summaryrefslogtreecommitdiffabout
path: root/lib/basic_op.cc
Unidiff
Diffstat (limited to 'lib/basic_op.cc') (more/less context) (ignore whitespace changes)
-rw-r--r--lib/basic_op.cc38
1 files changed, 19 insertions, 19 deletions
diff --git a/lib/basic_op.cc b/lib/basic_op.cc
index 7a2dbd2..18446dc 100644
--- a/lib/basic_op.cc
+++ b/lib/basic_op.cc
@@ -1,330 +1,330 @@
1#include <time.h> 1#include <time.h>
2#include <cassert> 2#include <cassert>
3#include <openssl/sha.h> 3#include <openssl/sha.h>
4#include <openssl/hmac.h> 4#include <openssl/hmac.h>
5#include <opkele/data.h> 5#include <opkele/data.h>
6#include <opkele/basic_op.h> 6#include <opkele/basic_op.h>
7#include <opkele/exception.h> 7#include <opkele/exception.h>
8#include <opkele/util.h> 8#include <opkele/util.h>
9#include <opkele/uris.h> 9#include <opkele/uris.h>
10 10
11namespace opkele { 11namespace opkele {
12 12
13 void basic_op::reset_vars() { 13 void basic_OP::reset_vars() {
14 assoc.reset(); 14 assoc.reset();
15 return_to.clear(); realm.clear(); 15 return_to.clear(); realm.clear();
16 claimed_id.clear(); identity.clear(); 16 claimed_id.clear(); identity.clear();
17 invalidate_handle.clear(); 17 invalidate_handle.clear();
18 } 18 }
19 19
20 bool basic_op::has_return_to() const { 20 bool basic_OP::has_return_to() const {
21 return !return_to.empty(); 21 return !return_to.empty();
22 } 22 }
23 const string& basic_op::get_return_to() const { 23 const string& basic_OP::get_return_to() const {
24 if(return_to.empty()) 24 if(return_to.empty())
25 throw no_return_to(OPKELE_CP_ "No return_to URL provided with request"); 25 throw no_return_to(OPKELE_CP_ "No return_to URL provided with request");
26 return return_to; 26 return return_to;
27 } 27 }
28 28
29 const string& basic_op::get_realm() const { 29 const string& basic_OP::get_realm() const {
30 assert(!realm.empty()); 30 assert(!realm.empty());
31 return realm; 31 return realm;
32 } 32 }
33 33
34 bool basic_op::has_identity() const { 34 bool basic_OP::has_identity() const {
35 return !identity.empty(); 35 return !identity.empty();
36 } 36 }
37 const string& basic_op::get_claimed_id() const { 37 const string& basic_OP::get_claimed_id() const {
38 if(claimed_id.empty()) 38 if(claimed_id.empty())
39 throw non_identity(OPKELE_CP_ "attempting to retrieve claimed_id of non-identity related request"); 39 throw non_identity(OPKELE_CP_ "attempting to retrieve claimed_id of non-identity related request");
40 assert(!identity.empty()); 40 assert(!identity.empty());
41 return claimed_id; 41 return claimed_id;
42 } 42 }
43 const string& basic_op::get_identity() const { 43 const string& basic_OP::get_identity() const {
44 if(identity.empty()) 44 if(identity.empty())
45 throw non_identity(OPKELE_CP_ "attempting to retrieve identity of non-identity related request"); 45 throw non_identity(OPKELE_CP_ "attempting to retrieve identity of non-identity related request");
46 assert(!claimed_id.empty()); 46 assert(!claimed_id.empty());
47 return identity; 47 return identity;
48 } 48 }
49 49
50 bool basic_op::is_id_select() const { 50 bool basic_OP::is_id_select() const {
51 return identity==IDURI_SELECT20; 51 return identity==IDURI_SELECT20;
52 } 52 }
53 53
