_log.error("XRDS discovery failed for " + srvType, de);
}
return false;
}
// --- end XRI discovery patch from William Tan ---
}
openid4java-0.9.6.662/src/org/openid4java/discovery/xri/XriResolver.java 0000644 0015012 0015012 00000001401 11352263621 025303 0 ustar miguel miguel package org.openid4java.discovery.xri;
import com.google.inject.ImplementedBy;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.discovery.XriIdentifier;
import org.openid4java.discovery.Identifier;
import java.util.List;
@ImplementedBy(XriDotNetProxyResolver.class)
public interface XriResolver
{
/**
* Performs OpenID discovery on the supplied XRI identifier.
*
* @param xri The XRI identifier
* @return A list of DiscoveryInformation, ordered the discovered
* priority.
* @throws DiscoveryException if discovery failed.
*/
public List discover(XriIdentifier xri) throws DiscoveryException;
XriIdentifier parseIdentifier(String identifier) throws DiscoveryException;
}
openid4java-0.9.6.662/src/org/openid4java/discovery/html/ 0000755 0015012 0015012 00000000000 11627733442 022332 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/discovery/html/CyberNekoDOMHtmlParser.java 0000644 0015012 0015012 00000012755 11140116773 027422 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery.html;
import java.util.Arrays;
import java.util.List;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.html.dom.HTMLDocumentImpl;
import org.openid4java.OpenIDException;
import org.openid4java.util.OpenID4JavaDOMParser;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.discovery.html.HtmlParser;
import org.openid4java.discovery.html.HtmlResult;
import org.w3c.dom.NodeList;
import org.w3c.dom.html.HTMLHeadElement;
import org.w3c.dom.html.HTMLLinkElement;
/**
* A {@link HtmlParser} implementation using the DOMParser of CyberNeko HTML.
*
* @author Sutra Zhou
* @since 0.9.4
* @see org.openid4java.util.OpenID4JavaDOMParser
*/
public class CyberNekoDOMHtmlParser implements HtmlParser
{
private static final Log _log = LogFactory.getLog(CyberNekoDOMHtmlParser.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/*
* (non-Javadoc)
*
* @see org.openid4java.discovery.html.HtmlParser#parse(java.lang.String,
* org.openid4java.discovery.html.HtmlResult)
*/
public void parseHtml(String htmlData, HtmlResult result)
throws DiscoveryException
{
if (DEBUG)
_log.debug("Parsing HTML data:\n" + htmlData);
HTMLDocumentImpl doc = this.parseDocument(htmlData);
NodeList heads = doc.getElementsByTagName("head");
if (heads.getLength() != 1)
throw new DiscoveryException(
"HTML response must have exactly one HEAD element, "
+ "found " + heads.getLength() + " : "
+ heads.toString(),
OpenIDException.DISCOVERY_HTML_PARSE_ERROR);
HTMLHeadElement head = (HTMLHeadElement) doc.getHead();
NodeList linkElements = head.getElementsByTagName("LINK");
for (int i = 0, len = linkElements.getLength(); i < len; i++)
{
HTMLLinkElement linkElement = (HTMLLinkElement) linkElements.item(i);
setResult(linkElement.getRel(), linkElement.getHref(), result);
}
if (DEBUG)
_log.debug("HTML discovery result:\n" + result);
}
private HTMLDocumentImpl parseDocument(String htmlData) throws DiscoveryException
{
OpenID4JavaDOMParser parser = new OpenID4JavaDOMParser();
try
{
parser.parse(OpenID4JavaDOMParser.createInputSource(htmlData));
}
catch (Exception e)
{
throw new DiscoveryException("Error parsing HTML message",
OpenIDException.DISCOVERY_HTML_PARSE_ERROR, e);
}
if (parser.isIgnoredHeadStartElement())
{
throw new DiscoveryException(
"HTML response must have exactly one HEAD element.",
OpenIDException.DISCOVERY_HTML_PARSE_ERROR);
}
return (HTMLDocumentImpl) parser.getDocument();
}
/**
* Set the result from rel and href that
* parsed from node link.
*
* @param rel
* the rel
* @param href
* the href
* @param result
* the result to set
* @throws DiscoveryException
* if the value has been setted yet, that is to say, find more
* than one entries with the same name(attribute value of
* rel).
*/
private void setResult(String rel, String href, HtmlResult result)
throws DiscoveryException
{
List relations = Arrays.asList(rel.split(" "));
// openid.server
if (relations.contains("openid.server"))
{
if (result.getOP1Endpoint() != null)
throw new DiscoveryException(
"More than one openid.server entries found",
OpenIDException.DISCOVERY_HTML_PARSE_ERROR);
if (DEBUG)
_log.debug("Found OpenID1 endpoint: " + href);
result.setEndpoint1(href);
}
// openid.delegate
if (relations.contains("openid.delegate"))
{
if (result.getDelegate1() != null)
throw new DiscoveryException(
"More than one openid.delegate entries found",
OpenIDException.DISCOVERY_HTML_PARSE_ERROR);
if (DEBUG)
_log.debug("Found OpenID1 delegate: " + href);
result.setDelegate1(href);
}
// openid2.provider
if (relations.contains("openid2.provider"))
{
if (result.getOP2Endpoint() != null)
throw new DiscoveryException(
"More than one openid.server entries found",
OpenIDException.DISCOVERY_HTML_PARSE_ERROR);
if (DEBUG)
_log.debug("Found OpenID2 endpoint: " + href);
result.setEndpoint2(href);
}
// openid2.local_id
if (relations.contains("openid2.local_id"))
{
if (result.getDelegate2() != null)
throw new DiscoveryException(
"More than one openid2.local_id entries found",
OpenIDException.DISCOVERY_HTML_PARSE_ERROR);
if (DEBUG)
_log.debug("Found OpenID2 localID: " + href);
result.setDelegate2(href);
}
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/html/HtmlResult.java 0000644 0015012 0015012 00000005155 11034531515 025273 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery.html;
import org.openid4java.discovery.UrlIdentifier;
import org.openid4java.discovery.DiscoveryException;
import java.net.URL;
import java.net.MalformedURLException;
/**
* Holds information obtained by performing HTML discovery on an URL.
*/
public class HtmlResult
{
private UrlIdentifier _claimedId;
private URL _op1Endpoint;
private String _delegate1;
private URL _op2Endpoint;
private String _delegate2;
/**
* Constructs an empty HtmlResult object.
*/
public HtmlResult()
{
}
/**
* Sets the claimed identifier.
*/
public void setClaimed(UrlIdentifier claimed)
{
_claimedId = claimed;
}
/**
* Gets the claimed identifier.
*/
public UrlIdentifier getClaimedId()
{
return _claimedId;
}
public void setEndpoint1(String op1Endpoint) throws DiscoveryException
{
URL url;
try
{
url = new URL(op1Endpoint);
_op1Endpoint = url;
}
catch (MalformedURLException e)
{
throw new DiscoveryException(
"Invalid openid.server URL: " + op1Endpoint);
}
}
public URL getOP1Endpoint()
{
return _op1Endpoint;
}
public void setDelegate1(String delegate1)
{
_delegate1 = delegate1;
}
public String getDelegate1()
{
return _delegate1;
}
public void setEndpoint2(String op2Endpoint) throws DiscoveryException
{
URL url;
try
{
url = new URL(op2Endpoint);
_op2Endpoint = url;
} catch (MalformedURLException e)
{
throw new DiscoveryException(
"Invalid openid2.provider URL: " + op2Endpoint);
}
}
public URL getOP2Endpoint()
{
return _op2Endpoint;
}
public void setDelegate2(String delegate2)
{
_delegate2 = delegate2;
}
public String getDelegate2()
{
return _delegate2;
}
public String toString()
{
return "ClaimedID:" + _claimedId +
(_op2Endpoint != null ?
"\nOpenID2-endpoint:" + _op2Endpoint.toString() : "") +
(_delegate2 != null ?
"\nOpenID2-localID:" + _delegate2 : "") +
(_op1Endpoint != null ?
"\nOpenID1-endpoint:" + _op1Endpoint.toString() : "") +
(_delegate1 != null ?
"\nOpenID1-delegate:" + _delegate1 : "");
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/html/HtmlParser.java 0000644 0015012 0015012 00000001231 11102646027 025241 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery.html;
import org.openid4java.discovery.DiscoveryException;
/**
* Html parser.
*
* @author Sutra Zhou
* @since 0.9.4
* @see #parseHtml(String, HtmlResult)
*/
public interface HtmlParser
{
/**
* Parses the HTML data and stores in the result the discovered openid
* information.
*
* @param htmlData
* HTML data obtained from the URL identifier.
* @param result
* The HTML result.
* @throws DiscoveryException
*/
void parseHtml(String htmlData, HtmlResult result) throws DiscoveryException;
}
openid4java-0.9.6.662/src/org/openid4java/discovery/html/HtmlResolver.java 0000644 0015012 0015012 00000013644 11517704450 025626 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery.html;
import com.google.inject.Inject;
import org.apache.http.HttpStatus;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import java.io.IOException;
import java.util.List;
import java.util.ArrayList;
import org.openid4java.discovery.UrlIdentifier;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.util.HttpCache;
import org.openid4java.util.HttpFetcher;
import org.openid4java.util.HttpFetcherFactory;
import org.openid4java.util.HttpResponse;
import org.openid4java.util.HttpRequestOptions;
import org.openid4java.util.OpenID4JavaUtils;
import org.openid4java.OpenIDException;
/**
* @author Marius Scurtescu, Johnny Bufu, Sutra Zhou
*/
public class HtmlResolver
{
private static Log _log = LogFactory.getLog(HtmlResolver.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private static final String HTML_PARSER_CLASS_NAME_KEY = "discovery.html.parser";
private static final HtmlParser HTML_PARSER;
private final HttpFetcher _httpFetcher;
static {
String className = OpenID4JavaUtils.getProperty(HTML_PARSER_CLASS_NAME_KEY);
if (DEBUG) _log.debug(HTML_PARSER_CLASS_NAME_KEY + ":" + className);
try
{
HTML_PARSER = (HtmlParser) Class.forName(className).newInstance();
}
catch (Exception e)
{
throw new RuntimeException(e);
}
}
@Inject
public HtmlResolver(HttpFetcherFactory httpFetcherFactory)
{
_httpFetcher = httpFetcherFactory.createFetcher(
HttpRequestOptions.getDefaultOptionsForDiscovery());
}
/**
* Maximum number of redirects to be followed for the HTTP calls.
*/
private int _maxRedirects = 10;
/**
* Gets the internal limit configured for the maximum number of redirects
* to be followed for the HTTP calls.
*/
public int getMaxRedirects()
{
return _maxRedirects;
}
/**
* Sets the maximum number of redirects to be followed for the HTTP calls.
*/
public void setMaxRedirects(int maxRedirects)
{
this._maxRedirects = maxRedirects;
}
/**
* Performs HTML discovery on the supplied URL identifier.
*
* @param identifier The URL identifier.
* @return List of DiscoveryInformation entries discovered
* obtained from the URL Identifier.
*/
public List discoverHtml(UrlIdentifier identifier)
throws DiscoveryException {
return discoverHtml(identifier, _httpFetcher);
}
/**
* Performs HTML discovery on the supplied URL identifier.
*
* @param identifier The URL identifier.
* @param httpFetcher {@link HttpFetcher} object to use for placing the call.
* @return List of DiscoveryInformation entries discovered
* obtained from the URL Identifier.
*/
public List discoverHtml(UrlIdentifier identifier, HttpFetcher httpFetcher)
throws DiscoveryException
{
// initialize the results of the HTML discovery
HtmlResult result = new HtmlResult();
HttpRequestOptions requestOptions = httpFetcher.getRequestOptions();
requestOptions.setContentType("text/html");
try
{
HttpResponse resp = httpFetcher.get(identifier.toString(), requestOptions);
if (HttpStatus.SC_OK != resp.getStatusCode())
throw new DiscoveryException( "GET failed on " +
identifier.toString() +
" Received status code: " + resp.getStatusCode(),
OpenIDException.DISCOVERY_HTML_GET_ERROR);
result.setClaimed( new UrlIdentifier(resp.getFinalUri()) );
if (resp.getBody() == null)
throw new DiscoveryException(
"No HTML data read from " + identifier.toString(),
OpenIDException.DISCOVERY_HTML_NODATA_ERROR);
HTML_PARSER.parseHtml(resp.getBody(), result);
}
catch (IOException e)
{
throw new DiscoveryException("Fatal transport error: ",
OpenIDException.DISCOVERY_HTML_GET_ERROR, e);
}
_log.info("HTML discovery completed on: " + identifier);
return extractDiscoveryInformation(result);
}
/**
* Extracts OpenID discovery endpoints from a HTML discovery result.
*
* @param htmlResult HTML discovery result.
* @return List of DiscoveryInformation endpoints.
* @throws DiscoveryException when invalid information is discovered.
*/
private List extractDiscoveryInformation(HtmlResult htmlResult)
throws DiscoveryException
{
ArrayList htmlList = new ArrayList();
if (htmlResult.getOP2Endpoint() != null)
{
DiscoveryInformation extracted = new DiscoveryInformation(
htmlResult.getOP2Endpoint(),
htmlResult.getClaimedId(),
htmlResult.getDelegate2(),
DiscoveryInformation.OPENID2);
if (DEBUG)
_log.debug("OpenID2-signon HTML discovery endpoint: " + extracted);
htmlList.add(extracted);
}
if (htmlResult.getOP1Endpoint() != null)
{
DiscoveryInformation extracted = new DiscoveryInformation(
htmlResult.getOP1Endpoint(),
htmlResult.getClaimedId(),
htmlResult.getDelegate1(),
DiscoveryInformation.OPENID11);
if (DEBUG)
_log.debug("OpenID1-signon HTML discovery endpoint: " + extracted);
htmlList.add(extracted);
}
return htmlList;
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/yadis/ 0000755 0015012 0015012 00000000000 11627733442 022477 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/discovery/yadis/YadisException.java 0000644 0015012 0015012 00000001543 11034531516 026263 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery.yadis;
import org.openid4java.discovery.DiscoveryException;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class YadisException extends DiscoveryException
{
public YadisException(String message)
{
super(message, YADIS_ERROR);
}
public YadisException(String message, int code)
{
super(message, code);
}
public YadisException(Throwable cause)
{
super(YADIS_ERROR, cause);
}
public YadisException(int code, Throwable cause)
{
super(code, cause);
}
public YadisException(String message, Throwable cause)
{
super(message, YADIS_ERROR, cause);
}
public YadisException(String message, int code, Throwable cause)
{
super(message, code, cause);
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/yadis/YadisUrl.java 0000644 0015012 0015012 00000006624 11102646027 025074 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery.yadis;
import java.net.URL;
import java.net.MalformedURLException;
import org.openid4java.OpenIDException;
import org.openid4java.discovery.XriIdentifier;
/**
* Wrapper class for various identifiers that are resolvable to URLs
* and can be used as YadisURLs with the Yadis protocol.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class YadisUrl
{
/**
* A YadisURL is a regular URL, with a couple restrictions.
