basic_RP: add methods for accessing identity information passed from OP.

Signed-off-by: Michael Krelin <hacker@klever.net>

2 files changed, 63 insertions, 2 deletions

diff --git a/include/opkele/basic_rp.h b/include/opkele/basic_rp.h
index d5356aa..d096e0a 100644
--- a/include/opkele/basic_rp.h
+++ b/include/opkele/basic_rp.h
@@ -5,19 +5,55 @@
 #include <opkele/types.h>
 #include <opkele/extension.h>
 
 namespace opkele {
     using std::string;
 
     class basic_RP {
         public:
+            /**
+             * Claimed identifier from a parsed id_res message.
+             */
+            string claimed_id;
+            /**
+             * OP-Local identifier from a parsed id_res message.
+             */
+            string identity;
 
             virtual ~basic_RP() { }
 
+            void reset_vars();
+
+            /**
+             * @name Assertion information retrieval
+             * Retrieval of the information passed with openid message
+             * @{
+             */
+            /**
+             * Find out if the assertion is about identity
+             * @return true if so
+             */
+            bool has_identity() const;
+            /**
+             * Get claimed identifier supplied with the request
+             * @return claimed identifier
+             * @throw non_identity if request is not about identity
+             */
+            const string& get_claimed_id() const;
+            /**
+             * Get the identity (OP-Local identifier) confirmed
+             * @return identity
+             * @throw non_identity if request is not about identity
+             */
+            const string& get_identity() const;
+            /**
+             * @}
+             */
+
             /**
              * @name Global persistent store API
              * These are functions related to the associations with OP storage
              * and retrieval and nonce records. They provide an interface to
              * the persistent storage which is shared by all sessions. If the
              * implementor prefers the dumb mode instead, the function should
              * throw dumb_RP exception instead.
              * @see opkele::dumb_RP
diff --git a/lib/basic_rp.cc b/lib/basic_rp.cc
index e65d9fb..3357d0b 100644
--- a/lib/basic_rp.cc
+++ b/lib/basic_rp.cc
@@ -3,19 +3,38 @@
 #include <openssl/hmac.h>
 #include <opkele/basic_rp.h>
 #include <opkele/exception.h>
 #include <opkele/uris.h>
 #include <opkele/data.h>
 #include <opkele/util.h>
 #include <opkele/util-internal.h>
 #include <opkele/curl.h>
+#include <opkele/debug.h>
 
 namespace opkele {
 
+    void basic_RP::reset_vars() {
+        claimed_id.clear(); identity.clear();
+    }
+
+    const string& basic_RP::get_claimed_id() const {
+        if(claimed_id.empty())
+            throw non_identity(OPKELE_CP_ "attempting to retreive claimed_id of non-identity assertion");
+        assert(!identity.empty());
+        return claimed_id;
+    }
+
+    const string& basic_RP::get_identity() const {
+        if(identity.empty())
+            throw non_identity(OPKELE_CP_ "attempting to retrieve identity of non-identity related assertion");
+        assert(!claimed_id.empty());
+        return identity;
+    }
+
     static void dh_get_secret(
             secret_t& secret, const basic_openid_message& om,
             const char *exp_assoc, const char *exp_sess,
             util::dh_t& dh,
             size_t d_len, unsigned char *(*d_fun)(const unsigned char*,size_t,unsigned char*),
             size_t exp_s_len) try {
         if(om.get_field("assoc_type")!=exp_assoc || om.get_field("session_type")!=exp_sess)
             throw bad_input(OPKELE_CP_ "Unexpected associate response");
@@ -191,16 +210,17 @@ namespace opkele {
                     p[u.substr(q,eq-q)] = u.substr(eq+1,am-eq-1);
                 }
                 q = ++am;
             }
         }
     }
 
     void basic_RP::id_res(const basic_openid_message& om,extension_t *ext) {
+        reset_vars();
         bool o2 = om.has_field("ns")
             && om.get_field("ns")==OIURI_OPENID20;
         if( (!o2) && om.has_field("user_setup_url"))
             throw id_res_setup(OPKELE_CP_ "assertion failed, setup url provided",
                     om.get_field("user_setup_url"));
         string m = om.get_field("mode");
         if(o2 && m=="setup_needed")
             throw id_res_setup(OPKELE_CP_ "setup needed, no setup url provided");
@@ -266,22 +286,27 @@ namespace opkele {
                 map<string,string>::const_iterator tpi = tp.find(rpi->first);
                 if(tpi==tp.end())
                     throw id_res_bad_return_to(OPKELE_CP_ string("Parameter '")+rpi->first+"' from return_to is missing from the request");
                 if(tpi->second!=rpi->second)
                     throw id_res_bad_return_to(OPKELE_CP_ string("Parameter '")+rpi->first+"' from return_to doesn't matche the request");
             }
 
             if(om.has_field("claimed_id")) {
+                claimed_id = om.get_field("claimed_id");
+                identity = om.get_field("identity");
                 verify_OP(
                         om.get_field("op_endpoint"),
-                        om.get_field("claimed_id"),
-                        om.get_field("identity") );
+                        claimed_id, identity );
             }
 
+        }else{
+            claimed_id = get_endpoint().claimed_id;
+            /* TODO: check if this is the identity we asked for */
+            identity = om.get_field("identity");
         }
         if(ext) ext->rp_id_res_hook(om,signeds);
     }
 
     void basic_RP::check_authentication(const string& OP,
             const basic_openid_message& om){
         openid_message_t res;
         static const string checkauthmode = "check_authentication";