1
//-----------------------------------------------------------------------
2 // <copyright file="OpenIdRelyingParty.cs" company="Andrew Arnott">
3 // Copyright (c) Andrew Arnott. All rights reserved.
5 //-----------------------------------------------------------------------
7 namespace DotNetOpenAuth
.OpenId
.RelyingParty
{
9 using System
.Collections
.Generic
;
10 using System
.Collections
.Specialized
;
11 using System
.ComponentModel
;
14 using DotNetOpenAuth
.Configuration
;
15 using DotNetOpenAuth
.Messaging
;
16 using DotNetOpenAuth
.Messaging
.Bindings
;
17 using DotNetOpenAuth
.OpenId
.ChannelElements
;
18 using DotNetOpenAuth
.OpenId
.Messages
;
21 /// A delegate that decides whether a given OpenID Provider endpoint may be
22 /// considered for authenticating a user.
24 /// <param name="endpoint">The endpoint for consideration.</param>
26 /// <c>True</c> if the endpoint should be considered.
27 /// <c>False</c> to remove it from the pool of acceptable providers.
29 public delegate bool EndpointSelector(IXrdsProviderEndpoint endpoint
);
32 /// Provides the programmatic facilities to act as an OpenId consumer.
34 public sealed class OpenIdRelyingParty
{
36 /// Backing field for the <see cref="SecuritySettings"/> property.
38 private RelyingPartySecuritySettings securitySettings
;
41 /// Backing store for the <see cref="EndpointOrder"/> property.
43 private Comparison
<IXrdsProviderEndpoint
> endpointOrder
= DefaultEndpointOrder
;
46 /// Initializes a new instance of the <see cref="OpenIdRelyingParty"/> class.
48 /// <param name="applicationStore">The application store. If null, the relying party will always operate in "dumb mode".</param>
49 public OpenIdRelyingParty(IRelyingPartyApplicationStore applicationStore
)
50 : this(applicationStore
, applicationStore
, applicationStore
) {
54 /// Initializes a new instance of the <see cref="OpenIdRelyingParty"/> class.
56 /// <param name="associationStore">The association store. If null, the relying party will always operate in "dumb mode".</param>
57 /// <param name="nonceStore">The nonce store to use. If null, the relying party will always operate in "dumb mode".</param>
58 /// <param name="secretStore">The secret store to use. If null, the relying party will always operate in "dumb mode".</param>
59 private OpenIdRelyingParty(IAssociationStore
<Uri
> associationStore
, INonceStore nonceStore
, IPrivateSecretStore secretStore
) {
60 // If we are a smart-mode RP (supporting associations), then we MUST also be
61 // capable of storing nonces to prevent replay attacks.
62 // If we're a dumb-mode RP, then 2.0 OPs are responsible for preventing replays.
63 ErrorUtilities
.VerifyArgument(associationStore
== null || nonceStore
!= null, OpenIdStrings
.AssociationStoreRequiresNonceStore
);
65 this.Channel
= new OpenIdChannel(associationStore
, nonceStore
, secretStore
);
66 this.AssociationStore
= associationStore
;
67 this.SecuritySettings
= RelyingPartySection
.Configuration
.SecuritySettings
.CreateSecuritySettings();
69 // Without a nonce store, we must rely on the Provider to protect against
70 // replay attacks. But only 2.0+ Providers can be expected to provide
72 if (nonceStore
== null) {
73 this.SecuritySettings
.MinimumRequiredOpenIdVersion
= ProtocolVersion
.V20
;
78 /// Gets an XRDS sorting routine that uses the XRDS Service/@Priority
79 /// attribute to determine order.
82 /// Endpoints lacking any priority value are sorted to the end of the list.
84 [EditorBrowsable(EditorBrowsableState
.Advanced
)]
85 public static Comparison
<IXrdsProviderEndpoint
> DefaultEndpointOrder
{
87 // Sort first by service type (OpenID 2.0, 1.1, 1.0),
88 // then by Service/@priority, then by Service/Uri/@priority
89 return (se1
, se2
) => {
90 int result
= GetEndpointPrecedenceOrderByServiceType(se1
).CompareTo(GetEndpointPrecedenceOrderByServiceType(se2
));
94 if (se1
.ServicePriority
.HasValue
&& se2
.ServicePriority
.HasValue
) {
95 result
= se1
.ServicePriority
.Value
.CompareTo(se2
.ServicePriority
.Value
);
99 if (se1
.UriPriority
.HasValue
&& se2
.UriPriority
.HasValue
) {
100 return se1
.UriPriority
.Value
.CompareTo(se2
.UriPriority
.Value
);
101 } else if (se1
.UriPriority
.HasValue
) {
103 } else if (se2
.UriPriority
.HasValue
) {
109 if (se1
.ServicePriority
.HasValue
) {
111 } else if (se2
.ServicePriority
.HasValue
) {
114 // neither service defines a priority, so base ordering by uri priority.