*/
private URL _yadisUrl;
/**
* Constructs a URL object from a string;
* needed by the YadisURL(String) constructor
*
* @param urlString URL-type identifier in string format
* @return URL object
* @throws YadisException if the provided string is not a valid URL
*/
private static URL urlFromString(String urlString) throws YadisException
{
URL url;
try
{
url = new URL(urlString);
}
catch (MalformedURLException e)
{
throw new YadisException("Invalid URL: " + urlString,
OpenIDException.YADIS_INVALID_URL, e);
}
return url;
}
/**
* Contructs a YadisURL from a string;
* assumes the string to be a URL-type identifier
*
* @param urlString URL-type identifier in string format
* @throws YadisException if the provided string cannot be a YadisUrl
*/
public YadisUrl(String urlString) throws YadisException
{
this(urlFromString(urlString));
if (! isValid(this._yadisUrl))
throw new YadisException(
"The scheme name of a Yadis URL must be 'http' or 'https'",
OpenIDException.YADIS_INVALID_SCHEME);
}
/**
* Constructs a YadisURL from a URL object;
* insures the schema is HTTP or HTTPS
*
* @param urlId URL identifier
* @throws YadisException tf the URL identifier is not a valid YadisURL
*/
public YadisUrl(URL urlId) throws YadisException
{
if (isValid(urlId))
_yadisUrl = urlId;
else
throw new YadisException(
"The scheme name of a Yadis URL must be 'http' or 'https'",
OpenIDException.YADIS_INVALID_SCHEME);
}
/**
* Validates a URL against the requirements for a YadisUrl.
*
* The URL must be absolute (the schema must be specified),
* and the schema must be HTTP or HTTPS.
*
* @param url the URL to be validated
* @return true if the URL is a valid YadisUrl,
* or false otherwise
*/
private boolean isValid(URL url)
{
return url.getProtocol().equalsIgnoreCase("http") ||
url.getProtocol().equalsIgnoreCase("https");
}
/**
* Constructs a YadisURL from an XRI identifier.
*
* @param xriId The XRI identifier
*/
public YadisUrl(XriIdentifier xriId) throws YadisException
{
this(urlFromString(xriId.toURINormalForm()));
}
/**
* Gets the URL to be used in Yadis transactions.
*/
public URL getUrl()
{
return _yadisUrl;
}
/**
* Gets a string representation of the YadisURL.
*/
public String toString()
{
return _yadisUrl.toString();
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/yadis/YadisResult.java 0000644 0015012 0015012 00000020260 11200624345 025576 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery.yadis;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.discovery.UrlIdentifier;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.discovery.xrds.XrdsServiceEndpoint;
import org.openid4java.OpenIDException;
import java.net.URL;
import java.net.MalformedURLException;
import java.util.*;
/**
* The results of Yadis discovery performed on a YadisURL,
* represented through a stripped-down XRDS model,
* containing only the those discovery information pieces
* that are relevant for OpenID.
*
* The payload is represented by the XRDS document. Along with it other
* meta-information is contained, which can be useful while consuming
* the results of Yadis discoveries.
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class YadisResult
{
private static Log _log = LogFactory.getLog(YadisResult.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/**
* XRDS endpoints obtained by performing Yadis discovery on the YadisURL.
*/
private List _endpoints;
/**
* The content-type of the XRDS response.
*/
private String _contentType;
/**
* The YadisURL on which discovery was performed.
*/
private YadisUrl _yadisUrl;
/**
* The result of following redirects from the request_uri
*/
private String _normalizedUrl;
/**
* The URL from where the XRDS document was retrieved.
*/
private URL _xrdsLocation;
/**
* The throwable or exception that caused the failure, if available.
*/
private Throwable _failureCause;
/**
* Sets the YadisURL on which discovery will be performed.
*/
public void setYadisUrl(YadisUrl url)
{
_yadisUrl = url;
}
/**
* Gets the YadisUrl on which discovery is to be performed.
*/
public YadisUrl getYadisUrl()
{
return _yadisUrl;
}
/**
* Sets the Yadis Resource Descriptor (XRDS) location
* found during discovery.
*
* The XRDS location can be the same as the YadisUrl, or different if
* redirects are followed during discovery, or if delegation is used.
*
* @param xrdsLocation The Resource Descriptor URL
* from where the XRDS is downloaded
* @param onFailError The error code which will be set in the result
* if the XRDS location is not valid
*/
public void setXrdsLocation(String xrdsLocation, int onFailError)
throws YadisException
{
URL xrdsUrl = null;
boolean validXrdsUrl = true;
try
{
xrdsUrl = new URL(xrdsLocation);
}
catch (MalformedURLException e)
{
validXrdsUrl = false;
}
// perform the required checks on the discovered URL
if (xrdsUrl == null || ! validXrdsUrl ||
( ! xrdsUrl.getProtocol().equals("http") &&
! xrdsUrl.getProtocol().equals("https")) )
throw new YadisException("A Yadis Resource Descriptor URL" +
" MUST be an absolute URL and " +
"it must be HTTP or HTTPS; found: " + xrdsLocation,
onFailError);
if (DEBUG)
_log.debug("Setting X-XRDS-Location for yadis result: " + xrdsLocation);
_xrdsLocation = xrdsUrl;
}
/**
* Gets the Yadis Resource Descriptor (XRDS) location
*/
public URL getXrdsLocation()
{
return _xrdsLocation;
}
/**
* Sets the OpenID XRDS endpoints discovered from an identifier.
*/
public void setEndpoints(List endpoints)
{
_endpoints = endpoints;
}
/**
* Gets the OpenID XRDS endpoints discovered from an identifier.
*/
public List getEndpoints()
{
return _endpoints;
}
public int getEndpointCount()
{
return _endpoints == null ? 0 : _endpoints.size();
}
public List getDiscoveredInformation(Set targetTypes) throws DiscoveryException
{
List result = new ArrayList();
if (hasEndpoints())
{
XrdsServiceEndpoint endpoint;
Iterator endpointsIter = _endpoints.iterator();
while (endpointsIter.hasNext()) {
endpoint = (XrdsServiceEndpoint) endpointsIter.next();
Iterator typesIter = endpoint.getTypes().iterator();
while (typesIter.hasNext()) {
String type = (String) typesIter.next();
if (!targetTypes.contains(type)) continue;
try {
result.add(new DiscoveryInformation(
new URL(endpoint.getUri()),
DiscoveryInformation.OPENID_SIGNON_TYPES.contains(type) ?
new UrlIdentifier(_normalizedUrl) : null,
DiscoveryInformation.OPENID2.equals(type) ? endpoint.getLocalId() :
DiscoveryInformation.OPENID1_SIGNON_TYPES.contains(type) ? endpoint.getDelegate() : null,
type,
endpoint.getTypes()));
} catch (MalformedURLException e) {
throw new YadisException("Invalid endpoint URL discovered: " + endpoint.getUri(), OpenIDException.YADIS_INVALID_URL);
}
}
}
}
return result;
}
/**
* @return true if the YadisResult has at least one XRDS endpoint,
* false otherwise.
*/
public boolean hasEndpoints()
{
return _endpoints != null && ! _endpoints.isEmpty();
}
/**
* Gets the result of following redirects on the YadisURL
*/
public String getNormalizedUrl()
{
return _normalizedUrl;
}
/**
* Sets the result of following redirects on the YadisURL
*/
public void setNormalizedUrl(String _normalizedUrl)
{
this._normalizedUrl = _normalizedUrl;
}
/**
* Sets the content-type of the response from which the XRDS was extracted.
*
* @param type The content-type of the HTTP response
* that contained the XRDS document
*/
public void setContentType(String type)
{
_contentType = type;
}
/**
* Gets the content-type of the response from which the XRDS was extracted.
*
* @return The content-type of the HTTP response
* that contained the XRDS document
*/
public String getContentType()
{
return _contentType;
}
/**
* Sets the throwable or exception that caused the failure of the Yadis
* discovery, if one was thrown and intercepted
*/
public void setFailureCause(Throwable e)
{
this._failureCause = e;
}
/**
* Gets the throwable (or exception) that caused the failure of the Yadis
* discovery, if one was thrown and intercepted
*/
public Throwable getFailureCause()
{
return _failureCause;
}
public String dump()
{
StringBuffer dump = new StringBuffer();
dump.append("YadisURL:").append(_yadisUrl);
dump.append("\nNormalizedURL:").append(_normalizedUrl);
dump.append("\nX-XRDS-Location:").append(_xrdsLocation);
dump.append("\nContent-type:").append(_contentType);
if (_endpoints != null)
{
dump.append("\nXRDS:");
XrdsServiceEndpoint endpoint;
Iterator iter = _endpoints.iterator();
while(iter.hasNext())
{
endpoint = (XrdsServiceEndpoint) iter.next();
dump.append("\n\tType: ").append(endpoint.getTypes().toArray());
dump.append("\n\tServicePriority: ").append(endpoint.getServicePriority());
dump.append("\n\tUriPriority: ").append(endpoint.getUriPriority());
dump.append("\n\tURI: ").append(endpoint.getUri());
}
}
return dump.toString();
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/yadis/YadisHtmlParser.java 0000644 0015012 0015012 00000001203 11130536343 026377 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery.yadis;
/**
* Yadis parser.
*
* @author Sutra Zhou
* @since 0.9.4
* @see #getHtmlMeta(String)
*/
public interface YadisHtmlParser
{
/**
* Parses the HTML input stream and scans for the Yadis XRDS location in the
* HTML HEAD Meta tags.
*
* @param input
* input data stream
* @return String the XRDS location URL, or null if not found
* @throws YadisException
* on parsing errors or Yadis protocal violations
*/
String getHtmlMeta(String input) throws YadisException;
}
openid4java-0.9.6.662/src/org/openid4java/discovery/yadis/CyberNekoDOMYadisHtmlParser.java 0000644 0015012 0015012 00000010325 11155267317 030557 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery.yadis;
import javax.xml.transform.TransformerException;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.html.dom.HTMLDocumentImpl;
import org.openid4java.OpenIDException;
import org.openid4java.util.OpenID4JavaDOMParser;
import org.openid4java.discovery.yadis.YadisException;
import org.openid4java.discovery.yadis.YadisHtmlParser;
import org.openid4java.discovery.yadis.YadisResolver;
import org.w3c.dom.NodeList;
import org.w3c.dom.html.HTMLHeadElement;
import org.w3c.dom.html.HTMLMetaElement;
/**
* A {@link org.openid4java.discovery.yadis.YadisHtmlParser} implementation using the DOMParser of CyberNeko HTML.
*
* @author Sutra Zhou
* @since 0.9.4
* @see org.openid4java.util.OpenID4JavaDOMParser
*/
public class CyberNekoDOMYadisHtmlParser implements YadisHtmlParser
{
private static final Log _log = LogFactory.getLog(CyberNekoDOMYadisHtmlParser.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/*
* (non-Javadoc)
*
* @see org.openid4java.discovery.yadis.YadisParser#getHtmlMeta(java.lang.String)
*/
public String getHtmlMeta(String input) throws YadisException
{
String xrdsLocation = null;
HTMLDocumentImpl doc = this.parseDocument(input);
if (DEBUG)
{
try
{
_log.debug("document:\n" + OpenID4JavaDOMParser.toXmlString(doc));
} catch (TransformerException e)
{
_log.debug("An exception occurs while transforming the document to string in debugging.", e);
}
}
NodeList heads = doc.getElementsByTagName("head");
if (heads.getLength() != 1)
throw new YadisException(
"HTML response must have exactly one HEAD element, "
+ "found " + heads.getLength() + " : "
+ heads.toString(),
OpenIDException.YADIS_HTMLMETA_INVALID_RESPONSE);
HTMLHeadElement head = (HTMLHeadElement) doc.getHead();
NodeList metaElements = head.getElementsByTagName("META");
if (metaElements == null || metaElements.getLength() == 0)
{
if (DEBUG)
_log.debug("No element found under
. " +
"See Yadis specification, section 6.2.5/1.");
}
else
{
for (int i = 0, len = metaElements.getLength(); i < len; i++)
{
HTMLMetaElement metaElement = (HTMLMetaElement) metaElements.item(i);
String httpEquiv = metaElement.getHttpEquiv();
if (YadisResolver.YADIS_XRDS_LOCATION.equalsIgnoreCase(httpEquiv))
{
if (xrdsLocation != null)
throw new YadisException(
"More than one "
+ YadisResolver.YADIS_XRDS_LOCATION
+ "META tags found in HEAD: "
+ head.toString(),
OpenIDException.YADIS_HTMLMETA_INVALID_RESPONSE);
xrdsLocation = metaElement.getContent();
if (DEBUG)
_log.debug("Found " + YadisResolver.YADIS_XRDS_LOCATION
+ " META tags.");
}
}
}
return xrdsLocation;
}
private HTMLDocumentImpl parseDocument(String htmlData) throws YadisException
{
OpenID4JavaDOMParser parser = new OpenID4JavaDOMParser();
try
{
parser.parse(OpenID4JavaDOMParser.createInputSource(htmlData));
}
catch (Exception e)
{
throw new YadisException("Error parsing HTML message",
OpenIDException.YADIS_HTMLMETA_INVALID_RESPONSE, e);
}
if (parser.isIgnoredHeadStartElement())
{
throw new YadisException("HTML response must have exactly one HEAD element.",
OpenIDException.YADIS_HTMLMETA_INVALID_RESPONSE);
}
return (HTMLDocumentImpl) parser.getDocument();
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/yadis/YadisResolver.java 0000644 0015012 0015012 00000044743 11504002767 026142 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery.yadis;
import com.google.inject.Inject;
import org.apache.http.HttpException;
import org.apache.http.HttpStatus;
import org.apache.http.Header;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.http.client.ClientProtocolException;
import java.io.IOException;
import java.util.Set;
import java.util.Collections;
import java.util.List;
import org.openid4java.OpenIDException;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.discovery.xrds.XrdsParser;
import org.openid4java.util.HttpCache;
import org.openid4java.util.HttpFetcher;
import org.openid4java.util.HttpFetcherFactory;
import org.openid4java.util.HttpRequestOptions;
import org.openid4java.util.HttpResponse;
import org.openid4java.util.OpenID4JavaUtils;
/**
* Yadis discovery protocol implementation.
