This repository has been archived by the owner on Jul 24, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 239
/
consumer.py
1875 lines (1481 loc) · 75.1 KB
/
consumer.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# -*- test-case-name: openid.test.test_consumer -*-
"""OpenID support for Relying Parties (aka Consumers).
This module documents the main interface with the OpenID consumer
library. The only part of the library which has to be used and isn't
documented in full here is the store required to create an
C{L{Consumer}} instance. More on the abstract store type and
concrete implementations of it that are provided in the documentation
for the C{L{__init__<Consumer.__init__>}} method of the
C{L{Consumer}} class.
OVERVIEW
========
The OpenID identity verification process most commonly uses the
following steps, as visible to the user of this library:
1. The user enters their OpenID into a field on the consumer's
site, and hits a login button.
2. The consumer site discovers the user's OpenID provider using
the Yadis protocol.
3. The consumer site sends the browser a redirect to the
OpenID provider. This is the authentication request as
described in the OpenID specification.
4. The OpenID provider's site sends the browser a redirect
back to the consumer site. This redirect contains the
provider's response to the authentication request.
The most important part of the flow to note is the consumer's site
must handle two separate HTTP requests in order to perform the
full identity check.
LIBRARY DESIGN
==============
This consumer library is designed with that flow in mind. The
goal is to make it as easy as possible to perform the above steps
securely.
At a high level, there are two important parts in the consumer
library. The first important part is this module, which contains
the interface to actually use this library. The second is the
C{L{openid.store.interface}} module, which describes the
interface to use if you need to create a custom method for storing
the state this library needs to maintain between requests.
In general, the second part is less important for users of the
library to know about, as several implementations are provided
which cover a wide variety of situations in which consumers may
use the library.
This module contains a class, C{L{Consumer}}, with methods
corresponding to the actions necessary in each of steps 2, 3, and
4 described in the overview. Use of this library should be as easy
as creating an C{L{Consumer}} instance and calling the methods
appropriate for the action the site wants to take.
SESSIONS, STORES, AND STATELESS MODE
====================================
The C{L{Consumer}} object keeps track of two types of state:
1. State of the user's current authentication attempt. Things like
the identity URL, the list of endpoints discovered for that
URL, and in case where some endpoints are unreachable, the list
of endpoints already tried. This state needs to be held from
Consumer.begin() to Consumer.complete(), but it is only applicable
to a single session with a single user agent, and at the end of
the authentication process (i.e. when an OP replies with either
C{id_res} or C{cancel}) it may be discarded.
2. State of relationships with servers, i.e. shared secrets
(associations) with servers and nonces seen on signed messages.
This information should persist from one session to the next and
should not be bound to a particular user-agent.
These two types of storage are reflected in the first two arguments of
Consumer's constructor, C{session} and C{store}. C{session} is a
dict-like object and we hope your web framework provides you with one
of these bound to the user agent. C{store} is an instance of
L{openid.store.interface.OpenIDStore}.
Since the store does hold secrets shared between your application and the
OpenID provider, you should be careful about how you use it in a shared
hosting environment. If the filesystem or database permissions of your
web host allow strangers to read from them, do not store your data there!
If you have no safe place to store your data, construct your consumer
with C{None} for the store, and it will operate only in stateless mode.
Stateless mode may be slower, put more load on the OpenID provider, and
trusts the provider to keep you safe from replay attacks.
Several store implementation are provided, and the interface is
fully documented so that custom stores can be used as well. See
the documentation for the C{L{Consumer}} class for more
information on the interface for stores. The implementations that
are provided allow the consumer site to store the necessary data
in several different ways, including several SQL databases and
normal files on disk.
IMMEDIATE MODE
==============
In the flow described above, the user may need to confirm to the
OpenID provider that it's ok to disclose his or her identity.
The provider may draw pages asking for information from the user
before it redirects the browser back to the consumer's site. This
is generally transparent to the consumer site, so it is typically
ignored as an implementation detail.
There can be times, however, where the consumer site wants to get
a response immediately. When this is the case, the consumer can
put the library in immediate mode. In immediate mode, there is an
extra response possible from the server, which is essentially the
server reporting that it doesn't have enough information to answer
the question yet.