115 if (se1
.UriPriority
.HasValue
&& se2
.UriPriority
.HasValue
) {
116 return se1
.UriPriority
.Value
.CompareTo(se2
.UriPriority
.Value
);
117 } else if (se1
.UriPriority
.HasValue
) {
119 } else if (se2
.UriPriority
.HasValue
) {
131 /// Gets the channel to use for sending/receiving messages.
133 public Channel Channel { get; internal set; }
136 /// Gets the security settings used by this Relying Party.
138 public RelyingPartySecuritySettings SecuritySettings
{
140 return this.securitySettings
;
145 throw new ArgumentNullException("value");
148 this.securitySettings
= value;
153 /// Gets or sets the optional Provider Endpoint filter to use.
156 /// Provides a way to optionally filter the providers that may be used in authenticating a user.
157 /// If provided, the delegate should return true to accept an endpoint, and false to reject it.
158 /// If null, all identity providers will be accepted. This is the default.
160 [EditorBrowsable(EditorBrowsableState
.Advanced
)]
161 public EndpointSelector EndpointFilter { get; set; }
164 /// Gets or sets the ordering routine that will determine which XRDS
165 /// Service element to try first
167 /// <value>Default is <see cref="DefaultEndpointOrder"/>.</value>
169 /// This may never be null. To reset to default behavior this property
170 /// can be set to the value of <see cref="DefaultEndpointOrder"/>.
172 [EditorBrowsable(EditorBrowsableState
.Advanced
)]
173 public Comparison
<IXrdsProviderEndpoint
> EndpointOrder
{
175 return this.endpointOrder
;
179 ErrorUtilities
.VerifyArgumentNotNull(value, "value");
180 this.endpointOrder
= value;
185 /// Gets the association store.
187 internal IAssociationStore
<Uri
> AssociationStore { get; private set; }
190 /// Gets a value indicating whether this Relying Party can sign its return_to
191 /// parameter in outgoing authentication requests.
193 internal bool CanSignCallbackArguments
{
194 get { return this.Channel.BindingElements.OfType<ReturnToSignatureBindingElement>().Any(); }
198 /// Gets the web request handler to use for discovery and the part of
199 /// authentication where direct messages are sent to an untrusted remote party.
201 internal IDirectWebRequestHandler WebRequestHandler
{
202 get { return this.Channel.WebRequestHandler; }
206 /// Creates an authentication request to verify that a user controls
207 /// some given Identifier.
209 /// <param name="userSuppliedIdentifier">
210 /// The Identifier supplied by the user. This may be a URL, an XRI or i-name.
212 /// <param name="realm">
213 /// The shorest URL that describes this relying party web site's address.
214 /// For example, if your login page is found at https://www.example.com/login.aspx,
215 /// your realm would typically be https://www.example.com/.
217 /// <param name="returnToUrl">
218 /// The URL of the login page, or the page prepared to receive authentication
219 /// responses from the OpenID Provider.
222 /// An authentication request object that describes the HTTP response to
223 /// send to the user agent to initiate the authentication.
225 /// <exception cref="ProtocolException">Thrown if no OpenID endpoint could be found.</exception>
226 public IAuthenticationRequest
CreateRequest(Identifier userSuppliedIdentifier
, Realm realm
, Uri returnToUrl
) {
228 return this.CreateRequests(userSuppliedIdentifier
, realm
, returnToUrl
).First();
229 } catch (InvalidOperationException ex
) {
230 throw ErrorUtilities
.Wrap(ex
, OpenIdStrings
.OpenIdEndpointNotFound
);
235 /// Creates an authentication request to verify that a user controls
236 /// some given Identifier.
238 /// <param name="userSuppliedIdentifier">
239 /// The Identifier supplied by the user. This may be a URL, an XRI or i-name.
241 /// <param name="realm">
242 /// The shorest URL that describes this relying party web site's address.
243 /// For example, if your login page is found at https://www.example.com/login.aspx,
244 /// your realm would typically be https://www.example.com/.
247 /// An authentication request object that describes the HTTP response to
248 /// send to the user agent to initiate the authentication.
