[project @ Ported patch to remove token]

2 files changed, 86 insertions, 166 deletions

diff --git a/Auth/OpenID/Consumer.php b/Auth/OpenID/Consumer.php
index 3566b7b..dea5326 100644
--- a/Auth/OpenID/Consumer.php
+++ b/Auth/OpenID/Consumer.php
@@ -353,7 +353,7 @@ class Auth_OpenID_Consumer {
     function &beginWithoutDiscovery($endpoint)
     {
         $auth_req = $this->consumer->begin($endpoint);
-        $this->session->set($this->_token_key, $auth_req->token);
+        $this->session->set($this->_token_key, $auth_req->endpoint);
         return $auth_req;
     }
 
@@ -374,13 +374,13 @@ class Auth_OpenID_Consumer {
     {
         $query = Auth_OpenID::fixArgs($query);
 
-        $token = $this->session->get($this->_token_key);
+        $endpoint = $this->session->get($this->_token_key);
 
-        if ($token === null) {
+        if ($endpoint === null) {
             $response = new Auth_OpenID_FailureResponse(null,
                                                    'No session state found');
         } else {
-            $response = $this->consumer->complete($query, $token);
+            $response = $this->consumer->complete($query, $endpoint);
             $this->session->del($this->_token_key);
         }
 
@@ -429,15 +429,6 @@ class Auth_OpenID_GenericConsumer {
     var $nonce_chrs = Auth_OpenID_DEFAULT_NONCE_CHRS;
 
     /**
-     * How long should an authentication session stay good?
-     *
-     * In units of sections. Shorter times mean less opportunity for
-     * attackers, longer times mean less chance of a user's session
-     * timing out.
-     */
-    var $token_lifetime = Auth_OpenID_DEFAULT_TOKEN_LIFETIME;
-
-    /**
      * This method initializes a new {@link Auth_OpenID_Consumer}
      * instance to access the library.
      *
@@ -477,43 +468,32 @@ class Auth_OpenID_GenericConsumer {
     function begin($service_endpoint)
     {
         $nonce = $this->_createNonce();
-        $token = $this->_genToken($service_endpoint->identity_url,
-                                  $service_endpoint->getServerID(),
-                                  $service_endpoint->server_url);
         $assoc = $this->_getAssociation($service_endpoint->server_url);
-        $r = new Auth_OpenID_AuthRequest($token, $assoc, $service_endpoint);
+        $r = new Auth_OpenID_AuthRequest($assoc, $service_endpoint);
         $r->return_to_args['nonce'] = $nonce;
         return $r;
     }
 
-    function complete($query, $token)
+    function complete($query, $endpoint)
     {
         $mode = Auth_OpenID::arrayGet($query, 'openid.mode',
                                       '<no mode specified>');
 
-        $pieces = $this->_splitToken($token);
-        if ($pieces === null) {
-            $pieces = array(null, null, null);
-        }
-
-        list($identity_url, $delegate, $server_url) = $pieces;
-
         if ($mode == Auth_OpenID_CANCEL) {
-            return new Auth_OpenID_CancelResponse($identity_url);
+            return new Auth_OpenID_CancelResponse($endpoint);
         } else if ($mode == 'error') {
             $error = Auth_OpenID::arrayGet($query, 'openid.error');
-            return new Auth_OpenID_FailureResponse($identity_url, $error);
+            return new Auth_OpenID_FailureResponse($endpoint, $error);
         } else if ($mode == 'id_res') {
-            if ($identity_url === null) {
+            if ($endpoint->identity_url === null) {
                 return new Auth_OpenID_FailureResponse($identity_url,
-                                                    "No session state found");
+                                               "No session state found");
             }
 
