Skip to content

Commit 302f965

Browse files
author
johnny.bufu
committed
Upgraded PAPE implementation to v1.0 final.
1 parent ba19e22 commit 302f965

5 files changed

Lines changed: 97 additions & 45 deletions

File tree

‎README‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ The library currently supports the following OpenID specifications:
1212
- OpenID Authentication 2.0
1313
- OpenID Attribute Exchange 1.0
1414
- OpenID Simple Registration 1.0 and 1.1
15-
- OpenID Provider Authentication Policy Extension 1.0, draft 2
15+
- OpenID Provider Authentication Policy Extension 1.0
1616
- OpenID Information Cards 1.0, draft 1
1717

1818
OpenID starts with the concept that anyone can identify themselves on the

‎TODO‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@
1717

1818
- Extensions to implement:
1919
- OpenID Signed Assertions 1.0
20-
- OpenID Provider Authentication Policy Extension 1.0
2120

2221
- MessageExtension.providesIdentifier()
2322
- review interface to allow exchange of messages with no identifiers at all

‎src/org/openid4java/message/pape/PapeMessage.java‎

Lines changed: 54 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@
88
import org.apache.commons.logging.Log;
99
import org.apache.commons.logging.LogFactory;
1010

11+
import java.util.Map;
12+
import java.util.HashMap;
13+
import java.util.Iterator;
14+
1115
/**
1216
* Base class for the OpenID Provider Authentication Policy extension
1317
* implementation.
@@ -35,6 +39,13 @@ public class PapeMessage implements MessageExtension, MessageExtensionFactory
3539
public static final String PAPE_POLICY_MULTI_FACTOR_PHYSICAL =
3640
"http://schemas.openid.net/pape/policies/2007/06/multi-factor-physical";
3741

42+
protected static final String AUTH_LEVEL_PREFIX = "auth_level.";
43+
protected static final String AUTH_LEVEL_NS_PREFIX = "auth_level.ns.";
44+
private static final String AUTH_LEVEL_ALIAS_PREFIX = "papeauthlevel";
45+
46+
protected Map authLevelAliases = new HashMap(); // auth level URL -> alias
47+
private int authLevelAliasCounter = 0;
48+
3849
/**
3950
* The OpenID Provider Authentication Policy extension URI.
4051
*/
@@ -67,7 +78,7 @@ public PapeMessage()
6778
*/
6879
public PapeMessage(ParameterList params)
6980
{
70-
_parameters = params;
81+
setParameters(params);
7182

7283
if (DEBUG)
7384
_log.debug("Created PapeMessage from parameter list:\n" + params);
@@ -108,6 +119,9 @@ public ParameterList getParameters()
108119
public void setParameters(ParameterList params)
109120
{
110121
_parameters = params;
122+
Iterator iter = params.getParameters().iterator();
123+
while(iter.hasNext())
124+
checkAddAuthLevelExtension((Parameter) iter.next());
111125
}
112126

113127
/**
@@ -131,7 +145,45 @@ public boolean hasParameter(String name)
131145
*/
132146
protected void set(String name, String value)
133147
{
134-
_parameters.set(new Parameter(name, value));
148+
Parameter param = new Parameter(name, value);
149+
_parameters.set(param);
150+
checkAddAuthLevelExtension(param);
151+
}
152+
153+
private void checkAddAuthLevelExtension(Parameter param) {
154+
String key = param == null ? null : param.getKey();
155+
String value = param == null ? null : param.getValue();
156+
if (key != null && key.startsWith(AUTH_LEVEL_NS_PREFIX))
157+
addAuthLevelExtension(value, key.substring(AUTH_LEVEL_NS_PREFIX.length()));
158+
}
159+
160+
private synchronized String newAuthLevelAlias()
161+
{
162+
return AUTH_LEVEL_ALIAS_PREFIX + ++authLevelAliasCounter;
163+
}
164+
165+
protected String addAuthLevelExtension(String authLevelTypeUri)
166+
{
167+
return addAuthLevelExtension(authLevelTypeUri, null);
168+
}
169+
170+
private String addAuthLevelExtension(String authLevelTypeUri, String alias)
171+
{
172+
if (!authLevelAliases.containsKey(authLevelTypeUri)) {
173+
String authLevelAlias = alias == null ? newAuthLevelAlias() : alias;
174+
authLevelAliases.put(authLevelTypeUri, authLevelAlias);
175+
}
176+
return (String) authLevelAliases.get(authLevelTypeUri);
177+
}
178+
179+
public boolean hasCustomAuthLevel(String authLevelTypeUri)
180+
{
181+
return authLevelAliases.containsKey(authLevelTypeUri);
182+
}
183+
184+
protected String getCustomAuthLevelAlias(String authLevelTypeUri)
185+
{
186+
return (String) authLevelAliases.get(authLevelTypeUri);
135187
}
136188

137189
/**

‎src/org/openid4java/message/pape/PapeRequest.java‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ public class PapeRequest extends PapeMessage
2626
private static final boolean DEBUG = _log.isDebugEnabled();
2727

2828
protected final static List PAPE_FIELDS = Arrays.asList( new String[] {
29-
"preferred_auth_policies", "max_auth_age"
29+
"preferred_auth_policies", "preferred_auth_level_types", "max_auth_age"
3030
});
3131

3232
/**
@@ -56,7 +56,7 @@ public static PapeRequest createPapeRequest()
5656
*/
5757
protected PapeRequest(ParameterList params)
5858
{
59-
_parameters = params;
59+
super(params);
6060
}
6161

