/python-openid

Permalink
Switch branches/tags
Nothing to show
Find file
python-openid/examples/server.py
Fetching contributors…
Cannot retrieve contributors at this time
Raw Blame History
722 lines (615 sloc) 24 KB
#!/usr/bin/env python
__copyright__ = 'Copyright 2005-2008, Janrain, Inc.'
from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
from urlparse import urlparse
import time
import Cookie
import cgi
import cgitb
import sys
def quoteattr(s):
qs = cgi.escape(s, 1)
return '"%s"' % (qs,)
try:
import openid
except ImportError:
sys.stderr.write("""
Failed to import the OpenID library. In order to use this example, you
must either install the library (see INSTALL in the root of the
distribution) or else add the library to python's import path (the
PYTHONPATH environment variable).
For more information, see the README in the root of the library
distribution.""")
sys.exit(1)
from openid.extensions import sreg
from openid.server import server
from openid.store.filestore import FileOpenIDStore
from openid.consumer import discover
class OpenIDHTTPServer(HTTPServer):
"""
http server that contains a reference to an OpenID Server and
knows its base URL.
"""
def __init__(self, *args, **kwargs):
HTTPServer.__init__(self, *args, **kwargs)
if self.server_port != 80:
self.base_url = ('http://%s:%s/' %
(self.server_name, self.server_port))
else:
self.base_url = 'http://%s/' % (self.server_name,)
self.openid = None
self.approved = {}
self.lastCheckIDRequest = {}
def setOpenIDServer(self, oidserver):
self.openid = oidserver
class ServerHandler(BaseHTTPRequestHandler):
def __init__(self, *args, **kwargs):
self.user = None
BaseHTTPRequestHandler.__init__(self, *args, **kwargs)
def do_GET(self):
try:
self.parsed_uri = urlparse(self.path)
self.query = {}
for k, v in cgi.parse_qsl(self.parsed_uri[4]):
self.query[k] = v
self.setUser()
path = self.parsed_uri[2].lower()
if path == '/':
self.showMainPage()
elif path == '/openidserver':
self.serverEndPoint(self.query)
elif path == '/login':
self.showLoginPage('/', '/')
elif path == '/loginsubmit':
self.doLogin()
elif path.startswith('/id/'):
self.showIdPage(path)
elif path.startswith('/yadis/'):
self.showYadis(path[7:])
elif path == '/serveryadis':
self.showServerYadis()
else:
self.send_response(404)
self.end_headers()
except (KeyboardInterrupt, SystemExit):
raise
except:
self.send_response(500)
self.send_header('Content-type', 'text/html')
self.end_headers()
self.wfile.write(cgitb.html(sys.exc_info(), context=10))
def do_POST(self):
try:
self.parsed_uri = urlparse(self.path)
self.setUser()
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length)
self.query = {}
for k, v in cgi.parse_qsl(post_data):
self.query[k] = v
path = self.parsed_uri[2]
if path == '/openidserver':
self.serverEndPoint(self.query)
elif path == '/allow':
self.handleAllow(self.query)
else:
self.send_response(404)
self.end_headers()
except (KeyboardInterrupt, SystemExit):
raise
except:
self.send_response(500)
self.send_header('Content-type', 'text/html')
self.end_headers()
self.wfile.write(cgitb.html(sys.exc_info(), context=10))
def handleAllow(self, query):
# pretend this next bit is keying off the user's session or something,
# right?
request = self.server.lastCheckIDRequest.get(self.user)
if 'yes' in query:
if 'login_as' in query:
self.user = self.query['login_as']
if request.idSelect():
identity = self.server.base_url + 'id/' + query['identifier']
else:
identity = request.identity
trust_root = request.trust_root
if self.query.get('remember', 'no') == 'yes':
self.server.approved[(identity, trust_root)] = 'always'
response = self.approved(request, identity)
elif 'no' in query:
response = request.answer(False)
else:
assert False, 'strange allow post. %r' % (query,)
self.displayResponse(response)
def setUser(self):
cookies = self.headers.get('Cookie')
if cookies:
morsel = Cookie.BaseCookie(cookies).get('user')
if morsel:
self.user = morsel.value
def isAuthorized(self, identity_url, trust_root):
if self.user is None:
return False
if identity_url != self.server.base_url + 'id/' + self.user:
return False
key = (identity_url, trust_root)
return self.server.approved.get(key) is not None
def serverEndPoint(self, query):
try:
request = self.server.openid.decodeRequest(query)
except server.ProtocolError, why:
self.displayResponse(why)
return
if request is None:
# Display text indicating that this is an endpoint.
self.showAboutPage()
return
if request.mode in ["checkid_immediate", "checkid_setup"]:
self.handleCheckIDRequest(request)
else:
response = self.server.openid.handleRequest(request)
self.displayResponse(response)
def addSRegResponse(self, request, response):
sreg_req = sreg.SRegRequest.fromOpenIDRequest(request)
# In a real application, this data would be user-specific,
# and the user should be asked for permission to release
# it.
sreg_data = {
'nickname':self.user
}
sreg_resp = sreg.SRegResponse.extractResponse(sreg_req, sreg_data)
response.addExtension(sreg_resp)
def approved(self, request, identifier=None):
response = request.answer(True, identity=identifier)
self.addSRegResponse(request, response)
return response
def handleCheckIDRequest(self, request):
is_authorized = self.isAuthorized(request.identity, request.trust_root)
if is_authorized:
response = self.approved(request)
self.displayResponse(response)
elif request.immediate:
response = request.answer(False)
self.displayResponse(response)
else:
self.server.lastCheckIDRequest[self.user] = request
self.showDecidePage(request)
def displayResponse(self, response):
try:
webresponse = self.server.openid.encodeResponse(response)
except server.EncodingError, why:
text = why.response.encodeToKVForm()
self.showErrorPage('<pre>%s</pre>' % cgi.escape(text))
return
self.send_response(webresponse.code)
for header, value in webresponse.headers.iteritems():
self.send_header(header, value)
self.writeUserHeader()
self.end_headers()
if webresponse.body:
self.wfile.write(webresponse.body)
def doLogin(self):
if 'submit' in self.query:
if 'user' in self.query:
self.user = self.query['user']
else:
self.user = None
self.redirect(self.query['success_to'])
elif 'cancel' in self.query:
self.redirect(self.query['fail_to'])
else:
assert 0, 'strange login %r' % (self.query,)
def redirect(self, url):
self.send_response(302)
self.send_header('Location', url)
self.writeUserHeader()
self.end_headers()
def writeUserHeader(self):
if self.user is None:
t1970 = time.gmtime(0)
expires = time.strftime(
'Expires=%a, %d-%b-%y %H:%M:%S GMT', t1970)
self.send_header('Set-Cookie', 'user=;%s' % expires)
else:
self.send_header('Set-Cookie', 'user=%s' % self.user)
def showAboutPage(self):
endpoint_url = self.server.base_url + 'openidserver'
def link(url):
url_attr = quoteattr(url)
url_text = cgi.escape(url)
return '<a href=%s><code>%s</code></a>' % (url_attr, url_text)
def term(url, text):
return '<dt>%s</dt><dd>%s</dd>' % (link(url), text)
resources = [
(self.server.base_url, "This example server's home page"),
('http://www.openidenabled.com/',
'An OpenID community Web site, home of this library'),
('http://www.openid.net/', 'the official OpenID Web site'),
]
resource_markup = ''.join([term(url, text) for url, text in resources])
self.showPage(200, 'This is an OpenID server', msg="""\
<p>%s is an OpenID server endpoint.<p>
<p>For more information about OpenID, see:</p>
<dl>
%s
</dl>
""" % (link(endpoint_url), resource_markup,))
def showErrorPage(self, error_message):
self.showPage(400, 'Error Processing Request', err='''\
<p>%s</p>
<!--
This is a large comment. It exists to make this page larger.
That is unfortunately necessary because of the "smart"
handling of pages returned with an error code in IE.
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
*************************************************************
-->
''' % error_message)
def showDecidePage(self, request):
id_url_base = self.server.base_url+'id/'
# XXX: This may break if there are any synonyms for id_url_base,
# such as referring to it by IP address or a CNAME.
assert (request.identity.startswith(id_url_base) or
request.idSelect()), repr((request.identity, id_url_base))
expected_user = request.identity[len(id_url_base):]
if request.idSelect(): # We are being asked to select an ID
msg = '''\
<p>A site has asked for your identity. You may select an
identifier by which you would like this site to know you.
On a production site this would likely be a drop down list
of pre-created accounts or have the facility to generate
a random anonymous identifier.