-            $response = $this->_doIdRes($query, $identity_url, $delegate,
-                                        $server_url);
+            $response = $this->_doIdRes($query, $endpoint);
 
             if ($response === null) {
-                return new Auth_OpenID_FailureResponse($identity_url,
+                return new Auth_OpenID_FailureResponse($endpoint,
                                                        "HTTP request failed");
             }
             if ($response->status == Auth_OpenID_SUCCESS) {
@@ -524,7 +504,7 @@ class Auth_OpenID_GenericConsumer {
                 return $response;
             }
         } else {
-            return new Auth_OpenID_FailureResponse($identity_url,
+            return new Auth_OpenID_FailureResponse($endpoint,
                                            sprintf("Invalid openid.mode '%s'",
                                                    $mode));
         }
@@ -533,13 +513,13 @@ class Auth_OpenID_GenericConsumer {
     /**
      * @access private
      */
-    function _doIdRes($query, $consumer_id, $server_id, $server_url)
+    function _doIdRes($query, $endpoint)
     {
         $user_setup_url = Auth_OpenID::arrayGet($query,
                                                 'openid.user_setup_url');
 
         if ($user_setup_url !== null) {
-            return new Auth_OpenID_SetupNeededResponse($consumer_id,
+            return new Auth_OpenID_SetupNeededResponse($endpoint,
                                                        $user_setup_url);
         }
 
@@ -549,55 +529,65 @@ class Auth_OpenID_GenericConsumer {
                                              'openid.assoc_handle', null);
 
         if (($return_to === null) ||
-            ($server_id === null) ||
+            ($server_id2 === null) ||
             ($assoc_handle === null)) {
-            return new Auth_OpenID_FailureResponse($consumer_id,
+            return new Auth_OpenID_FailureResponse($endpoint,
                                                    "Missing required field");
         }
 
-        if ($server_id != $server_id2) {
-            return new Auth_OpenID_FailureResponse($consumer_id,
+        if ($endpoint->delegate != $server_id2) {
+            return new Auth_OpenID_FailureResponse($endpoint,
                                              "Server ID (delegate) mismatch");
         }
 
         $signed = Auth_OpenID::arrayGet($query, 'openid.signed');
 
-        $assoc = $this->store->getAssociation($server_url, $assoc_handle);
+        $assoc = $this->store->getAssociation($endpoint->server_url,
+                                              $assoc_handle);
 
         if ($assoc === null) {
             // It's not an association we know about.  Dumb mode is
             // our only possible path for recovery.
-            if ($this->_checkAuth($query, $server_url)) {
-                return new Auth_OpenID_SuccessResponse($consumer_id, $query,
+            if ($this->_checkAuth($query, $endpoint->server_url)) {
+                return new Auth_OpenID_SuccessResponse($endpoint, $query,
                                                        $signed);
             } else {
-                return new Auth_OpenID_FailureResponse($consumer_id,
+                return new Auth_OpenID_FailureResponse($endpoint,
                                        "Server denied check_authentication");
             }
         }
 
         if ($assoc->getExpiresIn() <= 0) {
-            $msg = sprintf("Association with %s expired", $server_url);
-            return new Auth_OpenID_FailureResponse($consumer_id, $msg);
+            $msg = sprintf("Association with %s expired",
+                           $endpoint->server_url);
+            return new Auth_OpenID_FailureResponse($endpoint, $msg);
         }
 
         // Check the signature
         $sig = Auth_OpenID::arrayGet($query, 'openid.sig', null);
         if (($sig === null) ||
             ($signed === null)) {
-            return new Auth_OpenID_FailureResponse($consumer_id,
+            return new Auth_OpenID_FailureResponse($endpoint,
                                                "Missing argument signature");
         }
 
         $signed_list = explode(",", $signed);
+
+        //Fail if the identity field is present but not signed
+        if (($endpoint->identity_url !== null) &&
+            (!in_array('identity', $signed_list))) {
+            $msg = '"openid.identity" not signed';
+            return new Auth_OpenID_FailureResponse($endpoint, $msg);
+        }
+
         $v_sig = $assoc->signDict($signed_list, $query);
 
         if ($v_sig != $sig) {
-            return new Auth_OpenID_FailureResponse($consumer_id,
+            return new Auth_OpenID_FailureResponse($endpoint,
                                                    "Bad signature");
         }
 
-        return Auth_OpenID_SuccessResponse::fromQuery($consumer_id,
+        return Auth_OpenID_SuccessResponse::fromQuery($endpoint,
                                                       $query, $signed);
     }
 