USING THIS LIBRARY
==================
Integrating this library into an application is usually a
relatively straightforward process. The process should basically
follow this plan:
Add an OpenID login field somewhere on your site. When an OpenID
is entered in that field and the form is submitted, it should make
a request to your site which includes that OpenID URL.
First, the application should L{instantiate a Consumer<Consumer.__init__>}
with a session for per-user state and store for shared state.
using the store of choice.
Next, the application should call the 'C{L{begin<Consumer.begin>}}' method on the
C{L{Consumer}} instance. This method takes the OpenID URL. The
C{L{begin<Consumer.begin>}} method returns an C{L{AuthRequest}}
object.
Next, the application should call the
C{L{redirectURL<AuthRequest.redirectURL>}} method on the
C{L{AuthRequest}} object. The parameter C{return_to} is the URL
that the OpenID server will send the user back to after attempting
to verify his or her identity. The C{realm} parameter is the
URL (or URL pattern) that identifies your web site to the user
when he or she is authorizing it. Send a redirect to the
resulting URL to the user's browser.
That's the first half of the authentication process. The second
half of the process is done after the user's OpenID Provider sends the
user's browser a redirect back to your site to complete their
login.
When that happens, the user will contact your site at the URL
given as the C{return_to} URL to the
C{L{redirectURL<AuthRequest.redirectURL>}} call made
above. The request will have several query parameters added to
the URL by the OpenID provider as the information necessary to
finish the request.
Get a C{L{Consumer}} instance with the same session and store as
before and call its C{L{complete<Consumer.complete>}} method,
passing in all the received query arguments.
There are multiple possible return types possible from that
method. These indicate whether or not the login was successful,
and include any additional information appropriate for their type.
@var SUCCESS: constant used as the status for
L{SuccessResponse<openid.consumer.consumer.SuccessResponse>} objects.
@var FAILURE: constant used as the status for
L{FailureResponse<openid.consumer.consumer.FailureResponse>} objects.
@var CANCEL: constant used as the status for
L{CancelResponse<openid.consumer.consumer.CancelResponse>} objects.
@var SETUP_NEEDED: constant used as the status for
L{SetupNeededResponse<openid.consumer.consumer.SetupNeededResponse>}
objects.
"""
from __future__ import unicode_literals
import base64
import copy
import logging
import warnings
import six
from cryptography.hazmat.primitives import hashes
from six.moves.urllib.parse import parse_qsl, urldefrag, urlparse
from openid import cryptutil, fetchers, oidutil, urinorm
from openid.association import Association, SessionNegotiator, default_negotiator
from openid.consumer.discover import (OPENID_1_0_TYPE, OPENID_1_1_TYPE, OPENID_2_0_TYPE, DiscoveryFailure,
OpenIDServiceEndpoint, discover)
from openid.dh import DiffieHellman
from openid.message import BARE_NS, IDENTIFIER_SELECT, OPENID1_NS, OPENID2_NS, OPENID_NS, Message, no_default
from openid.oidutil import string_to_text
from openid.store.nonce import mkNonce, split as splitNonce
from openid.yadis.manager import Discovery
__all__ = ['AuthRequest', 'Consumer', 'SuccessResponse',
'SetupNeededResponse', 'CancelResponse', 'FailureResponse',
'SUCCESS', 'FAILURE', 'CANCEL', 'SETUP_NEEDED',
]
_LOGGER = logging.getLogger(__name__)
def makeKVPost(request_message, server_url):
"""Make a Direct Request to an OpenID Provider and return the
result as a Message object.
@raises openid.fetchers.HTTPFetchingError: if an error is
encountered in making the HTTP post.
@rtype: L{openid.message.Message}
"""
# XXX: TESTME
resp = fetchers.fetch(server_url, body=request_message.toURLEncoded().encode('utf-8'))
# Process response in separate function that can be shared by async code.
return _httpResponseToMessage(resp, server_url)
def _httpResponseToMessage(response, server_url):
"""Adapt a POST response to a Message.
@type response: L{openid.fetchers.HTTPResponse}
@param response: Result of a POST to an OpenID endpoint.
@rtype: L{openid.message.Message}
@raises openid.fetchers.HTTPFetchingError: if the server returned a
status of other than 200 or 400.
@raises ServerError: if the server returned an OpenID error.