54 void basic_op::select_identity(const string& c,const string& i) { 54 void basic_OP::select_identity(const string& c,const string& i) {
55 claimed_id = c; identity = i; 55 claimed_id = c; identity = i;
56 } 56 }
57 void basic_op::set_claimed_id(const string& c) { 57 void basic_OP::set_claimed_id(const string& c) {
58 claimed_id = c; 58 claimed_id = c;
59 } 59 }
60 60
61 basic_openid_message& basic_op::associate( 61 basic_openid_message& basic_OP::associate(
62 basic_openid_message& oum, 62 basic_openid_message& oum,
63 const basic_openid_message& inm) try { 63 const basic_openid_message& inm) try {
64 assert(inm.get_field("mode")=="associate"); 64 assert(inm.get_field("mode")=="associate");
65 util::dh_t dh; 65 util::dh_t dh;
66 util::bignum_t c_pub; 66 util::bignum_t c_pub;
67 unsigned char key_digest[SHA256_DIGEST_LENGTH]; 67 unsigned char key_digest[SHA256_DIGEST_LENGTH];
68 size_t d_len = 0; 68 size_t d_len = 0;
69 enum { 69 enum {
70 sess_cleartext, sess_dh_sha1, sess_dh_sha256 70 sess_cleartext, sess_dh_sha1, sess_dh_sha256
71 } st = sess_cleartext; 71 } st = sess_cleartext;
72 string sts = inm.get_field("session_type"); 72 string sts = inm.get_field("session_type");
73 string ats = inm.get_field("assoc_type"); 73 string ats = inm.get_field("assoc_type");
74 if(sts=="DH-SHA1" || sts=="DH-SHA256") { 74 if(sts=="DH-SHA1" || sts=="DH-SHA256") {
75 if(!(dh = DH_new())) 75 if(!(dh = DH_new()))
76 throw exception_openssl(OPKELE_CP_ "failed to DH_new()"); 76 throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
77 c_pub = util::base64_to_bignum(inm.get_field("dh_consumer_public")); 77 c_pub = util::base64_to_bignum(inm.get_field("dh_consumer_public"));
78 try { dh->p = util::base64_to_bignum(inm.get_field("dh_modulus")); 78 try { dh->p = util::base64_to_bignum(inm.get_field("dh_modulus"));
79 }catch(failed_lookup&) { 79 }catch(failed_lookup&) {
80 dh->p = util::dec_to_bignum(data::_default_p); } 80 dh->p = util::dec_to_bignum(data::_default_p); }
81 try { dh->g = util::base64_to_bignum(inm.get_field("dh_gen")); 81 try { dh->g = util::base64_to_bignum(inm.get_field("dh_gen"));
82 }catch(failed_lookup&) { 82 }catch(failed_lookup&) {
83 dh->g = util::dec_to_bignum(data::_default_g); } 83 dh->g = util::dec_to_bignum(data::_default_g); }
84 if(!DH_generate_key(dh)) 84 if(!DH_generate_key(dh))
85 throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()"); 85 throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
86 vector<unsigned char> ck(DH_size(dh)+1); 86 vector<unsigned char> ck(DH_size(dh)+1);
87 unsigned char *ckptr = &(ck.front())+1; 87 unsigned char *ckptr = &(ck.front())+1;
88 int cklen = DH_compute_key(ckptr,c_pub,dh); 88 int cklen = DH_compute_key(ckptr,c_pub,dh);
89 if(cklen<0) 89 if(cklen<0)
90 throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()"); 90 throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
91 if(cklen && (*ckptr)&0x80) { 91 if(cklen && (*ckptr)&0x80) {
92 (*(--ckptr)) = 0; ++cklen; } 92 (*(--ckptr)) = 0; ++cklen; }
93 if(sts=="DH-SHA1") { 93 if(sts=="DH-SHA1") {
94 SHA1(ckptr,cklen,key_digest); d_len = SHA_DIGEST_LENGTH; 94 SHA1(ckptr,cklen,key_digest); d_len = SHA_DIGEST_LENGTH;
95 }else if(sts=="DH-SHA256") { 95 }else if(sts=="DH-SHA256") {