*
* Yadis discovery protocol returns a Yadis Resource Descriptor (XRDS) document
* associated with a Yadis Identifier (YadisID)
*
* YadisIDs can be any type of identifiers that are resolvable to a URL form,
* and in addition the URL form uses a HTTP or a HTTPS schema. Such an URL
* is defined by the Yadis speficification as a YadisURL. This functionality
* is implemented by the YadisURL helper class.
*
* The discovery of the XRDS document is performed by the discover method
* on a YadisUrl.
*
* Internal parameters used during the discovery process :
*
*
max redirects (default 10): maximum number of redirects to be followed
* for YadisURL
*
*
* @author Marius Scurtescu, Johnny Bufu, Sutra Zhou
*/
public class YadisResolver
{
private static Log _log = LogFactory.getLog(YadisResolver.class);
private static final boolean DEBUG = _log.isDebugEnabled();
// Yadis constants
public static final String YADIS_XRDS_LOCATION = "X-XRDS-Location";
private static final String YADIS_CONTENT_TYPE = "application/xrds+xml";
private static final String YADIS_ACCEPT_HEADER =
"text/html; q=0.3, application/xhtml+xml; q=0.5, " +
YADIS_CONTENT_TYPE;
private static final String YADIS_HTML_PARSER_CLASS_NAME_KEY = "discovery.yadis.html.parser";
private static final YadisHtmlParser YADIS_HTML_PARSER;
private static final String XRDS_PARSER_CLASS_NAME_KEY = "discovery.xrds.parser";
private static final XrdsParser XRDS_PARSER;
static {
String className = OpenID4JavaUtils.getProperty(YADIS_HTML_PARSER_CLASS_NAME_KEY);
if (DEBUG) _log.debug(YADIS_HTML_PARSER_CLASS_NAME_KEY + ":" + className);
try
{
YADIS_HTML_PARSER = (YadisHtmlParser) Class.forName(className).newInstance();
}
catch (Exception e)
{
throw new RuntimeException(e);
}
className = OpenID4JavaUtils.getProperty(XRDS_PARSER_CLASS_NAME_KEY);
if (DEBUG) _log.debug(XRDS_PARSER_CLASS_NAME_KEY + ":" + className);
try
{
XRDS_PARSER = (XrdsParser) Class.forName(className).newInstance();
}
catch (Exception e)
{
throw new RuntimeException(e);
}
}
/**
* Maximum number of redirects to be followed for the HTTP calls.
* Defalut 10.
*/
private int _maxRedirects = 10;
private final HttpFetcher _httpFetcher;
/**
* Gets the internal limit configured for the maximum number of redirects
* to be followed for the HTTP calls.
*/
public int getMaxRedirects()
{
return _maxRedirects;
}
/**
* Sets the maximum number of redirects to be followed for the HTTP calls.
*/
public void setMaxRedirects(int maxRedirects)
{
this._maxRedirects = maxRedirects;
}
@Inject
public YadisResolver(HttpFetcherFactory httpFetcherFactory)
{
this(httpFetcherFactory.createFetcher(
HttpRequestOptions.getDefaultOptionsForDiscovery()));
}
public YadisResolver(HttpFetcher httpFetcher)
{
_httpFetcher = httpFetcher;
}
/**
* Performs Relyin Party discovery on the supplied URL.
*
* @param url RP's realm or return_to URL
* @return List of DiscoveryInformation entries discovered
* from the RP's endpoints
*/
public List discoverRP(String url) throws DiscoveryException
{
return discover(url, 0,
Collections.singleton(DiscoveryInformation.OPENID2_RP))
.getDiscoveredInformation(Collections.singleton(DiscoveryInformation.OPENID2_RP));
}
/**
* Performs Yadis discovery on the YadisURL.
*
*
*
tries to retrieve the XRDS location via a HEAD call on the Yadis URL
*
retrieves the XRDS document with a GET on the above if available,
* or through a GET on the YadisURL otherwise
*
*
* The maximum number of redirects that are followed is determined by the
* #_maxRedirects member field.
*
* @param url YadisURL on which discovery will be performed
* @return List of DiscoveryInformation entries discovered
* obtained from the URL Identifier.
* @see YadisResult #discover(String, int, HttpCache)
*/
public List discover(String url) throws DiscoveryException
{
return discover(url, _maxRedirects, _httpFetcher);
}
/**
* Performs Yadis discovery on the YadisURL.
*
*
*
tries to retrieve the XRDS location via a HEAD call on the Yadis URL
*
retrieves the XRDS document with a GET on the above if available,
* or through a GET on the YadisURL otherwise
*
*
* The maximum number of redirects that are followed is determined by the
* #_maxRedirects member field.
*
* @param url YadisURL on which discovery will be performed
* @param httpFetcher {@link HttpFetcher} object to use for the call
* @return List of DiscoveryInformation entries discovered
* obtained from the URL Identifier.
* @see YadisResult #discover(String, int, HttpCache)
*/
public List discover(String url, HttpFetcher httpFetcher) throws DiscoveryException
{
return discover(url, _maxRedirects, httpFetcher);
}
/**
* Performs Yadis discovery on the YadisURL.
*
*
*
tries to retrieve the XRDS location via a HEAD call on the Yadis URL
*
retrieves the XRDS document with a GET on the above if available,
* or through a GET on the YadisURL otherwise
*
*
* @param url YadisURL on which discovery will be performed
* @param maxRedirects The maximum number of redirects to be followed.
* @return List of DiscoveryInformation entries discovered
* obtained from the URL Identifier.
* @see YadisResult
*/
public List discover(String url, int maxRedirects)
throws DiscoveryException
{
return discover(url, maxRedirects, _httpFetcher);
}
/**
* Performs Yadis discovery on the YadisURL.
*
*
*
tries to retrieve the XRDS location via a HEAD call on the Yadis URL
*
retrieves the XRDS document with a GET on the above if available,
* or through a GET on the YadisURL otherwise
*
*
* @param url YadisURL on which discovery will be performed
* @param maxRedirects The maximum number of redirects to be followed.
* @param httpFetcher {@link HttpFetcher} object to use for the call.
* @return List of DiscoveryInformation entries discovered
* obtained from the URL Identifier.
* @see YadisResult
*/
public List discover(String url, int maxRedirects, HttpFetcher httpFetcher)
throws DiscoveryException
{
return discover(url, maxRedirects, httpFetcher, DiscoveryInformation.OPENID_OP_TYPES)
.getDiscoveredInformation(DiscoveryInformation.OPENID_OP_TYPES);
}
public YadisResult discover(String url, int maxRedirects, Set serviceTypes)
throws DiscoveryException
{
return discover(url, maxRedirects, _httpFetcher, serviceTypes);
}
public YadisResult discover(String url, int maxRedirects, HttpFetcher httpFetcher, Set serviceTypes)
throws DiscoveryException
{
YadisUrl yadisUrl = new YadisUrl(url);
// try to retrieve the Yadis Descriptor URL with a HEAD call first
YadisResult result = retrieveXrdsLocation(yadisUrl, false, maxRedirects, serviceTypes);
// try GET
if (result.getXrdsLocation() == null)
result = retrieveXrdsLocation(yadisUrl, true, maxRedirects, serviceTypes);
if (result.getXrdsLocation() != null)
{
retrieveXrdsDocument(result, maxRedirects, serviceTypes);
}
else if (result.hasEndpoints())
{
// report the yadis url as the xrds location
result.setXrdsLocation(url, OpenIDException.YADIS_INVALID_URL);
}
_log.info("Yadis discovered " + result.getEndpointCount() + " endpoints from: " + url);
return result;
}
/**
* Tries to retrieve the XRDS document via a GET call on XRDS location
* provided in the result parameter.
*
* @param result The YadisResult object containing a valid XRDS location.
* It will be further populated with the Yadis discovery results.
* @param cache The HttpClient object to use for placing the call
* @param maxRedirects
*/
private void retrieveXrdsDocument(YadisResult result, int maxRedirects, Set serviceTypes)
throws DiscoveryException {
_httpFetcher.getRequestOptions().setMaxRedirects(maxRedirects);
try {
HttpResponse resp = _httpFetcher.get(result.getXrdsLocation().toString());
if (resp == null || HttpStatus.SC_OK != resp.getStatusCode())
throw new YadisException("GET failed on " + result.getXrdsLocation(),
OpenIDException.YADIS_GET_ERROR);
// update xrds location, in case redirects were followed
result.setXrdsLocation(resp.getFinalUri(), OpenIDException.YADIS_GET_INVALID_RESPONSE);
Header contentType = resp.getResponseHeader("content-type");
if ( contentType != null && contentType.getValue() != null)
result.setContentType(contentType.getValue());
if (resp.isBodySizeExceeded())
throw new YadisException(
"More than " + _httpFetcher.getRequestOptions().getMaxBodySize() +
" bytes in HTTP response body from " + result.getXrdsLocation(),
OpenIDException.YADIS_XRDS_SIZE_EXCEEDED);
result.setEndpoints(XRDS_PARSER.parseXrds(resp.getBody(), serviceTypes));
} catch (IOException e) {
throw new YadisException("Fatal transport error: " + e.getMessage(),
OpenIDException.YADIS_GET_TRANSPORT_ERROR, e);
}
}
/**
* Parses the HTML input stream and scans for the Yadis XRDS location
* in the HTML HEAD Meta tags.
*
* @param input input data stream
* @return String the XRDS location URL, or null if not found
* @throws YadisException on parsing errors or Yadis protocal violations
*/
private String getHtmlMeta(String input) throws YadisException
{
String xrdsLocation;
if (input == null)
throw new YadisException("Cannot download HTML message",
OpenIDException.YADIS_HTMLMETA_DOWNLOAD_ERROR);
xrdsLocation = YADIS_HTML_PARSER.getHtmlMeta(input);
if (DEBUG)
{
_log.debug("input:\n" + input);
_log.debug("xrdsLocation: " + xrdsLocation);
}
return xrdsLocation;
}
/**
* Tries to retrieve the XRDS location url by performing a cheap HEAD call
* on the YadisURL.
*
* The returned string should be validated before being used
* as a XRDS-Location URL.
*
* @param cache HttpClient object to use for placing the call
* @param maxRedirects
* @param url The YadisURL
* @param result The location of the XRDS document and the normalized
* Url will be returned in the YadisResult object.
*
* The location of the XRDS document will be null if:
*
*
the returned status code is different than SC_OK
*
the Yadis header is not present
*
there was an HTTP-level error
* (allows fallback to GET + HTML response)
*
* @throws YadisException if:
*
*
there's a (lower level) transport error
*
there are more than one Yadis headers present
*
*/
private YadisResult retrieveXrdsLocation(
YadisUrl url, boolean useGet, int maxRedirects, Set serviceTypes)
throws DiscoveryException
{
int maxattempts = 1;
/***
* Need to try GET twice in some cases, because some major RPs do a redirect
* when Accept header is set to YADIS_ACCEPT_HEADER
* So, we need to retry with Accept header YADIS_CONTENT_TYPE
*/
if (useGet) maxattempts = 2;
YadisResult result = new YadisResult();
for (int attempt = 1; attempt <= maxattempts; attempt++)
{
try
{
result.setYadisUrl(url);
if (DEBUG) _log.debug(
"Performing HTTP " + (useGet ? "GET" : "HEAD") +
" on: " + url + " ...");
HttpRequestOptions requestOptions = _httpFetcher.getRequestOptions();
requestOptions.setMaxRedirects(maxRedirects);
if (useGet)
{
if (attempt == 1)
requestOptions.addRequestHeader("Accept", YADIS_ACCEPT_HEADER);
else
requestOptions.addRequestHeader("Accept", YADIS_CONTENT_TYPE);
}
HttpResponse resp = useGet ?
