RubyGems - ruby-openid - Versions diffs - 1.1.4 → 2.0.1 - Mend

ruby-openid 1.1.4 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (207) hide show

data/INSTALL +0 -9
data/README +21 -22
data/UPGRADE +117 -0
data/admin/runtests.rb +36 -0
data/examples/README +13 -21
data/examples/active_record_openid_store/README +8 -3
data/examples/active_record_openid_store/XXX_add_open_id_store_to_db.rb +4 -8
data/examples/active_record_openid_store/XXX_upgrade_open_id_store.rb +26 -0
data/examples/active_record_openid_store/lib/association.rb +2 -0
data/examples/active_record_openid_store/lib/openid_ar_store.rb +22 -47
data/examples/active_record_openid_store/test/store_test.rb +78 -48
data/examples/discover +46 -0
data/examples/{rails_server → rails_openid}/README +0 -0
data/examples/{rails_server → rails_openid}/Rakefile +0 -0
data/examples/{rails_server → rails_openid}/app/controllers/application.rb +0 -0
data/examples/rails_openid/app/controllers/consumer_controller.rb +115 -0
data/examples/{rails_server → rails_openid}/app/controllers/login_controller.rb +10 -2
data/examples/rails_openid/app/controllers/server_controller.rb +265 -0
data/examples/{rails_server → rails_openid}/app/helpers/application_helper.rb +0 -0
data/examples/{rails_server → rails_openid}/app/helpers/login_helper.rb +0 -0
data/examples/{rails_server → rails_openid}/app/helpers/server_helper.rb +0 -0
data/examples/rails_openid/app/views/consumer/index.rhtml +81 -0
data/examples/rails_openid/app/views/consumer/start.rhtml +8 -0
data/examples/{rails_server → rails_openid}/app/views/layouts/server.rhtml +0 -0
data/examples/{rails_server → rails_openid}/app/views/login/index.rhtml +1 -1
data/examples/rails_openid/app/views/server/decide.rhtml +26 -0
data/examples/{rails_server → rails_openid}/config/boot.rb +0 -0
data/examples/{rails_server → rails_openid}/config/database.yml +0 -0
data/examples/{rails_server → rails_openid}/config/environment.rb +0 -0
data/examples/{rails_server → rails_openid}/config/environments/development.rb +0 -0
data/examples/{rails_server → rails_openid}/config/environments/production.rb +0 -0
data/examples/{rails_server → rails_openid}/config/environments/test.rb +0 -0
data/examples/{rails_server → rails_openid}/config/routes.rb +2 -1
data/examples/{rails_server → rails_openid}/doc/README_FOR_APP +0 -0
data/examples/{rails_server → rails_openid}/public/404.html +0 -0
data/examples/{rails_server → rails_openid}/public/500.html +0 -0
data/examples/{rails_server → rails_openid}/public/dispatch.cgi +0 -0
data/examples/{rails_server → rails_openid}/public/dispatch.fcgi +0 -0
data/examples/{rails_server → rails_openid}/public/dispatch.rb +0 -0
data/examples/{rails_server → rails_openid}/public/favicon.ico +0 -0
data/examples/rails_openid/public/images/openid_login_bg.gif +0 -0
data/examples/{rails_server → rails_openid}/public/javascripts/controls.js +0 -0
data/examples/{rails_server → rails_openid}/public/javascripts/dragdrop.js +0 -0
data/examples/{rails_server → rails_openid}/public/javascripts/effects.js +0 -0
data/examples/{rails_server → rails_openid}/public/javascripts/prototype.js +0 -0
data/examples/{rails_server → rails_openid}/public/robots.txt +0 -0
data/examples/{rails_server → rails_openid}/script/about +0 -0
data/examples/{rails_server → rails_openid}/script/breakpointer +0 -0
data/examples/{rails_server → rails_openid}/script/console +0 -0
data/examples/{rails_server → rails_openid}/script/destroy +0 -0