@@ -715,9 +705,8 @@ class Auth_OpenID_GenericConsumer {
         foreach ($query as $k => $v) {
             if ($k == 'nonce') {
                 if ($v != $nonce) {
-                    return new Auth_OpenID_FailureResponse(
-                                                  $response->identity_url,
-                                                  "Nonce mismatch");
+                    return new Auth_OpenID_FailureResponse($response,
+                                                           "Nonce mismatch");
                 } else {
                     $found = true;
                     break;
@@ -726,13 +715,13 @@ class Auth_OpenID_GenericConsumer {
         }
 
         if (!$found) {
-            return new Auth_OpenID_FailureResponse($response->identity_url,
+            return new Auth_OpenID_FailureResponse($response,
                                  sprintf("Nonce missing from return_to: %s",
                                          $response->getReturnTo()));
         }
 
         if (!$this->store->useNonce($nonce)) {
-            return new Auth_OpenID_FailureResponse($response->identity_url,
+            return new Auth_OpenID_FailureResponse($response,
                                                    "Nonce missing from store");
         }
 
@@ -770,7 +759,7 @@ class Auth_OpenID_GenericConsumer {
         $assoc = $this->store->getAssociation($server_url);
 
         if (($assoc === null) ||
-            ($replace && ($assoc->getExpiresIn() < $this->token_lifetime))) {
+            ($replace && ($assoc->getExpiresIn() <= 0))) {
 
             $args = array(
                           'openid.mode' =>  'associate',
@@ -790,55 +779,6 @@ class Auth_OpenID_GenericConsumer {
     /**
      * @access private
      */
-    function _genToken($consumer_id, $server_id, $server_url)
-    {
-        $timestamp = strval(time());
-        $elements = array($timestamp, $consumer_id, $server_id, $server_url);
-
-        $joined = implode("\x00", $elements);
-        $sig = Auth_OpenID_HMACSHA1($this->store->getAuthKey(),
-                                              $joined);
-
-        return base64_encode($sig . $joined);
-    }
-
-    /**
-     * @access private
-     */
-    function _splitToken($token)
-    {
-        $token = base64_decode($token);
-        if (strlen($token) < 20) {
-            return null;
-        }
-
-        $sig = substr($token, 0, 20);
-        $joined = substr($token, 20);
-        $check_sig = Auth_OpenID_HMACSHA1($this->store->getAuthKey(), $joined);
-        if ($check_sig != $sig) {
-            return null;
-        }
-
-        $split = explode("\x00", $joined);
-        if (count($split) != 4) {
-            return null;
-        }
-
-        $ts = intval($split[0]);
-        if ($ts == 0) {
-            return null;
-        }
-
-        if ($ts + $this->token_lifetime < time()) {
-            return null;
-        }
-
-        return array_slice($split, 1);
-    }
-
-    /**
-     * @access private
-     */
     function _fetchAssociation($dh, $server_url, $body)
     {
         $ret = @$this->fetcher->post($server_url, $body);
@@ -938,13 +878,12 @@ class Auth_OpenID_AuthRequest {
      * class.  Instances of this class are created by the library when
      * needed.
      */
-    function Auth_OpenID_AuthRequest($token, $assoc, $endpoint)
+    function Auth_OpenID_AuthRequest($assoc, $endpoint)
     {
         $this->assoc = $assoc;
         $this->endpoint = $endpoint;
         $this->extra_args = array();
         $this->return_to_args = array();
-        $this->token = $token;
     }
 
     /**
@@ -1042,16 +981,17 @@ class Auth_OpenID_SuccessResponse extends Auth_OpenID_ConsumerResponse {
     /**
      * @access private
      */
-    function Auth_OpenID_SuccessResponse($identity_url, $signed_args)
+    function Auth_OpenID_SuccessResponse($endpoint, $signed_args)
     {
-        $this->identity_url = $identity_url;
+        $this->endpoint = $endpoint;
+        $this->identity_url = $endpoint->identity_url;
         $this->signed_args = $signed_args;
     }
 