96 SHA256(ckptr,cklen,key_digest); d_len = SHA256_DIGEST_LENGTH; 96 SHA256(ckptr,cklen,key_digest); d_len = SHA256_DIGEST_LENGTH;
97 }else 97 }else
98 throw internal_error(OPKELE_CP_ "I thought I knew the session type"); 98 throw internal_error(OPKELE_CP_ "I thought I knew the session type");
99 }else 99 }else
100 throw unsupported(OPKELE_CP_ "Unsupported session_type"); 100 throw unsupported(OPKELE_CP_ "Unsupported session_type");
101 assoc_t assoc; 101 assoc_t assoc;
102 if(ats=="HMAC-SHA1") 102 if(ats=="HMAC-SHA1")
103 assoc = alloc_assoc(ats,SHA_DIGEST_LENGTH,true); 103 assoc = alloc_assoc(ats,SHA_DIGEST_LENGTH,true);
104 else if(ats=="HMAC-SHA256") 104 else if(ats=="HMAC-SHA256")
105 assoc = alloc_assoc(ats,SHA256_DIGEST_LENGTH,true); 105 assoc = alloc_assoc(ats,SHA256_DIGEST_LENGTH,true);
106 else 106 else
107 throw unsupported(OPKELE_CP_ "Unsupported assoc_type"); 107 throw unsupported(OPKELE_CP_ "Unsupported assoc_type");
108 oum.reset_fields(); 108 oum.reset_fields();
109 oum.set_field("ns",OIURI_OPENID20); 109 oum.set_field("ns",OIURI_OPENID20);
110 oum.set_field("assoc_type",assoc->assoc_type()); 110 oum.set_field("assoc_type",assoc->assoc_type());
111 oum.set_field("assoc_handle",assoc->handle()); 111 oum.set_field("assoc_handle",assoc->handle());
112 oum.set_field("expires_in",util::long_to_string(assoc->expires_in())); 112 oum.set_field("expires_in",util::long_to_string(assoc->expires_in()));
113 secret_t secret = assoc->secret(); 113 secret_t secret = assoc->secret();
114 if(sts=="DH-SHA1" || sts=="DH-SHA256") { 114 if(sts=="DH-SHA1" || sts=="DH-SHA256") {
115 if(d_len != secret.size()) 115 if(d_len != secret.size())
116 throw bad_input(OPKELE_CP_ "Association secret and session MAC are not of the same size"); 116 throw bad_input(OPKELE_CP_ "Association secret and session MAC are not of the same size");
117 oum.set_field("session_type",sts); 117 oum.set_field("session_type",sts);
118 oum.set_field("dh_server_public",util::bignum_to_base64(dh->pub_key)); 118 oum.set_field("dh_server_public",util::bignum_to_base64(dh->pub_key));
119 string b64; secret.enxor_to_base64(key_digest,b64); 119 string b64; secret.enxor_to_base64(key_digest,b64);
120 oum.set_field("enc_mac_key",b64); 120 oum.set_field("enc_mac_key",b64);
121 }else /* TODO: support cleartext over encrypted connection */ 121 }else /* TODO: support cleartext over encrypted connection */
122 throw unsupported(OPKELE_CP_ "Unsupported session type"); 122 throw unsupported(OPKELE_CP_ "Unsupported session type");
123 return oum; 123 return oum;
124 } catch(unsupported& u) { 124 } catch(unsupported& u) {
125 oum.reset_fields(); 125 oum.reset_fields();
126 oum.set_field("ns",OIURI_OPENID20); 126 oum.set_field("ns",OIURI_OPENID20);
127 oum.set_field("error",u.what()); 127 oum.set_field("error",u.what());
128 oum.set_field("error_code","unsupported-type"); 128 oum.set_field("error_code","unsupported-type");
129 oum.set_field("session_type","DH-SHA256"); 129 oum.set_field("session_type","DH-SHA256");
130 oum.set_field("assoc_type","HMAC-SHA256"); 130 oum.set_field("assoc_type","HMAC-SHA256");
131 return oum; 131 return oum;
132 } 132 }
133 133
134 void basic_op::checkid_(const basic_openid_message& inm, 134 void basic_OP::checkid_(const basic_openid_message& inm,
