1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
|
<?php
require_once(dirname(dirname(__FILE__)) . '/libextinc/OAuth.php');
/**
* OAuth Store
*
* Updated version, works with consumer-callbacks, certificates and 1.0-RevA protocol
* behaviour (requestToken-callbacks and verifiers)
*
* @author Andreas Åkre Solberg, <andreas.solberg@uninett.no>, UNINETT AS.
* @author Mark Dobrinic, <mdobrinic@cozmanova.com>, Cozmanova bv
* @package simpleSAMLphp
*/
class sspmod_oauth_OAuthStore extends OAuthDataStore {
private $store;
private $config;
private $defaultversion = '1.0';
protected $_store_tables = array(
'consumers' => 'consumer = array with consumer attributes',
'nonce' => 'nonce+consumer_key = -boolean-',
'requesttorequest' => 'requestToken.key = array(version,callback,consumerKey,)',
'authorized' => 'requestToken.key, verifier = array(authenticated-user-attributes)',
'access' => 'accessToken.key+consumerKey = accestoken',
'request' => 'requestToken.key+consumerKey = requesttoken',
);
function __construct() {
$this->store = new sspmod_core_Storage_SQLPermanentStorage('oauth');
$this->config = SimpleSAML_Configuration::getOptionalConfig('module_oauth.php');
}
/**
* Attach the data to the token, and establish the Callback URL and verifier
* @param $requestTokenKey RequestToken that was authorized
* @param $data Data that is authorized and to be attached to the requestToken
* @return array(string:url, string:verifier) ; empty verifier for 1.0-response
*/
public function authorize($requestTokenKey, $data) {
$url = null;
$verifier = '';
$version = $this->defaultversion;
// See whether to remember values from the original requestToken request:
$request_attributes = $this->store->get('requesttorequest', $requestTokenKey, ''); // must be there ..
if ($request_attributes['value']) {
// establish version to work with
$v = $request_attributes['value']['version'];
if ($v) $version = $v;
// establish callback to use
if ($request_attributes['value']['callback']) {
$url = $request_attributes['value']['callback'];
}
}
// Is there a callback registered? This is leading, even over a supplied oauth_callback-parameter
$oConsumer = $this->lookup_consumer($request_attributes['value']['consumerKey']);
if ($oConsumer && ($oConsumer->callback_url)) $url = $oConsumer->callback_url;
$verifier = SimpleSAML_Utilities::generateID();
$url = SimpleSAML_Utilities::addURLparameter($url, array("oauth_verifier"=>$verifier));
$this->store->set('authorized', $requestTokenKey, $verifier, $data, $this->config->getValue('requestTokenDuration', 60*30) );
return array($url, $verifier);
}
/**
* Perform lookup whether a given token exists in the list of authorized tokens; if a verifier is
* passed as well, the verifier *must* match the verifier that was registered with the token<br/>
* Note that an accessToken should never be stored with a verifier
* @param $requestToken
* @param $verifier
* @return unknown_type
*/
public function isAuthorized($requestToken, $verifier='') {
SimpleSAML_Logger::info('OAuth isAuthorized(' . $requestToken . ')');
return $this->store->exists('authorized', $requestToken, $verifier);
}
public function getAuthorizedData($token, $verifier = '') {
SimpleSAML_Logger::info('OAuth getAuthorizedData(' . $token . ')');
$data = $this->store->get('authorized', $token, $verifier);
return $data['value'];
}
public function moveAuthorizedData($requestToken, $verifier, $accessTokenKey) {
SimpleSAML_Logger::info('OAuth moveAuthorizedData(' . $requestToken . ', ' . $accessTokenKey . ')');
// Retrieve authorizedData from authorized.requestToken (with provider verifier)
$authorizedData = $this->getAuthorizedData($requestToken, $verifier);
// Remove the requesttoken+verifier from authorized store
$this->store->remove('authorized', $requestToken, $verifier);