"""
# Should this function be named Message.fromHTTPResponse instead?
response_message = Message.fromKVForm(response.body)
if response.status == 400:
raise ServerError.fromMessage(response_message)
elif response.status not in (200, 206):
fmt = 'bad status code from server %s: %s'
error_message = fmt % (server_url, response.status)
raise fetchers.HTTPFetchingError(error_message)
return response_message
class Consumer(object):
"""An OpenID consumer implementation that performs discovery and
does session management.
@ivar consumer: an instance of an object implementing the OpenID
protocol, but doing no discovery or session management.
@type consumer: GenericConsumer
@ivar session: A dictionary-like object representing the user's
session data. This is used for keeping state of the OpenID
transaction when the user is redirected to the server.
@cvar session_key_prefix: A string that is prepended to session
keys to ensure that they are unique. This variable may be
changed to suit your application.
"""
session_key_prefix = "_openid_consumer_"
_token = 'last_token'
_discover = staticmethod(discover)
def __init__(self, session, store, consumer_class=None):
"""Initialize a Consumer instance.
You should create a new instance of the Consumer object with
every HTTP request that handles OpenID transactions.
@param session: See L{the session instance variable<openid.consumer.consumer.Consumer.session>}
@param store: an object that implements the interface in
C{L{openid.store.interface.OpenIDStore}}. Several
implementations are provided, to cover common database
environments.
@type store: C{L{openid.store.interface.OpenIDStore}}
@see: L{openid.store.interface}
@see: L{openid.store}
"""
self.session = session
if consumer_class is None:
consumer_class = GenericConsumer
self.consumer = consumer_class(store)
self._token_key = self.session_key_prefix + self._token
def begin(self, user_url, anonymous=False):
"""Start the OpenID authentication process. See steps 1-2 in
the overview at the top of this file.
@param user_url: Identity URL given by the user. This method
performs a textual transformation of the URL to try and
make sure it is normalized. For example, a user_url of
example.com will be normalized to http://example.com/
normalizing and resolving any redirects the server might
issue.
@type user_url: six.text_type
@param anonymous: Whether to make an anonymous request of the OpenID
provider. Such a request does not ask for an authorization
assertion for an OpenID identifier, but may be used with
extensions to pass other data. e.g. "I don't care who you are,
but I'd like to know your time zone."
@type anonymous: bool
@returns: An object containing the discovered information will
be returned, with a method for building a redirect URL to
the server, as described in step 3 of the overview. This
object may also be used to add extension arguments to the
request, using its
L{addExtensionArg<openid.consumer.consumer.AuthRequest.addExtensionArg>}
method.
@returntype: L{AuthRequest<openid.consumer.consumer.AuthRequest>}
@raises openid.consumer.discover.DiscoveryFailure: when I fail to
find an OpenID server for this URL. If the C{yadis} package
is available, L{openid.consumer.discover.DiscoveryFailure} is
an alias for C{yadis.discover.DiscoveryFailure}.
"""
disco = Discovery(self.session, user_url, self.session_key_prefix)
try:
service = disco.getNextService(self._discover)
except fetchers.HTTPFetchingError as why:
raise DiscoveryFailure('Error fetching XRDS document: %s' % six.text_type(why), None)
if service is None:
raise DiscoveryFailure(
'No usable OpenID services found for %s' % (user_url,), None)
else:
return self.beginWithoutDiscovery(service, anonymous)
def beginWithoutDiscovery(self, service, anonymous=False):
"""Start OpenID verification without doing OpenID server
discovery. This method is used internally by Consumer.begin
after discovery is performed, and exists to provide an
interface for library users needing to perform their own
discovery.
@param service: an OpenID service endpoint descriptor. This
object and factories for it are found in the
L{openid.consumer.discover} module.
@type service:
L{OpenIDServiceEndpoint<openid.consumer.discover.OpenIDServiceEndpoint>}
@returns: an OpenID authentication request object.
@rtype: L{AuthRequest<openid.consumer.consumer.AuthRequest>}
@See: Openid.consumer.consumer.Consumer.begin
@see: openid.consumer.discover
"""
auth_req = self.consumer.begin(service)
self.session[self._token_key] = auth_req.endpoint
try:
auth_req.setAnonymous(anonymous)
except ValueError as why:
raise ProtocolError(six.text_type(why))
return auth_req
def complete(self, query, current_url):
"""Called to interpret the server's response to an OpenID
request. It is called in step 4 of the flow described in the
consumer overview.
