Changeset 2173

Timestamp:

04/30/08 23:58:44 (7 months ago)

Author:

fumiakiy

Message:

Checking in Net::OpenID::Consumer for OpenID 2.0 support in commenting to Movable Type powered blog. Now commenters can login to your blog by entering "yahoo.com" or "myopenid.com" as their OpenID URL in the sign in screen. BugId:69889

Files:

• branches/release-36/extlib/Net/OpenID/Association.pm (modified) (5 diffs)
• branches/release-36/extlib/Net/OpenID/ClaimedIdentity.pm (modified) (9 diffs)
• branches/release-36/extlib/Net/OpenID/Consumer.pm (modified) (29 diffs)
• branches/release-36/extlib/Net/OpenID/IndirectMessage.pm (added)
• branches/release-36/extlib/Net/OpenID/VerifiedIdentity.pm (modified) (8 diffs)
• branches/release-36/extlib/Net/OpenID/Yadis (added)
• branches/release-36/extlib/Net/OpenID/Yadis.pm (added)
• branches/release-36/extlib/Net/OpenID/Yadis/Service.pm (added)

branches/release-36/extlib/Net/OpenID/Association.pm

@@ -38 +38 @@
-}
-
+sub type {
+    my $self = shift;
+    die if @_;
+    $self->{'type'};
+}
+
-sub server {
-    my Net::OpenID::Association $self = shift;
@@ -64 +70 @@
-# a new assoc_handle if none is found, or has expired
-sub server_assoc {
-
+
+
+
+
-
-    # closure to return undef (dumb consumer mode) and log why
@@ -75 +84 @@
-    return $dumb->("no_cache") unless $cache;
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
-        }
-    }
@@ -94 +105 @@
-                "openid.dh_consumer_public" => OpenID::util::bi2arg($dh->pub_key),
-                );
+
+    if ($protocol_version == 2) {
+        $post{"openid.ns"} = OpenID::util::version_2_namespace();
+    }
-
-    my $req = HTTP::Request->new(POST => $server);
@@ -160 +175 @@
-    $cache->set("shandle:$server", $ahandle);
-
+    # now we test that the cache object given to us actually works.  if it
+    # doesn't, it'll also fail later, making the verify fail, so let's
+    # go into stateless (dumb mode) earlier if we can detect this.
+    $cache->get("shandle:$server")
+        or return $dumb->("cache_broken");
+
-    return $assoc;
-}