     /**
      * @access private
      */
-    function fromQuery($identity_url, $query, $signed)
+    function fromQuery($endpoint, $query, $signed)
     {
         $signed_args = array();
         foreach (explode(",", $signed) as $field_name) {
@@ -1059,7 +999,7 @@ class Auth_OpenID_SuccessResponse extends Auth_OpenID_ConsumerResponse {
             $signed_args[$field_name] = Auth_OpenID::arrayGet($query,
                                                               $field_name, '');
         }
-        return new Auth_OpenID_SuccessResponse($identity_url, $signed_args);
+        return new Auth_OpenID_SuccessResponse($endpoint, $signed_args);
     }
 
     /**
@@ -1117,9 +1057,14 @@ class Auth_OpenID_SuccessResponse extends Auth_OpenID_ConsumerResponse {
 class Auth_OpenID_FailureResponse extends Auth_OpenID_ConsumerResponse {
     var $status = Auth_OpenID_FAILURE;
 
-    function Auth_OpenID_FailureResponse($identity_url = null, $message = null)
+    function Auth_OpenID_FailureResponse($endpoint, $message = null)
     {
-        $this->identity_url = $identity_url;
+        $this->endpoint = $endpoint;
+        if ($endpoint !== null) {
+            $this->identity_url = $endpoint->identity_url;
+        } else {
+            $this->identity_url = null;
+        }
         $this->message = $message;
     }
 }
@@ -1139,9 +1084,10 @@ class Auth_OpenID_FailureResponse extends Auth_OpenID_ConsumerResponse {
 class Auth_OpenID_CancelResponse extends Auth_OpenID_ConsumerResponse {
     var $status = Auth_OpenID_CANCEL;
 
-    function Auth_OpenID_CancelResponse($identity_url = null)
+    function Auth_OpenID_CancelResponse($endpoint)
     {
-        $this->identity_url = $identity_url;
+        $this->endpoint = $endpoint;
+        $this->identity_url = $endpoint->identity_url;
     }
 }
 
@@ -1165,10 +1111,11 @@ class Auth_OpenID_CancelResponse extends Auth_OpenID_ConsumerResponse {
 class Auth_OpenID_SetupNeededResponse extends Auth_OpenID_ConsumerResponse {
     var $status = Auth_OpenID_SETUP_NEEDED;
 
-    function Auth_OpenID_SetupNeededResponse($identity_url = null,
+    function Auth_OpenID_SetupNeededResponse($endpoint,
                                              $setup_url = null)
     {
-        $this->identity_url = $identity_url;
+        $this->endpoint = $endpoint;
+        $this->identity_url = $endpoint->identity_url;
         $this->setup_url = $setup_url;
     }
 }
diff --git a/Tests/Auth/OpenID/Consumer.php b/Tests/Auth/OpenID/Consumer.php
index 156fcdf..55f888f 100644
--- a/Tests/Auth/OpenID/Consumer.php
+++ b/Tests/Auth/OpenID/Consumer.php
@@ -213,7 +213,7 @@ class Tests_Auth_OpenID_Consumer extends PHPUnit_TestCase {
             $query['openid.sig'] = 'fake';
         }
 
-        $result = $consumer->complete($query, $result->token);
+        $result = $consumer->complete($query, $result->endpoint);
 
         $this->assertEquals($result->status, 'success');
         $this->assertEquals($result->identity_url, $user_url);
@@ -311,12 +311,15 @@ class _TestIdRes extends PHPUnit_TestCase {
         $cl = $this->consumer_class;
         $this->consumer = new $cl($this->store);
         $this->return_to = "nonny";
+        $this->endpoint = new Auth_OpenID_ServiceEndpoint();
+
         $this->server_id = "sirod";
         $this->server_url = "serlie";
         $this->consumer_id = "consu";
-        $this->token = $this->consumer->_genToken($this->consumer_id,
-                                                  $this->server_id,
-                                                  $this->server_url);
+
+        $this->endpoint->identity_url = $this->consumer_id;
+        $this->endpoint->server_url = $this->server_url;
+        $this->endpoint->delegate = $this->server_id;
     }
 }
 