_httpFetcher.get(url.getUrl().toString(), requestOptions) :
_httpFetcher.head(url.getUrl().toString(), requestOptions);
Header[] locationHeaders = resp.getResponseHeaders(YADIS_XRDS_LOCATION);
Header contentType = resp.getResponseHeader("content-type");
if (HttpStatus.SC_OK != resp.getStatusCode())
{
// won't be able to recover from a GET error, throw
if (useGet)
throw new YadisException("GET failed on " + url + " : " +
resp.getStatusCode(), OpenIDException.YADIS_GET_ERROR);
// HEAD is optional, will fall-back to GET
if (DEBUG)
_log.debug("Cannot retrieve " + YADIS_XRDS_LOCATION +
" using HEAD from " + url.getUrl().toString() +
"; status=" + resp.getStatusCode());
}
else if ((locationHeaders != null && locationHeaders.length > 1))
{
// fail if there are more than one YADIS_XRDS_LOCATION headers
throw new YadisException("Found " + locationHeaders.length +
" " + YADIS_XRDS_LOCATION + " headers.",
useGet ? OpenIDException.YADIS_GET_INVALID_RESPONSE :
OpenIDException.YADIS_HEAD_INVALID_RESPONSE);
}
else if (locationHeaders != null && locationHeaders.length > 0)
{
// we have exactly one xrds location header
result.setXrdsLocation(locationHeaders[0].getValue(),
useGet ? OpenIDException.YADIS_GET_INVALID_RESPONSE :
OpenIDException.YADIS_HEAD_INVALID_RESPONSE);
result.setNormalizedUrl(resp.getFinalUri());
}
else if (contentType != null && contentType.getValue() != null &&
contentType.getValue().split(";")[0].equalsIgnoreCase(YADIS_CONTENT_TYPE) &&
resp.getBody() != null)
{
// no location, but got xrds document
result.setNormalizedUrl(resp.getFinalUri());
result.setContentType(contentType.getValue());
if (resp.isBodySizeExceeded())
throw new YadisException(
"More than " + requestOptions.getMaxBodySize() +
" bytes in HTTP response body from " + url,
OpenIDException.YADIS_XRDS_SIZE_EXCEEDED);
result.setEndpoints(XRDS_PARSER.parseXrds(resp.getBody(), serviceTypes));
}
else if (resp.getBody() != null)
{
// fall-back to html-meta, if present
String xrdsLocation = getHtmlMeta(resp.getBody());
if (xrdsLocation != null)
{
result.setNormalizedUrl(resp.getFinalUri());
result.setXrdsLocation(xrdsLocation,
OpenIDException.YADIS_GET_INVALID_RESPONSE);
}
}
return result;
}
catch (ClientProtocolException e)
{
if (useGet && attempt == 2)
throw new YadisException("ClientProtocol error: " + e.getMessage(),
OpenIDException.YADIS_HEAD_TRANSPORT_ERROR, e);
else if (useGet && attempt == 1)
continue;
return result;
}
catch (IOException e)
{
throw new YadisException("I/O transport error: " + e.getMessage(),
OpenIDException.YADIS_HEAD_TRANSPORT_ERROR, e);
}
}
return result;
}
/* visible for testing */
public HttpFetcher getHttpFetcher()
{
return _httpFetcher;
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/Identifier.java 0000644 0015012 0015012 00000000404 11034531516 024277 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery;
import java.io.Serializable;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public interface Identifier extends Serializable
{
public String getIdentifier();
}
openid4java-0.9.6.662/src/org/openid4java/discovery/XriIdentifier.java 0000644 0015012 0015012 00000002444 11140116773 024772 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class XriIdentifier implements Identifier
{
private String identifier;
private String iriNormalForm;
private String uriNormalForm;
public XriIdentifier(String identifier, String iriNormalForm, String uriNormalForm) throws DiscoveryException
{
this.identifier = identifier;
this.iriNormalForm = iriNormalForm;
this.uriNormalForm = uriNormalForm;
}
public boolean equals(Object o)
{
if (this == o) return true;
if (o == null || getClass() != o.getClass()) return false;
XriIdentifier that = (XriIdentifier) o;
if (iriNormalForm != null ? !iriNormalForm.equals(that.iriNormalForm) : that.iriNormalForm != null)
return false;
return true;
}
public int hashCode()
{
return (iriNormalForm != null ? iriNormalForm.hashCode() : 0);
}
public String getIdentifier()
{
return identifier;
}
public String toString()
{
return identifier;
}
public String toIRINormalForm()
{
return iriNormalForm;
}
public String toURINormalForm()
{
return uriNormalForm;
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/Discovery.java 0000644 0015012 0015012 00000014002 11537353076 024176 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery;
import com.google.inject.Inject;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.discovery.html.HtmlResolver;
import org.openid4java.discovery.xri.XriResolver;
import org.openid4java.discovery.yadis.YadisResolver;
import org.openid4java.util.HttpFetcherFactory;
import org.openid4java.util.OpenID4JavaUtils;
import java.util.List;
import java.util.regex.Pattern;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class Discovery
{
private static Log _log = LogFactory.getLog(Discovery.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private static final Pattern URL_PATTERN =
Pattern.compile("^https?://", Pattern.CASE_INSENSITIVE);
private static final Pattern XRI_PATTERN =
Pattern.compile("^[!=@\\$\\+\\(]", Pattern.CASE_INSENSITIVE);
private HtmlResolver _htmlResolver;
private YadisResolver _yadisResolver;
private XriResolver _xriResolver;
private static final String XRI_RESOLVER_CLASS_NAME_KEY = "discovery.xri.resolver";
public static XriResolver getXriResolver()
{
String className = OpenID4JavaUtils.getProperty(XRI_RESOLVER_CLASS_NAME_KEY);
if (DEBUG) _log.debug(XRI_RESOLVER_CLASS_NAME_KEY + ":" + className);
try {
return (XriResolver) Class.forName(className).newInstance();
} catch (Exception e) {
throw new RuntimeException("Error initializing XRI resolver.", e);
}
}
@Inject
public Discovery(HtmlResolver htmlResolver, YadisResolver yadisResolver,
XriResolver xriResolver)
{
_htmlResolver = htmlResolver;
_yadisResolver = yadisResolver;
_xriResolver = xriResolver;
}
public Discovery()
{
this(
new HtmlResolver(new HttpFetcherFactory()),
new YadisResolver(new HttpFetcherFactory()),
getXriResolver());
}
public void setXriResolver(XriResolver xriResolver)
{
_xriResolver = xriResolver;
}
public void setYadisResolver(YadisResolver yadisResolver)
{
_yadisResolver = yadisResolver;
}
public void setHtmlResolver(HtmlResolver htmlResolver)
{
_htmlResolver = htmlResolver;
}
public Identifier parseIdentifier(String identifier)
throws DiscoveryException
{
return parseIdentifier(identifier, false);
}
public Identifier parseIdentifier(String identifier,
boolean removeFragment)
throws DiscoveryException
{
try
{
// strip the xri:// prefix if it exists
if (identifier.toLowerCase().startsWith("xri://"))
{
if (DEBUG) _log.debug("Dropping xri:// prefix from identifier: "
+ identifier);
identifier = identifier.substring(6);
}
if (URL_PATTERN.matcher(identifier).find())
{
if (DEBUG) _log.debug("Creating URL identifier for: " + identifier);
return new UrlIdentifier(identifier, removeFragment);
}
else if (XRI_PATTERN.matcher(identifier).find())
{
if (DEBUG) _log.debug("Creating XRI identifier for: " + identifier);
return _xriResolver.parseIdentifier(identifier);
}
else
{
if (DEBUG) _log.debug("Creating URL identifier (http:// prepended) for: "
+ identifier);
return new UrlIdentifier("http://" + identifier, removeFragment);
}
}
catch (Exception e)
{
throw new DiscoveryException(
"Cannot parse identifier: " + identifier, e);
}
}
public List discover(String identifier)
throws DiscoveryException
{
return discover(parseIdentifier(identifier, true)); // remove fragment
}
public List discover(Identifier identifier) throws DiscoveryException
{
List result;
if (identifier instanceof XriIdentifier)
{
_log.info("Starting discovery on XRI identifier: " + identifier);
result = _xriResolver.discover((XriIdentifier) identifier);
}
else if (identifier instanceof UrlIdentifier)
{
_log.info("Starting discovery on URL identifier: " + identifier);
UrlIdentifier urlId = (UrlIdentifier) identifier;
result = _yadisResolver.discover(urlId.getIdentifier());
// fall-back to HTML discovery
if (result == null || result.size() == 0)
{
_log.info("No OpenID service endpoints discovered through Yadis;" +
" attempting HTML discovery...");
result = _htmlResolver.discoverHtml(urlId);
}
}
else
{
throw new DiscoveryException(
"Unknown identifier type: " + identifier.toString());
}
_log.info("Discovered " + result.size() + " OpenID endpoints.");
return result;
}
/**
* Performs discovery on the Relying Party's realm and returns a list of
* OpenID 2.0 DiscoveryInformation entries.
*
* Static method / caller must provide a YadisResolver so that
* the OP doesn't have to instantiate a Discovery object.
*
* @param realm RP's realm.
* @param yadisResolver The YadisResolver instance to be used for discovery.
* @return List of OpenID 2.0 DiscoveryInformation endpoints.
*/
public static List rpDiscovery(String realm, YadisResolver yadisResolver)
throws DiscoveryException
{
// don't follow redirects when doing RP discovery
return yadisResolver.discoverRP(realm);
}
/* visible for testing */
public YadisResolver getYadisResolver()
{
return _yadisResolver;
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/DiscoveryException.java 0000644 0015012 0015012 00000001565 11034531516 026054 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.discovery;
import org.openid4java.OpenIDException;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class DiscoveryException extends OpenIDException
{
public DiscoveryException(String message)
{
super(message, DISCOVERY_ERROR);
}
public DiscoveryException(String message, int code)
{
super(message, code);
}
public DiscoveryException(Throwable cause)
{
super(DISCOVERY_ERROR, cause);
}
public DiscoveryException(int code, Throwable cause)
{
super(code, cause);
}
public DiscoveryException(String message, Throwable cause)
{
super(message, DISCOVERY_ERROR, cause);
}
public DiscoveryException(String message, int code, Throwable cause)
{
super(message, code, cause);
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/xrds/ 0000755 0015012 0015012 00000000000 11627733442 022346 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/discovery/xrds/XrdsParser.java 0000644 0015012 0015012 00000001442 11140116773 025277 0 ustar miguel miguel package org.openid4java.discovery.xrds;
import org.openid4java.discovery.DiscoveryException;
import java.util.List;
import java.util.Set;
/**
* XRDS parser for OpenID.
*/
public interface XrdsParser
{
/**
* Parses a XRDS document and extracts the relevant information
* for the specified service endpoint types.
*
* @param xrdsInput the XRDS document in String format
* discovered from an Identifier.
* @param targetTypes Set of service endpoint types
* that should be matched
* @return a List of {@link XrdsServiceEndpoint}s
* extracted from the XRDS document,
* in the proper, sorted order
*/
public List parseXrds(String input, Set targetTypes) throws DiscoveryException;
}
openid4java-0.9.6.662/src/org/openid4java/discovery/xrds/XrdsParserImpl.java 0000644 0015012 0015012 00000021221 11200670447 026116 0 ustar miguel miguel package org.openid4java.discovery.xrds;
import org.openid4java.discovery.Discovery;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.OpenIDException;
import org.w3c.dom.Document;
import org.w3c.dom.NodeList;
import org.w3c.dom.Node;
import org.xml.sax.SAXException;
import org.xml.sax.ErrorHandler;
import org.xml.sax.SAXParseException;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import javax.xml.parsers.*;
import java.util.*;
import java.io.ByteArrayInputStream;
import java.io.IOException;
/**
* @author jbufu
*/
public class XrdsParserImpl implements XrdsParser
{
private static final Log _log = LogFactory.getLog(XrdsParserImpl.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private static final String W3C_XML_SCHEMA = "http://www.w3.org/2001/XMLSchema";
private static final String JAXP_SCHEMA_LANGUAGE = "http://java.sun.com/xml/jaxp/properties/schemaLanguage";
private static final String JAXP_SCHEMA_SOURCE = "http://java.sun.com/xml/jaxp/properties/schemaSource";
private static final String XRDS_SCHEMA = "xrds.xsd";
private static final String XRD_SCHEMA = "xrd.xsd";
private static final String XRD_NS = "xri://$xrd*($v*2.0)";
private static final String XRD_ELEM_XRD = "XRD";
private static final String XRD_ELEM_TYPE = "Type";
private static final String XRD_ELEM_URI = "URI";
private static final String XRD_ELEM_LOCALID = "LocalID";
private static final String XRD_ELEM_CANONICALID = "CanonicalID";
private static final String XRD_ATTR_PRIORITY = "priority";
private static final String OPENID_NS = "http://openid.net/xmlns/1.0";
private static final String OPENID_ELEM_DELEGATE = "Delegate";
public List parseXrds(String input, Set targetTypes) throws DiscoveryException
{
if (DEBUG)
_log.debug("Parsing XRDS input for service types: " + targetTypes.toString());
Document document = parseXmlInput(input);
NodeList XRDs = document.getElementsByTagNameNS(XRD_NS, XRD_ELEM_XRD);
Node lastXRD;
if (XRDs.getLength() < 1 || (lastXRD = XRDs.item(XRDs.getLength() - 1)) == null)
throw new DiscoveryException("No XRD elements found.");
// get the canonical ID, if any (needed for XRIs)
String canonicalId = null;
Node canonicalIdNode;
NodeList canonicalIDs = document.getElementsByTagNameNS(XRD_NS, XRD_ELEM_CANONICALID);
for (int i = 0; i < canonicalIDs.getLength(); i++) {
canonicalIdNode = canonicalIDs.item(i);
if (canonicalIdNode.getParentNode() != lastXRD) continue;
if (canonicalId != null)
throw new DiscoveryException("More than one Canonical ID found.");
canonicalId = canonicalIdNode.getFirstChild() != null && canonicalIdNode.getFirstChild().getNodeType() == Node.TEXT_NODE ?
canonicalIdNode.getFirstChild().getNodeValue() : null;
}
// extract the services that match the specified target types
NodeList types = document.getElementsByTagNameNS(XRD_NS, XRD_ELEM_TYPE);
Map serviceTypes = new HashMap();
Set selectedServices = new HashSet();
Node typeNode, serviceNode;
for (int i = 0; i < types.getLength(); i++) {
typeNode = types.item(i);
String type = typeNode != null && typeNode.getFirstChild() != null && typeNode.getFirstChild().getNodeType() == Node.TEXT_NODE ?
