1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
|
#include "consumer.h"
using opkele::assoc_t;
using opkele::association;
using opkele::endpoint_t;
using opkele::failed_lookup;
using opkele::params;
using opkele::prequeue_RP;
using opkele::secret_t;
using std::string;
using std::vector;
class Consumer :
public prequeue_RP
{
private: // types
vector<endpoint_t> endpoints;
public: // interface
Consumer(const char *url, singleid_board_t *board)
: _url(url), _board(board)
{ }
public: // overrides
virtual void begin_queueing() const
{ _endpoints.clear(); }
virtual void queue_endpoint(const openid_endpoint_t& oep)
{ _endpoints.push(oep); }
virtual void set_normalized_id(const string& nid)
{ _normalized = nid; }
virtual const string get_normalized_id() const
{ return _normalized; }
virtual const string get_this_url()
{ return _url; }
virtual assoc_t store_assoc(const string& server, const string& handle,
const string& type, const secret_t& secret,
int expires_in);
virtual assoc_t find_assoc(const string& server);
virtual assoc_t retrieve_assoc(const string& server, const string& handle);
virtual assoc_t invalidate_assoc(const string& server, const string& handle);
virtual void check_nonce(const string& server, const string& nonce);
private: // data
singleid_board_t _board;
endpoints _endpoints;
string _normalized;
string _url;
};
assoc_t
Consumer::store_assoc(const string& server, const string& handle,
const string& type, const secret_t& secret,
int expires_in)
{
singleid_assoc_t data;
int res;
data.server = server.c_str();
data.handle = handle.c_str();
data.type = type.c_str();
data.secret = secret.data();
data.n_secret = secret.size();
data.expires = expires_in;
{
LockShared lock; /* scoped lock */
res = singleid_board_store_assoc (_board, &data);
}
if (!res)
throw dump_RP("association data was too large to fit in shared storage");
return assoc_t(new association(server, handle, type, secret, expires_on, false));
}
assoc_t
Consumer::find_assoc(const string& server)
{
singleid_assoc_t data = { 0, };
association assoc = NULL;
{
LockShared lock;
if (singleid_board_find_assoc (_board, server.c_str(), NULL, &data))
assoc = new association(data.server, data.handle, data.type,
secret_t(data.secret, data.secret + data.n_secret),
data.expires, false);
}
if (!assoc)
throw failed_lookup("could not find association for server: " + server);
return assoc_t(assoc);
}
assoc_t
Consumer::retrieve_assoc(const string& server, const string& handle)
{
singleid_assoc_t data = { 0, };
association assoc = NULL;
{
LockShared lock;
if (singleid_board_find_assoc (_board, server.c_str(), handle.c_str(), &data))
assoc = new association(data.server, data.handle, data.type,
secret_t(data.secret, data.secret + data.n_secret),
data.expires, false);
}
if (!assoc)
throw failed_lookup("could not retrieve association for server: " + server);
return assoc_t(assoc);
}
assoc_t
Consumer::invalidate_assoc(const string& server, const string& handle)
{
LockShared lock;
singleid_board_invalidate_assoc (_board, server.c_str(), handle.c_str());
}
void
Consumer::check_nonce(const string& server, const string& nonce)
{
LockShared lock;
singleid_board_check_nonce (_board, server.c_str(), nonce.c_str());
}
/* -----------------------------------------------------------------------
* AUTHENTICATION
*/
static void
filter_openid_params (params_t ¶ms, params_t &extensions)
{
for (params_t::iterator it = params.begin(); it != params.end(); ) {
const string& name = it->first;
if (name.find ("openid.") == 0) {
/* Extension params have at least a second dot */
if (name.find ('.', sizeof ("openid.")))
extensions.insert(*it);
/* We erase an increment together, must use post-increment operator */
it->erase(it++);
} else {
/* Did not match, just go to next element */
++it;
}
}
}
static void
start_auth (sid_request_t *req, Consumer &consumer, params_t ¶ms,
const string& trust_root, const string &identity)
{
/* Remove all openid params, and stash away extensions */
filter_openid_params (params);
string return_to = params.append_query (consumer.get_this_url(), "");
params_t result;
try {
openid_message_t cm;
consumer.initiate (identity);
result = consumer.checkid_ (cm, opkele::mode_checkid_setup, return_to, trust_root);
output = result.append_query (consumer.get_endpoint().uri);
} catch (failed_xri_resolution &ex) {
sid_request_respond (xxx, xxx, xxx);
return;
} catch (failed_discovery &ex) {
sid_request_respond (xxx, xxx, xxx);
return;
} catch (bad_input &ex) {
sid_request_respond (xxx, xxx, xxx);
return;
} catch (exception &ex) {
sid_request_respond (xxx, xxx, xxx);
xxx log xxx;
return;
}
sid_request_respond (xxx, xxx, xxx);
}
static void
complete_auth (sid_request_t *req, Consumer &consumer, params_t ¶ms)
{
try {
consumer.id_res(AdaptorFix(params));
string identity = consumer.get_claimed_id();
sid_request_authenticated (req, identity.c_str());
} catch (exception &ex) {
sid_request_respond (xxx, xxx, xxx);
}
}
static void
cancelled_auth (sid_request_t *req, Consumer &consumer, params_t ¶ms)
{
sid_request_respond (xxx, xxx, xxx);
}
void
sid_consumer_authenticate(sid_request_t *req, sid_storage_t *store, const char *identity)
{
params_t params;
assert (req);
assert (store);
const char *qs = sid_request_qs (req);
parse_query_string (qs, params);
const char *url = sid_request_url (req);
Consumer consumer(url, store);
if (params.has_param("openid.assoc_handle"))
complete_auth (req, consumer, params);
else if (params.has_param("openid.mode") && params.get_param("openid.mode") == "cancel")
cancelled_auth (req, consumer, params);
else
begin_auth (req, consumer, params, trust_root, identity);
consumer.close();
}
|