6262
/**
@@ -186,12 +186,19 @@ public void validate() throws MessageException
186186
while (it.hasNext())
187187
{
188188
String paramName = ((Parameter) it.next()).getKey();
189-
if (! PAPE_FIELDS.contains(paramName) )
189+
if (! PAPE_FIELDS.contains(paramName) && ! paramName.startsWith(PapeMessage.AUTH_LEVEL_NS_PREFIX))
190190
{
191191
throw new MessageException(
192192
"Invalid parameter name in PAPE request: " + paramName,
193193
OpenIDException.PAPE_ERROR);
194194
}
195195
}
196196
}
197+
198+
public void addPreferredCustomAuthLevel(String authLevelTypeUri)
199+
{
200+
String alias = addAuthLevelExtension(authLevelTypeUri);
201+
String preferred = getParameterValue("preferred_auth_level_types");
202+
set("preferred_auth_level_types", preferred == null ? alias : preferred + " " + alias);
203+
}
197204
}

‎src/org/openid4java/message/pape/PapeResponse.java‎

Lines changed: 32 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -27,17 +27,19 @@ public class PapeResponse extends PapeMessage
2727
private static final boolean DEBUG = _log.isDebugEnabled();
2828

2929
protected final static List PAPE_FIELDS = Arrays.asList( new String[] {
30-
"auth_policies", "auth_time", "nist_auth_level"
30+
"auth_policies", "auth_time",
3131
});
3232

33+
private static final String AUTH_POLICY_NONE = "http://schemas.openid.net/pape/policies/2007/06/none";
34+
3335
private static InternetDateFormat _dateFormat = new InternetDateFormat();
3436

3537
/**
3638
* Constructs a Pape Response with an empty parameter list.
3739
*/
3840
protected PapeResponse()
3941
{
40-
set("auth_policies", "none");
42+
set("auth_policies", AUTH_POLICY_NONE);
4143

4244
if (DEBUG) _log.debug("Created empty PAPE response.");
4345
}
@@ -59,7 +61,7 @@ public static PapeResponse createPapeResponse()
5961
*/
6062
protected PapeResponse(ParameterList params)
6163
{
62-
_parameters = params;
64+
super(params);
6365
}
6466

6567
public static PapeResponse createPapeResponse(ParameterList params)
@@ -112,7 +114,7 @@ public void addAuthPolicy(String policyUri)
112114

113115
String policies = getAuthPolicies();
114116

115-
if (policies == null || "none".equals(policies)) // should never be null
117+
if (policies == null || AUTH_POLICY_NONE.equals(policies)) // should never be null
116118
setAuthPolicies(policyUri);
117119
else
118120
setAuthPolicies(policies + " " + policyUri);
@@ -126,7 +128,7 @@ public List getAuthPoliciesList()
126128
{
127129
String policies = getParameterValue("auth_policies");
128130

129-
if (policies == null || "none".equals(policies)) // should never be null
131+
if (policies == null || AUTH_POLICY_NONE.equals(policies)) // should never be null
130132
return new ArrayList();
131133
else
132134
return Arrays.asList(policies.split(" "));
@@ -190,33 +192,6 @@ public Date getAuthDate()
190192
return null;
191193
}
192194

193-
/**
194-
* Gets the value of the nist_auth_level parameter.
195-
* <p>
196-
* NIST levels are integers between 1 and 4 inclusive. Level 0 is
197-
* used to signify that the OP recognizes the parameter and the
198-
* user authentication did not meet the requirements of Level 1.
199-
*
200-
* @return The NIST level, or -1 if the parameter is not set.
201-
*/
202-
public int getNistAuthLevel()
203-
{
204-
String level = getParameterValue("nist_auth_level");
205-
206-
if ( level != null && level.length() > 0 )
207-
return Integer.parseInt(level);
208-
else
209-
return -1;
210-
}
211-
212-
public void setNistAuthLevel(int level) throws MessageException
213-
{
214-
if (level < 0 || level > 4)
215-
throw new MessageException("Invalid NIST level: " + level);
216-
217-
set("nist_auth_level", Integer.toString(level));
218-
}
219-
220195
/**
221196
* Checks the validity of the extension.
222197
* <p>
@@ -253,12 +228,31 @@ private void validate() throws MessageException
253228
{
254229
String paramName = ((Parameter) it.next()).getKey();
255230

256-
if (! PAPE_FIELDS.contains(paramName))
257-
{
258-
throw new MessageException(
259-
"Invalid parameter name in PAPE response: " + paramName,
260-
OpenIDException.PAPE_ERROR);
261-
}
231+
if (PAPE_FIELDS.contains(paramName) || paramName.startsWith(PapeMessage.AUTH_LEVEL_NS_PREFIX))
232+
continue;
233+
234+
if ( paramName.startsWith(AUTH_LEVEL_PREFIX) &&
235+
(authLevelAliases.values().contains(paramName.substring(AUTH_LEVEL_PREFIX.length()))))
236+
continue;
237+
238+
throw new MessageException(
239+
"Invalid parameter in PAPE response: " + paramName,
240+
OpenIDException.PAPE_ERROR);
262241
}
263242
}
243+
244+
public void setCustomAuthLevel(String authLevelTypeUri, String level)
245+
{
246+
String alias = addAuthLevelExtension(authLevelTypeUri);
247+
set(AUTH_LEVEL_PREFIX + alias, level);
248+
}
249+
250+
public String getCustomAuthLevel(String authLevelTypeUri)
251+
{
252+
if (hasCustomAuthLevel(authLevelTypeUri))
253+
return getParameterValue(AUTH_LEVEL_PREFIX + getCustomAuthLevelAlias(authLevelTypeUri));
254+
else
255+
return null;
256+
}
257+
264258
}

0 commit comments

Comments
 (0)