RubyGems - ruby-openid - Versions diffs - 1.0 - Mend

ruby-openid 1.0

Potentially problematic release.

This version of ruby-openid might be problematic. Click here for more details.

Files changed (114) hide show

data/COPYING +21 -0
data/INSTALL +34 -0
data/README +67 -0
data/TODO +9 -0
data/examples/README +54 -0
data/examples/cacert.pem +7815 -0
data/examples/consumer.rb +285 -0
data/examples/openid-store/associations/http-localhost_3A3000_2Fserver-EMQbAy3NnHVzA.s0u5KAcplKGzo +6 -0
data/examples/openid-store/auth_key +1 -0
data/examples/rails_active_record_store/README +59 -0
data/examples/rails_active_record_store/XX_add_openidstore.rb +30 -0
data/examples/rails_active_record_store/models/openid_association.rb +12 -0
data/examples/rails_active_record_store/models/openid_nonce.rb +3 -0
data/examples/rails_active_record_store/models/openid_setting.rb +2 -0
data/examples/rails_active_record_store/openid_helper.rb +91 -0
data/examples/rails_active_record_store/openidstore_test.rb +15 -0
data/examples/rails_active_record_store/schema.mysql.sql +22 -0
data/examples/rails_active_record_store/schema.postgresql.sql +21 -0
data/examples/rails_active_record_store/schema.sqlite.sql +21 -0
data/examples/rails_openid_login_generator/USAGE +23 -0
data/examples/rails_openid_login_generator/openid_login_generator.rb +36 -0
data/examples/rails_openid_login_generator/templates/README +116 -0
data/examples/rails_openid_login_generator/templates/controller.rb +116 -0
data/examples/rails_openid_login_generator/templates/controller_test.rb +0 -0
data/examples/rails_openid_login_generator/templates/helper.rb +2 -0
data/examples/rails_openid_login_generator/templates/openid_login_system.rb +87 -0
data/examples/rails_openid_login_generator/templates/user.rb +14 -0
data/examples/rails_openid_login_generator/templates/user_test.rb +0 -0
data/examples/rails_openid_login_generator/templates/users.yml +0 -0
data/examples/rails_openid_login_generator/templates/view_login.rhtml +15 -0
data/examples/rails_openid_login_generator/templates/view_logout.rhtml +10 -0
data/examples/rails_openid_login_generator/templates/view_welcome.rhtml +9 -0
data/examples/rails_server/README +153 -0
data/examples/rails_server/Rakefile +10 -0
data/examples/rails_server/app/controllers/application.rb +4 -0
data/examples/rails_server/app/controllers/login_controller.rb +35 -0
data/examples/rails_server/app/controllers/server_controller.rb +185 -0
data/examples/rails_server/app/helpers/application_helper.rb +3 -0
data/examples/rails_server/app/helpers/login_helper.rb +2 -0
data/examples/rails_server/app/helpers/server_helper.rb +9 -0
data/examples/rails_server/app/views/layouts/server.rhtml +61 -0
data/examples/rails_server/app/views/login/index.rhtml +32 -0
data/examples/rails_server/app/views/server/decide.rhtml +11 -0
data/examples/rails_server/config/boot.rb +19 -0
data/examples/rails_server/config/database.yml +85 -0
data/examples/rails_server/config/environment.rb +53 -0
data/examples/rails_server/config/environments/development.rb +19 -0
data/examples/rails_server/config/environments/production.rb +19 -0
data/examples/rails_server/config/environments/test.rb +19 -0
data/examples/rails_server/config/routes.rb +23 -0
data/examples/rails_server/db/openid-store/associations/http-localhost_2F_7Cnormal-YU.tkND1J4fEZhnuAoT5Zc0yCA0 +6 -0
data/examples/rails_server/doc/README_FOR_APP +2 -0
data/examples/rails_server/log/development.log +6059 -0
data/examples/rails_server/log/production.log +0 -0
data/examples/rails_server/log/server.log +0 -0
data/examples/rails_server/log/test.log +0 -0
data/examples/rails_server/public/404.html +8 -0
data/examples/rails_server/public/500.html +8 -0
data/examples/rails_server/public/dispatch.cgi +12 -0
data/examples/rails_server/public/dispatch.fcgi +26 -0
data/examples/rails_server/public/dispatch.rb +12 -0
data/examples/rails_server/public/favicon.ico +0 -0
data/examples/rails_server/public/images/rails.png +0 -0
data/examples/rails_server/public/javascripts/controls.js +750 -0
data/examples/rails_server/public/javascripts/dragdrop.js +584 -0
data/examples/rails_server/public/javascripts/effects.js +854 -0
data/examples/rails_server/public/javascripts/prototype.js +1785 -0
data/examples/rails_server/public/robots.txt +1 -0
data/examples/rails_server/script/about +3 -0
data/examples/rails_server/script/breakpointer +3 -0
data/examples/rails_server/script/console +3 -0
data/examples/rails_server/script/destroy +3 -0
data/examples/rails_server/script/generate +3 -0
data/examples/rails_server/script/performance/benchmarker +3 -0
data/examples/rails_server/script/performance/profiler +3 -0
data/examples/rails_server/script/plugin +3 -0
data/examples/rails_server/script/process/reaper +3 -0
data/examples/rails_server/script/process/spawner +3 -0
data/examples/rails_server/script/process/spinner +3 -0
data/examples/rails_server/script/runner +3 -0
data/examples/rails_server/script/server +3 -0
data/examples/rails_server/test/functional/login_controller_test.rb +18 -0
data/examples/rails_server/test/functional/server_controller_test.rb +18 -0
data/examples/rails_server/test/test_helper.rb +28 -0
data/lib/hmac-md5.rb +11 -0
data/lib/hmac-rmd160.rb +11 -0
data/lib/hmac-sha1.rb +11 -0
data/lib/hmac-sha2.rb +25 -0
data/lib/hmac.rb +112 -0
data/lib/openid/association.rb +109 -0
data/lib/openid/consumer.rb +928 -0
data/lib/openid/dh.rb +48 -0
data/lib/openid/discovery.rb +89 -0
data/lib/openid/fetchers.rb +119 -0
data/lib/openid/filestore.rb +315 -0
data/lib/openid/htmltokenizer.rb +355 -0
data/lib/openid/parse.rb +23 -0
data/lib/openid/server.rb +951 -0
data/lib/openid/service.rb +135 -0
data/lib/openid/stores.rb +178 -0
data/lib/openid/trustroot.rb +100 -0
data/lib/openid/util.rb +273 -0
data/test/assoc.rb +38 -0
data/test/consumer.rb +384 -0
data/test/dh.rb +20 -0
data/test/extensions.rb +30 -0
data/test/linkparse.rb +305 -0
data/test/runtests.rb +11 -0
data/test/server2.rb +1053 -0
data/test/storetestcase.rb +172 -0
data/test/teststore.rb +23 -0
data/test/trustroot.rb +113 -0
data/test/util.rb +56 -0
metadata +218 -0

data/lib/openid/htmltokenizer.rb ADDED Viewed

@@ -0,0 +1,355 @@
+# = HTMLTokenizer
+#
+# Author::    Ben Giddings  (mailto:bg-rubyforge@infofiend.com)
+# Copyright:: Copyright (c) 2004 Ben Giddings
+# License::   Distributes under the same terms as Ruby
+#
+#
+# This is a partial port of the functionality behind Perl's TokeParser
+# Provided a page it progressively returns tokens from that page
+#
+# $Id: htmltokenizer.rb,v 1.7 2005/06/07 21:05:53 merc Exp $
+#
+# A class to tokenize HTML.