data/examples/{rails_server → rails_openid}/script/generate +0 -0
data/examples/{rails_server → rails_openid}/script/performance/benchmarker +0 -0
data/examples/{rails_server → rails_openid}/script/performance/profiler +0 -0
data/examples/{rails_server → rails_openid}/script/plugin +0 -0
data/examples/{rails_server → rails_openid}/script/process/reaper +0 -0
data/examples/{rails_server → rails_openid}/script/process/spawner +0 -0
data/examples/{rails_server → rails_openid}/script/process/spinner +0 -0
data/examples/{rails_server → rails_openid}/script/runner +0 -0
data/examples/{rails_server → rails_openid}/script/server +0 -0
data/examples/{rails_server → rails_openid}/test/functional/login_controller_test.rb +0 -0
data/examples/{rails_server → rails_openid}/test/functional/server_controller_test.rb +0 -0
data/examples/{rails_server → rails_openid}/test/test_helper.rb +0 -0
data/lib/{hmac.rb → hmac/hmac.rb} +0 -0
data/lib/{hmac-sha1.rb → hmac/sha1.rb} +1 -1
data/lib/{hmac-sha2.rb → hmac/sha2.rb} +1 -1
data/lib/openid/association.rb +213 -73
data/lib/openid/consumer/associationmanager.rb +338 -0
data/lib/openid/consumer/checkid_request.rb +175 -0
data/lib/openid/consumer/discovery.rb +480 -0
data/lib/openid/consumer/discovery_manager.rb +123 -0
data/lib/openid/consumer/html_parse.rb +136 -0
data/lib/openid/consumer/idres.rb +525 -0
data/lib/openid/consumer/responses.rb +133 -0
data/lib/openid/consumer.rb +280 -807
data/lib/openid/cryptutil.rb +85 -0
data/lib/openid/dh.rb +60 -23
data/lib/openid/extension.rb +31 -0
data/lib/openid/extensions/ax.rb +506 -0
data/lib/openid/extensions/pape.rb +182 -0
data/lib/openid/extensions/sreg.rb +275 -0
data/lib/openid/extras.rb +11 -0
data/lib/openid/fetchers.rb +132 -93
data/lib/openid/kvform.rb +133 -0
data/lib/openid/kvpost.rb +56 -0
data/lib/openid/message.rb +534 -0
data/lib/openid/protocolerror.rb +6 -0
data/lib/openid/server.rb +1215 -666
data/lib/openid/store/filesystem.rb +271 -0
data/lib/openid/store/interface.rb +75 -0
data/lib/openid/store/memory.rb +84 -0
data/lib/openid/store/nonce.rb +68 -0
data/lib/openid/trustroot.rb +314 -87
data/lib/openid/urinorm.rb +37 -34
data/lib/openid/util.rb +42 -220
data/lib/openid/yadis/accept.rb +148 -0
data/lib/openid/yadis/constants.rb +21 -0
data/lib/openid/yadis/discovery.rb +153 -0
data/lib/openid/yadis/filters.rb +205 -0
data/lib/openid/{htmltokenizer.rb → yadis/htmltokenizer.rb} +1 -54
data/lib/openid/yadis/parsehtml.rb +36 -0
data/lib/openid/yadis/services.rb +42 -0
data/lib/openid/yadis/xrds.rb +171 -0
data/lib/openid/yadis/xri.rb +90 -0
data/lib/openid/yadis/xrires.rb +106 -0
data/lib/openid.rb +1 -4
data/test/data/accept.txt +124 -0
data/test/data/dh.txt +29 -0
data/test/data/example-xrds.xml +14 -0
data/test/data/linkparse.txt +587 -0
data/test/data/n2b64 +650 -0
data/test/data/test1-discover.txt +137 -0
data/test/data/test1-parsehtml.txt +128 -0
data/test/data/test_discover/openid.html +11 -0
data/test/data/test_discover/openid2.html +11 -0
data/test/data/test_discover/openid2_xrds.xml +12 -0
data/test/data/test_discover/openid2_xrds_no_local_id.xml +11 -0
data/test/data/test_discover/openid_1_and_2.html +11 -0
data/test/data/test_discover/openid_1_and_2_xrds.xml +16 -0
data/test/data/test_discover/openid_1_and_2_xrds_bad_delegate.xml +17 -0
data/test/data/test_discover/openid_and_yadis.html +12 -0
data/test/data/test_discover/openid_no_delegate.html +10 -0