135 extension_t *ext) { 135 extension_t *ext) {
136 reset_vars(); 136 reset_vars();
137 string mode = inm.get_field("mode"); 137 string mode = inm.get_field("mode");
138 if(mode=="checkid_setup") 138 if(mode=="checkid_setup")
139 mode = mode_checkid_setup; 139 mode = mode_checkid_setup;
140 else if(mode=="checkid_immediate") 140 else if(mode=="checkid_immediate")
141 mode = mode_checkid_immediate; 141 mode = mode_checkid_immediate;
142 else 142 else
143 throw bad_input(OPKELE_CP_ "Invalid checkid_* mode"); 143 throw bad_input(OPKELE_CP_ "Invalid checkid_* mode");
144 try { 144 try {
145 assoc = retrieve_assoc(invalidate_handle=inm.get_field("assoc_handle")); 145 assoc = retrieve_assoc(invalidate_handle=inm.get_field("assoc_handle"));
146 invalidate_handle.clear(); 146 invalidate_handle.clear();
147 }catch(failed_lookup&) { } 147 }catch(failed_lookup&) { }
148 try { 148 try {
149 openid2 = (inm.get_field("ns")==OIURI_OPENID20); 149 openid2 = (inm.get_field("ns")==OIURI_OPENID20);
150 }catch(failed_lookup&) { openid2 = false; } 150 }catch(failed_lookup&) { openid2 = false; }
151 try { 151 try {
152 return_to = inm.get_field("return_to"); 152 return_to = inm.get_field("return_to");
153 }catch(failed_lookup&) { } 153 }catch(failed_lookup&) { }
154 if(openid2) { 154 if(openid2) {
155 try { 155 try {
156 realm = inm.get_field("realm"); 156 realm = inm.get_field("realm");
157 }catch(failed_lookup&) { 157 }catch(failed_lookup&) {
158 try { 158 try {
159 realm = inm.get_field("trust_root"); 159 realm = inm.get_field("trust_root");
160 }catch(failed_lookup&) { 160 }catch(failed_lookup&) {
161 if(return_to.empty()) 161 if(return_to.empty())
162 throw bad_input(OPKELE_CP_ 162 throw bad_input(OPKELE_CP_
163 "Both realm and return_to are unset"); 163 "Both realm and return_to are unset");
164 realm = return_to; 164 realm = return_to;
165 } 165 }
166 } 166 }
167 }else{ 167 }else{
168 try { 168 try {
169 realm = inm.get_field("trust_root"); 169 realm = inm.get_field("trust_root");
170 }catch(failed_lookup&) { 170 }catch(failed_lookup&) {
171 if(return_to.empty()) 171 if(return_to.empty())
172 throw bad_input(OPKELE_CP_ 172 throw bad_input(OPKELE_CP_
173 "Both realm and return_to are unset"); 173 "Both realm and return_to are unset");
174 realm = return_to; 174 realm = return_to;
175 } 175 }
176 } 176 }
177 try { 177 try {
178 identity = inm.get_field("identity"); 178 identity = inm.get_field("identity");
179 try { 179 try {
180 claimed_id = inm.get_field("claimed_id"); 180 claimed_id = inm.get_field("claimed_id");
181 }catch(failed_lookup&) { 181 }catch(failed_lookup&) {
182 if(openid2) 182 if(openid2)
183 throw bad_input(OPKELE_CP_ 183 throw bad_input(OPKELE_CP_
184 "claimed_id and identity must be either both present or both absent"); 184 "claimed_id and identity must be either both present or both absent");
185 claimed_id = identity; 185 claimed_id = identity;
186 } 186 }
187 }catch(failed_lookup&) { 187 }catch(failed_lookup&) {
188 if(openid2 && inm.has_field("claimed_id")) 188 if(openid2 && inm.has_field("claimed_id"))
189 throw bad_input(OPKELE_CP_ 189 throw bad_input(OPKELE_CP_