@@ -327,8 +330,7 @@ class Tests_Auth_OpenID_Consumer_TestSetupNeeded extends _TestIdRes {
         $query = array(
                        'openid.mode' => 'id_res',
                        'openid.user_setup_url' => $setup_url);
-        $ret = $this->consumer->_doIdRes($query, $this->consumer_id,
-                                         $this->server_id, $this->server_url);
+        $ret = $this->consumer->_doIdRes($query, $this->endpoint);
         $this->assertEquals($ret->status, Auth_OpenID_SETUP_NEEDED);
         $this->assertEquals($ret->setup_url, $setup_url);
     }
@@ -357,7 +359,7 @@ class Tests_Auth_OpenID_Consumer_CheckNonceTest extends _TestIdRes {
     {
         $this->return_to = sprintf('http://rt.unittest/?nonce=%s',
                                    $this->nonce);
-        $this->response = new Auth_OpenID_SuccessResponse($this->consumer_id,
+        $this->response = new Auth_OpenID_SuccessResponse($this->endpoint,
                                    array('openid.return_to' => $this->return_to));
 
         $ret = $this->consumer->_checkNonce($this->response, $this->nonce);
@@ -371,7 +373,7 @@ class Tests_Auth_OpenID_Consumer_CheckNonceTest extends _TestIdRes {
         $this->store->useNonce($this->nonce);
         $this->return_to = sprintf('http://rt.unittest/?nonce=%s',
                                    $this->nonce);
-        $this->response = new Auth_OpenID_SuccessResponse($this->consumer_id,
+        $this->response = new Auth_OpenID_SuccessResponse($this->endpoint,
                                  array('openid.return_to' => $this->return_to));
         $ret = $this->consumer->_checkNonce($this->response, $this->nonce);
         $this->assertEquals($ret->status, Auth_OpenID_FAILURE);
@@ -383,7 +385,7 @@ class Tests_Auth_OpenID_Consumer_CheckNonceTest extends _TestIdRes {
     {
         $this->return_to = sprintf('http://rt.unittest/?nonce=HACKED-%s',
                                    $this->nonce);
-        $this->response = new Auth_OpenID_SuccessResponse($this->consumer_id,
+        $this->response = new Auth_OpenID_SuccessResponse($this->endpoint,
                                   array('openid.return_to' => $this->return_to));
         $ret = $this->consumer->_checkNonce($this->response, $this->nonce);
         $this->assertEquals($ret->status, Auth_OpenID_FAILURE);
@@ -394,7 +396,7 @@ class Tests_Auth_OpenID_Consumer_CheckNonceTest extends _TestIdRes {
     function test_missingNonce()
     {
         // no nonce parameter on the return_to
-        $this->response = new Auth_OpenID_SuccessResponse($this->consumer_id,
+        $this->response = new Auth_OpenID_SuccessResponse($this->endpoint,
                                      array('openid.return_to' => $this->return_to));
         $ret = $this->consumer->_checkNonce($this->response, $this->nonce);
         $this->assertEquals($ret->status, Auth_OpenID_FAILURE);
@@ -409,10 +411,7 @@ class Tests_Auth_OpenID_Consumer_TestCheckAuthTriggered extends _TestIdRes {
 
     function _doIdRes($query)
     {
-        return $this->consumer->_doIdRes($query,
-                                         $this->consumer_id,
-                                         $this->server_id,
-                                         $this->server_url);
+        return $this->consumer->_doIdRes($query, $this->endpoint);
     }
 