</p>
'''
fdata = {
'id_url_base': id_url_base,
'trust_root': request.trust_root,
}
form = '''\
<form method="POST" action="/allow">
<table>
<tr><td>Identity:</td>
<td>%(id_url_base)s<input type='text' name='identifier'></td></tr>
<tr><td>Trust Root:</td><td>%(trust_root)s</td></tr>
</table>
<p>Allow this authentication to proceed?</p>
<input type="checkbox" id="remember" name="remember" value="yes"
/><label for="remember">Remember this
decision</label><br />
<input type="submit" name="yes" value="yes" />
<input type="submit" name="no" value="no" />
</form>
'''%fdata
elif expected_user == self.user:
msg = '''\
<p>A new site has asked to confirm your identity. If you
approve, the site represented by the trust root below will
be told that you control identity URL listed below. (If
you are using a delegated identity, the site will take
care of reversing the delegation on its own.)</p>'''
fdata = {
'identity': request.identity,
'trust_root': request.trust_root,
}
form = '''\
<table>
<tr><td>Identity:</td><td>%(identity)s</td></tr>
<tr><td>Trust Root:</td><td>%(trust_root)s</td></tr>
</table>
<p>Allow this authentication to proceed?</p>
<form method="POST" action="/allow">
<input type="checkbox" id="remember" name="remember" value="yes"
/><label for="remember">Remember this
decision</label><br />
<input type="submit" name="yes" value="yes" />
<input type="submit" name="no" value="no" />
</form>''' % fdata
else:
mdata = {
'expected_user': expected_user,
'user': self.user,
}
msg = '''\
<p>A site has asked for an identity belonging to
%(expected_user)s, but you are logged in as %(user)s. To
log in as %(expected_user)s and approve the login request,
hit OK below. The "Remember this decision" checkbox
applies only to the trust root decision.</p>''' % mdata
fdata = {
'identity': request.identity,
'trust_root': request.trust_root,
'expected_user': expected_user,
}
form = '''\
<table>
<tr><td>Identity:</td><td>%(identity)s</td></tr>
<tr><td>Trust Root:</td><td>%(trust_root)s</td></tr>
</table>
<p>Allow this authentication to proceed?</p>
<form method="POST" action="/allow">
<input type="checkbox" id="remember" name="remember" value="yes"
/><label for="remember">Remember this
decision</label><br />
<input type="hidden" name="login_as" value="%(expected_user)s"/>
<input type="submit" name="yes" value="yes" />
<input type="submit" name="no" value="no" />
</form>''' % fdata
self.showPage(200, 'Approve OpenID request?', msg=msg, form=form)
def showIdPage(self, path):
link_tag = '<link rel="openid.server" href="%sopenidserver">' %\
self.server.base_url
yadis_loc_tag = '<meta http-equiv="x-xrds-location" content="%s">'%\
(self.server.base_url+'yadis/'+path[4:])
disco_tags = link_tag + yadis_loc_tag
ident = self.server.base_url + path[1:]
approved_trust_roots = []
for (aident, trust_root) in self.server.approved.keys():
if aident == ident:
trs = '<li><tt>%s</tt></li>\n' % cgi.escape(trust_root)
approved_trust_roots.append(trs)
if approved_trust_roots:
prepend = '<p>Approved trust roots:</p>\n<ul>\n'
approved_trust_roots.insert(0, prepend)
approved_trust_roots.append('</ul>\n')
msg = ''.join(approved_trust_roots)
else:
msg = ''
self.showPage(200, 'An Identity Page', head_extras=disco_tags, msg='''\
<p>This is an identity page for %s.</p>
%s
''' % (ident, msg))
def showYadis(self, user):
self.send_response(200)
self.send_header('Content-type', 'application/xrds+xml')
self.end_headers()
endpoint_url = self.server.base_url + 'openidserver'
user_url = self.server.base_url + 'id/' + user
self.wfile.write("""\
<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS
xmlns:xrds="xri://$xrds"
xmlns="xri://$xrd*($v*2.0)">
<XRD>
<Service priority="0">
<Type>%s</Type>
<Type>%s</Type>
<URI>%s</URI>
<LocalID>%s</LocalID>
</Service>
</XRD>
</xrds:XRDS>
"""%(discover.OPENID_2_0_TYPE, discover.OPENID_1_0_TYPE,
endpoint_url, user_url))
def showServerYadis(self):
self.send_response(200)
self.send_header('Content-type', 'application/xrds+xml')
self.end_headers()
endpoint_url = self.server.base_url + 'openidserver'
self.wfile.write("""\
<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS
xmlns:xrds="xri://$xrds"
xmlns="xri://$xrd*($v*2.0)">
<XRD>
<Service priority="0">
<Type>%s</Type>
<URI>%s</URI>
</Service>
</XRD>
</xrds:XRDS>
"""%(discover.OPENID_IDP_2_0_TYPE, endpoint_url,))
def showMainPage(self):
yadis_tag = '<meta http-equiv="x-xrds-location" content="%s">'%\
(self.server.base_url + 'serveryadis')
if self.user:
openid_url = self.server.base_url + 'id/' + self.user
user_message = """\
<p>You are logged in as %s. Your OpenID identity URL is
<tt><a href=%s>%s</a></tt>. Enter that URL at an OpenID
consumer to test this server.</p>
""" % (self.user, quoteattr(openid_url), openid_url)
else:
user_message = """\
<p>This server uses a cookie to remember who you are in
order to simulate a standard Web user experience. You are
not <a href='/login'>logged in</a>.</p>"""
self.showPage(200, 'Main Page', head_extras = yadis_tag, msg='''\
<p>This is a simple OpenID server implemented using the <a
href="http://openid.schtuff.com/">Python OpenID
library</a>.</p>
%s
<p>To use this server with a consumer, the consumer must be
able to fetch HTTP pages from this web server. If this
computer is behind a firewall, you will not be able to use
OpenID consumers outside of the firewall with it.</p>
<p>The URL for this server is <a href=%s><tt>%s</tt></a>.</p>
''' % (user_message, quoteattr(self.server.base_url), self.server.base_url))
def showLoginPage(self, success_to, fail_to):
self.showPage(200, 'Login Page', form='''\
<h2>Login</h2>
<p>You may log in with any name. This server does not use
passwords because it is just a sample of how to use the OpenID
library.</p>
<form method="GET" action="/loginsubmit">
<input type="hidden" name="success_to" value="%s" />
<input type="hidden" name="fail_to" value="%s" />
<input type="text" name="user" value="" />
<input type="submit" name="submit" value="Log In" />
<input type="submit" name="cancel" value="Cancel" />
</form>
''' % (success_to, fail_to))
def showPage(self, response_code, title,
head_extras='', msg=None, err=None, form=None):
if self.user is None:
user_link = '<a href="/login">not logged in</a>.'