typeNode.getFirstChild().getNodeValue() : null;
if (type == null) continue;
serviceNode = typeNode.getParentNode();
if (serviceNode.getParentNode() != lastXRD) continue;
if (targetTypes.contains(type))
selectedServices.add(serviceNode);
addServiceType(serviceTypes, serviceNode, type);
}
if (DEBUG)
_log.debug("Found " + serviceTypes.size() + " services for the requested types.");
// extract local IDs
Map serviceLocalIDs = extractElementsByParent(XRD_NS, XRD_ELEM_LOCALID, selectedServices, document);
Map serviceDelegates = extractElementsByParent(OPENID_NS, OPENID_ELEM_DELEGATE, selectedServices, document);
// build XrdsServiceEndpoints for all URIs in the found services
List result = new ArrayList();
NodeList uris = document.getElementsByTagNameNS(XRD_NS, XRD_ELEM_URI);
Node uriNode;
for (int i = 0; i < uris.getLength(); i++) {
uriNode = uris.item(i);
if (uriNode == null || !selectedServices.contains(uriNode.getParentNode())) continue;
String uri = uriNode.getFirstChild() != null && uriNode.getFirstChild().getNodeType() == Node.TEXT_NODE ?
uriNode.getFirstChild().getNodeValue() : null;
serviceNode = uriNode.getParentNode();
Set typeSet = (Set) serviceTypes.get(serviceNode);
String localId = (String) serviceLocalIDs.get(serviceNode);
String delegate = (String) serviceDelegates.get(serviceNode);
XrdsServiceEndpoint endpoint = new XrdsServiceEndpoint(uri, typeSet, getPriority(serviceNode), getPriority(uriNode), localId, delegate, canonicalId);
if (DEBUG)
_log.debug("Discovered endpoint: \n" + endpoint);
result.add(endpoint);
}
Collections.sort(result);
return result;
}
private Map extractElementsByParent(String ns, String elem, Set parents, Document document)
{
Map result = new HashMap();
NodeList nodes = document.getElementsByTagNameNS(ns, elem);
Node node;
for (int i = 0; i < nodes.getLength(); i++) {
node = nodes.item(i);
if (node == null || !parents.contains(node.getParentNode())) continue;
String localId = node.getFirstChild() != null && node.getFirstChild().getNodeType() == Node.TEXT_NODE ?
node.getFirstChild().getNodeValue() : null;
result.put(node.getParentNode(), localId);
}
return result;
}
private int getPriority(Node node)
{
if (node.hasAttributes())
{
Node priority = node.getAttributes().getNamedItem(XRD_ATTR_PRIORITY);
if (priority != null)
return Integer.parseInt(priority.getNodeValue());
else
return XrdsServiceEndpoint.LOWEST_PRIORITY;
}
return 0;
}
private Document parseXmlInput(String input) throws DiscoveryException
{
if (input == null)
throw new DiscoveryException("Cannot read XML message",
OpenIDException.XRDS_DOWNLOAD_ERROR);
if (DEBUG)
_log.debug("Parsing XRDS input: " + input);
try
{
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
dbf.setValidating(true);
dbf.setAttribute(JAXP_SCHEMA_LANGUAGE, W3C_XML_SCHEMA);
dbf.setAttribute(JAXP_SCHEMA_SOURCE, new Object[] {
Discovery.class.getResourceAsStream(XRD_SCHEMA),
Discovery.class.getResourceAsStream(XRDS_SCHEMA),
});
DocumentBuilder builder = dbf.newDocumentBuilder();
builder.setErrorHandler(new ErrorHandler() {
public void error(SAXParseException exception) throws SAXException {
throw exception;
}
public void fatalError(SAXParseException exception) throws SAXException {
throw exception;
}
public void warning(SAXParseException exception) throws SAXException {
throw exception;
}
});
return builder.parse(new ByteArrayInputStream(input.getBytes()));
}
catch (ParserConfigurationException e)
{
throw new DiscoveryException("Parser configuration error",
OpenIDException.XRDS_PARSING_ERROR, e);
}
catch (SAXException e)
{
throw new DiscoveryException("Error parsing XML document",
OpenIDException.XRDS_PARSING_ERROR, e);
}
catch (IOException e)
{
throw new DiscoveryException("Error reading XRDS document",
OpenIDException.XRDS_DOWNLOAD_ERROR, e);
}
}
private void addServiceType(Map serviceTypes, Node serviceNode, String type)
{
Set types = (Set) serviceTypes.get(serviceNode);
if (types == null)
{
types = new HashSet();
serviceTypes.put(serviceNode, types);
}
types.add(type);
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/xrds/XrdsServiceEndpoint.java 0000644 0015012 0015012 00000006763 11200670527 027156 0 ustar miguel miguel package org.openid4java.discovery.xrds;
import java.util.Set;
import java.util.Arrays;
/**
* Encapsulates the (OpenID-related) information extracted in
* service elements discovered through Yadis.
*
* Note: this class has a natural ordering that is inconsistent with equals.
* Only the URI priority and Service priority fields are used for comparison.
*
* @author jbufu
*/
public class XrdsServiceEndpoint implements Comparable {
private int servicePriority;
private int uriPriority;
private Set types;
private String uri;
private String localId;
private String delegate;
public static final int LOWEST_PRIORITY = -1;
private String canonicalId;
public XrdsServiceEndpoint(String uri, Set types,
int servicePriority, int uriPriority, String localId, String delegate, String canonicalId)
{
this.servicePriority = servicePriority;
this.uriPriority = uriPriority;
this.types = types;
this.uri = uri;
this.localId = localId;
this.delegate = delegate;
this.canonicalId = canonicalId;
}
public int getServicePriority() {
return servicePriority;
}
public void setServicePriority(int servicePriority) {
this.servicePriority = servicePriority;
}
public int getUriPriority() {
return uriPriority;
}
public void setUriPriority(int uriPriority) {
this.uriPriority = uriPriority;
}
public Set getTypes() {
return types;
}
public void setTypes(Set types) {
this.types = types;
}
public boolean matchesType(String type)
{
return types != null && types.contains(type);
}
public String getUri() {
return uri;
}
public void setUri(String uri) {
this.uri = uri;
}
public String getLocalId() {
return localId;
}
public void setLocalId(String localId) {
this.localId = localId;
}
public String getDelegate() {
return delegate;
}
public void setDelegate(String delegate) {
this.delegate = delegate;
}
public String getCanonicalId() {
return canonicalId;
}
public void setCanonicalId(String canonicalId) {
this.canonicalId = canonicalId;
}
public int compareTo(Object o) {
XrdsServiceEndpoint other = (XrdsServiceEndpoint) o;
if (servicePriority == LOWEST_PRIORITY && other.servicePriority != LOWEST_PRIORITY)
return 1;
if (other.servicePriority == LOWEST_PRIORITY && servicePriority != LOWEST_PRIORITY)
return -1;
if (servicePriority < other.servicePriority) return -1;
if (servicePriority > other.servicePriority) return 1;
if (uriPriority == LOWEST_PRIORITY && other.uriPriority != LOWEST_PRIORITY)
return 1;
if (other.uriPriority == LOWEST_PRIORITY && uriPriority != LOWEST_PRIORITY)
return -1;
if (uriPriority < other.uriPriority) return -1;
if (uriPriority > other.uriPriority) return 1;
// XRI spec says the consumer should pick at random here
return 0;
}
public String toString() {
StringBuffer sb = new StringBuffer();
sb.append("Service priority: ").append(servicePriority);
sb.append("\nType: ").append(types.toString());
sb.append("\nURI: ").append(uri);
sb.append("\nURI Priority: ").append(uriPriority);
sb.append("\nLocalID: ").append(localId);
return sb.toString();
}
}
openid4java-0.9.6.662/src/org/openid4java/discovery/xrds.xsd 0000644 0015012 0015012 00000002263 11140116773 023061 0 ustar miguel miguel
openid4java-0.9.6.662/src/org/openid4java/discovery/xrd.xsd 0000644 0015012 0015012 00000017223 11140116773 022700 0 ustar miguel miguel
openid4java-0.9.6.662/src/org/openid4java/openid4java-default.properties 0000644 0015012 0015012 00000001274 11140116774 025320 0 ustar miguel miguel # HTML Parser for HtmlResolver of discovery - Must implement org.openid4java.discovery.html.HtmlPaser
discovery.html.parser=org.openid4java.discovery.html.CyberNekoDOMHtmlParser
# HTML Parser for YadisResolver of discovery - Must implement org.openid4java.discovery.yadis.YadisHtmlParser
discovery.yadis.html.parser=org.openid4java.discovery.yadis.CyberNekoDOMYadisHtmlParser
# XRDS Parser for YadisResolver of discovery - Must implement org.openid4java.discovery.yadis.YadisXrdsParser
discovery.xrds.parser=org.openid4java.discovery.xrds.XrdsParserImpl
discovery.xri.resolver=org.openid4java.discovery.xri.XriDotNetProxyResolver
#discovery.xri.resolver=org.openid4java.discovery.xri.LocalXriResolver openid4java-0.9.6.662/src/org/openid4java/server/ 0000755 0015012 0015012 00000000000 11627733442 020665 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/server/InMemoryServerAssociationStore.java 0000644 0015012 0015012 00000004770 11034531515 027665 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.server;
import org.openid4java.association.Association;
import org.openid4java.association.AssociationException;
import java.util.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class InMemoryServerAssociationStore implements ServerAssociationStore
{
private static Log _log = LogFactory.getLog(InMemoryServerAssociationStore.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private String _timestamp;
private int _counter;
private Map _handleMap;
public InMemoryServerAssociationStore()
{
_timestamp = Long.toString(new Date().getTime());
_counter = 0;
_handleMap = new HashMap();
}
public synchronized Association generate(String type, int expiryIn)
throws AssociationException
{
removeExpired();
String handle = _timestamp + "-" + _counter++;
Association association = Association.generate(type, handle, expiryIn);
_handleMap.put(handle, association);
if (DEBUG) _log.debug("Generated association, handle: " + handle +
" type: " + type +
" expires in: " + expiryIn + " seconds.");
return association;
}
public synchronized Association load(String handle)
{
removeExpired();
return (Association) _handleMap.get(handle);
}
public synchronized void remove(String handle)
{
if (DEBUG) _log.debug("Removing association, handle: " + handle);
_handleMap.remove(handle);
removeExpired();
}
private synchronized void removeExpired()
{
Set handleToRemove = new HashSet();
Iterator handles = _handleMap.keySet().iterator();
while (handles.hasNext())
{
String handle = (String) handles.next();
Association association = (Association) _handleMap.get(handle);
if (association.hasExpired())
handleToRemove.add(handle);
}
handles = handleToRemove.iterator();
while (handles.hasNext())
{
String handle = (String) handles.next();
if (DEBUG) _log.debug("Removing expired association, handle: " + handle);
_handleMap.remove(handle);
}
}
protected synchronized int size()
{
return _handleMap.size();
}
}
openid4java-0.9.6.662/src/org/openid4java/server/ServerManager.java 0000644 0015012 0015012 00000077047 11537353076 024311 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.server;
import com.google.inject.Inject;
import org.openid4java.message.*;
import org.openid4java.util.HttpCache;
import org.openid4java.util.HttpFetcherFactory;
import org.openid4java.association.AssociationSessionType;
import org.openid4java.association.AssociationException;
import org.openid4java.association.DiffieHellmanSession;
import org.openid4java.association.Association;
import org.openid4java.discovery.yadis.YadisResolver;
import org.openid4java.OpenIDException;
import java.net.URL;
import java.net.MalformedURLException;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Manages OpenID communications with an OpenID Relying Party (Consumer).
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class ServerManager
{
private static Log _log = LogFactory.getLog(ServerManager.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/**
* Keeps track of the associations established with consumer sites.
*/
private ServerAssociationStore _sharedAssociations = new InMemoryServerAssociationStore();
/**
* Keeps track of private (internal) associations created for signing
* authentication responses for stateless consumer sites.
*/
private ServerAssociationStore _privateAssociations = new InMemoryServerAssociationStore();
/**
* Nonce generator implementation.
*/
private NonceGenerator _nonceGenerator = new IncrementalNonceGenerator();
// --- association preferences ---
/**
* The lowest encryption level session accepted for association sessions
*/
private AssociationSessionType _minAssocSessEnc
= AssociationSessionType.NO_ENCRYPTION_SHA1MAC;
/**
* The preferred association session type; will be attempted first.
*/
private AssociationSessionType _prefAssocSessEnc
= AssociationSessionType.DH_SHA256;
/**
* Expiration time (in seconds) for associations.
*/
private int _expireIn = 1800;
// --- authentication preferences ---
/**
* In OpenID 1.x compatibility mode, the URL at the OpenID Provider where
* the user should be directed when a immediate authentication request
* fails.
*
* MUST be configured in order for the OpenID provider to be able to
* respond correctly with AuthImmediateFailure messages in compatibility
* mode.
*/
private String _userSetupUrl = null;
/**
* List of coma-separated fields to be signed in authentication responses.
*/
private String _signFields;
/**
* Array of extension namespace URIs that the consumer manager will sign,
* if present in auth responses.
*/
private String[] _signExtensions;
/**
* Used to perform verify realms against return_to URLs.
*/
private RealmVerifier _realmVerifier;
/**
* The OpenID Provider's endpoint URL, where it accepts OpenID
* authentication requests.
*
* This is a global setting for the ServerManager; can also be set on a
* per message basis.
*
* @see #authResponse(org.openid4java.message.ParameterList, String, String, boolean, String)
*/
private String _opEndpointUrl;
/**
* Gets the store implementation used for keeping track of the generated
* associations established with consumer sites.
*
* @see ServerAssociationStore
*/
public ServerAssociationStore getSharedAssociations()
{
return _sharedAssociations;
}
/**
* Sets the store implementation that will be used for keeping track of
* the generated associations established with consumer sites.
*
* @param sharedAssociations ServerAssociationStore implementation
* @see ServerAssociationStore
*/
public void setSharedAssociations(ServerAssociationStore sharedAssociations)
{
_sharedAssociations = sharedAssociations;
}
/**
* Gets the store implementation used for keeping track of the generated
* private associations (used for signing responses to stateless consumer
* sites).
*
* @see ServerAssociationStore
*/
public ServerAssociationStore getPrivateAssociations()
{
return _privateAssociations;
}
/**
* Sets the store implementation that will be used for keeping track of
* the generated private associations (used for signing responses to
* stateless consumer sites).
*
* @param privateAssociations ServerAssociationStore implementation
* @see ServerAssociationStore
*/
public void setPrivateAssociations(ServerAssociationStore privateAssociations)
{
_privateAssociations = privateAssociations;
}
/**
* Gets the minimum level of encryption configured for association sessions.