+#
+# Example:
+#
+#   page = "<HTML>
+#   <HEAD>
+#   <TITLE>This is the title</TITLE>
+#   </HEAD>
+#    <!-- Here comes the <a href=\"missing.link\">blah</a>
+#    comment body
+#     -->
+#    <BODY>
+#      <H1>This is the header</H1>
+#      <P>
+#        This is the paragraph, it contains
+#        <a href=\"link.html\">links</a>,
+#        <img src=\"blah.gif\" optional alt='images
+#        are
+#        really cool'>.  Ok, here is some more text and
+#        <A href=\"http://another.link.com/\" target=\"_blank\">another link</A>.
+#      </P>
+#    </body>
+#    </HTML>
+#    "
+#    toke = HTMLTokenizer.new(page)
+#
+#    assert("<h1>" == toke.getTag("h1", "h2", "h3").to_s.downcase)
+#    assert(HTMLTag.new("<a href=\"link.html\">") == toke.getTag("IMG", "A"))
+#    assert("links" == toke.getTrimmedText)
+#    assert(toke.getTag("IMG", "A").attr_hash['optional'])
+#    assert("_blank" == toke.getTag("IMG", "A").attr_hash['target'])
+#
+class HTMLTokenizer
+  @@version = 1.0
+  # Get version of HTMLTokenizer lib
+  def self.version
+    @@version
+  end
+  attr_reader :page
+  # Create a new tokenizer, based on the content, used as a string.
+  def initialize(content)
+    @page = content.to_s
+    @cur_pos = 0
+  end
+  # Reset the parser, setting the current position back at the stop
+  def reset
+    @cur_pos = 0
+  end
+  # Look at the next token, but don't actually grab it
+  def peekNextToken
+    if @cur_pos == @page.length then return nil end
+    if ?< == @page[@cur_pos]
+      # Next token is a tag of some kind
+      if '!--' == @page[(@cur_pos + 1), 3]
+        # Token is a comment
+        tag_end = @page.index('-->', (@cur_pos + 1))
+        if tag_end.nil?
+          raise "No end found to started comment:\n#{@page[@cur_pos,80]}"
+        end
+        # p @page[@cur_pos .. (tag_end+2)]
+        HTMLComment.new(@page[@cur_pos .. (tag_end + 2)])
+      else
+        # Token is a html tag
+        tag_end = @page.index('>', (@cur_pos + 1))
+        if tag_end.nil?
+          raise "No end found to started tag:\n#{@page[@cur_pos,80]}"
+        end
+        # p @page[@cur_pos .. tag_end]
+        HTMLTag.new(@page[@cur_pos .. tag_end])
+      end
+    else
+      # Next token is text
+      text_end = @page.index('<', @cur_pos)
+      text_end = text_end.nil? ? -1 : (text_end - 1)
+      # p @page[@cur_pos .. text_end]
+      HTMLText.new(@page[@cur_pos .. text_end])
+    end
+  end
+  # Get the next token, returns an instance of
+  # * HTMLText
+  # * HTMLToken
+  # * HTMLTag
+  def getNextToken
+    token = peekNextToken
+    if token
+      # @page = @page[token.raw.length .. -1]
+      # @page.slice!(0, token.raw.length)
+      @cur_pos += token.raw.length
+    end
+    #p token
+    #print token.raw
+    return token
+  end
+  # Get a tag from the specified set of desired tags.
+  # For example:
+  # <tt>foo =  toke.getTag("h1", "h2", "h3")</tt>
+  # Will return the next header tag encountered.
+  def getTag(*sought_tags)
+    sought_tags.collect! {|elm| elm.downcase}
+    while (tag = getNextToken)
+      if tag.kind_of?(HTMLTag) and
+          (0 == sought_tags.length or sought_tags.include?(tag.tag_name))
+        break
+      end
+    end
+    tag
+  end
+  # Get all the text between the current position and the next tag
+  # (if specified) or a specific later tag
+  def getText(until_tag = nil)
+    if until_tag.nil?