190 "claimed_id and identity must be either both present or both absent"); 190 "claimed_id and identity must be either both present or both absent");
191 } 191 }
192 verify_return_to(); 192 verify_return_to();
193 if(ext) ext->op_checkid_hook(inm); 193 if(ext) ext->op_checkid_hook(inm);
194 } 194 }
195 195
196 basic_openid_message& basic_op::id_res(basic_openid_message& om, 196 basic_openid_message& basic_OP::id_res(basic_openid_message& om,
197 extension_t *ext) { 197 extension_t *ext) {
198 assert(!return_to.empty()); 198 assert(!return_to.empty());
199 assert(!is_id_select()); 199 assert(!is_id_select());
200 if(!assoc) { 200 if(!assoc) {
201 assoc = alloc_assoc("HMAC-SHA256",SHA256_DIGEST_LENGTH,true); 201 assoc = alloc_assoc("HMAC-SHA256",SHA256_DIGEST_LENGTH,true);
202 } 202 }
203 time_t now = time(0); 203 time_t now = time(0);
204 struct tm gmt; gmtime_r(&now,&gmt); 204 struct tm gmt; gmtime_r(&now,&gmt);
205 char w3timestr[24]; 205 char w3timestr[24];
206 if(!strftime(w3timestr,sizeof(w3timestr),"%Y-%m-%dT%H:%M:%SZ",&gmt)) 206 if(!strftime(w3timestr,sizeof(w3timestr),"%Y-%m-%dT%H:%M:%SZ",&gmt))
207 throw failed_conversion(OPKELE_CP_ 207 throw failed_conversion(OPKELE_CP_
208 "Failed to build time string for nonce" ); 208 "Failed to build time string for nonce" );
209 om.set_field("ns",OIURI_OPENID20); 209 om.set_field("ns",OIURI_OPENID20);
210 om.set_field("mode","id_res"); 210 om.set_field("mode","id_res");
211 om.set_field("op_endpoint",get_op_endpoint()); 211 om.set_field("op_endpoint",get_op_endpoint());
212 string ats = "ns,mode,op_endpoint,return_to,response_nonce," 212 string ats = "ns,mode,op_endpoint,return_to,response_nonce,"
213 "assoc_handle,signed"; 213 "assoc_handle,signed";
214 if(!identity.empty()) { 214 if(!identity.empty()) {
215 om.set_field("identity",identity); 215 om.set_field("identity",identity);
216 om.set_field("claimed_id",claimed_id); 216 om.set_field("claimed_id",claimed_id);
217 ats += ",identity,claimed_id"; 217 ats += ",identity,claimed_id";
218 } 218 }
219 om.set_field("return_to",return_to); 219 om.set_field("return_to",return_to);
220 string nonce = w3timestr; 220 string nonce = w3timestr;
221 om.set_field("response_nonce",alloc_nonce(nonce,assoc->stateless())); 221 om.set_field("response_nonce",alloc_nonce(nonce));
222 if(!invalidate_handle.empty()) { 222 if(!invalidate_handle.empty()) {
223 om.set_field("invalidate_handle",invalidate_handle); 223 om.set_field("invalidate_handle",invalidate_handle);
224 ats += ",invalidate_handle"; 224 ats += ",invalidate_handle";
225 } 225 }
226 om.set_field("assoc_handle",assoc->handle()); 226 om.set_field("assoc_handle",assoc->handle());
227 om.add_to_signed(ats); 227 om.add_to_signed(ats);
228 if(ext) ext->op_id_res_hook(om); 228 if(ext) ext->op_id_res_hook(om);
229 om.set_field("sig",util::base64_signature(assoc,om)); 229 om.set_field("sig",util::base64_signature(assoc,om));
230 return om; 230 return om;
231 } 231 }
232 232
233 basic_openid_message& basic_op::cancel(basic_openid_message& om) { 233 basic_openid_message& basic_OP::cancel(basic_openid_message& om) {
234 assert(!return_to.empty()); 234 assert(!return_to.empty());
235 om.set_field("ns",OIURI_OPENID20); 235 om.set_field("ns",OIURI_OPENID20);