@param query: A dictionary of the query parameters for this
HTTP request.
@param current_url: The URL used to invoke the application.
Extract the URL from your application's web
request framework and specify it here to have it checked
against the openid.return_to value in the response. If
the return_to URL check fails, the status of the
completion will be FAILURE.
@returns: a subclass of Response. The type of response is
indicated by the status attribute, which will be one of
SUCCESS, CANCEL, FAILURE, or SETUP_NEEDED.
@see: L{SuccessResponse<openid.consumer.consumer.SuccessResponse>}
@see: L{CancelResponse<openid.consumer.consumer.CancelResponse>}
@see: L{SetupNeededResponse<openid.consumer.consumer.SetupNeededResponse>}
@see: L{FailureResponse<openid.consumer.consumer.FailureResponse>}
"""
endpoint = self.session.get(self._token_key)
message = Message.fromPostArgs(query)
response = self.consumer.complete(message, endpoint, current_url)
try:
del self.session[self._token_key]
except KeyError:
pass
if (response.status in ['success', 'cancel'] and response.identity_url is not None):
disco = Discovery(self.session,
response.identity_url,
self.session_key_prefix)
# This is OK to do even if we did not do discovery in
# the first place.
disco.cleanup(force=True)
return response
def setAssociationPreference(self, association_preferences):
"""Set the order in which association types/sessions should be
attempted. For instance, to only allow HMAC-SHA256
associations created with a DH-SHA256 association session:
>>> consumer.setAssociationPreference([('HMAC-SHA256', 'DH-SHA256')])
Any association type/association type pair that is not in this
list will not be attempted at all.
@param association_preferences: The list of allowed
(association type, association session type) pairs that
should be allowed for this consumer to use, in order from
most preferred to least preferred.
@type association_preferences: List[Tuple[six.text_type, six.text_type]], six.binary_type is deprecated
@returns: None
@see: C{L{openid.association.SessionNegotiator}}
"""
self.consumer.negotiator = SessionNegotiator(association_preferences)
class DiffieHellmanSHA1ConsumerSession(object):
"""Handler for Diffie-Hellman session.
@cvar algorithm: Hash algorithm for MAC key generation.
@type algorithm: hashes.HashAlgorithm
@cvar hash_func: Hash function for MAC key generation. Deprecated attribute.
@type hash_func: function
"""
session_type = 'DH-SHA1'
algorithm = hashes.SHA1()
hash_func = None
secret_size = 20
allowed_assoc_types = ['HMAC-SHA1']
def __init__(self, dh=None):
if dh is None:
dh = DiffieHellman.fromDefaults()
self.dh = dh
def getRequest(self):
args = {'dh_consumer_public': self.dh.public_key}
if not self.dh.usingDefaultValues():
modulus, generator = self.dh.parameters
args.update({'dh_modulus': modulus, 'dh_gen': generator})
return args
def extractSecret(self, response):
dh_server_public64 = response.getArg(
OPENID_NS, 'dh_server_public', no_default)
enc_mac_key64 = response.getArg(OPENID_NS, 'enc_mac_key', no_default)
dh_server_public = cryptutil.base64ToLong(dh_server_public64)
enc_mac_key = oidutil.fromBase64(enc_mac_key64)
if self.hash_func is not None:
warnings.warn("Attribute hash_func is deprecated, use algorithm instead.", DeprecationWarning)
return self.dh.xorSecret(dh_server_public, enc_mac_key, self.hash_func)
else:
return base64.b64decode(self.dh.xor_secret(dh_server_public64, enc_mac_key64, self.algorithm))
class DiffieHellmanSHA256ConsumerSession(DiffieHellmanSHA1ConsumerSession):
session_type = 'DH-SHA256'
algorithm = hashes.SHA256()
secret_size = 32
allowed_assoc_types = ['HMAC-SHA256']
class PlainTextConsumerSession(object):
session_type = 'no-encryption'
allowed_assoc_types = ['HMAC-SHA1', 'HMAC-SHA256']
def getRequest(self):
return {}
def extractSecret(self, response):
mac_key64 = response.getArg(OPENID_NS, 'mac_key', no_default)
return oidutil.fromBase64(mac_key64)
class SetupNeededError(Exception):
"""Internally-used exception that indicates that an immediate-mode
request cancelled."""