*
* Default: no-encryption session, SHA1 MAC association
*/
public AssociationSessionType getMinAssocSessEnc()
{
return _minAssocSessEnc;
}
/**
* Gets the NonceGenerator used for generating nonce tokens to uniquely
* identify authentication responses.
*
* @see NonceGenerator
*/
public NonceGenerator getNonceGenerator()
{
return _nonceGenerator;
}
/**
* Sets the NonceGenerator implementation that will be used to generate
* nonce tokens to uniquely identify authentication responses.
*
* @see NonceGenerator
*/
public void setNonceGenerator(NonceGenerator nonceGenerator)
{
_nonceGenerator = nonceGenerator;
}
/**
* Configures the minimum level of encryption accepted for association
* sessions.
*
* Default: no-encryption session, SHA1 MAC association
*/
public void setMinAssocSessEnc(AssociationSessionType minAssocSessEnc)
{
this._minAssocSessEnc = minAssocSessEnc;
}
/**
* Gets the preferred association / session type.
*/
public AssociationSessionType getPrefAssocSessEnc()
{
return _prefAssocSessEnc;
}
/**
* Sets the preferred association / session type.
*
* @see AssociationSessionType
*/
public void setPrefAssocSessEnc(AssociationSessionType type)
throws ServerException
{
if (! Association.isHmacSupported(type.getAssociationType()) ||
! DiffieHellmanSession.isDhSupported(type) )
throw new ServerException("Unsupported association / session type: "
+ type.getSessionType() + " : " + type.getAssociationType());
if (_minAssocSessEnc.isBetter(type) )
throw new ServerException(
"Minimum encryption settings cannot be better than the preferred");
this._prefAssocSessEnc = type;
}
/**
* Gets the expiration time (in seconds) for the generated associations
*/
public int getExpireIn()
{
return _expireIn;
}
/**
* Sets the expiration time (in seconds) for the generated associations
*/
public void setExpireIn(int _expireIn)
{
this._expireIn = _expireIn;
}
/**
* Gets the URL at the OpenID Provider where the user should be directed
* when a immediate authentication request fails.
*/
public String getUserSetupUrl()
{
return _userSetupUrl;
}
/**
* Sets the URL at the OpenID Provider where the user should be directed
* when a immediate authentication request fails.
*/
public void setUserSetupUrl(String userSetupUrl)
{
this._userSetupUrl = userSetupUrl;
}
/**
* Sets the list of parameters that the OpenID Provider will sign when
* generating authentication responses.
*
* The fields in the list must be coma-separated and must not include the
* 'openid.' prefix. Fields that are required to be signed are automatically
* added by the underlying logic, so that a valid message is generated,
* regardles if they are included in the user-supplied list or not.
*/
public void setSignFields(String signFields)
{
this._signFields = signFields;
}
/**
* Gets the list of parameters that the OpenID Provider will sign when
* generating authentication responses.
*
* Coma-separated list.
*/
public String getSignFields()
{
return _signFields;
}
public void setSignExtensions(String[] extensins)
{
_signExtensions = extensins;
}
public String[] getSignExtensions()
{
return _signExtensions;
}
/**
* Gets the RealmVerifier used to verify realms against return_to URLs.
*/
public RealmVerifier getRealmVerifier()
{
return _realmVerifier;
}
/**
* Sets the RealmVerifier used to verify realms against return_to URLs.
*/
public void setRealmVerifier(RealmVerifier realmVerifier)
{
this._realmVerifier = realmVerifier;
}
/**
* Gets the flag that instructs the realm verifier to enforce validation
* of the return URL agains the endpoints discovered from the RP's realm.
*/
public boolean getEnforceRpId()
{
return _realmVerifier.getEnforceRpId();
}
/**
* Sets the flag that instructs the realm verifier to enforce validation
* of the return URL agains the endpoints discovered from the RP's realm.
*/
public void setEnforceRpId(boolean enforceRpId)
{
_realmVerifier.setEnforceRpId(enforceRpId);
}
/**
* Gets OpenID Provider's endpoint URL, where it accepts OpenID
* authentication requests.
*
* This is a global setting for the ServerManager; can also be set on a
* per message basis.
*
* @see #authResponse(org.openid4java.message.ParameterList, String, String, boolean, String)
*/
public String getOPEndpointUrl()
{
return _opEndpointUrl;
}
/**
* Sets the OpenID Provider's endpoint URL, where it accepts OpenID
* authentication requests.
*
* This is a global setting for the ServerManager; can also be set on a
* per message basis.
*
* @see #authResponse(org.openid4java.message.ParameterList, String, String, boolean, String)
*/
public void setOPEndpointUrl(String opEndpointUrl)
{
this._opEndpointUrl = opEndpointUrl;
}
/**
* Constructs a ServerManager with default settings.
*/
public ServerManager() {
this(new RealmVerifierFactory(new YadisResolver(new HttpFetcherFactory())));
}
@Inject
public ServerManager(RealmVerifierFactory factory)
{
// initialize a default realm verifier
_realmVerifier = factory.getRealmVerifierForServer();
_realmVerifier.setEnforceRpId(false);
}
/**
* Processes a Association Request and returns a Association Response
* message, according to the request parameters and the preferences
* configured for the OpenID Provider
*
* @return AssociationResponse upon successfull association,
* or AssociationError if no association
* was established
*
*/
public Message associationResponse(ParameterList requestParams)
{
boolean isVersion2 = requestParams.hasParameter("openid.ns");
_log.info("Processing association request...");
try
{
// build request message from response params (+ integrity check)
AssociationRequest assocReq =
AssociationRequest.createAssociationRequest(requestParams);
isVersion2 = assocReq.isVersion2();
AssociationSessionType type = assocReq.getType();
// is supported / allowed ?
if (! Association.isHmacSupported(type.getAssociationType()) ||
! DiffieHellmanSession.isDhSupported(type) ||
_minAssocSessEnc.isBetter(type))
{
throw new AssociationException("Unable create association for: "
+ type.getSessionType() + " / "
+ type.getAssociationType() );
}
else // all ok, go ahead
{
Association assoc = _sharedAssociations.generate(
type.getAssociationType(), _expireIn);
_log.info("Returning shared association; handle: " + assoc.getHandle());
return AssociationResponse.createAssociationResponse(assocReq, assoc);
}
}
catch (OpenIDException e)
{
// association failed, respond accordingly
if (isVersion2)
{
_log.warn("Cannot establish association, " +
"responding with an OpenID2 association error.", e);
return AssociationError.createAssociationError(
e.getMessage(), _prefAssocSessEnc);
}
else
{
_log.warn("Error processing an OpenID1 association request: " +
e.getMessage() +
" Responding with a dummy association.", e);
try
{
// generate dummy association & no-encryption response
// for compatibility mode
Association dummyAssoc = _sharedAssociations.generate(
Association.TYPE_HMAC_SHA1, 0);
AssociationRequest dummyRequest =
AssociationRequest.createAssociationRequest(
AssociationSessionType.NO_ENCRYPTION_COMPAT_SHA1MAC);
return AssociationResponse.createAssociationResponse(
dummyRequest, dummyAssoc);
}
catch (OpenIDException ee)
{
_log.error("Error creating negative OpenID1 association response.", e);
return null;
}
}
}
}
/**
* Processes a Authentication Request received from a consumer site.
*
* Uses ServerManager's global OpenID Provider endpoint URL.
*
* @return An signed positive Authentication Response if successfull,
* or an IndirectError / DirectError message.
* @see #authResponse(org.openid4java.message.ParameterList, String, String,
* boolean, String, boolean)
*/
public Message authResponse(ParameterList requestParams,
String userSelId,
String userSelClaimed,
boolean authenticatedAndApproved)
{
return authResponse(requestParams, userSelId, userSelClaimed,
authenticatedAndApproved, _opEndpointUrl, true);
}
/**
* Processes a Authentication Request received from a consumer site.
*
* Uses ServerManager's global OpenID Provider endpoint URL.
*
* @return A signed positive Authentication Response if successfull,
* or an IndirectError / DirectError message.
* @see #authResponse(org.openid4java.message.AuthRequest, String, String,
* boolean, String, boolean)
*/
public Message authResponse(AuthRequest authReq,
String userSelId,
String userSelClaimed,
boolean authenticatedAndApproved)
{
return authResponse(authReq, userSelId, userSelClaimed,
authenticatedAndApproved, _opEndpointUrl, true);
}
/**
* Processes a Authentication Request received from a consumer site.
*
* Uses ServerManager's global OpenID Provider endpoint URL.
*
* @return A positive Authentication Response if successfull,
* or an IndirectError / DirectError message.
* @see #authResponse(org.openid4java.message.ParameterList, String, String,
* boolean, String, boolean)
*/
public Message authResponse(ParameterList requestParams,
String userSelId,
String userSelClaimed,
boolean authenticatedAndApproved,
boolean signNow)
{
return authResponse(requestParams, userSelId, userSelClaimed,
authenticatedAndApproved, _opEndpointUrl, signNow);
}
/**
* Processes a Authentication Request received from a consumer site.
*
* Uses ServerManager's global OpenID Provider endpoint URL.
*
* @return A positive Authentication Response if successfull,
* or an IndirectError / DirectError message.
* @see #authResponse(org.openid4java.message.AuthRequest, String, String,
* boolean, String, boolean)
*/
public Message authResponse(AuthRequest authReq,
String userSelId,
String userSelClaimed,
boolean authenticatedAndApproved,
boolean signNow)
{
return authResponse(authReq, userSelId, userSelClaimed,
authenticatedAndApproved, _opEndpointUrl, signNow);
}
/**
* Processes a Authentication Request received from a consumer site.
*
*
* @return A signed positive Authentication Response if successfull,
* or an IndirectError / DirectError message.
* @see #authResponse(org.openid4java.message.ParameterList, String, String,
* boolean, String, boolean)
*/
public Message authResponse(ParameterList requestParams,
String userSelId,
String userSelClaimed,
boolean authenticatedAndApproved,
String opEndpoint)
{
return authResponse(requestParams, userSelId, userSelClaimed,
authenticatedAndApproved, opEndpoint, true);
}
/**
* Processes a Authentication Request received from a consumer site.
*
*
* @return A signed positive Authentication Response if successfull,
* or an IndirectError / DirectError message.
* @see #authResponse(org.openid4java.message.AuthRequest, String, String,
* boolean, String, boolean)
*/
public Message authResponse(AuthRequest auhtReq,
String userSelId,
String userSelClaimed,
boolean authenticatedAndApproved,
String opEndpoint)
{
return authResponse(auhtReq, userSelId, userSelClaimed,
authenticatedAndApproved, opEndpoint, true);
}
/**
* Processes a Authentication Request received from a consumer site,
* after parsing the request parameters into a valid AuthRequest.
*
*
* @return A signed positive Authentication Response if successfull,
* or an IndirectError / DirectError message.
* @see #authResponse(org.openid4java.message.AuthRequest, String, String,
* boolean, String, boolean)
*/
public Message authResponse(ParameterList requestParams,
String userSelId,
String userSelClaimed,
boolean authenticatedAndApproved,
String opEndpoint,
boolean signNow)
{
_log.info("Parsing authentication request...");
AuthRequest authReq;
boolean isVersion2 = Message.OPENID2_NS.equals(
requestParams.getParameterValue("openid.ns"));
try
{
// build request message from response params (+ integrity check)
authReq = AuthRequest.createAuthRequest(
requestParams, _realmVerifier);
return authResponse(authReq, userSelId, userSelClaimed,
authenticatedAndApproved, opEndpoint, signNow);
}
catch (MessageException e)
{
if (requestParams.hasParameter("openid.return_to"))
{
_log.error("Invalid authentication request; " +
"responding with an indirect error message.", e);
return IndirectError.createIndirectError(e,
requestParams.getParameterValue("openid.return_to"),
! isVersion2 );
}
else
{
_log.error("Invalid authentication request; " +
"responding with a direct error message.", e);
return DirectError.createDirectError( e, ! isVersion2 );
}
}
}
/**
* Processes a Authentication Request received from a consumer site.
*
* @param opEndpoint The endpoint URL where the OP accepts OpenID
* authentication requests.
* @param authReq A valid authentication request.
* @param userSelId OP-specific Identifier selected by the user at
* the OpenID Provider; if present it will override
* the one received in the authentication request.
* @param userSelClaimed Claimed Identifier selected by the user at
* the OpenID Provider; if present it will override
* the one received in the authentication request.
* @param authenticatedAndApproved Flag indicating that the OP has
* authenticated the user and the user
* has approved the authentication
* transaction
* @param signNow If true, the returned AuthSuccess will be signed.
* If false, the signature will not be computed and
* set - this will have to be performed later,
* using #sign(org.openid4java.message.Message).
*
* @return
AuthSuccess, if authenticatedAndApproved
*
AuthFailure (negative response) if either
* of authenticatedAndApproved is false;
*
A IndirectError or DirectError message
* if the authentication could not be performed, or
*
Null if there was no return_to parameter
* specified in the AuthRequest.
