Module: OpenID::TrustRoot
- Defined in:
- lib/openid/trustroot.rb
Defined Under Namespace
Classes: TrustRoot
Constant Summary collapse
- TOP_LEVEL_DOMAINS =
%w' ac ad ae aero af ag ai al am an ao aq ar arpa as asia at au aw ax az ba bb bd be bf bg bh bi biz bj bm bn bo br bs bt bv bw by bz ca cat cc cd cf cg ch ci ck cl cm cn co com coop cr cu cv cx cy cz de dj dk dm do dz ec edu ee eg er es et eu fi fj fk fm fo fr ga gb gd ge gf gg gh gi gl gm gn gov gp gq gr gs gt gu gw gy hk hm hn hr ht hu id ie il im in info int io iq ir is it je jm jo jobs jp ke kg kh ki km kn kp kr kw ky kz la lb lc li lk lr ls lt lu lv ly ma mc md me mg mh mil mk ml mm mn mo mobi mp mq mr ms mt mu museum mv mw mx my mz na name nc ne net nf ng ni nl no np nr nu nz om org pa pe pf pg ph pk pl pm pn pr pro ps pt pw py qa re ro rs ru rw sa sb sc sd se sg sh si sj sk sl sm sn so sr st su sv sy sz tc td tel tf tg th tj tk tl tm tn to tp tr travel tt tv tw tz ua ug uk us uy uz va vc ve vg vi vn vu wf ws xn--0zwm56d xn--11b5bs3a9aj6g xn--80akhbyknj4f xn--9t4b11yi5a xn--deba0ad xn--g6w251d xn--hgbk6aj7f53bba xn--hlcj6aya9esc7a xn--jxalpdlp xn--kgbechtv xn--zckzah ye yt yu za zm zw'
- ALLOWED_PROTOCOLS =
['http', 'https']
- RP_RETURN_TO_URL_TYPE =
The URI for relying party discovery, used in realm verification.
XXX: This should probably live somewhere else (like in OpenID or OpenID::Yadis somewhere)
'http://specs.openid.net/auth/2.0/return_to'
Class Method Summary collapse
-
._extract_return_url(endpoint) ⇒ Object
If the endpoint is a relying party OpenID return_to endpoint, return the endpoint URL.
-
.get_allowed_return_urls(relying_party_url) ⇒ Object
Given a relying party discovery URL return a list of return_to URLs.
-
.return_to_matches(allowed_return_to_urls, return_to) ⇒ Object
Is the return_to URL under one of the supplied allowed return_to URLs?.
-
.verify_return_to(realm_str, return_to, _vrfy = nil) ⇒ Object
Verify that a return_to URL is valid for the given realm.
Class Method Details
._extract_return_url(endpoint) ⇒ Object
If the endpoint is a relying party OpenID return_to endpoint, return the endpoint URL. Otherwise, return None.
This function is intended to be used as a filter for the Yadis filtering interface.
endpoint: An XRDS BasicServiceEndpoint, as returned by performing Yadis dicovery.
returns the endpoint URL or None if the endpoint is not a relying party endpoint.
59 60 61 62 63 64 65 |
# File 'lib/openid/trustroot.rb', line 59 def TrustRoot._extract_return_url(endpoint) if endpoint.matchTypes([RP_RETURN_TO_URL_TYPE]) return endpoint.uri else return nil end end |
.get_allowed_return_urls(relying_party_url) ⇒ Object
Given a relying party discovery URL return a list of return_to URLs.
96 97 98 99 100 101 102 103 104 105 106 107 |
# File 'lib/openid/trustroot.rb', line 96 def TrustRoot.get_allowed_return_urls() rp_url_after_redirects, return_to_urls = services.get_service_endpoints( , _extract_return_url) if rp_url_after_redirects != # Verification caused a redirect raise RealmVerificationRedirected.new( , rp_url_after_redirects) end return return_to_urls end |
.return_to_matches(allowed_return_to_urls, return_to) ⇒ Object
Is the return_to URL under one of the supplied allowed return_to URLs?
69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 |
# File 'lib/openid/trustroot.rb', line 69 def TrustRoot.return_to_matches(allowed_return_to_urls, return_to) allowed_return_to_urls.each { |allowed_return_to| # A return_to pattern works the same as a realm, except that # it's not allowed to use a wildcard. We'll model this by # parsing it as a realm, and not trying to match it if it has # a wildcard. return_realm = TrustRoot.parse(allowed_return_to) if (# Parses as a trust root !return_realm.nil? and # Does not have a wildcard !return_realm.wildcard and # Matches the return_to that we passed in with it return_realm.validate_url(return_to) ) return true end } # No URL in the list matched return false end |
.verify_return_to(realm_str, return_to, _vrfy = nil) ⇒ Object
Verify that a return_to URL is valid for the given realm.
This function builds a discovery URL, performs Yadis discovery on it, makes sure that the URL does not redirect, parses out the return_to URLs, and finally checks to see if the current return_to URL matches the return_to.
raises DiscoveryFailure when Yadis discovery fails returns true if the return_to URL is valid for the realm
118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 |
# File 'lib/openid/trustroot.rb', line 118 def TrustRoot.verify_return_to(realm_str, return_to, _vrfy=nil) # _vrfy parameter is there to make testing easier if _vrfy.nil? _vrfy = self.method('get_allowed_return_urls') end if !(_vrfy.is_a?(Proc) or _vrfy.is_a?(Method)) raise ArgumentError, "_vrfy must be a Proc or Method" end realm = TrustRoot.parse(realm_str) if realm.nil? # The realm does not parse as a URL pattern return false end begin allowable_urls = _vrfy.call(realm.build_discovery_url()) rescue RealmVerificationRedirected => err Util.log(err.to_s) return false end if return_to_matches(allowable_urls, return_to) return true else Util.log("Failed to validate return_to #{return_to} for " + "realm #{realm_str}, was not in #{allowable_urls}") return false end end |