251 /// <para>Requires an <see cref="HttpContext.Current">HttpContext.Current</see> context.</para>
253 /// <exception cref="ProtocolException">Thrown if no OpenID endpoint could be found.</exception>
254 /// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
255 public IAuthenticationRequest
CreateRequest(Identifier userSuppliedIdentifier
, Realm realm
) {
257 return this.CreateRequests(userSuppliedIdentifier
, realm
).First();
258 } catch (InvalidOperationException ex
) {
259 throw ErrorUtilities
.Wrap(ex
, OpenIdStrings
.OpenIdEndpointNotFound
);
264 /// Creates an authentication request to verify that a user controls
265 /// some given Identifier.
267 /// <param name="userSuppliedIdentifier">
268 /// The Identifier supplied by the user. This may be a URL, an XRI or i-name.
271 /// An authentication request object that describes the HTTP response to
272 /// send to the user agent to initiate the authentication.
275 /// <para>Requires an <see cref="HttpContext.Current">HttpContext.Current</see> context.</para>
277 /// <exception cref="ProtocolException">Thrown if no OpenID endpoint could be found.</exception>
278 /// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
279 public IAuthenticationRequest
CreateRequest(Identifier userSuppliedIdentifier
) {
281 return this.CreateRequests(userSuppliedIdentifier
).First();
282 } catch (InvalidOperationException ex
) {
283 throw ErrorUtilities
.Wrap(ex
, OpenIdStrings
.OpenIdEndpointNotFound
);
288 /// Gets an authentication response from a Provider.
290 /// <returns>The processed authentication response if there is any; <c>null</c> otherwise.</returns>
292 /// <para>Requires an <see cref="HttpContext.Current">HttpContext.Current</see> context.</para>
294 public IAuthenticationResponse
GetResponse() {
295 return this.GetResponse(this.Channel
.GetRequestFromContext());
299 /// Gets an authentication response from a Provider.
301 /// <param name="httpRequestInfo">The HTTP request that may be carrying an authentication response from the Provider.</param>
302 /// <returns>The processed authentication response if there is any; <c>null</c> otherwise.</returns>
303 public IAuthenticationResponse
GetResponse(HttpRequestInfo httpRequestInfo
) {
305 var message
= this.Channel
.ReadFromRequest();
306 PositiveAssertionResponse positiveAssertion
;
307 NegativeAssertionResponse negativeAssertion
;
308 if ((positiveAssertion
= message
as PositiveAssertionResponse
) != null) {
309 return new PositiveAuthenticationResponse(positiveAssertion
, this);
310 } else if ((negativeAssertion
= message
as NegativeAssertionResponse
) != null) {
311 return new NegativeAuthenticationResponse(negativeAssertion
);
312 } else if (message
!= null) {
313 Logger
.WarnFormat("Received unexpected message type {0} when expecting an assertion message.", message
.GetType().Name
);
317 } catch (ProtocolException ex
) {
318 return new FailedAuthenticationResponse(ex
);
323 /// Determines whether some parameter name belongs to OpenID or this library
324 /// as a protocol or internal parameter name.
326 /// <param name="parameterName">Name of the parameter.</param>
328 /// <c>true</c> if the named parameter is a library- or protocol-specific parameter; otherwise, <c>false</c>.
330 internal static bool IsOpenIdSupportingParameter(string parameterName
) {
331 Protocol protocol
= Protocol
.Default
;
332 return parameterName
.StartsWith(protocol
.openid
.Prefix
, StringComparison
.OrdinalIgnoreCase
)
333 || parameterName
.StartsWith("dnoi.", StringComparison
.Ordinal
);
337 /// Generates the authentication requests that can satisfy the requirements of some OpenID Identifier.
339 /// <param name="userSuppliedIdentifier">
340 /// The Identifier supplied by the user. This may be a URL, an XRI or i-name.
342 /// <param name="realm">
343 /// The shorest URL that describes this relying party web site's address.
344 /// For example, if your login page is found at https://www.example.com/login.aspx,
345 /// your realm would typically be https://www.example.com/.
347 /// <param name="returnToUrl">
348 /// The URL of the login page, or the page prepared to receive authentication
349 /// responses from the OpenID Provider.
352 /// An authentication request object that describes the HTTP response to
353 /// send to the user agent to initiate the authentication.
356 /// <para>Any individual generated request can satisfy the authentication.
357 /// The generated requests are sorted in preferred order.