def __init__(self, user_setup_url=None):
Exception.__init__(self, user_setup_url)
self.user_setup_url = user_setup_url
class ProtocolError(ValueError):
"""Exception that indicates that a message violated the
protocol. It is raised and caught internally to this file."""
class TypeURIMismatch(ProtocolError):
"""A protocol error arising from type URIs mismatching
"""
def __init__(self, expected, endpoint):
ProtocolError.__init__(self, expected, endpoint)
self.expected = expected
self.endpoint = endpoint
def __str__(self):
s = '<%s.%s: Required type %s not found in %s for endpoint %s>' % (
self.__class__.__module__, self.__class__.__name__,
self.expected, self.endpoint.type_uris, self.endpoint)
return s
class ServerError(Exception):
"""Exception that is raised when the server returns a 400 response
code to a direct request."""
def __init__(self, error_text, error_code, message):
Exception.__init__(self, error_text)
self.error_text = error_text
self.error_code = error_code
self.message = message
@classmethod
def fromMessage(cls, message):
"""Generate a ServerError instance, extracting the error text
and the error code from the message."""
error_text = message.getArg(
OPENID_NS, 'error', '<no error message supplied>')
error_code = message.getArg(OPENID_NS, 'error_code')
return cls(error_text, error_code, message)
class GenericConsumer(object):
"""This is the implementation of the common logic for OpenID
consumers. It is unaware of the application in which it is
running.
@ivar negotiator: An object that controls the kind of associations
that the consumer makes. It defaults to
C{L{openid.association.default_negotiator}}. Assign a
different negotiator to it if you have specific requirements
for how associations are made.
@type negotiator: C{L{openid.association.SessionNegotiator}}
"""
# The name of the query parameter that gets added to the return_to
# URL when using OpenID1. You can change this value if you want or
# need a different name, but don't make it start with openid,
# because it's not a standard protocol thing for OpenID1. For
# OpenID2, the library will take care of the nonce using standard
# OpenID query parameter names.
openid1_nonce_query_arg_name = 'janrain_nonce'
# Another query parameter that gets added to the return_to for
# OpenID 1; if the user's session state is lost, use this claimed
# identifier to do discovery when verifying the response.
openid1_return_to_identifier_name = 'openid1_claimed_id'
session_types = {
'DH-SHA256': DiffieHellmanSHA256ConsumerSession,
'DH-SHA1': DiffieHellmanSHA1ConsumerSession,
'no-encryption': PlainTextConsumerSession,
}
_discover = staticmethod(discover)
def __init__(self, store):
self.store = store
self.negotiator = default_negotiator.copy()
def begin(self, service_endpoint):
"""Create an AuthRequest object for the specified
service_endpoint. This method will create an association if
necessary."""
if self.store is None:
assoc = None
else:
assoc = self._getAssociation(service_endpoint)
request = AuthRequest(service_endpoint, assoc)
request.return_to_args[self.openid1_nonce_query_arg_name] = mkNonce()
if request.message.isOpenID1():
request.return_to_args[self.openid1_return_to_identifier_name] = \
request.endpoint.claimed_id
return request
def complete(self, message, endpoint, return_to):
"""Process the OpenID message, using the specified endpoint
and return_to URL as context. This method will handle any
OpenID message that is sent to the return_to URL.