+      if ?< == @page[@cur_pos]
+        # Next token is a tag, not text
+        ""
+      else
+        # Next token is text
+        getNextToken.text
+      end
+    else
+      ret_str = ""
+      while (tag = peekNextToken)
+        if tag.kind_of?(HTMLTag) and tag.tag_name == until_tag
+          break
+        end
+        if ("" != tag.text)
+          ret_str << (tag.text + " ")
+        end
+        getNextToken
+      end
+      ret_str
+    end
+  end
+  # Like getText, but squeeze all whitespace, getting rid of
+  # leading and trailing whitespace, and squeezing multiple
+  # spaces into a single space.
+  def getTrimmedText(until_tag = nil)
+    getText(until_tag).strip.gsub(/\s+/m, " ")
+  end
+end
+# The parent class for all three types of HTML tokens
+class HTMLToken
+  attr_accessor :raw
+  # Initialize the token based on the raw text
+  def initialize(text)
+    @raw = text
+  end
+  # By default, return exactly the string used to create the text
+  def to_s
+    raw
+  end
+  # By default tokens have no text representation
+  def text
+    ""
+  end
+  def trimmed_text
+    text.strip.gsub(/\s+/m, " ")
+  end
+  # Compare to another based on the raw source
+  def ==(other)
+    raw == other.to_s
+  end
+end
+# Class representing text that isn't inside a tag
+class HTMLText < HTMLToken
+  def text
+    raw
+  end
+end
+# Class representing an HTML comment
+class HTMLComment < HTMLToken
+  attr_accessor :contents
+  def initialize(text)
+    super(text)
+    temp_arr = text.scan(/^<!--\s*(.*?)\s*-->$/m)
+    if temp_arr[0].nil?
+      raise "Text passed to HTMLComment.initialize is not a comment"
+    end
+    @contents = temp_arr[0][0]
+  end
+end
+# Class representing an HTML tag
+class HTMLTag < HTMLToken
+  attr_reader :end_tag, :tag_name
+  def initialize(text)
+    super(text)
+    if ?< != text[0] or ?> != text[-1]
+      raise "Text passed to HTMLComment.initialize is not a comment"
+    end
+    @attr_hash = Hash.new
+    @raw = text
+    tag_name = text.scan(/[\w:-]+/)[0]
+    if tag_name.nil?
+      raise "Error, tag is nil: #{tag_name}"
+    end
+    if ?/ == text[1]
+      # It's an end tag
+      @end_tag = true
+      @tag_name = '/' + tag_name.downcase
+    else
+      @end_tag = false
+      @tag_name = tag_name.downcase
+    end
+    @hashed = false
+  end
+  # Retrieve a hash of all the tag's attributes.
+  # Lazily done, so that if you don't look at a tag's attributes
+  # things go quicker
+  def attr_hash
+    # Lazy initialize == don't build the hash until it's needed
+    if !@hashed
+      if !@end_tag
+        # Get the attributes
+        attr_arr = @raw.scan(/<[\w:-]+\s+(.*)>/m)[0]
+        if attr_arr.kind_of?(Array)
+          # Attributes found, parse them
+          attrs = attr_arr[0]
+          attr_arr = attrs.scan(/\s*([\w:-]+)(?:\s*=\s*("[^"]*"|'[^']*'|([^"'>][^\s>]*)))?/m)
+          # clean up the array by:
+          # * setting all nil elements to true
+          # * removing enclosing quotes
+          attr_arr.each {
+            |item|
+            val = if item[1].nil?
+                    item[0]
+                  elsif '"'[0] == item[1][0] or '\''[0] == item[1][0]
+                    item[1][1 .. -2]
+                  else
+                    item[1]
+                  end
+            @attr_hash[item[0].downcase] = val
+          }
+        end
+      end
+      @hashed = true
+    end
+    #p self
+    @attr_hash
+  end
+  # Get the 'alt' text for a tag, if it exists, or an empty string otherwise
+  def text
+    if !end_tag
+      case tag_name
+      when 'img'
+        if !attr_hash['alt'].nil?
+          return attr_hash['alt']
+        end
+      when 'applet'
+        if !attr_hash['alt'].nil?
+          return attr_hash['alt']
+        end
+      end
+    end
+    return ''
+  end
+end
+if $0 == __FILE__
+  require 'test/unit'
+  class TC_TestHTMLTokenizer < Test::Unit::TestCase
+    def test_bad_link
+      toke = HTMLTokenizer.new("<p><a href=http://bad.com/link>foo</a></p>")
+      assert("http://bad.com/link" == toke.getTag("a").attr_hash['href'])
+    end
+    def test_namespace
+      toke = HTMLTokenizer.new("<f:table xmlns:f=\"http://www.com/foo\">")
+      assert("http://www.com/foo" == toke.getTag("f:table").attr_hash['xmlns:f'])
+    end
+    def test_comment
+      toke = HTMLTokenizer.new("<!-- comment on me -->")
+      t = toke.getNextToken
+      assert(HTMLComment == t.class)
+      assert("comment on me" == t.contents)
+    end
+    def test_full
+      page = "<HTML>
+<HEAD>
+<TITLE>This is the title</TITLE>
+</HEAD>
+<!-- Here comes the <a href=\"missing.link\">blah</a>
+comment body
+ -->
+<BODY>
+  <H1>This is the header</H1>
+  <P>
+    This is the paragraph, it contains
+    <a href=\"link.html\">links</a>,
+    <img src=\"blah.gif\" optional alt='images
+are
+really cool'>.  Ok, here is some more text and
+    <A href=\"http://another.link.com/\" target=\"_blank\">another link</A>.