358 /// Each request is generated as it is enumerated to. Associations are created only as
359 /// <see cref="IAuthenticationRequest.RedirectingResponse"/> is called.</para>
360 /// <para>No exception is thrown if no OpenID endpoints were discovered.
361 /// An empty enumerable is returned instead.</para>
363 internal IEnumerable
<IAuthenticationRequest
> CreateRequests(Identifier userSuppliedIdentifier
, Realm realm
, Uri returnToUrl
) {
364 ErrorUtilities
.VerifyArgumentNotNull(realm
, "realm");
365 ErrorUtilities
.VerifyArgumentNotNull(returnToUrl
, "returnToUrl");
367 return AuthenticationRequest
.Create(userSuppliedIdentifier
, this, realm
, returnToUrl
, true).Cast
<IAuthenticationRequest
>();
371 /// Generates the authentication requests that can satisfy the requirements of some OpenID Identifier.
373 /// <param name="userSuppliedIdentifier">
374 /// The Identifier supplied by the user. This may be a URL, an XRI or i-name.
376 /// <param name="realm">
377 /// The shorest URL that describes this relying party web site's address.
378 /// For example, if your login page is found at https://www.example.com/login.aspx,
379 /// your realm would typically be https://www.example.com/.
382 /// An authentication request object that describes the HTTP response to
383 /// send to the user agent to initiate the authentication.
386 /// <para>Any individual generated request can satisfy the authentication.
387 /// The generated requests are sorted in preferred order.
388 /// Each request is generated as it is enumerated to. Associations are created only as
389 /// <see cref="IAuthenticationRequest.RedirectingResponse"/> is called.</para>
390 /// <para>No exception is thrown if no OpenID endpoints were discovered.
391 /// An empty enumerable is returned instead.</para>
392 /// <para>Requires an <see cref="HttpContext.Current">HttpContext.Current</see> context.</para>
394 /// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
395 internal IEnumerable
<IAuthenticationRequest
> CreateRequests(Identifier userSuppliedIdentifier
, Realm realm
) {
396 ErrorUtilities
.VerifyHttpContext();
398 // Build the return_to URL
399 UriBuilder returnTo
= new UriBuilder(MessagingUtilities
.GetRequestUrlFromContext());
401 // Trim off any parameters with an "openid." prefix, and a few known others
402 // to avoid carrying state from a prior login attempt.
403 returnTo
.Query
= string.Empty
;
404 NameValueCollection queryParams
= MessagingUtilities
.GetQueryFromContextNVC();
405 var returnToParams
= new Dictionary
<string, string>(queryParams
.Count
);
406 foreach (string key
in queryParams
) {
407 if (!IsOpenIdSupportingParameter(key
)) {
408 returnToParams
.Add(key
, queryParams
[key
]);
411 returnTo
.AppendQueryArgs(returnToParams
);
413 return this.CreateRequests(userSuppliedIdentifier
, realm
, returnTo
.Uri
);
417 /// Generates the authentication requests that can satisfy the requirements of some OpenID Identifier.
419 /// <param name="userSuppliedIdentifier">
420 /// The Identifier supplied by the user. This may be a URL, an XRI or i-name.
423 /// An authentication request object that describes the HTTP response to
424 /// send to the user agent to initiate the authentication.
427 /// <para>Any individual generated request can satisfy the authentication.
428 /// The generated requests are sorted in preferred order.
429 /// Each request is generated as it is enumerated to. Associations are created only as
430 /// <see cref="IAuthenticationRequest.RedirectingResponse"/> is called.</para>
431 /// <para>No exception is thrown if no OpenID endpoints were discovered.
432 /// An empty enumerable is returned instead.</para>
433 /// <para>Requires an <see cref="HttpContext.Current">HttpContext.Current</see> context.</para>
435 /// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
436 internal IEnumerable
<IAuthenticationRequest
> CreateRequests(Identifier userSuppliedIdentifier
) {
437 ErrorUtilities
.VerifyHttpContext();
439 // Build the realm URL
440 UriBuilder realmUrl
= new UriBuilder(MessagingUtilities
.GetRequestUrlFromContext());
441 realmUrl
.Path
= HttpContext
.Current
.Request
.ApplicationPath
;
442 realmUrl
.Query
= null;
443 realmUrl
.Fragment
= null;
445 // For RP discovery, the realm url MUST NOT redirect. To prevent this for
446 // virtual directory hosted apps, we need to make sure that the realm path ends
447 // in a slash (since our calculation above guarantees it doesn't end in a specific
448 // page like default.aspx).