data/test/data/test_discover/yadis_0entries.xml +12 -0
data/test/data/test_discover/yadis_2_bad_local_id.xml +15 -0
data/test/data/test_discover/yadis_2entries_delegate.xml +22 -0
data/test/data/test_discover/yadis_2entries_idp.xml +21 -0
data/test/data/test_discover/yadis_another_delegate.xml +14 -0
data/test/data/test_discover/yadis_idp.xml +12 -0
data/test/data/test_discover/yadis_idp_delegate.xml +13 -0
data/test/data/test_discover/yadis_no_delegate.xml +11 -0
data/test/data/test_xrds/=j3h.2007.11.14.xrds +25 -0
data/test/data/test_xrds/README +12 -0
data/test/data/test_xrds/delegated-20060809-r1.xrds +34 -0
data/test/data/test_xrds/delegated-20060809-r2.xrds +34 -0
data/test/data/test_xrds/delegated-20060809.xrds +34 -0
data/test/data/test_xrds/no-xrd.xml +7 -0
data/test/data/test_xrds/not-xrds.xml +2 -0
data/test/data/test_xrds/prefixsometimes.xrds +34 -0
data/test/data/test_xrds/ref.xrds +109 -0
data/test/data/test_xrds/sometimesprefix.xrds +34 -0
data/test/data/test_xrds/spoof1.xrds +25 -0
data/test/data/test_xrds/spoof2.xrds +25 -0
data/test/data/test_xrds/spoof3.xrds +37 -0
data/test/data/test_xrds/status222.xrds +9 -0
data/test/data/test_xrds/valid-populated-xrds.xml +39 -0
data/test/data/trustroot.txt +147 -0
data/test/discoverdata.rb +131 -0
data/test/test_accept.rb +170 -0
data/test/test_association.rb +266 -0
data/test/test_associationmanager.rb +899 -0
data/test/test_ax.rb +587 -0
data/test/test_checkid_request.rb +297 -0
data/test/test_consumer.rb +257 -0
data/test/test_cryptutil.rb +117 -0
data/test/test_dh.rb +86 -0
data/test/test_discover.rb +772 -0
data/test/test_discovery_manager.rb +262 -0
data/test/test_extras.rb +35 -0
data/test/test_fetchers.rb +472 -0
data/test/test_filters.rb +270 -0
data/test/test_idres.rb +816 -0
data/test/test_kvform.rb +165 -0
data/test/test_kvpost.rb +65 -0
data/test/test_linkparse.rb +101 -0
data/test/test_message.rb +1058 -0
data/test/test_nonce.rb +89 -0
data/test/test_openid_yadis.rb +178 -0
data/test/test_pape.rb +233 -0
data/test/test_parsehtml.rb +80 -0
data/test/test_responses.rb +63 -0
data/test/test_server.rb +2270 -0
data/test/test_sreg.rb +479 -0
data/test/test_stores.rb +269 -0
data/test/test_trustroot.rb +112 -0
data/test/{urinorm.rb → test_urinorm.rb} +6 -3
data/test/test_util.rb +144 -0
data/test/test_xrds.rb +160 -0
data/test/test_xri.rb +48 -0
data/test/test_xrires.rb +63 -0
data/test/test_yadis_discovery.rb +207 -0
data/test/testutil.rb +116 -0
data/test/util.rb +47 -50
metadata +233 -143
data/examples/consumer.rb +0 -290
data/examples/rails_openid_login_generator/openid_login_generator-0.1.gem +0 -0
data/examples/rails_server/app/controllers/server_controller.rb +0 -190
data/examples/rails_server/app/views/server/decide.rhtml +0 -11
data/examples/rails_server/public/images/rails.png +0 -0
data/lib/hmac-md5.rb +0 -11
data/lib/hmac-rmd160.rb +0 -11
data/lib/openid/discovery.rb +0 -122
data/lib/openid/filestore.rb +0 -315
data/lib/openid/parse.rb +0 -23
data/lib/openid/service.rb +0 -147
data/lib/openid/stores.rb +0 -178
data/test/assoc.rb +0 -38
data/test/consumer.rb +0 -376
data/test/data/brian.xrds +0 -16
data/test/data/brianellin.mylid.xrds +0 -42
data/test/dh.rb +0 -20
data/test/extensions.rb +0 -30
data/test/linkparse.rb +0 -305
data/test/runtests.rb +0 -22
data/test/server2.rb +0 -1053
data/test/service.rb +0 -47
data/test/storetestcase.rb +0 -172
data/test/teststore.rb +0 -47
data/test/trustroot.rb +0 -117