+  </P>
+</body>
+</HTML>
+"
+      toke = HTMLTokenizer.new(page)
+      assert("<h1>" == toke.getTag("h1", "h2", "h3").to_s.downcase)
+      assert(HTMLTag.new("<a href=\"link.html\">") == toke.getTag("IMG", "A"))
+      assert("links" == toke.getTrimmedText)
+      assert(toke.getTag("IMG", "A").attr_hash['optional'])
+      assert("_blank" == toke.getTag("IMG", "A").attr_hash['target'])
+    end
+  end
+end

data/lib/openid/parse.rb ADDED Viewed

@@ -0,0 +1,23 @@
+require "openid/htmltokenizer"
+def parse_link_attrs(data)
+  parser = HTMLTokenizer.new(data)
+  in_head = false
+  begin
+    while el = parser.getTag("head", "link", "body")
+      if el.tag_name == "head"
+        in_head = true
+      elsif el.tag_name == "link"
+        continue unless in_head
+        yield el.attr_hash
+      elsif el.tag_name == "body"
+        return
+      end
+    end
+  rescue
+    return
+  end
+end

data/lib/openid/server.rb ADDED Viewed

@@ -0,0 +1,951 @@
+require 'openid/util'
+require 'openid/association'
+require 'openid/dh'
+require 'openid/trustroot'
+module OpenID
+  # This module contains classes specific to implemeting an OpenID
+  # server.
+  #
+  # ==Overview
+  #
+  # An OpenID server must perform three tasks:
+  #
+  #   1. Examine the incoming request to determine its nature and validity.
+  #
+  #   2. Make a decision about how to respond to this request.
+  #
+  #   3. Format the response according to the protocol.
+  #
+  # The first and last of these tasks may performed by
+  # the Server.decode_request and Server.encode_response methods of the
+  # OpenID::Server::Server object.  Who gets to do the intermediate task --
+  # deciding how to respond to the request -- will depend on what type of
+  # request it is.
+  #
+  # If it's a request to authenticate a user (a checkid_setup or
+  # checkid_immediate request), you need to decide if you will assert
+  # that this user may claim the identity in question.  Exactly how you do
+  # that is a matter of application policy, but it generally involves making
+  # sure the user has an account with your system and is logged in, checking
+  # to see if that identity is hers to claim, and verifying with the user that
+  # she does consent to releasing that information to the party making the
+  # request.  Do this by examining the properties of the CheckIDRequest
+  # object, and when you've come to a decision, form a response by calling
+  # CheckIDRequest.answer.
+  #
+  # Other types of requests relate to establishing associations between client
+  # and server and verifing the authenticity of previous communications.
+  # Server contains all the logic and data necessary to respond to
+  # such requests; just pass it to Server.handle_request.
+  #
+  #
+  # ==OpenID Extensions
+  #
+  # Do you want to provide other information for your users
+  # in addition to authentication?  Version 1.2 of the OpenID
+  # protocol allows consumers to add extensions to their requests.
+  # For example, with sites using the Simple Registration Extension
+  # http://www.openidenabled.com/openid/simple-registration-extension/,
+  # a user can agree to have their nickname and e-mail address sent to a
+  # site when they sign up.
+  #
+  # Since extensions do not change the way OpenID authentication works,
+  # code to handle extension requests may be completely separate from the
+  # OpenIDRequest class here.  But you'll likely want data sent back by
+  # your extension to be signed.  OpenIDResponse provides methods with
+  # which you can add data to it which can be signed with the other data in
+  # the OpenID signature.
+  #
+  # For example when request is a checkid_* request:
+  #
+  #   response = request.answer(true)
+  #   # this will add a signed 'openid.sreg.timezone' parameter to the response
+  #   response.add_field('sreg', 'timezone', 'America/Los_Angeles')
+  #
+  #
+  # ==Stores
+  #
+  # The OpenID server needs to maintain state between requests in order
+  # to function.  Its mechanism for doing this is called a store.  The
+  # store interface is defined in OpenID::Store.
+  # Additionally, several concrete store implementations are provided, so that
+  # most sites won't need to implement a custom store.  For a store backed
+  # by flat files on disk, see OpenID::FilesystemStore.
+  #
+  # ==Upgrading
+  #
+  # The keys by which a server looks up associations in its store have changed
+  # in version 1.2 of this library.  If your store has entries created from
+  # version 1.0 code, you should empty it.
+  module Server
+    HTTP_REDIRECT = 302
+    HTTP_OK = 200
+    HTTP_ERROR = 400
+    BROWSER_REQUEST_MODES = ['checkid_setup', 'checkid_immediate']
+    OPENID_PREFIX = 'openid.'
+    ENCODE_KVFORM = ['kvform'].freeze
+    ENCODE_URL = ['URL/redirect'].freeze
+    # Represents an incoming OpenID request.
+    class OpenIDRequest
+      attr_reader :mode
+      # +mode+ is the corresponsing "openid.mode" value of the request,
+      # and is available through the +mode+ method.
+      def initialize(mode)
+        @mode = mode
+      end
+    end
+    # A request to verify the validity of a previous response.
+    class CheckAuthRequest < OpenIDRequest
+      attr_accessor :assoc_handle, :sig, :signed, :invalidate_handle
+      # Create a new CheckAuthRequest. Please see the
+      # CheckAuthRequest.from_query class method, as it is the preferred
+      # way to produce this object.
+      #
+      # ==Parameters
+      #
+      # [+assoc_handle+]
+      #   String value of the "openid.assoc_handle" from the incoming request
+      #
+      # [+sig+]
+      #   String signature for the request. This is "openid.sig"
+      #
+      # [+signed+]
+      #   An array of pairs of [key, value], where key is the signed paramter
+      #   name without the "openid." prefix.  Value is the String value of
+      #   of the paramter.
+      #
+      # [+invalidate_handle+]
+      #   Optional. The association handle that the consumer is asking about
+      #   the validity of.  May be nil.
+      def initialize(assoc_handle, sig, signed, invalidate_handle=nil)
+        super('check_authentication')
+        @assoc_handle = assoc_handle
+        @sig = sig
+        @signed = signed
+        @invalidate_handle = invalidate_handle
+      end
+      # Produce a CheckAuthRequest instance from the request query.  Raises
+      # a ProtocolError if the request is malformed, and returns an instance
+      # CheckAuthRequest on success.