449 if (!realmUrl
.Path
.EndsWith("/", StringComparison
.Ordinal
)) {
450 realmUrl
.Path
+= "/";
453 return this.CreateRequests(userSuppliedIdentifier
, new Realm(realmUrl
.Uri
));
457 /// Gets an association between this Relying Party and a given Provider
458 /// if it already exists in the association store.
460 /// <param name="provider">The provider to create an association with.</param>
461 /// <returns>The association if one exists and has useful life remaining. Otherwise <c>null</c>.</returns>
462 internal Association
GetExistingAssociation(ProviderEndpointDescription provider
) {
463 ErrorUtilities
.VerifyArgumentNotNull(provider
, "provider");
465 Protocol protocol
= Protocol
.Lookup(provider
.ProtocolVersion
);
467 // If the RP has no application store for associations, there's no point in creating one.
468 if (this.AssociationStore
== null) {
472 // TODO: we need a way to lookup an association that fulfills a given set of security
473 // requirements. We may have a SHA-1 association and a SHA-256 association that need
474 // to be called for specifically. (a bizzare scenario, admittedly, making this low priority).
475 Association association
= this.AssociationStore
.GetAssociation(provider
.Endpoint
);
477 // If the returned association does not fulfill security requirements, ignore it.
478 if (association
!= null && !this.SecuritySettings
.IsAssociationInPermittedRange(protocol
, association
.GetAssociationType(protocol
))) {
482 if (association
!= null && !association
.HasUsefulLifeRemaining
) {
490 /// Gets an existing association with the specified Provider, or attempts to create
491 /// a new association of one does not already exist.
493 /// <param name="provider">The provider to get an association for.</param>
494 /// <returns>The existing or new association; <c>null</c> if none existed and one could not be created.</returns>
495 internal Association
GetOrCreateAssociation(ProviderEndpointDescription provider
) {
496 return this.GetExistingAssociation(provider
) ?? this.CreateNewAssociation(provider
);
500 /// Gets the priority rating for a given type of endpoint, allowing a
501 /// priority sorting of endpoints.
503 /// <param name="endpoint">The endpoint to prioritize.</param>
504 /// <returns>An arbitary integer, which may be used for sorting against other returned values from this method.</returns>
505 private static double GetEndpointPrecedenceOrderByServiceType(IXrdsProviderEndpoint endpoint
) {
506 // The numbers returned from this method only need to compare against other numbers
507 // from this method, which makes them arbitrary but relational to only others here.
508 if (endpoint
.IsTypeUriPresent(Protocol
.V20
.OPIdentifierServiceTypeURI
)) {
511 if (endpoint
.IsTypeUriPresent(Protocol
.V20
.ClaimedIdentifierServiceTypeURI
)) {
514 if (endpoint
.IsTypeUriPresent(Protocol
.V11
.ClaimedIdentifierServiceTypeURI
)) {
517 if (endpoint
.IsTypeUriPresent(Protocol
.V10
.ClaimedIdentifierServiceTypeURI
)) {
524 /// Creates a new association with a given Provider.
526 /// <param name="provider">The provider to create an association with.</param>
528 /// The newly created association, or null if no association can be created with
529 /// the given Provider given the current security settings.
532 /// A new association is created and returned even if one already exists in the
533 /// association store.
534 /// Any new association is automatically added to the <see cref="AssociationStore"/>.
536 private Association
CreateNewAssociation(ProviderEndpointDescription provider
) {
537 ErrorUtilities
.VerifyArgumentNotNull(provider
, "provider");
539 // If there is no association store, there is no point in creating an association.
540 if (this.AssociationStore
== null) {
544 var associateRequest
= AssociateRequest
.Create(this.SecuritySettings
, provider
);
545 if (associateRequest
== null) {
546 // this can happen if security requirements and protocol conflict
547 // to where there are no association types to choose from.
551 var associateResponse
= this.Channel
.Request(associateRequest
);
552 var associateSuccessfulResponse
= associateResponse
as AssociateSuccessfulResponse
;
553 var associateUnsuccessfulResponse
= associateResponse
as AssociateUnsuccessfulResponse
;
554 if (associateSuccessfulResponse
!= null) {
555 Association association
= associateSuccessfulResponse
.CreateAssociation(associateRequest
);
556 this.AssociationStore
.StoreAssociation(provider
.Endpoint
, association
);
558 } else if (associateUnsuccessfulResponse
!= null) {
560 throw new NotImplementedException();
562 throw new ProtocolException(MessagingStrings
.UnexpectedMessageReceivedOfMany
);