data/examples/rails_openid/app/views/consumer/index.rhtml ADDED Viewed

@@ -0,0 +1,81 @@
+<html>
+<head>
+<title>Rails OpenID Example Consumer</title>
+</head>
+  <style type="text/css">
+      * {
+        font-family: verdana,sans-serif;
+      }
+      body {
+        width: 50em;
+        margin: 1em;
+      }
+      div {
+        padding: .5em;
+      }
+      .alert {
+        border: 1px solid #e7dc2b;
+        background: #fff888;
+      }
+      .error {
+        border: 1px solid #ff0000;
+        background: #ffaaaa;
+      }
+      .success {
+        border: 1px solid #00ff00;
+        background: #aaffaa;
+      }
+      #verify-form {
+        border: 1px solid #777777;
+        background: #dddddd;
+        margin-top: 1em;
+        padding-bottom: 0em;
+      }
+      input.openid {
+        background: url( /images/openid_login_bg.gif ) no-repeat;
+        background-position: 0 50%;
+        background-color: #fff;
+        padding-left: 18px;
+      }
+  </style>
+  <body>
+    <h1>Rails OpenID Example Consumer</h1>
+    <% if flash[:alert] %>
+      <div class='alert'>
+       <%= h(flash[:alert]) %>
+      </div>
+    <% end %>
+    <% if flash[:error] %>
+      <div class='error'>
+       <%= h(flash[:error]) %>
+      </div>
+    <% end %>
+    <% if flash[:success] %>
+      <div class='success'>
+       <%= h(flash[:success]) %>
+      </div>
+    <% end %>
+    <% if flash[:sreg_results] %>
+      <div class='alert'>
+      <%= flash[:sreg_results] %>
+      </div>
+    <% end %>
+    <% if flash[:pape_results] %>
+      <div class='alert'>
+      <%= flash[:pape_results] %>
+      </div>
+    <% end %>
+    <div id="verify-form">
+      <form method="get" accept-charset="UTF-8"
+            action='<%= url_for :action => 'start' %>'>
+        Identifier:
+        <input type="text" class="openid" name="openid_identifier" />
+        <input type="submit" value="Verify" /><br />
+        <input type="checkbox" name="immediate" id="immediate" /><label for="immediate">Use immediate mode</label><br/>
+        <input type="checkbox" name="use_sreg" id="use_sreg" /><label for="use_sreg">Request registration data</label><br/>
+        <input type="checkbox" name="use_pape" id="use_pape" /><label for="use_pape">Request phishing-resistent auth policy (PAPE)</label><br/>
+        <input type="checkbox" name="force_post" id="force_post" /><label for="force_post">Force the transaction to use POST by adding 2K of extra data</label>
+      </form>
+    </div>
+  </body>
+</html>

data/examples/rails_openid/app/views/consumer/start.rhtml ADDED Viewed

@@ -0,0 +1,8 @@
+<html>
+<body>
+<%= @form_text %>
+<script type="text/javascript">
+document.getElementById('openid_form').submit();
+</script>
+</body>
+</html>

data/examples/{rails_server → rails_openid}/app/views/layouts/server.rhtml RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/app/views/login/index.rhtml RENAMED Viewed