236 om.set_field("mode","cancel"); 236 om.set_field("mode","cancel");
237 return om; 237 return om;
238 } 238 }
239 239
240 basic_openid_message& basic_op::error(basic_openid_message& om, 240 basic_openid_message& basic_OP::error(basic_openid_message& om,
241 const string& error,const string& contact, 241 const string& error,const string& contact,
242 const string& reference ) { 242 const string& reference ) {
243 assert(!return_to.empty()); 243 assert(!return_to.empty());
244 om.set_field("ns",OIURI_OPENID20); 244 om.set_field("ns",OIURI_OPENID20);
245 om.set_field("mode","error"); 245 om.set_field("mode","error");
246 om.set_field("error",error); 246 om.set_field("error",error);
247 om.set_field("contact",contact); 247 om.set_field("contact",contact);
248 om.set_field("reference",reference); 248 om.set_field("reference",reference);
249 return om; 249 return om;
250 } 250 }
251 251
252 basic_openid_message& basic_op::setup_needed( 252 basic_openid_message& basic_OP::setup_needed(
253 basic_openid_message& oum,const basic_openid_message& inm) { 253 basic_openid_message& oum,const basic_openid_message& inm) {
254 assert(mode==mode_checkid_immediate); 254 assert(mode==mode_checkid_immediate);
255 assert(!return_to.empty()); 255 assert(!return_to.empty());
256 if(openid2) { 256 if(openid2) {
257 oum.set_field("ns",OIURI_OPENID20); 257 oum.set_field("ns",OIURI_OPENID20);
258 oum.set_field("mode","setup_needed"); 258 oum.set_field("mode","setup_needed");
259 }else{ 259 }else{
260 oum.set_field("mode","id_res"); 260 oum.set_field("mode","id_res");
261 static const string setupmode = "checkid_setup"; 261 static const string setupmode = "checkid_setup";
262 oum.set_field("user_setup_url", 262 oum.set_field("user_setup_url",
263 util::change_mode_message_proxy(inm,setupmode) 263 util::change_mode_message_proxy(inm,setupmode)
264 .append_query(get_op_endpoint())); 264 .append_query(get_op_endpoint()));
265 } 265 }
266 return oum; 266 return oum;
267 } 267 }
268 268
269 basic_openid_message& basic_op::check_authentication( 269 basic_openid_message& basic_OP::check_authentication(
270 basic_openid_message& oum, 270 basic_openid_message& oum,
271 const basic_openid_message& inm) try { 271 const basic_openid_message& inm) try {
272 assert(inm.get_field("mode")=="check_authentication"); 272 assert(inm.get_field("mode")=="check_authentication");
273 oum.reset_fields(); 273 oum.reset_fields();
274 oum.set_field("ns",OIURI_OPENID20); 274 oum.set_field("ns",OIURI_OPENID20);
275 bool o2; 275 bool o2;
276 try { 276 try {
277 o2 = (inm.get_field("ns")==OIURI_OPENID20); 277 o2 = (inm.get_field("ns")==OIURI_OPENID20);
278 }catch(failed_lookup&) { o2 = false; } 278 }catch(failed_lookup&) { o2 = false; }
279 string nonce; 279 string nonce;
280 if(o2) { 280 if(o2) {
281 try { 281 try {
282 if(!check_nonce(nonce = inm.get_field("response_nonce"))) 282 if(!check_nonce(nonce = inm.get_field("response_nonce")))
283 throw failed_check_authentication(OPKELE_CP_ "Invalid nonce"); 283 throw failed_check_authentication(OPKELE_CP_ "Invalid nonce");
284 }catch(failed_lookup&) { 284 }catch(failed_lookup&) {
285 throw failed_check_authentication(OPKELE_CP_ "No nonce provided with check_authentication request"); 285 throw failed_check_authentication(OPKELE_CP_ "No nonce provided with check_authentication request");