else:
user_link = 'logged in as <a href="/id/%s">%s</a>.<br /><a href="/loginsubmit?submit=true&success_to=/login">Log out</a>' % \
(self.user, self.user)
body = ''
if err is not None:
body += '''\
<div class="error">
%s
</div>
''' % err
if msg is not None:
body += '''\
<div class="message">
%s
</div>
''' % msg
if form is not None:
body += '''\
<div class="form">
%s
</div>
''' % form
contents = {
'title': 'Python OpenID Server Example - ' + title,
'head_extras': head_extras,
'body': body,
'user_link': user_link,
}
self.send_response(response_code)
self.writeUserHeader()
self.send_header('Content-type', 'text/html')
self.end_headers()
self.wfile.write('''<html>
<head>
<title>%(title)s</title>
%(head_extras)s
</head>
<style type="text/css">
h1 a:link {
color: black;
text-decoration: none;
}
h1 a:visited {
color: black;
text-decoration: none;
}
h1 a:hover {
text-decoration: underline;
}
body {
font-family: verdana,sans-serif;
width: 50em;
margin: 1em;
}
div {
padding: .5em;
}
table {
margin: none;
padding: none;
}
.banner {
padding: none 1em 1em 1em;
width: 100%%;
}
.leftbanner {
text-align: left;
}
.rightbanner {
text-align: right;
font-size: smaller;
}
.error {
border: 1px solid #ff0000;
background: #ffaaaa;
margin: .5em;
}
.message {
border: 1px solid #2233ff;
background: #eeeeff;
margin: .5em;
}
.form {
border: 1px solid #777777;
background: #ddddcc;
margin: .5em;
margin-top: 1em;
padding-bottom: 0em;
}
dd {
margin-bottom: 0.5em;
}
</style>
<body>
<table class="banner">
<tr>
<td class="leftbanner">
<h1><a href="/">Python OpenID Server Example</a></h1>
</td>
<td class="rightbanner">
You are %(user_link)s
</td>
</tr>
</table>
%(body)s
</body>
</html>
''' % contents)
def main(host, port, data_path):
addr = (host, port)
httpserver = OpenIDHTTPServer(addr, ServerHandler)
# Instantiate OpenID consumer store and OpenID consumer. If you
# were connecting to a database, you would create the database
# connection and instantiate an appropriate store here.
store = FileOpenIDStore(data_path)
oidserver = server.Server(store, httpserver.base_url + 'openidserver')
httpserver.setOpenIDServer(oidserver)
print 'Server running at:'
print httpserver.base_url
httpserver.serve_forever()
if __name__ == '__main__':
host = 'localhost'
data_path = 'sstore'
port = 8000
try:
import optparse
except ImportError:
pass # Use defaults (for Python 2.2)
else:
parser = optparse.OptionParser('Usage:\n %prog [options]')
parser.add_option(
'-d', '--data-path', dest='data_path', default=data_path,
help='Data directory for storing OpenID consumer state. '
'Defaults to "%default" in the current directory.')
parser.add_option(
'-p', '--port', dest='port', type='int', default=port,
help='Port on which to listen for HTTP requests. '
'Defaults to port %default.')
parser.add_option(
'-s', '--host', dest='host', default=host,
help='Host on which to listen for HTTP requests. '
'Also used for generating URLs. Defaults to %default.')
options, args = parser.parse_args()
if args:
parser.error('Expected no arguments. Got %r' % args)
host = options.host
port = options.port
data_path = options.data_path
main(host, port, data_path)