"""
mode = message.getArg(OPENID_NS, 'mode', '<No mode set>')
modeMethod = getattr(self, '_complete_' + mode,
self._completeInvalid)
return modeMethod(message, endpoint, return_to)
def _complete_cancel(self, message, endpoint, _):
return CancelResponse(endpoint)
def _complete_error(self, message, endpoint, _):
error = message.getArg(OPENID_NS, 'error')
contact = message.getArg(OPENID_NS, 'contact')
reference = message.getArg(OPENID_NS, 'reference')
return FailureResponse(endpoint, error, contact=contact,
reference=reference)
def _complete_setup_needed(self, message, endpoint, _):
if not message.isOpenID2():
return self._completeInvalid(message, endpoint, _)
user_setup_url = message.getArg(OPENID2_NS, 'user_setup_url')
return SetupNeededResponse(endpoint, user_setup_url)
def _complete_id_res(self, message, endpoint, return_to):
try:
self._checkSetupNeeded(message)
except SetupNeededError as why:
return SetupNeededResponse(endpoint, why.user_setup_url)
else:
try:
return self._doIdRes(message, endpoint, return_to)
except (ProtocolError, DiscoveryFailure) as why:
return FailureResponse(endpoint, six.text_type(why))
def _completeInvalid(self, message, endpoint, _):
mode = message.getArg(OPENID_NS, 'mode', '<No mode set>')
return FailureResponse(endpoint,
'Invalid openid.mode: %r' % (mode,))
def _checkReturnTo(self, message, return_to):
"""Check an OpenID message and its openid.return_to value
against a return_to URL from an application. Return True on
success, False on failure.
"""
# Check the openid.return_to args against args in the original
# message.
try:
self._verifyReturnToArgs(message.toPostArgs())
except ProtocolError as why:
_LOGGER.warning("Verifying return_to arguments: %s", why)
return False
# Check the return_to base URL against the one in the message.
msg_return_to = message.getArg(OPENID_NS, 'return_to')
# The URL scheme, authority, and path MUST be the same between
# the two URLs.
app_parts = urlparse(urinorm.urinorm(return_to))
msg_parts = urlparse(urinorm.urinorm(msg_return_to))
# (addressing scheme, network location, path) must be equal in
# both URLs.
for part in range(0, 3):
if app_parts[part] != msg_parts[part]:
return False
return True
_makeKVPost = staticmethod(makeKVPost)
def _checkSetupNeeded(self, message):
"""Check an id_res message to see if it is a
checkid_immediate cancel response.
@raises SetupNeededError: if it is a checkid_immediate cancellation
"""
# In OpenID 1, we check to see if this is a cancel from
# immediate mode by the presence of the user_setup_url
# parameter.
if message.isOpenID1():
user_setup_url = message.getArg(OPENID1_NS, 'user_setup_url')
if user_setup_url is not None:
raise SetupNeededError(user_setup_url)
def _doIdRes(self, message, endpoint, return_to):
"""Handle id_res responses that are not cancellations of
immediate mode requests.
@param message: the response paramaters.
@param endpoint: the discovered endpoint object. May be None.
@raises ProtocolError: If the message contents are not
well-formed according to the OpenID specification. This
includes missing fields or not signing fields that should
be signed.
@raises DiscoveryFailure: If the subject of the id_res message
does not match the supplied endpoint, and discovery on the
identifier in the message fails (this should only happen
when using OpenID 2)
@returntype: L{Response}
"""
# Checks for presence of appropriate fields (and checks
# signed list fields)
self._idResCheckForFields(message)
if not self._checkReturnTo(message, return_to):
raise ProtocolError(
"return_to does not match return URL. Expected %r, got %r"
% (return_to, message.getArg(OPENID_NS, 'return_to')))
# Verify discovery information:
endpoint = self._verifyDiscoveryResults(message, endpoint)
_LOGGER.info("Received id_res response from %s using association %s",
endpoint.server_url, message.getArg(OPENID_NS, 'assoc_handle'))
self._idResCheckSignature(message, endpoint.server_url)
# Will raise a ProtocolError if the nonce is bad
self._idResCheckNonce(message, endpoint)
signed_list_str = message.getArg(OPENID_NS, 'signed', no_default)
signed_list = signed_list_str.split(',')
signed_fields = ["openid." + s for s in signed_list]
return SuccessResponse(endpoint, message, signed_fields)
def _idResGetNonceOpenID1(self, message, endpoint):
"""Extract the nonce from an OpenID 1 response. Return the
nonce from the BARE_NS since we independently check the
return_to arguments are the same as those in the response
message.