+      def CheckAuthRequest.from_query(query)
+        assoc_handle = query['openid.assoc_handle']
+        sig = query['openid.sig']
+        signed = query['openid.signed']
+        invalidate_handle = query['openid.invalidate_handle']
+        unless assoc_handle and sig and signed
+          raise ProtocolError.new(query,
+                                  "#{@mode} request missing required paramter")
+        end
+        signed = signed.split(',')
+        signed_pairs = []
+        signed.each do |field|
+          if field == 'mode'
+            value = 'id_res'
+          else
+            value = query['openid.'+field]
+            if value.nil?
+              raise ProtocolError.new(query, "Couldn't find signed field #{field}")
+            end
+          end
+          signed_pairs << [field, value]
+        end
+        return new(assoc_handle, sig, signed_pairs, invalidate_handle)
+      end
+      # Respond to this request.  Given an OpenID::Server::Signatory instance
+      # the validity of the signature and invalidate_handle can be checked.
+      #
+      # Returns an OpenIDResponse object with an appropriate "is_valid" field
+      # and an "invalidate_handle" field if appropriate.
+      def answer(signatory)
+        is_valid = signatory.verify(@assoc_handle, @sig, @signed)
+        signatory.invalidate(assoc_handle, true)
+        response = OpenIDResponse.new(self)
+        response.fields['is_valid'] = is_valid ? 'true' : 'false'
+        if @invalidate_handle
+          assoc = signatory.get_association(@invalidate_handle, false)
+          unless assoc
+            response.fields['invalidate_handle'] = @invalidate_handle
+          end
+        end
+        return response
+      end
+    end
+    # An object that knows how to handle association requests with no
+    # session type.
+    class PlainTextServerSession
+      attr_reader :session_type
+      def initialize
+        @session_type = 'plaintext'
+      end
+      def PlainTextServerSession.from_query(query)
+        new
+      end
+      def answer(secret)
+        return {'mac_key' => OpenID::Util.to_base64(secret)}
+      end
+    end
+    # An object that knows how to handle Diffie Hellman (DH-SHA1) association
+    # requests.
+    class DiffieHellmanServerSession
+      attr_reader :session_type, :dh, :consumer_pubkey
+      # In general you should create instances of DiffieHellmanServerSession
+      # with the from_query class method.
+      #
+      # ==Parameters
+      #
+      # [+dh+]
+      #   OpenID::DiffieHellman instance
+      #
+      # [+consumer_pubkey+]
+      #   Decoded "openid.dh_consumer_public".
+      def initialize(dh, consumer_pubkey)
+        @dh = dh
+        @consumer_pubkey = consumer_pubkey
+        @session_type = 'DH-SHA1'
+      end
+      # Creates a new DiffieHellmanServerSession from the incoming request.
+      # Raises a ProtocolError for malformed requests, and returns a
+      # DiffieHellmanServerSession instnace on success.
+      def DiffieHellmanServerSession.from_query(query)
+        dh_modulus = query['openid.dh_modulus']
+        dh_gen = query['openid.dh_gen']
+        dh = OpenID::DiffieHellman.from_base64(dh_modulus, dh_gen)
+        consumer_pubkey = query['openid.dh_consumer_public']
+        unless consumer_pubkey
+          msg = 'No openid.dh_consumer_public found for DH-SHA1 session'
+          raise ProtocolError.new(query, msg)
+        end
+        consumer_pubkey = OpenID::Util.base64_to_num(consumer_pubkey)
+        return new(dh, consumer_pubkey)
+      end
+      # Generate the arguments to be added to the response using +secret+.
+      def answer(secret)
+        mac_key = @dh.xor_secrect(@consumer_pubkey, secret)
+        return {
+          'dh_server_public' => OpenID::Util.num_to_base64(@dh.public),
+          'enc_mac_key' => OpenID::Util.to_base64(mac_key)
+        }
+      end
+    end
+    # A request to establish an OpenID association.  This object contains the
+    # logic for handling "openid.mode=associate" requests.
+    class AssociateRequest < OpenIDRequest
+      attr_accessor :assoc_type, :session
+      # +session+ is an instance of PlainTextServerSession or
+      # DiffieHellmanServerSession
+      def initialize(session)
+        super('associate')
+        @assoc_type = 'HMAC-SHA1'
+        @session = session
+      end
+      # Generate an AssociateRequest instance from the incoming query.
+      # Raises a ProtocolError on malformed requests.
+      def AssociateRequest.from_query(query)
+        session_type = query['openid.session_type']
+        if session_type == 'DH-SHA1'
+          session = DiffieHellmanServerSession.from_query(query)
+        elsif session_type.nil?
+          session = PlainTextServerSession.from_query(query)
+        else
+          raise ProtocolError.new(query,
+                                  "Unknown session_type #{session_type}")
+        end
+        return new(session)
+      end
+      # Respond to this request with an association.  +assoc+ is an
+      # OpenID::Association instance that represents the association to
+      # respond with.
+      def answer(assoc)
+        response = OpenIDResponse.new(self)
+        fields = {
+          'expires_in' => assoc.expires_in.to_s,
+          'assoc_type' => 'HMAC-SHA1',
+          'assoc_handle' => assoc.handle
+        }
+        # add the session specific arguments to the response fields
+        response.fields.update(fields)
+        response.fields.update(@session.answer(assoc.secret))
+        if @session.session_type != 'plaintext'
+          response.fields['session_type'] = @session.session_type
+        end
+        return response
+      end
+    end
+    # Object representing a request to confirm the identity of a
+    # user. This object handles requests for openid.mode checkid_immediate, and
+    # checkid_setup.
+    class CheckIDRequest < OpenIDRequest
+      attr_accessor :identity, :return_to, :trust_root, :immediate, \
+                    :assoc_handle, :mode, :query
+      # Create a new CheckIDRequest instance.  Most likely you'll want to
+      # use CheckIDRequest.from_query to create this object.