*/
public Message authResponse(AuthRequest authReq,
String userSelId,
String userSelClaimed,
boolean authenticatedAndApproved,
String opEndpoint,
boolean signNow)
{
_log.info("Processing authentication request...");
boolean isVersion2 = authReq.isVersion2();
try
{
new URL(opEndpoint);
}
catch (MalformedURLException e)
{
String errMsg = "Invalid OP-endpoint configured; " +
"cannot issue authentication responses." + opEndpoint;
_log.error(errMsg, e);
return DirectError.createDirectError(
new ServerException(errMsg, e), isVersion2);
}
try
{
if (authReq.getReturnTo() == null)
{
_log.error("No return_to in the received (valid) auth request; "
+ "returning null auth response.");
return null;
}
String id;
String claimed;
if (AuthRequest.SELECT_ID.equals(authReq.getIdentity()))
{
id = userSelId;
claimed = userSelClaimed;
}
else
{
id = userSelId != null ? userSelId : authReq.getIdentity();
claimed = userSelClaimed != null ? userSelClaimed :
authReq.getClaimed();
}
if (id == null)
throw new ServerException(
"No identifier provided by the authntication request" +
"or by the OpenID Provider");
if (DEBUG) _log.debug("Using ClaimedID: " + claimed +
" OP-specific ID: " + id);
if (authenticatedAndApproved) // positive response
{
Association assoc = null;
String handle = authReq.getHandle();
String invalidateHandle = null;
if (handle != null)
{
assoc = _sharedAssociations.load(handle);
if (assoc == null)
{
_log.info("Invalidating handle: " + handle);
invalidateHandle = handle;
}
else
_log.info("Loaded shared association; handle: " + handle);
}
if (assoc == null)
{
assoc = _privateAssociations.generate(
_prefAssocSessEnc.getAssociationType(),
_expireIn);
_log.info("Generated private association; handle: "
+ assoc.getHandle());
}
AuthSuccess response = AuthSuccess.createAuthSuccess(
opEndpoint, claimed, id, !isVersion2,
authReq.getReturnTo(),
isVersion2 ? _nonceGenerator.next() : null,
invalidateHandle, assoc, false);
if (_signFields != null)
response.setSignFields(_signFields);
if (_signExtensions != null)
response.setSignExtensions(_signExtensions);
if (signNow)
response.setSignature(assoc.sign(response.getSignedText()));
_log.info("Returning positive assertion for " +
response.getReturnTo());
return response;
}
else // negative response
{
if (authReq.isImmediate())
{
_log.error("Responding with immediate authentication " +
"failure to " + authReq.getReturnTo());
authReq.setImmediate(false);
String separator = _userSetupUrl.contains("?") ? "&" : "?";
return AuthImmediateFailure.createAuthImmediateFailure(
_userSetupUrl + separator + authReq.wwwFormEncoding(),
authReq.getReturnTo(), ! isVersion2);
}
else
{
_log.error("Responding with authentication failure to " +
authReq.getReturnTo());
return new AuthFailure(! isVersion2, authReq.getReturnTo());
}
}
}
catch (OpenIDException e)
{
if (authReq.hasParameter("openid.return_to"))
{
_log.error("Error processing authentication request; " +
"responding with an indirect error message.", e);
return IndirectError.createIndirectError(e,
authReq.getReturnTo(),
! isVersion2 );
}
else
{
_log.error("Error processing authentication request; " +
"responding with a direct error message.", e);
return DirectError.createDirectError( e, ! isVersion2 );
}
}
}
/**
* Signs an AuthSuccess message, using the association identified by the
* handle specified within the message.
*
* @param authSuccess The Authentication Success message to be signed.
*
* @throws ServerException If the Association corresponding to the handle
* in the @authSuccess cannot be retrieved from
* the store.
* @throws AssociationException If the signature cannot be computed.
*
*/
public void sign(AuthSuccess authSuccess)
throws ServerException, AssociationException
{
String handle = authSuccess.getHandle();
// try shared associations first, then private
Association assoc = _sharedAssociations.load(handle);
if (assoc == null)
assoc = _privateAssociations.load(handle);
if (assoc == null) throw new ServerException(
"No association found for handle: " + handle);
authSuccess.setSignature(assoc.sign(authSuccess.getSignedText()));
}
/**
* Responds to a verification request from the consumer.
*
* @param requestParams ParameterList containing the parameters received
* in a verification request from a consumer site.
* @return VerificationResponse to be sent back to the
* consumer site.
*/
public Message verify(ParameterList requestParams)
{
_log.info("Processing verification request...");
boolean isVersion2 = true;
try
{
// build request message from response params (+ ntegrity check)
VerifyRequest vrfyReq = VerifyRequest.createVerifyRequest(requestParams);
isVersion2 = vrfyReq.isVersion2();
String handle = vrfyReq.getHandle();
boolean verified = false;
Association assoc = _privateAssociations.load(handle);
if (assoc != null) // verify the signature
{
_log.info("Loaded private association; handle: " + handle);
verified = assoc.verifySignature(
vrfyReq.getSignedText(),
vrfyReq.getSignature());
// remove the association so that the request
// cannot be verified more than once
_privateAssociations.remove(handle);
}
VerifyResponse vrfyResp =
VerifyResponse.createVerifyResponse(! vrfyReq.isVersion2());
vrfyResp.setSignatureVerified(verified);
if (verified)
{
String invalidateHandle = vrfyReq.getInvalidateHandle();
if (invalidateHandle != null &&
_sharedAssociations.load(invalidateHandle) == null) {
_log.info("Confirming shared association invalidate handle: "
+ invalidateHandle);
vrfyResp.setInvalidateHandle(invalidateHandle);
}
}
else
_log.error("Signature verification failed, handle: " + handle);
_log.info("Responding with " + (verified? "positive" : "negative")
+ " verification response");
return vrfyResp;
}
catch (OpenIDException e)
{
_log.error("Error processing verification request; " +
"responding with verification error.", e);
return DirectError.createDirectError(e, ! isVersion2);
}
}
}
openid4java-0.9.6.662/src/org/openid4java/server/JdbcServerAssociationStore.java 0000644 0015012 0015012 00000016362 11034531515 026770 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.server;
import org.openid4java.association.Association;
import org.openid4java.association.AssociationException;
import java.util.*;
import org.springframework.jdbc.core.support.JdbcDaoSupport;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.dao.DataAccessException;
import org.springframework.dao.IncorrectResultSizeDataAccessException;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* JDBC implementation for the ServerAssociationStore interface.
*
* The JdbcServerAssociation store requires a javax.sql.DataSource to be
* configured and passed in to it with the setDataSource setter method.
* The table name also needs to be specified, either through the constructor,
* or through the setTableName setter.
*
* The specified table must have the following structure:
*
*
handle : string : primary key
*
type : string
*
mackey : string
*
expdate : date
*
*
* @author Marius Scurtescu, Johnny Bufu
*/
public class JdbcServerAssociationStore extends JdbcDaoSupport
implements ServerAssociationStore
{
private static Log _log = LogFactory.getLog(JdbcServerAssociationStore.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private static Random _random = new Random(System.currentTimeMillis());
private static final int CLEANUP_INTERVAL = 60 * 1000; // 1 min in millis
private static long _lastCleanup = 0;
private String _tableName;
public JdbcServerAssociationStore()
{
}
public JdbcServerAssociationStore(String tableName)
{
_tableName = tableName;
}
public String getTableName()
{
return _tableName;
}
public void setTableName(String tableName)
{
this._tableName = tableName;
}
public Association generate(String type, int expiryIn)
throws AssociationException
{
cleanupExpired();
String sql = "INSERT INTO " + _tableName +
" (handle, type, mackey, expdate) VALUES (?,?,?,?)";
JdbcTemplate jdbcTemplate = getJdbcTemplate();
int attemptsLeft = 5;
while (attemptsLeft > 0)
{
try
{
String handle = Long.toHexString(_random.nextLong());
Association association =
Association.generate(type, handle, expiryIn);
int cnt = jdbcTemplate.update(sql,
new Object[] {
association.getHandle(),
association.getType(),
new String(Base64.encodeBase64(
association.getMacKey().getEncoded())),
association.getExpiry()
});
if (cnt == 1)
{
if (DEBUG)
_log.debug("Generated association, handle: " + handle +
" type: " + type +
" expires in: " + expiryIn + " seconds.");
return association;
}
}
catch (DataAccessException e)
{
_log.error("Error generating association; attempts left: "
+ (attemptsLeft-1), e);
}
attemptsLeft--;
}
throw new AssociationException(
"JDBCServerAssociationStore: Error generating association.");
}
public Association load(String handle)
{
try
{
String sql = "SELECT type,mackey,expdate FROM " + _tableName +
" WHERE handle=?";
JdbcTemplate jdbcTemplate = getJdbcTemplate();
Map res = jdbcTemplate.queryForMap(sql, new Object[] {handle});
String type = (String) res.get("type");
String macKey = (String) res.get("mackey");
Date expDate = (Date) res.get("expdate");
if (type == null || macKey == null || expDate == null)
throw new AssociationException("Invalid association data " +
"retrived from database; cannot create Association " +
"object for handle: " + handle);
Association assoc;
if (Association.TYPE_HMAC_SHA1.equals(type))
assoc = Association.createHmacSha1(handle,
Base64.decodeBase64(macKey.getBytes() ), expDate);
else if (Association.TYPE_HMAC_SHA256.equals(type))
assoc = Association.createHmacSha256(handle,
Base64.decodeBase64(macKey.getBytes() ), expDate);
else
throw new AssociationException("Invalid association type " +
"retrieved from database: " + type);
if (DEBUG)
_log.debug("Retrieved association for handle: " + handle +
" from table: " + _tableName);
return assoc;
}
catch (AssociationException ase )
{
_log.error("Error retrieving association from table: " + _tableName, ase);
return null;
}
catch (IncorrectResultSizeDataAccessException rse)
{
_log.warn("Association not found for handle: " + handle +
" in the table: " + _tableName);
return null;
}
catch (DataAccessException dae)
{
_log.error("Error retrieving association for handle: " + handle +
"from table: " + _tableName, dae);
return null;
}
}
public void remove(String handle)
{
try
{
String sql = "DELETE FROM " + _tableName + " WHERE handle=?";
JdbcTemplate jdbcTemplate = getJdbcTemplate();
int cnt = jdbcTemplate.update(sql, new Object[] { handle } );
if (cnt == 1 && DEBUG)
_log.debug("Removed association, handle: " + handle +
" from table: " + _tableName);
if (cnt != 1)
_log.warn("Trying to remove handle: " + handle + " from table: "
+ _tableName + "; affected entries: " + cnt);
}
catch (Exception e)
{
_log.error("Error removing association from table: " + _tableName, e);
}
}
private void cleanupExpired()
{
if (System.currentTimeMillis() - _lastCleanup < CLEANUP_INTERVAL)
return;
try
{
String sql = "DELETE FROM " + _tableName + " WHERE expdate
Offers support for implementing an OpenID Provider server.
The general usage pattern for a OpenID Provider is outlined below:
// instantiate a ServerManager object
public static ServerManager manager = new ServerManager();
// configure the OpenID Provider's endpoint URL
static
{
manager.setOPEndpointUrl("Http://my.openidprovider.com/server");
}
// extract the parameters from the request
ParameterList request = new ParameterList(httpReq.getParameterMap());
String mode = request.hasParameter("openid.mode") ?
request.getParameterValue("openid.mode") : null;
Message response;
String responseText;
if ("associate".equals(mode))
{
// --- process an association request ---
response = manager.associationResponse(request);
responseText = response.keyValueFormEncoding();
}
else if ("checkid_setup".equals(mode)
|| "checkid_immediate".equals(mode))
{
// interact with the user and obtain data needed to continue
List userData = userInteraction(request);
String userSelectedId = (String) userData.get(0);
String userSelectedClaimedId = (String) userData.get(1);
Boolean authenticatedAndApproved = (Boolean) userData.get(2);
// --- process an authentication request ---
response = manager.authResponse(request,
userSelectedId,
userSelectedClaimedId,
authenticatedAndApproved.booleanValue());
// caller will need to decide which of the following to use:
// - GET HTTP-redirect to the return_to URL
// - HTML FORM Redirection
responseText = response.wwwFormEncoding();
}
else if ("check_authentication".equals(mode))
{
// --- processing a verification request ---
response = manager.verify(request);
responseText = response.keyValueFormEncoding();
}
else
{
// --- error response ---
response = DirectError.createDirectError("Unknown request");
responseText = response.keyValueFormEncoding();
}
// return the result to the user
return responseText;
openid4java-0.9.6.662/src/org/openid4java/server/RealmVerifierFactory.java 0000644 0015012 0015012 00000002314 11352263621 025604 0 ustar miguel miguel /**
* Copyright 2009 Google Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package org.openid4java.server;
import com.google.inject.Inject;
import org.openid4java.discovery.yadis.YadisResolver;
/**
* Factory object that, given a Yadis resolver, makes {@link RealmVerifier}s.
*/
public class RealmVerifierFactory {
private final YadisResolver _yadisResolver;
@Inject
public RealmVerifierFactory(YadisResolver yadisResolver) {
_yadisResolver = yadisResolver;
}
public RealmVerifier getRealmVerifierForConsumer() {
return new RealmVerifier(false, _yadisResolver);
}
public RealmVerifier getRealmVerifierForServer() {
return new RealmVerifier(true, _yadisResolver);
}
}
openid4java-0.9.6.662/src/org/openid4java/server/NonceGenerator.java 0000644 0015012 0015012 00000000311 11034531515 024421 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.server;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public interface NonceGenerator
{
public String next();
}
openid4java-0.9.6.662/src/org/openid4java/server/SampleServer.java 0000644 0015012 0015012 00000017372 11034531515 024137 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.server;
import org.openid4java.message.AuthRequest;
import org.openid4java.message.AuthSuccess;
import org.openid4java.message.MessageExtension;
import org.openid4java.message.ParameterList;
import org.openid4java.message.Message;
import org.openid4java.message.DirectError;
import org.openid4java.message.ax.AxMessage;
import org.openid4java.message.ax.FetchRequest;
import org.openid4java.message.ax.FetchResponse;
import org.openid4java.message.sreg.SRegMessage;
import org.openid4java.message.sreg.SRegRequest;
import org.openid4java.message.sreg.SRegResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.ServletOutputStream;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.io.IOException;
/**
* Sample Server (OpenID Provider) implementation.