See the openid1_nonce_query_arg_name class variable
@returns: The nonce as a string or None
"""
return message.getArg(BARE_NS, self.openid1_nonce_query_arg_name)
def _idResCheckNonce(self, message, endpoint):
if message.isOpenID1():
# This indicates that the nonce was generated by the consumer
nonce = self._idResGetNonceOpenID1(message, endpoint)
server_url = ''
else:
nonce = message.getArg(OPENID2_NS, 'response_nonce')
server_url = endpoint.server_url
if nonce is None:
raise ProtocolError('Nonce missing from response')
try:
timestamp, salt = splitNonce(nonce)
except ValueError as why:
raise ProtocolError('Malformed nonce: %s' % six.text_type(why))
if (self.store is not None and not self.store.useNonce(server_url, timestamp, salt)):
raise ProtocolError('Nonce already used or out of range')
def _idResCheckSignature(self, message, server_url):
assoc_handle = message.getArg(OPENID_NS, 'assoc_handle')
if self.store is None:
assoc = None
else:
assoc = self.store.getAssociation(server_url, assoc_handle)
if assoc:
if assoc.getExpiresIn() <= 0:
# XXX: It might be a good idea sometimes to re-start the
# authentication with a new association. Doing it
# automatically opens the possibility for
# denial-of-service by a server that just returns expired
# associations (or really short-lived associations)
raise ProtocolError(
'Association with %s expired' % (server_url,))
if not assoc.checkMessageSignature(message):
raise ProtocolError('Bad signature')
else:
# It's not an association we know about. Stateless mode is our
# only possible path for recovery.
# XXX - async framework will not want to block on this call to
# _checkAuth.
if not self._checkAuth(message, server_url):
raise ProtocolError('Server denied check_authentication')
def _idResCheckForFields(self, message):
# XXX: this should be handled by the code that processes the
# response (that is, if a field is missing, we should not have
# to explicitly check that it's present, just make sure that
# the fields are actually being used by the rest of the code
# in tests). Although, which fields are signed does need to be
# checked somewhere.
basic_fields = ['return_to', 'assoc_handle', 'sig', 'signed']
basic_sig_fields = ['return_to', 'identity']
require_fields = {
OPENID2_NS: basic_fields + ['op_endpoint'],
OPENID1_NS: basic_fields + ['identity'],
}
require_sigs = {
OPENID2_NS: basic_sig_fields + ['response_nonce', 'claimed_id', 'assoc_handle', 'op_endpoint'],
OPENID1_NS: basic_sig_fields,
}
for field in require_fields[message.getOpenIDNamespace()]:
if not message.hasKey(OPENID_NS, field):
raise ProtocolError('Missing required field %r' % (field,))
signed_list_str = message.getArg(OPENID_NS, 'signed', no_default)
signed_list = signed_list_str.split(',')
for field in require_sigs[message.getOpenIDNamespace()]:
# Field is present and not in signed list
if message.hasKey(OPENID_NS, field) and field not in signed_list:
raise ProtocolError('"%s" not signed' % (field,))
@staticmethod
def _verifyReturnToArgs(query):
"""Verify that the arguments in the return_to URL are present in this
response.
"""
message = Message.fromPostArgs(query)
return_to = message.getArg(OPENID_NS, 'return_to')
if return_to is None:
raise ProtocolError('Response has no return_to')
parsed_url = urlparse(return_to)
rt_query = parsed_url[4]
parsed_args = parse_qsl(rt_query, keep_blank_values=True)
for rt_key, rt_value in parsed_args:
try:
value = query[rt_key]
if rt_value != value:
format = ("parameter %s value %r does not match "
"return_to's value %r")
raise ProtocolError(format % (rt_key, value, rt_value))
except KeyError:
format = "return_to parameter %s absent from query %r"
raise ProtocolError(format % (rt_key, query))