     function test_checkAuthTriggered()
@@ -528,37 +527,12 @@ class _MockFetcher {
 }
 
 class Tests_Auth_OpenID_Complete extends _TestIdRes {
-    function test_badTokenLength()
-    {
-        $query = array('openid.mode' => 'id_res');
-        $r = $this->consumer->complete($query, 'badtoken');
-        $this->assertEquals($r->status, Auth_OpenID_FAILURE);
-        $this->assertTrue($r->identity_url === null);
-    }
-
-    function test_badTokenSig()
-    {
-        $query = array('openid.mode' => 'id_res');
-        $r = $this->consumer->complete($query, 'badtoken' . $this->token);
-        $this->assertEquals($r->status, Auth_OpenID_FAILURE);
-        $this->assertTrue($r->identity_url === null);
-    }
-
-    function test_expiredToken()
-    {
-        $this->consumer->token_lifetime = -1; // in the past
-        $query = array('openid.mode' => 'id_res');
-        $r = $this->consumer->complete($query, $this->token);
-        $this->assertEquals($r->status, Auth_OpenID_FAILURE, "Status comparison");
-        $this->assertTrue($r->identity_url === null, "Identity URL comparison");
-    }
-
     function test_cancel()
     {
         $query = array('openid.mode' => 'cancel');
-        $r = $this->consumer->complete($query, 'badtoken');
+        $r = $this->consumer->complete($query, $this->endpoint);
         $this->assertEquals($r->status, Auth_OpenID_CANCEL);
-        $this->assertTrue($r->identity_url === null);
+        $this->assertTrue($r->identity_url == $this->endpoint->identity_url);
     }
 
     function test_error()
@@ -566,24 +540,24 @@ class Tests_Auth_OpenID_Complete extends _TestIdRes {
         $msg = 'an error message';
         $query = array('openid.mode' =>'error',
                        'openid.error' => $msg);
-        $r = $this->consumer->complete($query, 'badtoken');
+        $r = $this->consumer->complete($query, $this->endpoint);
         $this->assertEquals($r->status, Auth_OpenID_FAILURE);
-        $this->assertTrue($r->identity_url === null);
+        $this->assertTrue($r->identity_url == $this->endpoint->identity_url);
         $this->assertEquals($r->message, $msg);
     }
 
     function test_noMode()
     {
         $query = array();
-        $r = $this->consumer->complete($query, 'badtoken');
+        $r = $this->consumer->complete($query, $this->endpoint);
         $this->assertEquals($r->status, Auth_OpenID_FAILURE);
-        $this->assertTrue($r->identity_url === null);
+        $this->assertTrue($r->identity_url == $this->endpoint->identity_url);
     }
 
     function test_idResMissingField()
     {
         $query = array('openid.mode' => 'id_res');
-        $r = $this->consumer->complete($query, $this->token);
+        $r = $this->consumer->complete($query, $this->endpoint);
         $this->assertEquals($r->status, Auth_OpenID_FAILURE);
         $this->assertEquals($r->identity_url, $this->consumer_id);
     }
@@ -594,7 +568,7 @@ class Tests_Auth_OpenID_Complete extends _TestIdRes {
                        'openid.return_to' => 'return_to (just anything)',
                        'openid.identity' => 'something wrong (not this->consumer_id)',
                        'openid.assoc_handle' => 'does not matter');
-        $r = $this->consumer->complete($query, $this->token);
+        $r = $this->consumer->complete($query, $this->endpoint);
         $this->assertEquals($r->status, Auth_OpenID_FAILURE);
         $this->assertEquals($r->identity_url, $this->consumer_id);
         $this->assertTrue(strpos($r->message, 'delegate') !== false);
@@ -681,10 +655,9 @@ class Tests_Auth_OpenID_CheckAuthResponse extends _TestIdRes {
 class _IdResFetchFailingConsumer extends Auth_OpenID_GenericConsumer {
     var $message = 'fetch failed';
 
-    function _doIdRes($query, $consumer_id, $server_id,
-                      $server_url)
+    function _doIdRes($query, $endpoint)
     {
-        return new Auth_OpenID_FailureResponse($consumer_id,
+        return new Auth_OpenID_FailureResponse($endpoint,
                                                $this->message);
     }
 }
@@ -695,7 +668,7 @@ class Tests_Auth_OpenID_FetchErrorInIdRes extends _TestIdRes {
     function test_idResFailure()
     {
         $query = array('openid.mode' => 'id_res');
-        $r = $this->consumer->complete($query, $this->token);
+        $r = $this->consumer->complete($query, $this->endpoint);
         $this->assertEquals($r->status, Auth_OpenID_FAILURE);
         $this->assertEquals($r->identity_url, $this->consumer_id);
         $this->assertEquals($this->consumer->message, $r->message);