@@ -20,7 +20,7 @@ Welcome to the Ruby OpenID server example.  This code is a starting point for de
 <h2>To use the example</h2>
 <p>
   <ol>
-    <li>Enter a username in the form above.  You will be "Logged In" to the server, at which point you may authenticate using an OpenID consumer. Your OpenID URL will be displayed after you log in.<p>The server will automatically create an identity page for you at http://localhost:3000/user/<i>name</i></p></li>
+    <li>Enter a username in the form above.  You will be "Logged In" to the server, at which point you may authenticate using an OpenID consumer. Your OpenID URL will be displayed after you log in.<p>The server will automatically create an identity page for you at <%= @base_url %>user/<i>name</i></p></li>
     <li>Run the example OpenID consumer: <blockquote>ruby examples/consumer.rb</blockquote></li>
     <li>In another browser window visit <a href="http://localhost:2000/">http://localhost:2000/</a>, and type your OpenID URL to verfiy your identity with this server.</li>
   </ol>

data/examples/rails_openid/app/views/server/decide.rhtml ADDED Viewed

@@ -0,0 +1,26 @@
+<form method="post" action="<%= url_for :controller => 'server', :action => 'decision' %>">
+<table>
+  <tr><td>Site:</td><td><%= @oidreq.trust_root %></td></tr>
+  <% if @oidreq.id_select %>
+    <tr>
+      <td colspan="2">
+        You entered the server identifier at the relying party.
+        You'll need to send an identifier of your choosing.  Enter a
+        username below.
+      </td>
+    </tr>
+    <tr>
+      <td>Identity to send:</td>
+      <td><input type="text" name="id_to_send" size="25" /></td>
+    </tr>
+  <% else %>
+    <tr><td>Identity:</td><td><%= @oidreq.identity %></td></tr>
+  <% end %>
+</table>
+<input type="submit" name="yes" value="yes" />
+<input type="submit" name="no" value="no" />
+</form>

data/examples/{rails_server → rails_openid}/config/boot.rb RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/config/database.yml RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/config/environment.rb RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/config/environments/development.rb RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/config/environments/production.rb RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/config/environments/test.rb RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/config/routes.rb RENAMED Viewed

@@ -11,8 +11,9 @@ ActionController::Routing::Routes.draw do |map|
   # map.connect '', :controller => "welcome"
   map.connect '', :controller => 'login'
+  map.connect 'server/xrds', :controller => 'server', :action => 'idp_xrds'
   map.connect 'user/:username', :controller => 'server', :action => 'user_page'
-  map.connect 'user/:username/xrds', :controller => 'server', :action => 'xrds'
+  map.connect 'user/:username/xrds', :controller => 'server', :action => 'user_xrds'
   # Allow downloading Web Service WSDL as a file with an extension
   # instead of a file named 'wsdl'

data/examples/{rails_server → rails_openid}/doc/README_FOR_APP RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/public/404.html RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/public/500.html RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/public/dispatch.cgi RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/public/dispatch.fcgi RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/public/dispatch.rb RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/public/favicon.ico RENAMED Viewed

File without changes

data/examples/rails_openid/public/images/openid_login_bg.gif ADDED Viewed

Binary file

data/examples/{rails_server → rails_openid}/public/javascripts/controls.js RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/public/javascripts/dragdrop.js RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/public/javascripts/effects.js RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/public/javascripts/prototype.js RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/public/robots.txt RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/about RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/breakpointer RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/console RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/destroy RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/generate RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/performance/benchmarker RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/performance/profiler RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/plugin RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/process/reaper RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/process/spawner RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/process/spinner RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/runner RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/script/server RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/test/functional/login_controller_test.rb RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/test/functional/server_controller_test.rb RENAMED Viewed