branches/release-36/extlib/Net/OpenID/ClaimedIdentity.pm

@@ -5 +5 @@
-package Net::OpenID::ClaimedIdentity;
-use fields (
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-sub new {
@@ -15 +18 @@
-    $self = fields::new( $self ) unless ref $self;
-    my %opts = @_;
-
+protocol_version semantic_info 
-        $self->{$f} = delete $opts{$f};
+    }
+
+    $self->{protocol_version} ||= 1;
+    unless ($self->{protocol_version} == 1 || $self->{protocol_version} == 2) {
+        Carp::croak("Unsupported protocol version");
-    }
-
@@ -22 +30 @@
-    $self->{'identity'} =~ s!^(https?://.+?)(/(?:.*))?$!lc($1) . $2!ie;
-
+    $self->{extension_args} = {};
+
-    Carp::croak("unknown options: " . join(", ", keys %opts)) if %opts;
-    return $self;
@@ -32 +42 @@
-}
-
+sub delegated_url {
+    my Net::OpenID::ClaimedIdentity $self = shift;
+    Carp::croak("Too many parameters") if @_;
+    return $self->{'delegate'};
+}
+
-sub identity_server {
-    my Net::OpenID::ClaimedIdentity $self = shift;
-    Carp::croak("Too many parameters") if @_;
-    return $self->{server};
+}
+
+sub protocol_version {
+    my Net::OpenID::ClaimedIdentity $self = shift;
+    Carp::croak("Too many parameters") if @_;
+    return $self->{protocol_version};
+}
+
+sub semantic_info {
+    my Net::OpenID::ClaimedIdentity $self = shift;
+    Carp::croak("Too many parameters") if @_;
+    return $self->{semantic_info} if $self->{semantic_info};
+    my $final_url = '';
+    my $info = $self->{consumer}->_find_semantic_info($self->claimed_url, \$final_url);
+    # Don't return anything if the URL has changed. Something bad may be happening.
+    $info = {} if $final_url ne $self->claimed_url;
+    return $self->{semantic_info} = $info;
+}
+
+sub set_extension_args {
+    my Net::OpenID::ClaimedIdentity $self = shift;
+    my $ext_uri = shift;
+    my $args = shift;
+    Carp::croak("Too many parameters") if @_;
+    Carp::croak("No extension URI given") unless $ext_uri;
+    Carp::croak("Expecting hashref of args") if defined($args) && ref $args ne 'HASH';
+
+    $self->{extension_args}{$ext_uri} = $args;
-}
-
@@ -45 +89 @@
-    my $trust_root  = delete $opts{'trust_root'};
-    my $delayed_ret = delete $opts{'delayed_return'};
+    my $force_reassociate = delete $opts{'force_reassociate'};
+    my $use_assoc_handle = delete $opts{'use_assoc_handle'};
+    my $actually_return_association = delete $opts{'actually_return_association'};
-
-    Carp::croak("Unknown options: " . join(", ", keys %opts)) if %opts;
@@ -55 +102 @@
-
-    # get an assoc (or undef for dumb mode)
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    my $identity_arg = $self->{'delegate'} || $self->{'identity'};
-
-    # make a note back to ourselves that we're using a delegate
-
+
+
-        OpenID::util::push_url_arg(\$return_to,
-                                   "oic.identity",  $self->{identity});
@@ -73 +133 @@
-
-    my $curl = $ident_server;
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    $self->{consumer}->_debug("check_url for (del=$self->{delegate}, id=$self->{identity}) = $curl");
@@ -144 +250 @@
-claimed identity is valid, and sign a message saying so.
-
+=item $url = $cident->B<delegated_url>
+
+If the claimed URL is using delegation, this returns the delegated identity that will
+actually be sent to the identity server.
+
+=item $version = $cident->B<protocol_version>
+
+Determines whether this identifier is to be verified by OpenID 1.1
+or by OpenID 2.0. Returns C<1> or C<2> respectively. This will
+affect the way the C<check_url> is constructed.
+
+=item $cident->B<set_extension_args>($ns_uri, $args)
+
+If called before you access C<check_url>, the arguments given in the hashref
+$args will be added to the request in the given extension namespace.
+For example, to use the Simple Registration (SREG) extension:
+
+    $cident->set_extension_args(
+        'http://openid.net/extensions/sreg/1.1',
+        {
+            required => 'email',
+            optional => 'fullname,nickname',
+            policy_url => 'http://example.com/privacypolicy.html',
+        },
+    );
+
+Note that when making an OpenID 1.1 request, only the Simple Registration
+extension is supported. There was no general extension mechanism defined
+in OpenID 1.1, so SREG (with the namespace URI as in the example above)
+is supported as a special case. All other extension namespaces will
+be silently ignored when making a 1.1 request.
+
-=item $url = $cident->B<check_url>( %opts )
-
@@ -204 +342 @@
-L<Net::OpenID::Server>
-
-danga.com/openid
-
+openid.net
+