+      def initialize(mode, identity, return_to,
+                     trust_root=nil, assoc_handle=nil)
+        unless ['checkid_immediate', 'checkid_setup'].include?(mode)
+          raise ProtocolError, "Can't create CheckIDRequest for mode #{mode}"
+        end
+        super(mode)
+        @identity = identity
+        @return_to = return_to
+        @trust_root = trust_root
+        @immediate = mode == 'checkid_immediate' ? true : false
+        @assoc_handle = assoc_handle
+        @query = {}
+      end
+      # Create a CheckIDRequest object from a web query.  May raise a
+      # ProtocolError if request is a malformed checkid_* reuquest.
+      def CheckIDRequest.from_query(query)
+        mode = query['openid.mode']
+        identity = query['openid.identity']
+        raise ProtocolError.new(query, 'openid.identity missing') unless identity
+        return_to = query['openid.return_to']
+        raise ProtocolError.new(query, 'openid.return_to missing') unless return_to
+        trust_root = query['openid.trust_root']
+        unless OpenID::TrustRoot.parse(return_to)
+          raise MalformedReturnURL.new(query, return_to)
+        end
+        if trust_root and not OpenID::TrustRoot.parse(return_to)
+          raise MalformedTrustRoot.new(query, trust_root)
+        end
+        assoc_handle = query['openid.assoc_handle']
+        req = new(mode, identity, return_to, trust_root, assoc_handle)
+        req.query = query
+        unless req.trust_root_valid
+          raise UntrustedReturnURL.new(query, return_to, trust_root)
+        end
+        return req
+      end
+      # Returns +true+ or +false+ according to whether the return_to
+      # is under the supplied trust_root.
+      def trust_root_valid
+        return true unless @trust_root
+        tr = OpenID::TrustRoot.parse(@trust_root)
+        raise MalformedTrustRoot.new(nil, @trust_root) if tr.nil?
+        return tr.validate_url(@return_to)
+      end
+      # Generate a response to this checkid_* request.
+      #
+      # ==Paramters
+      #
+      # [+allow+]
+      #   Boolean value stating whether or not to allow this user to "claim"
+      #   supplied identity and let the consumer have the information. The
+      #   value of allow should be follow the following algorithm:
+      #
+      #   The identity URL provided (openid.identity) and available
+      #   through the +identity_url+ method of this object is owned by
+      #   the logged in user, and they have approved the consumer receive
+      #   the identity assertion.
+      #
+      # [+server_url+]
+      #   When an immeditate mode request does not succeed, it gets back a URL
+      #   where the request may be continued in a not-so-immediate fashion.
+      #   The URL returned is generated using the supplied +server_url+ here.
+      #   +server_url+ should be the full URL of you openid server endpoint.
+      def answer(allow, server_url=nil)
+        if allow or @immediate
+          mode = 'id_res'
+        else
+          mode = 'cancel'
+        end
+        response = OpenIDResponse.new(self)
+        if allow
+          response.add_fields(nil, {
+                                'mode' => mode,
+                                'identity' => @identity,
+                                'return_to' => @return_to
+                              })
+        else
+          response.add_field(nil, 'mode', mode, false)
+          response.signed.clear
+          if @immediate
+            unless server_url
+              raise ArgumentError, "setup_url is required for allow=false in immediate mode"
+            end
+            # make a request just like this one, but immediate mode
+            setup_request = self.class.new('checkid_immediate',
+                                           @identity,
+                                           @return_to,
+                                           @trust_root)
+            setup_url = setup_request.encode_to_url(server_url)
+            response.add_field(nil, 'user_setup_url', setup_url, false)
+          end
+        end
+        return response
+      end
+      # Encode this request as a GET URL, returning the URL.
+      def encode_to_url(server_url)
+        q = {
+          'openid.mode' => @mode,
+          'openid.identity' => @identity,
+          'openid.return_to' => @return_to
+        }
+        q['openid.trust_root'] = @trust_root if @trust_root
+        q['openid.assoc_handle'] = @assoc_handle if @assoc_handle
+        return OpenID::Util.append_args(server_url, q)
+      end
+      # Create the URL to cancel this request.  Useful for creating a "Cancel"
+      # button on your "approve this openid transaction" form.
+      def cancel_url
+        if @immediate
+          raise ProtocolError.new(nil, 'cancel is not an appropriate reponse to immediate mode requests')
+        end
+        return OpenID::Util.append_args(@return_to,{'openid.mode' => 'cancel'})
+      end
+      # The identity_url which was requested to be verified.  Your server
+      # should provide a page at identity_url, and be able to assert
+      # that the logged in user does or does not "own" that URL.
+      # "Owning" an identity_url is in the details of the
+      # server account name to URL mapping.
+      def identity_url
+        @identity
+      end
+    end
+    # Object representing a response to an OpenIDRequest
+    class OpenIDResponse
+      attr_accessor :request, :fields, :signed
+      # +request+ is a subclass of OpenIDRequest that this object
+      # should respond to.
+      def initialize(request)
+        @request = request
+        @fields = {}
+        @signed = []
+      end
+      # Add an extra field to this response.
+      #
+      # [+namespace+]
+      #   Extension namespace the field is in with no leading "openid.". For
+      #   example, if you are adding a simple registration argument, you would
+      #   pass 'sreg' as the namespace.
+      def add_field(namespace, key, value, signed=true)
+        if namespace and namespace != ''
+          key = namespace + '.' + key
+        end
+        @fields[key] = value
+        if signed and not @signed.member?(key)
+          @signed << key
+        end
+      end
+      # Same as OpenIDResponse.add_field, except that it accepts a Hash
+      # fields to be added as the +fields+ argument.
+      def add_fields(namespace, fields, signed=true)
+        fields.each {|k,v| self.add_field(namespace, k, v, signed)}
+      end
+      # Update the fields of this request with another OpenIDResponse, +other+.
+      def update(namespace, other)
+        if namespace and namespace != ''
+          namespaced_fields = {}
+          other.fields.each {|k,v| namespaced_fields[namespace+'.'+k] = v}
+          namespaced_signed = other.signed.collect {|k| namespace+'.'+k}
+        else
+          namespaced_fields = other.fields.dup
+          namespaced_signed = other.signed.dup
+        end
+        @fields.update(namespaced_fields)
+        @signed |= namespaced_signed
+      end
+      # Returns a boolean saying whether or not this response requires
+      # signing.