# Make sure all non-OpenID arguments in the response are also
# in the signed return_to.
bare_args = message.getArgs(BARE_NS)
for pair in six.iteritems(bare_args):
if pair not in parsed_args:
raise ProtocolError("Parameter %s not in return_to URL" % (pair[0],))
def _verifyDiscoveryResults(self, resp_msg, endpoint=None):
"""
Extract the information from an OpenID assertion message and
verify it against the original
@param endpoint: The endpoint that resulted from doing discovery
@param resp_msg: The id_res message object
@returns: the verified endpoint
"""
if resp_msg.getOpenIDNamespace() == OPENID2_NS:
return self._verifyDiscoveryResultsOpenID2(resp_msg, endpoint)
else:
return self._verifyDiscoveryResultsOpenID1(resp_msg, endpoint)
def _verifyDiscoveryResultsOpenID2(self, resp_msg, endpoint):
to_match = OpenIDServiceEndpoint()
to_match.type_uris = [OPENID_2_0_TYPE]
to_match.claimed_id = resp_msg.getArg(OPENID2_NS, 'claimed_id')
to_match.local_id = resp_msg.getArg(OPENID2_NS, 'identity')
# Raises a KeyError when the op_endpoint is not present
to_match.server_url = resp_msg.getArg(
OPENID2_NS, 'op_endpoint', no_default)
# claimed_id and identifier must both be present or both
# be absent
if (to_match.claimed_id is None and to_match.local_id is not None):
raise ProtocolError(
'openid.identity is present without openid.claimed_id')
elif (to_match.claimed_id is not None and to_match.local_id is None):
raise ProtocolError(
'openid.claimed_id is present without openid.identity')
# This is a response without identifiers, so there's really no
# checking that we can do, so return an endpoint that's for
# the specified `openid.op_endpoint'
elif to_match.claimed_id is None:
return OpenIDServiceEndpoint.fromOPEndpointURL(to_match.server_url)
# The claimed ID doesn't match, so we have to do discovery
# again. This covers not using sessions, OP identifier
# endpoints and responses that didn't match the original
# request.
if not endpoint:
_LOGGER.info('No pre-discovered information supplied.')
endpoint = self._discoverAndVerify(to_match.claimed_id, [to_match])
else:
# The claimed ID matches, so we use the endpoint that we
# discovered in initiation. This should be the most common
# case.
try:
self._verifyDiscoverySingle(endpoint, to_match)
except ProtocolError as e:
_LOGGER.info("Unable to use stored discovery information: %s", e)
_LOGGER.info("Attempting discovery to verify endpoint")
endpoint = self._discoverAndVerify(
to_match.claimed_id, [to_match])
# The endpoint we return should have the claimed ID from the
# message we just verified, fragment and all.
if endpoint.claimed_id != to_match.claimed_id:
endpoint = copy.copy(endpoint)
endpoint.claimed_id = to_match.claimed_id
return endpoint
def _verifyDiscoveryResultsOpenID1(self, resp_msg, endpoint):
claimed_id = resp_msg.getArg(BARE_NS, self.openid1_return_to_identifier_name)
if endpoint is None and claimed_id is None:
raise RuntimeError(
'When using OpenID 1, the claimed ID must be supplied, '
'either by passing it through as a return_to parameter '
'or by using a session, and supplied to the GenericConsumer '
'as the argument to complete()')
elif endpoint is not None and claimed_id is None:
claimed_id = endpoint.claimed_id
to_match = OpenIDServiceEndpoint()
to_match.type_uris = [OPENID_1_1_TYPE]
to_match.local_id = resp_msg.getArg(OPENID1_NS, 'identity')
# Restore delegate information from the initiation phase
to_match.claimed_id = claimed_id
if to_match.local_id is None:
raise ProtocolError('Missing required field openid.identity')
to_match_1_0 = copy.copy(to_match)
to_match_1_0.type_uris = [OPENID_1_0_TYPE]
if endpoint is not None:
try:
try:
self._verifyDiscoverySingle(endpoint, to_match)
except TypeURIMismatch:
self._verifyDiscoverySingle(endpoint, to_match_1_0)
except ProtocolError as e:
_LOGGER.info("Unable to use stored discovery information: %s", e)
_LOGGER.info("Attempting discovery to verify endpoint")
else:
return endpoint
# Endpoint is either bad (failed verification) or None
return self._discoverAndVerify(claimed_id, [to_match, to_match_1_0])
def _verifyDiscoverySingle(self, endpoint, to_match):
"""Verify that the given endpoint matches the information
extracted from the OpenID assertion, and raise an exception if
there is a mismatch.
@type endpoint: openid.consumer.discover.OpenIDServiceEndpoint
@type to_match: openid.consumer.discover.OpenIDServiceEndpoint
@rtype: NoneType
@raises ProtocolError: when the endpoint does not match the
discovered information.
"""
# Every type URI that's in the to_match endpoint has to be