branches/release-36/extlib/Net/OpenID/Consumer.pm

@@ -10 +10 @@
-
-use vars qw($VERSION);
-2
+4
-
-use fields (
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-
-use Net::OpenID::ClaimedIdentity;
-use Net::OpenID::VerifiedIdentity;
-use Net::OpenID::Association;
+use Net::OpenID::Yadis;
+use Net::OpenID::IndirectMessage;
-
-use MIME::Base64 ();
@@ -38 +42 @@
-    my %opts = @_;
-
+    $opts{minimum_version} ||= 1;
+
-    $self->{ua}            = delete $opts{ua};
-    $self->args            ( delete $opts{args}            );
@@ -43 +49 @@
-    $self->consumer_secret ( delete $opts{consumer_secret} );
-    $self->required_root   ( delete $opts{required_root}   );
+    $self->minimum_version ( delete $opts{minimum_version} );
-
-    $self->{debug} = delete $opts{debug};
@@ -48 +55 @@
-    Carp::croak("Unknown options: " . join(", ", keys %opts)) if %opts;
-    return $self;
+}
+
+# NOTE: This method is here only to support the openid-test library.
+# Don't call it from anywhere else, or you'll break when it gets 
+# removed. Instead, set the minimum_version property.
+# FIXME: Can we just make openid-test set minimum_version and get
+# rid of this?
+sub disable_version_1 {
+    my $self = shift;
+    $self->{minimum_version} = 2.0;
-}
-
@@ -53 +70 @@
-sub consumer_secret { &_getset; }
-sub required_root   { &_getset; }
+sub minimum_version { &_getset; }
-
-sub _getset {
@@ -98 +116 @@
-        } elsif (ref $what eq "HASH") {
-            $getter = sub { $what->{$_[0]}; };
-ref $what eq "CGI"
+UNIVERSAL::isa($what, "CGI")
-            $getter = sub { scalar $what->param($_[0]); };
-        } elsif (ref $what eq "Apache") {
@@ -112 +130 @@
-        if ($getter) {
-            $self->{args} = $getter;
+            $self->{message} = Net::OpenID::IndirectMessage->new($what, minimum_version => $self->minimum_version);
-        }
-    }
-    $self->{args};
+}
+
+sub message {
+    my Net::OpenID::Consumer $self = shift;
+    if (my $key = shift) {
+        return $self->{message} ? $self->{message}->get($key) : undef;
+    }
+    else {
+        return $self->{message};
+    }
+}
+
+sub _message_mode {
+    my $message = $_[0]->message;
+    return $message ? $message->mode : undef;
+}
+
+sub _message_version {
+    my $message = $_[0]->message;
+    return $message ? $message->protocol_version : undef;
-}
-
@@ -141 +180 @@
-        'no_head_tag' => "URL provided doesn't seem to have a head tag.",
-        'url_fetch_err' => "Error fetching the provided URL.",
+        'bad_mode' => "The openid.mode argument is not correct",
+        'protocol_version_incorrect' => "The provided URL uses the wrong protocol version",
+        'naive_verify_failed_return' => "Provider says signature is invalid",
+        'naive_verify_failed_network' => "Could not contact provider to verify signature",
-    }->{$code};
-
@@ -239 +282 @@
-            $val =~ m!\bhref=[\"\']([^\"\']+)[\"\']!i) {
-            $ret->{"openid.$temp"} = $1;
+            next;
+        }
+
+        # OpenID2 providers / local identifiers
+        # <link rel="openid2.provider" href="http://www.livejournal.com/misc/openid.bml" />
+        if ($type eq "link" &&
+            $val =~ /\brel=.openid2\.(provider|local_id)./i && ($temp = $1) &&
+            $val =~ m!\bhref=[\"\']([^\"\']+)[\"\']!i) {
+            $ret->{"openid2.$temp"} = $1;
-            next;
-        }
@@ -302 +354 @@
-    }
-
-%$ret))
+map { $_.' => '.$ret->{$_} } keys %$ret)) if $self->{debug}
-
-    return $ret;
@@ -317 +369 @@
-    return $self->_fail("no_identity_server") unless $sem_info->{"openid.server"};
-    $sem_info->{"openid.server"};
+}
+
+sub is_server_response {
+    my Net::OpenID::Consumer $self = shift;
+    return $self->_message_mode ? 1 : 0;
+}
+
+sub handle_server_response {
+    my Net::OpenID::Consumer $self = shift;
+    my %callbacks_in = @_;
+    my %callbacks = ();
+
+    foreach my $cb (qw(not_openid setup_required cancelled verified error)) {
+        $callbacks{$cb} = delete($callbacks_in{$cb}) || sub { Carp::croak("No ".$cb." callback") };