// Add accesstoken with authorizedData to authorized store (with empty verifier)
// accessTokenKey+consumer => accessToken is already registered in 'access'-table
$this->store->set('authorized', $accessTokenKey, '', $authorizedData, $this->config->getValue('accessTokenDuration', 60*60*24));
}
public function lookup_consumer($consumer_key) {
SimpleSAML_Logger::info('OAuth lookup_consumer(' . $consumer_key . ')');
if (! $this->store->exists('consumers', $consumer_key, '')) return NULL;
$consumer = $this->store->get('consumers', $consumer_key, '');
$callback = NULL;
if ($consumer['value']['callback_url']) $callback = $consumer['value']['callback_url'];
// SimpleSAML_Logger::info('OAuth consumer dump(' . var_export($consumer, TRUE) . ')');
if ($consumer['value']['RSAcertificate']) {
return new OAuthConsumer($consumer['value']['key'], $consumer['value']['RSAcertificate'], $callback);
} else {
return new OAuthConsumer($consumer['value']['key'], $consumer['value']['secret'], $callback);
}
}
function lookup_token($consumer, $tokenType = 'default', $token) {
SimpleSAML_Logger::info('OAuth lookup_token(' . $consumer->key . ', ' . $tokenType. ',' . $token . ')');
$data = $this->store->get($tokenType, $token, $consumer->key);
if ($data == NULL) throw new Exception('Could not find token');
return $data['value'];
}
function lookup_nonce($consumer, $token, $nonce, $timestamp) {
SimpleSAML_Logger::info('OAuth lookup_nonce(' . $consumer . ', ' . $token. ',' . $nonce . ')');
if ($this->store->exists('nonce', $nonce, $consumer->key)) return TRUE;
$this->store->set('nonce', $nonce, $consumer->key, TRUE, $this->config->getValue('nonceCache', 60*60*24*14));
return FALSE;
}
function new_request_token($consumer, $callback = null, $version = null) {
SimpleSAML_Logger::info('OAuth new_request_token(' . $consumer . ')');
$lifetime = $this->config->getValue('requestTokenDuration', 60*30);
$token = new OAuthToken(SimpleSAML_Utilities::generateID(), SimpleSAML_Utilities::generateID());
$token->callback = $callback; // OAuth1.0-RevA
$this->store->set('request', $token->key, $consumer->key, $token, $lifetime);
// also store in requestToken->key => array('callback'=>CallbackURL, 'version'=>oauth_version
$request_attributes = array(
'callback' => $callback,
'version' => ($version?$version:$this->defaultversion),
'consumerKey' => $consumer->key,
);
$this->store->set('requesttorequest', $token->key, '', $request_attributes, $lifetime);
// also store in requestToken->key => Consumer->key (enables consumer-lookup during reqToken-authorization stage)
$this->store->set('requesttoconsumer', $token->key, '', $consumer->key, $lifetime);
return $token;
}
function new_access_token($requestToken, $consumer, $verifier = null) {
SimpleSAML_Logger::info('OAuth new_access_token(' . $requestToken . ',' . $consumer . ')');
$accestoken = new OAuthToken(SimpleSAML_Utilities::generateID(), SimpleSAML_Utilities::generateID());
// SimpleSAML_Logger::info('OAuth new_access_token(' . $requestToken . ',' . $consumer . ',' . $accestoken . ')');
$this->store->set('access', $accestoken->key, $consumer->key, $accestoken, $this->config->getValue('accessTokenDuration', 60*60*24) );
return $accestoken;
}
/**
* Return OAuthConsumer-instance that a given requestToken was issued to
* @param $requestTokenKey
* @return unknown_type
*/
public function lookup_consumer_by_requestToken($requestTokenKey) {
SimpleSAML_Logger::info('OAuth lookup_consumer_by_requestToken(' . $requestTokenKey . ')');
if (! $this->store->exists('requesttorequest', $requestTokenKey, '')) return NULL;
$request = $this->store->get('requesttorequest', $requestTokenKey, '');
$consumerKey = $request['value']['consumerKey'];
if (! $consumerKey) {
return NULL;
}
$consumer = $this->store->get('consumers', $consumerKey['value'], '');
return $consumer['value'];
}
}
|
