diff options
Diffstat (limited to 'src')
4 files changed, 48 insertions, 3 deletions
diff --git a/src/DotNetOpenAuth.Test/OpenId/RelyingParty/RelyingPartySecuritySettingsTests.cs b/src/DotNetOpenAuth.Test/OpenId/RelyingParty/RelyingPartySecuritySettingsTests.cs index 3f1cea0..7e342e1 100644 --- a/src/DotNetOpenAuth.Test/OpenId/RelyingParty/RelyingPartySecuritySettingsTests.cs +++ b/src/DotNetOpenAuth.Test/OpenId/RelyingParty/RelyingPartySecuritySettingsTests.cs @@ -40,5 +40,17 @@ namespace DotNetOpenAuth.Test.OpenId.RelyingParty { this.settings.RequireSsl = false; Assert.IsFalse(this.settings.RequireSsl); } + + /// <summary> + /// Verifies that the <see cref="RelyingPartySecuritySettings.RequireDirectedIdentity"/> + /// property getter/setter are implemented correctly. + /// </summary> + [TestMethod] + public void RequireDirectedIdentity() { + this.settings.RequireDirectedIdentity = true; + Assert.IsTrue(this.settings.RequireDirectedIdentity); + this.settings.RequireDirectedIdentity = false; + Assert.IsFalse(this.settings.RequireDirectedIdentity); + } } } diff --git a/src/DotNetOpenAuth/Configuration/OpenIdRelyingPartySecuritySettingsElement.cs b/src/DotNetOpenAuth/Configuration/OpenIdRelyingPartySecuritySettingsElement.cs index 7f7dd98..01821e9 100644 --- a/src/DotNetOpenAuth/Configuration/OpenIdRelyingPartySecuritySettingsElement.cs +++ b/src/DotNetOpenAuth/Configuration/OpenIdRelyingPartySecuritySettingsElement.cs @@ -36,6 +36,11 @@ namespace DotNetOpenAuth.Configuration { private const string RequireSslConfigName = "requireSsl"; /// <summary> + /// Gets the name of the @requireDirectedIdentity attribute. + /// </summary> + private const string RequireDirectedIdentityConfigName = "requireDirectedIdentity"; + + /// <summary> /// Gets the name of the @rejectUnsolicitedAssertions attribute. /// </summary> private const string RejectUnsolicitedAssertionsConfigName = "rejectUnsolicitedAssertions"; @@ -66,6 +71,16 @@ namespace DotNetOpenAuth.Configuration { } /// <summary> + /// Gets or sets a value indicating whether only OP Identifiers will be discoverable + /// when creating authentication requests. + /// </summary> + [ConfigurationProperty(RequireDirectedIdentityConfigName, DefaultValue = false)] + public bool RequireDirectedIdentity { + get { return (bool)this[RequireDirectedIdentityConfigName]; } + set { this[RequireDirectedIdentityConfigName] = value; } + } + + /// <summary> /// Gets or sets the minimum OpenID version a Provider is required to support in order for this library to interoperate with it. /// </summary> /// <remarks> @@ -142,6 +157,7 @@ namespace DotNetOpenAuth.Configuration { RelyingPartySecuritySettings settings = new RelyingPartySecuritySettings(); settings.RequireSsl = this.RequireSsl; + settings.RequireDirectedIdentity = this.RequireDirectedIdentity; settings.MinimumRequiredOpenIdVersion = this.MinimumRequiredOpenIdVersion; settings.MinimumHashBitLength = this.MinimumHashBitLength; settings.MaximumHashBitLength = this.MaximumHashBitLength; diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/AuthenticationRequest.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/AuthenticationRequest.cs index b3a9020..50db4cf 100644 --- a/src/DotNetOpenAuth/OpenId/RelyingParty/AuthenticationRequest.cs +++ b/src/DotNetOpenAuth/OpenId/RelyingParty/AuthenticationRequest.cs @@ -298,9 +298,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty { } // Filter disallowed endpoints. - if (relyingParty.SecuritySettings.RejectDelegatingIdentifiers) { - serviceEndpoints = serviceEndpoints.Where(se => se.ClaimedIdentifier == se.ProviderLocalIdentifier); - } + serviceEndpoints = relyingParty.SecuritySettings.FilterEndpoints(serviceEndpoints); // Call another method that defers request generation. return CreateInternal(userSuppliedIdentifier, relyingParty, realm, returnToUrl, serviceEndpoints, createNewAssociationsAsNeeded); diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/RelyingPartySecuritySettings.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/RelyingPartySecuritySettings.cs index 2019d16..4e2374c 100644 --- a/src/DotNetOpenAuth/OpenId/RelyingParty/RelyingPartySecuritySettings.cs +++ b/src/DotNetOpenAuth/OpenId/RelyingParty/RelyingPartySecuritySettings.cs @@ -6,6 +6,8 @@ namespace DotNetOpenAuth.OpenId.RelyingParty { using System; + using System.Collections.Generic; + using System.Linq; using DotNetOpenAuth.Messaging; /// <summary> @@ -51,6 +53,12 @@ namespace DotNetOpenAuth.OpenId.RelyingParty { public bool RequireSsl { get; set; } /// <summary> + /// Gets or sets a value indicating whether only OP Identifiers will be discoverable + /// when creating authentication requests. + /// </summary> + public bool RequireDirectedIdentity { get; set; } + + /// <summary> /// Gets or sets the oldest version of OpenID the remote party is allowed to implement. /// </summary> /// <value>Defaults to <see cref="ProtocolVersion.V10"/></value> @@ -80,5 +88,16 @@ namespace DotNetOpenAuth.OpenId.RelyingParty { /// directly issued by the Provider that is sending the assertion. /// </remarks> public bool RejectDelegatingIdentifiers { get; set; } + + /// <summary> + /// Filters out any disallowed endpoints. + /// </summary> + /// <param name="endpoints">The endpoints discovered on an Identifier.</param> + /// <returns>A sequence of endpoints that satisfy all security requirements.</returns> + internal IEnumerable<ServiceEndpoint> FilterEndpoints(IEnumerable<ServiceEndpoint> endpoints) { + return endpoints + .Where(se => !this.RejectDelegatingIdentifiers || se.ClaimedIdentifier == se.ProviderLocalIdentifier) + .Where(se => !this.RequireDirectedIdentity || se.ClaimedIdentifier == se.Protocol.ClaimedIdentifierForOPIdentifier); + } } } |