+      def needs_signing?
+        ['checkid_immediate','checkid_setup'].member?(@request.mode) and \
+           @signed.length > 0
+      end
+      # OpenID responses can be sent back as a URL redirect or as a kvform
+      # reponse to a POST. This method returns a code describing how the
+      # response should be encoded, and return either
+      # OpenID::Server::ENCODE_URL or OpenID::Server::ENCODE_KVFORM.
+      def which_encoding?
+        if BROWSER_REQUEST_MODES.member?(@request.mode)
+          return ENCODE_URL
+        else
+          return ENCODE_KVFORM
+        end
+      end
+      # Encode the response to a URL, suitable to be send via 302 redirect.
+      def encode_to_url
+        fields = {}
+        @fields.each {|k,v| fields['openid.'+k] = v}
+        return OpenID::Util.append_args(@request.return_to, fields)
+      end
+      # Encode the response to kvform format.
+      def encode_to_kvform
+        return OpenID::Util.kvform(@fields)
+      end
+    end
+    # Object responsible for signing responses, and checking signatures.
+    class Signatory
+      @@secret_lifetime = 14 * 24 * 60 * 6
+      @@normal_key = 'http://localhost/|normal'
+      @@dumb_key = 'http://localhost/|dumb'
+      attr_reader :dumb_key
+      # Accepts an object that implements the OpenID::Store interface.  See
+      # OpenID::FilesystemStore for a simple file based store.
+      def initialize(store)
+        @store = store
+      end
+      # Verify that the signature for some data is valid.
+      #
+      # ==Paramters
+      #
+      # [+assoc_handle+]
+      #   The association handle used to get the secret out of the store, and
+      #   passed in via openid.assoc_handle.
+      #
+      # [+sig+]
+      #   Value of openid.sig
+      #
+      # [+signed_pairs+]
+      #   Array of Array pairs of key, value signed data.
+      #
+      # [+dumb+]
+      #   boolean representing whether this is a dumb mode request
+      def verify(assoc_handle, sig, signed_pairs, dumb=true)
+        assoc = self.get_association(assoc_handle, dumb)
+        unless assoc
+          OpenID::Util.log("failed to get assoc with handle #{assoc_handle} to verify sig #{sig}")
+          return false
+        end
+        expected_sig = OpenID::Util.to_base64(assoc.sign(signed_pairs))
+        if sig == expected_sig
+          return true
+        else
+          OpenID::Util.log("signture mismatch: expected #{expected_sig}, got #{sig}")
+          return false
+        end
+      end
+      # Sign a response, creating a signature based on everything in it's
+      # +signed+ array.  Returns a new response object with sig and signed
+      # values in its field set.
+      def sign(response)
+        # get a deep copy of the response
+        signed_response = Marshal.load(Marshal.dump(response))
+        assoc_handle = response.request.assoc_handle
+        if assoc_handle
+          assoc = self.get_association(assoc_handle, false)
+          unless assoc
+            # no assoc for handle, fall back to dumb mode
+            signed_response.fields['invalidate_handle'] = assoc_handle
+            assoc = self.create_association(true)
+          end
+        else
+          # dumb mode
+          assoc = self.create_association(true)
+        end
+        signed_response.fields['assoc_handle'] = assoc.handle
+        assoc.add_signature(signed_response.signed,
+                            signed_response.fields, '')
+        return signed_response
+      end
+      # Make a new assocation.
+      def create_association(dumb=true, assoc_type='HMAC-SHA1')
+        secret = OpenID::Util.get_random_bytes(20)
+        uniq = OpenID::Util.to_base64(OpenID::Util.get_random_bytes(4))
+        handle = "{%s}{%x}{%s}" % [assoc_type, Time.now.to_i, uniq]
+        assoc = Association.from_expires_in(@@secret_lifetime,
+                                            handle,
+                                            secret,
+                                            assoc_type)
+        key = dumb ? @@dumb_key : @@normal_key
+        @store.store_association(key, assoc)
+        return assoc
+      end
+      # Get an association by assoc_handle and mode
+      def get_association(assoc_handle, dumb)
+        if assoc_handle.nil?
+          raise ArgumentError, 'assoc_handle must not be nil'
+        end
+        key = dumb ? @@dumb_key : @@normal_key
+        assoc = @store.get_association(key, assoc_handle)
+        if assoc and assoc.expired?
+          @store.remove_association(key, assoc_handle)
+          assoc = nil
+        end
+        return assoc
+      end
+      # Invalidate an association by assoc_handle and mode
+      def invalidate(assoc_handle, dumb)
+        key = dumb ? @@dumb_key : @@normal_key
+        @store.remove_association(key, assoc_handle)
+      end
+    end
+    # Response to an OpenID request that a web server can understand. Proper
+    # responses can be issued to your framework by examining the +code+
+    # method and associated methods.
+    class WebResponse
+      attr_accessor :code, :headers, :body
+      def initialize
+        @code = HTTP_OK
+        @headers = {}
+        @body = ''
+      end
+      def set_redirect(url)
+        @code = HTTP_REDIRECT
+        @headers['location'] = url
+      end
+      # If this method returns true, a redirect should be issued by the
+      # webserver to the value returned by the redirect_url method.
+      #
+      # If this method returns false, the value returned by the +body+
+      # method should be returned to ther server as-is without modification.
+      def is_redirect?
+        @code == HTTP_REDIRECT
+      end
+      def redirect_url
+        @headers['location']
+      end
+    end
+    # Object that encodes OpenIDResponse objects into WebResponse objects.
+    class Encoder
+      def encode(response)
+        webresponse = WebResponse.new
+        case response.which_encoding?