File without changes

data/examples/{rails_server → rails_openid}/test/test_helper.rb RENAMED Viewed

File without changes

data/lib/{hmac.rb → hmac/hmac.rb} RENAMED Viewed

File without changes

data/lib/{hmac-sha1.rb → hmac/sha1.rb} RENAMED Viewed

@@ -1,4 +1,4 @@
-require 'hmac'
+require 'hmac/hmac'
 require 'digest/sha1'
 module HMAC

data/lib/{hmac-sha2.rb → hmac/sha2.rb} RENAMED Viewed

@@ -1,4 +1,4 @@
-require 'hmac'
+require 'hmac/hmac'
 require 'digest/sha2'
 module HMAC

data/lib/openid/association.rb CHANGED Viewed

@@ -1,71 +1,57 @@
-require 'openid/util'
+require "openid/kvform"
+require "openid/util"
+require "openid/cryptutil"
+require "openid/message"
 module OpenID
-  # Represents an "association" between a consumer and server, and
-  # is also used for storage of the information exchanged
-  # during the openid.mode='associate' transaction.
-  # This class is used by the both the server and consumer.
-  class Association
-    @@version = '2'
-    @@assoc_keys = [
-                    'version',
-                    'handle',
-                    'secret',
-                    'issued',
-                    'lifetime',
-                    'assoc_type'
-                   ]
+  def self.get_secret_size(assoc_type)
+    if assoc_type == 'HMAC-SHA1'
+      return 20
+    elsif assoc_type == 'HMAC-SHA256'
+      return 32
+    else
+      raise ArgumentError("Unsupported association type: #{assoc_type}")
+    end
+  end
+  # An Association holds the shared secret between a relying party and
+  # an OpenID provider.
+  class Association
     attr_reader :handle, :secret, :issued, :lifetime, :assoc_type
-    def Association.from_expires_in(expires_in, handle, secret, assoc_type)
-      issued = Time.now.to_i
-      lifetime = expires_in
-      new(handle, secret, issued, lifetime, assoc_type)
-    end
-    def Association.serialize(assoc)
-      data = [
-              '2',
-              assoc.handle,
-              OpenID::Util.to_base64(assoc.secret),
-              assoc.issued.to_i.to_s,
-              assoc.lifetime.to_i.to_s,
-              assoc.assoc_type
-             ]
-      lines = ""
-      (0...@@assoc_keys.length).collect do |i|
-        lines += "#{@@assoc_keys[i]}: #{data[i]}\n"
+    FIELD_ORDER =
+      [:version, :handle, :secret, :issued, :lifetime, :assoc_type,]
+    # Load a serialized Association
+    def self.deserialize(serialized)
+      parsed = Util.kv_to_seq(serialized)
+      parsed_fields = parsed.map{|k, v| k.to_sym}
+      if parsed_fields != FIELD_ORDER
+          raise StandardError, 'Unexpected fields in serialized association'\
+          " (Expected #{FIELD_ORDER.inspect}, got #{parsed_fields.inspect})"
+      end
+      version, handle, secret64, issued_s, lifetime_s, assoc_type =
+        parsed.map {|field, value| value}
+      if version != '2'
+        raise StandardError, "Attempted to deserialize unsupported version "\
+                             "(#{parsed[0][1].inspect})"
       end
-      lines
+      self.new(handle,
+               Util.from_base64(secret64),
+               Time.at(issued_s.to_i),
+               lifetime_s.to_i,
+               assoc_type)
     end
-    def Association.deserialize(assoc_s)
-      keys = []
-      values = []
-      assoc_s.split("\n").each do |line|
-        k, v = line.split(":", 2)
-        keys << k.strip
-        values << v.strip
-      end
-      version, handle, secret, issued, lifetime, assoc_type = values
-      raise 'VersionError' if version != @@version
-      secret = OpenID::Util.from_base64(secret)