+    }
+    Carp::croak("Unknown callbacks ".join(',', keys %callbacks)) if %callbacks_in;
+
+    unless ($self->is_server_response) {
+        return $callbacks{not_openid}->();
+    }
+
+    if (my $setup_url = $self->user_setup_url) {
+        return $callbacks{setup_required}->($setup_url);
+    }
+    elsif ($self->user_cancel) {
+        return $callbacks{cancelled}->();
+    }
+    elsif (my $vident = $self->verified_identity) {
+        return $callbacks{verified}->($vident);
+    }
+    else {
+        return $callbacks{error}->($self->errcode, $self->errtext);
+    }
+
-}
-
@@ -334 +420 @@
-    return $self->_fail("bogus_url", "Invalid URL") unless $url =~ m!^https?://!i;
-    # add a slash, if none exists
-
+s?
-
-    my $final_url;
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    return Net::OpenID::ClaimedIdentity->new(
-
-
-
-
-
+
+
+
+
+
+
+
-}
-
-sub user_cancel {
-    my Net::OpenID::Consumer $self = shift;
-args("openid.mode")
+_message_mode
-}
-
@@ -362 +533 @@
-    my $post_grant = delete $opts{'post_grant'};
-    Carp::croak("Unknown options: " . join(", ", keys %opts)) if %opts;
-
-
-
+
+
+
+
+
+
+
+
+
-
-    OpenID::util::push_url_arg(\$setup_url, "openid.post_grant", $post_grant)
@@ -379 +556 @@
-    Carp::croak("Unknown options: " . join(", ", keys %opts)) if %opts;
-
-args("openid.mode")
+_message_mode
-
-    # the asserted identity (the delegated one, if there is one, since the protocol
-    # knows nothing of the original URL)
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    # check that returnto is for the right host
@@ -409 +596 @@
-    }
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    # if openid.delegate was used, check that it was done correctly
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-
-    $self->_debug("verified_identity: assoc_handle: $assoc_handle");
-    my $assoc = Net::OpenID::Association::handle_assoc($self, $server, $assoc_handle);
-
+    my %signed_fields;   # key (without openid.) -> value
+
-    if ($assoc) {
-        $self->_debug("verified_identity: verifying with found association");
@@ -434 +651 @@
-        # verify the token
-        my $token = "";
-
-
+
+
+
+
-        }
-
@@ -452 +671 @@
-                    );
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-        # if the server told us our handle as bogus, let's ask in our
-        # check_authentication mode whether that's true
-args("openid.
+message("
-            $post{"openid.invalidate_handle"} = $ih;
-        }
@@ -492 +713 @@
-    # verified!
-    return Net::OpenID::VerifiedIdentity->new(
-
-
-
-
-
-
-
+
+
+
+
-}
-
@@ -522 +740 @@
-
-package OpenID::util;
+
+use constant VERSION_1_NAMESPACE => "http://openid.net/signon/1.1";
+use constant VERSION_2_NAMESPACE => "http://specs.openid.net/auth/2.0";
+
+# I guess this is a bit daft since constants are subs anyway,
+# but whatever.
+sub version_1_namespace {
+    return VERSION_1_NAMESPACE;
+}
+sub version_2_namespace {
+    return VERSION_2_NAMESPACE;
+}
+sub version_1_xrds_service_url {
+    return VERSION_1_NAMESPACE;
+}
+sub version_2_xrds_service_url {
+    return "http://specs.openid.net/auth/2.0/signon";
+}
+sub version_2_xrds_directed_service_url {
+    return "http://specs.openid.net/auth/2.0/server";
+}
+sub version_2_identifier_select_url {
+    return "http://specs.openid.net/auth/2.0/identifier_select";
+}
-
-# From Digest::HMAC
@@ -602 +844 @@
-}
-
+sub push_openid2_url_arg {
+    my $uref = shift;
+    my %args = @_;
+    push_url_arg($uref,
+        'openid.ns' => VERSION_2_NAMESPACE,
+        map {
+            'openid.'.$_ => $args{$_}
+        } keys %args,
+    );
+}
+
-sub time_to_w3c {
-    my $time = shift || time();
@@ -701 +954 @@
-
-  # so you send the user off there, and then they come back to
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-  if (my $setup_url = $csr->user_setup_url) {
-       # redirect/link/popup user to $setup_url
@@ -721 +997 @@
-identity.  More information is available at:
-
-www.danga.com/openid