+        when ENCODE_KVFORM
+          webresponse.code = HTTP_ERROR if response.kind_of?(Exception)
+          webresponse.body = response.encode_to_kvform
+        when ENCODE_URL
+          webresponse.set_redirect(response.encode_to_url)
+        else
+          # don't know how to encode response
+          raise EncodingError.new(response)
+        end
+        return webresponse
+      end
+    end
+    # Object that encodes OpenIDResponse objects into WebResponse objects,
+    # potentially adding a signature along the way.
+    class SigningEncoder < Encoder
+      def initialize(signatory)
+        if signatory.nil?
+          raise ArgumentError, "signatory must not be nil"
+        end
+        @signatory = signatory
+      end
+      def encode(response)
+        if (not response.kind_of?(Exception)) and response.needs_signing?
+          if response.fields.has_key?('sig')
+            raise AlreadySigned
+          end
+          response = @signatory.sign(response)
+        end
+        return super(response)
+      end
+    end
+    # Decode incoming web requests into an OpenIDRequest object.
+    class Decoder
+      def decode(query)
+        return nil if query.length == 0
+        mode = query['openid.mode']
+        return nil if mode.nil?
+        if mode.class == Array
+          raise ArgumentError, 'query hash must have one value for each key'
+        end
+        case mode
+        when 'checkid_setup', 'checkid_immediate'
+          return CheckIDRequest.from_query(query)
+        when 'check_authentication'
+          return CheckAuthRequest.from_query(query)
+        when 'associate'
+          return AssociateRequest.from_query(query)
+        else
+          raise ProtocolError.new(query, "Unknown mode #{mode}")
+        end
+      end
+    end
+    # Top level object that handles incoming requests for an OpenID server.
+    #
+    # Some types of requests (those which are not CheckIDRequest objects) may
+    # be handed to the handle_request method, and an appropriate response
+    # will be returned.
+    #
+    # For convenienve, decode and encode methods are exposed which should be
+    # used as the entry and exit points of the OpenID server logic.  The first
+    # step when handling an OpenID server action should be to call
+    # Server.decode_request with the query arguments.
+    #
+    # This object needs an instance of OpenID::Store to store state between
+    # sessions and associations.  See OpenID::FilesystemStore for a simple
+    # file based solution.
+    #
+    # ==Pseudo Code
+    #
+    # Below is some pseudo code for using this object to handle OpenID server
+    # requests. The +params+ variable represents a Hash of the incoming
+    # arguments.  is_authorized and show_decide_page are methods you provide.
+    # At the end you have a WebResponse object suitable for examining and
+    # issuing a response to your web server.
+    #
+    #   include OpenID
+    #   store = FilesystemStore.new('/var/openid/store')
+    #   server = Server::Server.new(store)
+    #   request = server.decode_request(params)
+    #   if request.kind_of?(CheckIDRequest)
+    #     if is_authorized(request.identity, request.trust_root)
+    #       response = request.answer(true)
+    #     elsif request.immediate
+    #       response = request.answer(false,'http://example.com/openid-server')
+    #     else
+    #       show_decide_page(request)
+    #       return
+    #     end
+    #   else
+    #     response = server.handle_request(request)
+    #   end
+    #
+    #   web_response = server.encode_response(response)
+    #
+    # For an actual working example, please see the rails_server
+    # directory inside of the examples directory.  Have a look at the
+    # app/controllers/server_controller.rb and the +index+ method of the
+    # ServerController object.
+    class Server
+      # +store+ is a kind of OpenID::Store
+      def initialize(store)
+        @store = store
+        @signatory = Signatory.new(store)
+        @encoder = SigningEncoder.new(@signatory)
+        @decoder = Decoder.new
+      end
+      # Decode an incoming web request into a kind of OpenIDRequest object.
+      # +query+ should be a hash of request arguments. Rails users will want to
+      # pass in the @params instance variable of the ActionController.
+      def decode_request(query)
+        return @decoder.decode(query)
+      end
+      # Handle all non checkid_* OpenID requests.
+      def handle_request(request)
+        return self.send('openid_'+request.mode, request)
+      end
+      # Return a WebResponse object given an OpenIDResponse object
+      def encode_response(response)
+        return @encoder.encode(response)
+      end
+      # called by handle_request to perform check auth calls
+      def openid_check_authentication(request)
+        return request.answer(@signatory)
+      end
+      # called by handle_request to perform openid.mode=associate calls.
+      def openid_associate(request)
+        assoc = @signatory.create_association(false)
+        return request.answer(assoc)
+      end
+    end
+    # Raised when an OpenID request encounters some kind of protocol error.
+    class ProtocolError < Exception
+      attr_reader :query
+      def initialize(query, text=nil)
+        super(text)
+        @query = query
+      end
+      def has_return_to?
+        @query.has_key?('openid.return_to')
+      end
+      def encode_to_url
+        return_to = @query['openid.return_to']
+        unless return_to
+          raise ArgumentError, 'No return_to in query'
+        end
+        args = {
+          'openid.mode' => 'error',
+          'openid.error' => self.to_s
+        }
+        return OpenID::Util.append_args(return_to, args)
+      end
+      def encode_to_kvform
+        args = {
+          'mode' => 'error',
+          'error' => self.to_s
+        }
+        return OpenID::Util.kvform(args)
+      end
+      def which_encoding?
+        if self.has_return_to?
+          return ENCODE_URL
+        end
+        mode = @query['openid.mode']
+        if mode and not BROWSER_REQUEST_MODES.member?(mode)
+          return ENCODE_KVFORM
+        end
+        return nil
+      end
+    end
+    class EncodingError < Exception; end
+    class AlreadySigned < EncodingError; end
+    class MalformedReturnURL < ProtocolError
+      attr_reader :return_to
+      def initialize(query, return_to)
+        super(query)
+        @return_to = return_to
+      end
+    end
+    class MalformedTrustRoot < ProtocolError; end
+    class UntrustedReturnURL < ProtocolError
+      attr_reader :return_to, :trust_root
+      def initialize(query, return_to, trust_root)
+        super(query)
+        @return_to = return_to
+        @trust_root = trust_root
+      end
+    end
+  end
+end