-      issued = issued.to_i
-      lifetime = lifetime.to_i
-      Association.new(handle, secret, issued, lifetime, assoc_type)
+    # Create an Association with an issued time of now
+    def self.from_expires_in(expires_in, handle, secret, assoc_type)
+      issued = Time.now
+      self.new(handle, secret, issued, expires_in, assoc_type)
     end
     def initialize(handle, secret, issued, lifetime, assoc_type)
-      if assoc_type != 'HMAC-SHA1'
-        raise ArgumentError, "HMAC-SHA1 is the only supported assoc_type, got #{assoc_type}"
-      end
       @handle = handle
       @secret = secret
       @issued = issued
@@ -73,37 +59,191 @@ module OpenID
       @assoc_type = assoc_type
     end
-    def expires_in
-      [0, @issued + @lifetime - Time.now.to_i].max
+    # Serialize the association to a form that's consistent across
+    # JanRain OpenID libraries.
+    def serialize
+      data = {
+        :version => '2',
+        :handle => handle,
+        :secret => Util.to_base64(secret),
+        :issued => issued.to_i.to_s,
+        :lifetime => lifetime.to_i.to_s,
+        :assoc_type => assoc_type,
+      }
+      Util.assert(data.length == FIELD_ORDER.length)
+      pairs = FIELD_ORDER.map{|field| [field.to_s, data[field]]}
+      return Util.seq_to_kv(pairs, strict=true)
     end
-    def expired?
-      return expires_in == 0
+    # The number of seconds until this association expires
+    def expires_in(now=nil)
+      if now.nil?
+        now = Time.now.to_i
+      else
+        now = now.to_i
+      end
+      time_diff = (issued.to_i + lifetime) - now
+      if time_diff < 0
+        return 0
+      else
+        return time_diff
+      end
     end
+    # Generate a signature for a sequence of [key, value] pairs
     def sign(pairs)
-      kv = ''
-      pairs.each {|k,v| kv << "#{k}:#{v}\n"}
-      return OpenID::Util.hmac_sha1(@secret, kv)
+      kv = Util.seq_to_kv(pairs)
+      case assoc_type
+      when 'HMAC-SHA1'
+        CryptUtil.hmac_sha1(@secret, kv)
+      when 'HMAC-SHA256'
+        CryptUtil.hmac_sha256(@secret, kv)
+      else
+        raise StandardError, "Association has unknown type: "\
+          "#{assoc_type.inspect}"
+      end
     end
-    def sign_hash(fields, hash, prefix='openid.')
-      pairs = []
-      fields.each { |f| pairs << [f, hash[prefix+f]] }
-      return OpenID::Util.to_base64(sign(pairs))
+    # Generate the list of pairs that form the signed elements of the
+    # given message
+    def make_pairs(message)
+      signed = message.get_arg(OPENID_NS, 'signed')
+      if signed.nil?
+        raise StandardError, 'Missing signed list'
+      end
+      signed_fields = signed.split(',', -1)
+      data = message.to_post_args
+      signed_fields.map {|field| [field, data.fetch('openid.'+field,'')] }
     end
-    def add_signature(fields, hash, prefix='openid.')
-      sig = sign_hash(fields, hash, prefix)
-      signed = fields.join(',')
-      hash[prefix+'sig'] = sig
-      hash[prefix+'signed'] = signed
+    # Return whether the message's signature passes
+    def check_message_signature(message)
+      message_sig = message.get_arg(OPENID_NS, 'sig')
+      if message_sig.nil?
+        raise StandardError, "#{message} has no sig."
+      end
+      calculated_sig = get_message_signature(message)
+      return calculated_sig == message_sig
+    end
+    # Get the signature for this message
+    def get_message_signature(message)
+      Util.to_base64(sign(make_pairs(message)))
     end
     def ==(other)
-      self.instance_variable_hash == other.instance_variable_hash