286 } 286 }
287 } 287 }
288 try { 288 try {
289 assoc = retrieve_assoc(inm.get_field("assoc_handle")); 289 assoc = retrieve_assoc(inm.get_field("assoc_handle"));
290 if(!assoc->stateless()) 290 if(!assoc->stateless())
291 throw failed_check_authentication(OPKELE_CP_ "Will not do check_authentication on a stateful handle"); 291 throw failed_check_authentication(OPKELE_CP_ "Will not do check_authentication on a stateful handle");
292 }catch(failed_lookup&) { 292 }catch(failed_lookup&) {
293 throw failed_check_authentication(OPKELE_CP_ "No assoc_handle or invalid assoc_handle specified with check_authentication request"); 293 throw failed_check_authentication(OPKELE_CP_ "No assoc_handle or invalid assoc_handle specified with check_authentication request");
294 } 294 }
295 static const string idresmode = "id_res"; 295 static const string idresmode = "id_res";
296 try { 296 try {
297 if(util::base64_signature(assoc,util::change_mode_message_proxy(inm,idresmode))!=inm.get_field("sig")) 297 if(util::base64_signature(assoc,util::change_mode_message_proxy(inm,idresmode))!=inm.get_field("sig"))
298 throw failed_check_authentication(OPKELE_CP_ "Signature mismatch"); 298 throw failed_check_authentication(OPKELE_CP_ "Signature mismatch");
299 }catch(failed_lookup&) { 299 }catch(failed_lookup&) {
300 throw failed_check_authentication(OPKELE_CP_ "failed to calculate signature"); 300 throw failed_check_authentication(OPKELE_CP_ "failed to calculate signature");
301 } 301 }
302 oum.set_field("is_valid","true"); 302 oum.set_field("is_valid","true");
303 try { 303 try {
304 string h = inm.get_field("invalidate_handle"); 304 string h = inm.get_field("invalidate_handle");
305 try { 305 try {
306 assoc_t ih = retrieve_assoc(h); 306 assoc_t ih = retrieve_assoc(h);
307 }catch(invalid_handle& ih) { 307 }catch(invalid_handle& ih) {
308 oum.set_field("invalidate_handle",h); 308 oum.set_field("invalidate_handle",h);
309 }catch(failed_lookup& ih) { 309 }catch(failed_lookup& ih) {
310 oum.set_field("invalidate_handle",h); 310 oum.set_field("invalidate_handle",h);
311 } 311 }
312 }catch(failed_lookup&) { } 312 }catch(failed_lookup&) { }
313 if(o2) { 313 if(o2) {
314 assert(!nonce.empty()); 314 assert(!nonce.empty());
315 invalidate_nonce(nonce); 315 invalidate_nonce(nonce);
316 } 316 }
317 return oum; 317 return oum;
318 }catch(failed_check_authentication& ) { 318 }catch(failed_check_authentication& ) {
319 oum.set_field("is_valid","false"); 319 oum.set_field("is_valid","false");
320 return oum; 320 return oum;
321 } 321 }
322 322
323 void basic_op::verify_return_to() { 323 void basic_OP::verify_return_to() {
324 if(realm.find('#')!=string::npos) 324 if(realm.find('#')!=string::npos)
325 throw opkele::bad_realm(OPKELE_CP_ "authentication realm contains URI fragment"); 325 throw opkele::bad_realm(OPKELE_CP_ "authentication realm contains URI fragment");
326 if(!util::uri_matches_realm(return_to,realm)) 326 if(!util::uri_matches_realm(return_to,realm))
327 throw bad_return_to(OPKELE_CP_ "return_to URL doesn't match realm"); 327 throw bad_return_to(OPKELE_CP_ "return_to URL doesn't match realm");
328 } 328 }
329 329
330} 330}