1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
|
use strict;
use Carp ();
############################################################################
package Net::OpenID::ClaimedIdentity;
use fields (
'identity', # the canonical URL that was found, following redirects
'server', # author-identity identity server endpoint
'consumer', # ref up to the Net::OpenID::Consumer which generated us
'delegate', # the delegated URL actually asserted by the server
);
sub new {
my Net::OpenID::ClaimedIdentity $self = shift;
$self = fields::new( $self ) unless ref $self;
my %opts = @_;
for my $f (qw( identity server consumer delegate )) {
$self->{$f} = delete $opts{$f};
}
# lowercase the scheme and hostname
$self->{'identity'} =~ s!^(https?://.+?)(/(?:.*))?$!lc($1) . $2!ie;
Carp::croak("unknown options: " . join(", ", keys %opts)) if %opts;
return $self;
}
sub claimed_url {
my Net::OpenID::ClaimedIdentity $self = shift;
Carp::croak("Too many parameters") if @_;
return $self->{'identity'};
}
sub identity_server {
my Net::OpenID::ClaimedIdentity $self = shift;
Carp::croak("Too many parameters") if @_;
return $self->{server};
}
sub check_url {
my Net::OpenID::ClaimedIdentity $self = shift;
my (%opts) = @_;
my $return_to = delete $opts{'return_to'};
my $trust_root = delete $opts{'trust_root'};
my $delayed_ret = delete $opts{'delayed_return'};
Carp::croak("Unknown options: " . join(", ", keys %opts)) if %opts;
Carp::croak("Invalid/missing return_to") unless $return_to =~ m!^https?://!;
my $csr = $self->{consumer};
my $ident_server = $self->{server} or
Carp::croak("No identity server");
# get an assoc (or undef for dumb mode)
my $assoc = Net::OpenID::Association::server_assoc($csr, $ident_server);
my $identity_arg = $self->{'delegate'} || $self->{'identity'};
# make a note back to ourselves that we're using a delegate
if ($self->{'delegate'}) {
OpenID::util::push_url_arg(\$return_to,
"oic.identity", $self->{identity});
}
# add a HMAC-signed time so we can verify the return_to URL wasn't spoofed
my $sig_time = time();
my $c_secret = $csr->_get_consumer_secret($sig_time);
my $sig = substr(OpenID::util::hmac_sha1_hex($sig_time, $c_secret), 0, 20);
OpenID::util::push_url_arg(\$return_to,
"oic.time", "${sig_time}-$sig");
my $curl = $ident_server;
OpenID::util::push_url_arg(\$curl,
"openid.mode", ($delayed_ret ? "checkid_setup" : "checkid_immediate"),
"openid.identity", $identity_arg,
"openid.return_to", $return_to,
($trust_root ?
("openid.trust_root", $trust_root) : ()),
($assoc ?
("openid.assoc_handle", $assoc->handle) : ()),
);
$self->{consumer}->_debug("check_url for (del=$self->{delegate}, id=$self->{identity}) = $curl");
return $curl;
}
1;
__END__
=head1 NAME
Net::OpenID::ClaimedIdentity - a not-yet-verified OpenID identity
=head1 SYNOPSIS
use Net::OpenID::Consumer;
my $csr = Net::OpenID::Consumer->new;
....
my $cident = $csr->claimed_identity("bradfitz.com")
or die $csr->err;
if ($AJAX_mode) {
my $url = $cident->claimed_url;
my $openid_server = $cident->identity_server;
# ... return JSON with those to user agent (whose request was
# XMLHttpRequest, probably)
}
if ($CLASSIC_mode) {
my $check_url = $cident->check_url(
delayed_return => 1,
return_to => "http://example.com/get-identity.app",
trust_root => "http://*.example.com/",
);
WebApp::redirect($check_url);
}
=head1 DESCRIPTION
After L<Net::OpenID::Consumer> crawls a user's declared identity URL
and finds openid.server link tags in the HTML head, you get this
object. It represents an identity that can be verified with OpenID
(the link tags are present), but hasn't been actually verified yet.
=head1 METHODS
=over 4
=item $url = $cident->B<claimed_url>
The URL, now canonicalized, that the user claims to own. You can't
know whether or not they do own it yet until you send them off to the
check_url, though.
=item $id_server = $cident->B<identity_server>
Returns the identity server that will assert whether or not this
claimed identity is valid, and sign a message saying so.
=item $url = $cident->B<check_url>( %opts )
Makes the URL that you have to somehow send the user to in order to
validate their identity. The options to put in %opts are:
=over
=item C<return_to>
The URL that the identity server should redirect the user with either
a verified identity signature -or- a user_setup_url (if the assertion
couldn't be made). This URL may contain query parameters, and the
identity server must preserve them.
=item C<trust_root>
The URL that you want the user to actually see and declare trust for.
Your C<return_to> URL must be at or below your trust_root. Sending
the trust_root is optional, and defaults to your C<return_to> value,
but it's highly recommended (and prettier for users) to see a simple
trust_root. Note that the trust root may contain a wildcard at the
beginning of the host, like C<http://*.example.com/>
=item C<delayed_return>
If set to a true value, the check_url returned will indicate to the
user's identity server that it has permission to control the user's
user-agent for awhile, giving them real pages (not just redirects) and
lets them bounce around the identity server site for awhile until
the requested assertion can be made, and they can finally be redirected
back to your return_to URL above.
The default value, false, means that the identity server will
immediately return to your return_to URL with either a "yes" or "no"
answer. In the "no" case, you'll instead have control of what to do,
and you'll be sent the identity server's user_setup_url where you'll
have to somehow send the user (be it link, redirect, or pop-up
window).
When writing a dynamic "AJAX"-style application, you can't use
delayed_return because the remote site can't usefully take control of
a 1x1 pixel hidden IFRAME, so you'll need to get the user_setup_url
and present it to the user somehow.
=back
=back
=head1 COPYRIGHT, WARRANTY, AUTHOR
See L<Net::OpenID::Consumer> for author, copyrignt and licensing information.
=head1 SEE ALSO
L<Net::OpenID::Consumer>
L<Net::OpenID::VerifiedIdentity>
L<Net::OpenID::Server>
Website: L<http://www.danga.com/openid/>
|