+openid.net
-
-=head1 CONSTRUCTOR
@@ -732 +1008 @@
-
-You can set the C<ua>, C<cache>, C<consumer_secret>, C<required_root>,
-
-
+
+method 
-
-=back
@@ -784 +1060 @@
-Your secret may not exceed 255 characters.
-
+=item $csr->B<minimum_version>(2)
+
+=item $csr->B<minimum_version>
+
+Get or set the minimum OpenID protocol version supported. Currently
+the only useful value you can set here is 2, which will cause
+1.1 identifiers to fail discovery with the error C<protocol_version_incorrect>.
+
+In most cases you'll want to allow both 1.1 and 2.0 identifiers,
+which is the default. If you want, you can set this property to 1
+to make this behavior explicit.
+
+=item $csr->B<message>($key)
+
+Obtain a value from the message contained in the request arguments
+with the given key. This can only be used to obtain core arguments,
+not extension arguments.
+
+Call this method without a C<$key> argument to get a L<Net::OpenID::IndirectMessage>
+object representing the message.
+
-=item $csr->B<args>($ref)
-
@@ -807 +1104 @@
-you haven't defined a way to get at the parameters.
-
+Most callers should instead use the C<message> method above, which
+abstracts away the need to understand OpenID's message serialization.
+
-3. Get the getter:
-
@@ -813 +1113 @@
-Without arguments, returns a subref that returns the value given a
-parameter name.
+
+Most callers should instead use the C<message> method above with no
+arguments, which returns an object from which extension attributes
+can be obtained by their documented namespace URI.
-
-=item $nos->B<required_root>($url_prefix)
@@ -848 +1152 @@
-=back
-
+=item $csr->B<handle_server_response>( %callbacks );
+
+When a request comes in that contains a response from an OpenID provider,
+figure out what it means and dispatch to an appropriate callback to handle
+the request. This is the callback-based alternative to explicitly calling
+the methods below in the correct sequence, and is recommended unless you
+need to do something strange.
+
+Anything you return from the selected callback function will be returned
+by this method verbatim. This is useful if the caller needs to return
+something different in each case.
+
+The available callbacks are:
+
+=over 8
+
+=item B<not_openid> - the request isn't an OpenID response after all.
+
+=item B<setup_required>($setup_url) - the provider needs to present some UI to the user before it can respond. Send the user to the given URL by some means.
+
+=item B<cancelled> - the user cancelled the authentication request from the provider's UI
+
+=item B<verified>($verified_identity) - the user's identity has been successfully verified. A L<Net::OpenID::VerifiedIdentity> object is passed in.
+
+=item B<error>($errcode, $errmsg) - an error has occured. An error code and message are provided.
+
+=back
-
-=item $csr->B<user_setup_url>( [ %opts ] )
@@ -935 +1266 @@
-=head1 SEE ALSO
-
- http://www.danga.com/openid
+http://openid.net
-
-L<Net::OpenID::ClaimedIdentity> -- part of this module
@@ -946 +1277 @@
-
-Brad Fitzpatrick <brad@danga.com>
+
+Tatsuhiko Miyagawa <miyagawa@sixapart.com>
+
+Martin Atkins <mart@degeneration.co.uk>
+

branches/release-36/extlib/Net/OpenID/VerifiedIdentity.pm

@@ -5 +5 @@
-package Net::OpenID::VerifiedIdentity;
-use fields (
-        
-        
-
-        'foaf',      # discovered foaf URL
-        'foafmaker', # discovered foaf maker
-
-        'atom',      # discovered atom feed
-
-        'consumer',  # The Net::OpenID::Consumer module which created us
-
-            
+
+
+
+'claimed_identity', # The ClaimedIdentity object that we've verified
+'semantic_info',    # The "semantic info" (RSS URLs, etc) at the verified identity URL
+
+'consumer',  # The Net::OpenID::Consumer module which created us
+
+'signed_fields' ,  # hashref of key->value of things that were signed.  without "openid." prefix
+
+
-use URI;
-
@@ -25 +25 @@
-    $self->{'consumer'} = delete $opts{'consumer'};
-
-
+
+
-        unless ($self->{'id_uri'} = URI->new($self->{identity})) {
-            return $self-&