+      (other.class == self.class and
+       other.handle == self.handle and
+       other.secret == self.secret and
+       # The internals of the time objects seemed to differ
+       # in an opaque way when serializing/unserializing.
+       # I don't think this will be a problem.
+       other.issued.to_i == self.issued.to_i and
+       other.lifetime == self.lifetime and
+       other.assoc_type == self.assoc_type)
+    end
+    # Add a signature (and a signed list) to a message.
+    def sign_message(message)
+      if (message.has_key?(OPENID_NS, 'sig') or
+          message.has_key?(OPENID_NS, 'signed'))
+        raise ArgumentError, 'Message already has signed list or signature'
+      end
+      extant_handle = message.get_arg(OPENID_NS, 'assoc_handle')
+      if extant_handle and extant_handle != self.handle
+        raise ArgumentError, "Message has a different association handle"
+      end
+      signed_message = message.copy()
+      signed_message.set_arg(OPENID_NS, 'assoc_handle', self.handle)
+      message_keys = signed_message.to_post_args.keys()
+      signed_list = []
+      message_keys.each { |k|
+        if k.starts_with?('openid.')
+          signed_list << k[7..-1]
+        end
+      }
+      signed_list << 'signed'
+      signed_list.sort!
+      signed_message.set_arg(OPENID_NS, 'signed', signed_list.join(','))
+      sig = get_message_signature(signed_message)
+      signed_message.set_arg(OPENID_NS, 'sig', sig)
+      return signed_message
+    end
+  end
+  class AssociationNegotiator
+    attr_reader :allowed_types
+    def self.get_session_types(assoc_type)
+      case assoc_type
+      when 'HMAC-SHA1'
+        ['DH-SHA1', 'no-encryption']
+      when 'HMAC-SHA256'
+        ['DH-SHA256', 'no-encryption']
+      else
+        raise StandardError, "Unknown association type #{assoc_type.inspect}"
+      end
+    end
+    def self.check_session_type(assoc_type, session_type)
+      if !get_session_types(assoc_type).include?(session_type)
+        raise StandardError, "Session type #{session_type.inspect} not "\
+                             "valid for association type #{assoc_type.inspect}"
+      end
+    end
+    def initialize(allowed_types)
+      self.allowed_types=(allowed_types)
     end
+    def copy
+      Marshal.load(Marshal.dump(self))
+    end
+    def allowed_types=(allowed_types)
+      allowed_types.each do |assoc_type, session_type|
+        self.class.check_session_type(assoc_type, session_type)
+      end
+      @allowed_types = allowed_types
+    end
+    def add_allowed_type(assoc_type, session_type=nil)
+      if session_type.nil?
+        session_types = self.class.get_session_types(assoc_type)
+      else
+        self.class.check_session_type(assoc_type, session_type)
+        session_types = [session_type]
+      end
+      session_types.each do |session_type|
+        @allowed_types << [assoc_type, session_type]
+      end
+    end
+    def allowed?(assoc_type, session_type)
+      @allowed_types.include?([assoc_type, session_type])
+    end
+    def get_allowed_type
+      @allowed_types.empty? ? nil : @allowed_types[0]
+    end
   end
+  DefaultNegotiator =
+    AssociationNegotiator.new([['HMAC-SHA1', 'DH-SHA1'],
+                               ['HMAC-SHA1', 'no-encryption'],
+                               ['HMAC-SHA256', 'DH-SHA256'],
+                               ['HMAC-SHA256', 'no-encryption']])
+  EncryptedNegotiator =
+    AssociationNegotiator.new([['HMAC-SHA1', 'DH-SHA1'],
+                               ['HMAC-SHA256', 'DH-SHA256']])
 end