*/
public class SampleServer
{
// instantiate a ServerManager object
public ServerManager manager = new ServerManager();
public SampleServer()
{
this("http://my.openidprovider.com/server");
}
public SampleServer(String endPointUrl)
{
manager.setOPEndpointUrl(endPointUrl);
// for a working demo, not enforcing RP realm discovery
// since this new feature is not deployed
manager.getRealmVerifier().setEnforceRpId(false);
}
public String processRequest(HttpServletRequest httpReq,
HttpServletResponse httpResp)
throws Exception
{
// extract the parameters from the request
ParameterList request = new ParameterList(httpReq.getParameterMap());
String mode = request.hasParameter("openid.mode") ?
request.getParameterValue("openid.mode") : null;
Message response;
String responseText;
if ("associate".equals(mode))
{
// --- process an association request ---
response = manager.associationResponse(request);
responseText = response.keyValueFormEncoding();
}
else if ("checkid_setup".equals(mode)
|| "checkid_immediate".equals(mode))
{
// interact with the user and obtain data needed to continue
List userData = userInteraction(request);
String userSelectedClaimedId = (String) userData.get(0);
Boolean authenticatedAndApproved = (Boolean) userData.get(1);
String email = (String) userData.get(2);
// --- process an authentication request ---
AuthRequest authReq =
AuthRequest.createAuthRequest(request, manager.getRealmVerifier());
String opLocalId = null;
// if the user chose a different claimed_id than the one in request
if (userSelectedClaimedId != null &&
userSelectedClaimedId.equals(authReq.getClaimed()))
{
//opLocalId = lookupLocalId(userSelectedClaimedId);
}
response = manager.authResponse(request,
opLocalId,
userSelectedClaimedId,
authenticatedAndApproved.booleanValue(),
false); // Sign after we added extensions.
if (response instanceof DirectError)
return directResponse(httpResp, response.keyValueFormEncoding());
else
{
if (authReq.hasExtension(AxMessage.OPENID_NS_AX))
{
MessageExtension ext = authReq.getExtension(AxMessage.OPENID_NS_AX);
if (ext instanceof FetchRequest)
{
FetchRequest fetchReq = (FetchRequest) ext;
Map required = fetchReq.getAttributes(true);
//Map optional = fetchReq.getAttributes(false);
if (required.containsKey("email"))
{
Map userDataExt = new HashMap();
//userDataExt.put("email", userData.get(3));
FetchResponse fetchResp =
FetchResponse.createFetchResponse(fetchReq, userDataExt);
// (alternatively) manually add attribute values
fetchResp.addAttribute("email",
"http://schema.openid.net/contact/email", email);
response.addExtension(fetchResp);
}
}
else //if (ext instanceof StoreRequest)
{
throw new UnsupportedOperationException("TODO");
}
}
if (authReq.hasExtension(SRegMessage.OPENID_NS_SREG))
{
MessageExtension ext = authReq.getExtension(SRegMessage.OPENID_NS_SREG);
if (ext instanceof SRegRequest)
{
SRegRequest sregReq = (SRegRequest) ext;
List required = sregReq.getAttributes(true);
//List optional = sregReq.getAttributes(false);
if (required.contains("email"))
{
// data released by the user
Map userDataSReg = new HashMap();
//userData.put("email", "user@example.com");
SRegResponse sregResp = SRegResponse.createSRegResponse(sregReq, userDataSReg);
// (alternatively) manually add attribute values
sregResp.addAttribute("email", email);
response.addExtension(sregResp);
}
}
else
{
throw new UnsupportedOperationException("TODO");
}
}
// Sign the auth success message.
// This is required as AuthSuccess.buildSignedList has a `todo' tag now.
manager.sign((AuthSuccess) response);
// caller will need to decide which of the following to use:
// option1: GET HTTP-redirect to the return_to URL
return response.getDestinationUrl(true);
// option2: HTML FORM Redirection
//RequestDispatcher dispatcher =
// getServletContext().getRequestDispatcher("formredirection.jsp");
//httpReq.setAttribute("prameterMap", response.getParameterMap());
//httpReq.setAttribute("destinationUrl", response.getDestinationUrl(false));
//dispatcher.forward(request, response);
//return null;
}
}
else if ("check_authentication".equals(mode))
{
// --- processing a verification request ---
response = manager.verify(request);
responseText = response.keyValueFormEncoding();
}
else
{
// --- error response ---
response = DirectError.createDirectError("Unknown request");
responseText = response.keyValueFormEncoding();
}
// return the result to the user
return responseText;
}
protected List userInteraction(ParameterList request) throws ServerException
{
throw new ServerException("User-interaction not implemented.");
}
private String directResponse(HttpServletResponse httpResp, String response)
throws IOException
{
ServletOutputStream os = httpResp.getOutputStream();
os.write(response.getBytes());
os.close();
return null;
}
}
openid4java-0.9.6.662/src/org/openid4java/server/ServerException.java 0000644 0015012 0015012 00000001506 11034531515 024644 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.server;
import org.openid4java.OpenIDException;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class ServerException extends OpenIDException
{
public ServerException(String message)
{
super(message, SERVER_ERROR);
}
public ServerException(String message, int code)
{
super(message, code);
}
public ServerException(String message, Throwable cause)
{
super(message, SERVER_ERROR, cause);
}
public ServerException(String message, int code, Throwable cause)
{
super(message, code, cause);
}
public ServerException(Throwable cause)
{
super(cause);
}
public ServerException(int code, Throwable cause)
{
super(code, cause);
}
}
openid4java-0.9.6.662/src/org/openid4java/server/IncrementalNonceGenerator.java 0000644 0015012 0015012 00000002331 11034531515 026607 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.server;
import org.openid4java.util.InternetDateFormat;
import java.util.Date;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* @author Marius Scurtescu, Johnny Bufu
*/
public class IncrementalNonceGenerator implements NonceGenerator
{
private static Log _log = LogFactory.getLog(IncrementalNonceGenerator.class);
private static final boolean DEBUG = _log.isDebugEnabled();
private static InternetDateFormat _dateFormat = new InternetDateFormat();
private String _timestamp = "";
private int _counter = 0;
public synchronized String next()
{
String currentTimestamp = getCurrentTimpestamp();
if (_timestamp.equals(currentTimestamp))
{
_counter++;
}
else
{
_timestamp = currentTimestamp;
_counter = 0;
}
String nonce = _timestamp + Integer.toString(_counter);
if (DEBUG) _log.debug("Generated nonce: " + nonce);
return nonce;
}
private String getCurrentTimpestamp()
{
Date now = new Date();
return _dateFormat.format(now);
}
}
openid4java-0.9.6.662/src/org/openid4java/infocard/ 0000755 0015012 0015012 00000000000 11627733442 021144 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/infocard/InfocardException.java 0000644 0015012 0015012 00000001175 11034531514 025403 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.infocard;
import org.openid4java.OpenIDException;
/**
* @author Johnny Bufu
*/
public class InfocardException extends OpenIDException
{
public InfocardException(String message)
{
super(message, INFOCARD_ERROR);
}
public InfocardException(String message, int code)
{
super(message, code);
}
public InfocardException(String message, Throwable cause)
{
super(message, INFOCARD_ERROR, cause);
}
public InfocardException(Throwable cause)
{
super(INFOCARD_ERROR, cause);
}
}
openid4java-0.9.6.662/src/org/openid4java/infocard/OpenIDTokenType.java 0000644 0015012 0015012 00000002165 11034531514 024760 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.infocard;
/**
* Enumeration class with the defined OpenID token types.
*/
public class OpenIDTokenType
{
/**
* OpenID 1.1 token type.
*/
public static final OpenIDTokenType OPENID11_TOKEN =
new OpenIDTokenType("http://specs.openid.net/auth/1.1");
/**
* OpenID 2.0 token type.
*/
public static final OpenIDTokenType OPENID20_TOKEN =
new OpenIDTokenType("http://specs.openid.net/auth/2.0");
/**
* The OpenID Identifier claim type.
*/
public static final String OPENID_CLAIM =
"http://schema.openid.net/2007/05/claims/identifier";
/**
* Token URI value.
*/
private final String _tokenTypeUri;
/**
* Constructs a token type for the given URI value.
*/
private OpenIDTokenType(String uriValue)
{
_tokenTypeUri = uriValue;
}
/**
* Gets the URI string value for the token type.
* @return String representation of the token URI type.
*/
public String toString()
{
return _tokenTypeUri;
}
}
openid4java-0.9.6.662/src/org/openid4java/infocard/package.html 0000644 0015012 0015012 00000002265 11034531514 023416 0 ustar miguel miguel
Provides support for
OpenID-InforCards.
RP support:
Generate <OBJECT;> element of type
"application/x-informationCard" for RPs to request login
with an OpenID InfoCard.
Extract the OpenID Authentication Response from the
XML token posted by an Identity Selctor
OP support:
OpenID Token Generator plugin/extension for the
Higgins STS.
Sample InfoCard-enabled OpenID DemoRP (samples/demorp) and
Infocard OP (samples/infocardop).
openid4java-0.9.6.662/src/org/openid4java/infocard/rp/ 0000755 0015012 0015012 00000000000 11627733442 021565 5 ustar miguel miguel openid4java-0.9.6.662/src/org/openid4java/infocard/rp/InfocardInvocation.java 0000644 0015012 0015012 00000022021 11034531513 026167 0 ustar miguel miguel /*
* Copyright 2006-2008 Sxip Identity Corporation
*/
package org.openid4java.infocard.rp;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.message.ax.FetchRequest;
import org.openid4java.infocard.OpenIDTokenType;
import java.util.List;
import java.util.ArrayList;
import java.util.Iterator;
/**
* Utility class to generate HTML or XHTLM snippets that express
* Relying Parties' requirements and invoke Infocard Selectors,
* requesting login with an OpenID Infocard.
*
* Attribute Exchange Fetch Requests can be mapped to Infocard claim URIs.
*
* @author Johnny Bufu
*/
public class InfocardInvocation
{
private static Log _log = LogFactory.getLog(InfocardInvocation.class);
private static final boolean DEBUG = _log.isDebugEnabled();
/**
* The requested token type (OpenID 1.1 or 2.0)
*/
private OpenIDTokenType _tokenType;
/**
* List of required claim URIs. The OpenID Identifier claim
* is always part of the list.
*/
private List _requiredClaims = new ArrayList();
/**
* List of optional claim URIs.
*/
private List _optionalClaims = new ArrayList();
/**
* The issuer's URL for the accepted claims.
*/
private String _issuer;
/**
* The issuer's WS-SecurityPolicy URL, if different than "/mex".
*/
private String _issuerPolicy;
/**
* Relying Party's privacy URL.
*/
private String _privacyUrl;
/**
* Relying Party's privacy document version. When selectors notice
* a change in this value, users are prompted with the privacy policy
* document retrieved from the privacyUrl.
*/
private int _privacyVersion;
// todo: enforce data types?
/**
* Creates a new InfocardInvocation object, describing Relying Party's
* requirements.
*
* @param tokenType The required token type.
*/
public InfocardInvocation(OpenIDTokenType tokenType)
{
_requiredClaims.add(OpenIDTokenType.OPENID_CLAIM);
_tokenType = tokenType;
if (DEBUG)
_log.debug("Created " + _tokenType + " token type InfocardInvocation");
}
/**
* Creates an InfocardInvocation object from an Attribute Exchange
* Fetch Request.
*
* Attriute type URIs are mapped to Infocard claim URIs.
* Attribute value count and update_url features are cannot be
* expressed in InfocardInvocation data structures.
*
* @param fetch The Fetch Request.
*/
public InfocardInvocation(FetchRequest fetch)
{
_requiredClaims.add(OpenIDTokenType.OPENID_CLAIM);
_tokenType = OpenIDTokenType.OPENID20_TOKEN;
_requiredClaims.addAll(fetch.getAttributes(true).values());
_optionalClaims.addAll(fetch.getAttributes(false).values());
if (DEBUG)
_log.debug("Created " + _tokenType +
" token type InfocardInvocation from a FetchRequest.");
}
/**
* Gets the token type.
*/
public OpenIDTokenType getTokenType()
{
return _tokenType;
}
/**
* Sets the token type.
* @param tokenType
*/
public void setTokenType(OpenIDTokenType tokenType)
{
this._tokenType = tokenType;
}
/**
* Gets required or optional claim URIs.
*
* The OpenID Identifier claim is always part of the required claims list.
*
* @param required If true, the required claims are returned; optional
* claims are returned otherwise.
* @return The list of configured required/optional claims.
*/
public List getClaims(boolean required)
{
return required ? _requiredClaims : _optionalClaims;
}
/**
* Adds a claim URI to the required or optional claim list.
*
* @param claim The claim URI to be added.
* @param required If true, the clai is added to the required
* claims list, otherwise it is added to the
* optional claims list.
*/
public void addClaim(String claim, boolean required)
{
if (required && ! _requiredClaims.contains(claim))
_requiredClaims.add(claim);
else if (! _optionalClaims.contains(claim))
_optionalClaims.add(claim);
}
/**
* Sets the list of required or optional claim URIs.
*
* If the required claim list is set, and the OpenID Identifier claim
* is not part of the provided list, it is added transparently to the list.
*
* @param claims List of claim URIs.
* @param required If true, the required claims list is set,
* otherwise the optional claims list is set.
*/
public void setClaims(List claims, boolean required)
{
if (required)
{
_requiredClaims = claims;
if (! _requiredClaims.contains(OpenIDTokenType.OPENID_CLAIM))
_requiredClaims.add(OpenIDTokenType.OPENID_CLAIM);
}
else
_optionalClaims = claims;
}
/**
* Gets the issuer URL.
*/
public String getIssuer()
{
return _issuer;
}
/**
* Sets the issuer URL.
* @param issuer
*/
public void setIssuer(String issuer)
{
this._issuer = issuer;
}
/**
* Gets the issuer policy URL, if different than "/mex".
*/
public String getIssuerPolicy()
{
return _issuerPolicy;
}
/**
* Sets the issuer policy URL, if different than "/mex".
*/
public void setIssuerPolicy(String issuerPolicy)
{
this._issuerPolicy = issuerPolicy;
}
/**
* Gets the Relyin Party's privacy policy URL.
*/
public String getPrivacyUrl()
{
return _privacyUrl;
}
/**
* Gets the Relying Party's privacy document's version.
*/
public int getPrivacyVersion()
{
return _privacyVersion;
}
/**
* Sets the Relyin Party's privacy policy URL and version.
*
* When selectors notice a change in this value, users are prompted
* with the privacy policy document retrieved from the privacyUrl.
*/
public void setPrivacyData(String url, int version)
{
_privacyUrl = url;
_privacyVersion = version;
}
/**
* Generates the HTML