eliseuamaro
/
gnu-social
forked from GNUsocial/gnu-social
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
gnu-social/vendor/openid/php-openid/Tests/Auth/OpenID/Server.php

2464 lines
93 KiB
PHP
Raw Blame History

<?php
/**
* Tests for Auth_OpenID_Server
*/
require_once "Tests/Auth/OpenID/MemStore.php";
require_once "Auth/OpenID.php";
require_once "Auth/OpenID/DiffieHellman.php";
require_once "Auth/OpenID/Server.php";
require_once "Auth/OpenID/Consumer.php";
function altModulus()
{
$lib = Auth_OpenID_getMathLib();
static $num = null;
if (!$num) {
$num = $lib->init("1423261515703355186607439952816216983770".
"5735494988446894302176757360889904836136".
"0422513557553514790045512299468953431585".
"3008125488594198571710943663581589034331".
"6791551733211386105974742540867014420109".
"9811846875730766487278261498262568348338".
"4764372005569983660877797099908075182915".
"81860338635288400119293970087"
);
}
return $num;
}
global $ALT_GEN;
$ALT_GEN = 5;
function arrayToString($arr)
{
$s = "Array(";
$parts = array();
foreach ($arr as $k => $v) {
if (is_array($v)) {
$v = arrayToString($v);
}
$parts[] = sprintf("%s => %s", $k, $v);
}
$s .= implode(", ", $parts);
$s .= ")";
return $s;
}
function _Auth_OpenID_NotAuthorized()
{
return false;
}
class Tests_Auth_OpenID_Test_ServerError extends PHPUnit_Framework_TestCase {
function test_browserWithReturnTo()
{
$return_to = "http://rp.unittest/consumer";
// will be a ProtocolError raised by Decode or CheckIDRequest.answer
$args = array(
'openid.mode' => 'monkeydance',
'openid.identity' => 'http://wagu.unittest/',
'openid.return_to' => $return_to);
$e = new Auth_OpenID_ServerError(
Auth_OpenID_Message::fromPostArgs($args),
"plucky");
$this->assertTrue($e->hasReturnTo());
$expected_args = array(
'openid.mode' => 'error',
'openid.error' => 'plucky');
$encoded = $e->encodeToURL();
if (Auth_OpenID_isError($encoded)) {
$this->fail($encoded->toString());
return;
}
list($rt_base, $_result_args) = explode("?", $e->encodeToURL(), 2);
$result_args = Auth_OpenID::getQuery($_result_args);
$this->assertEquals($result_args, $expected_args);
}
function test_browserWithReturnTo_OpenID2_GET()
{
$return_to = "http://rp.unittest/consumer";
// will be a ProtocolError raised by Decode or
// CheckIDRequest.answer
$args = Auth_OpenID_Message::fromPostArgs(array(
'openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.mode' => 'monkeydance',
'openid.identity' => 'http://wagu.unittest/',
'openid.claimed_id' => 'http://wagu.unittest/',
'openid.return_to' => $return_to));
$e = new Auth_OpenID_ServerError($args, "plucky");
$this->assertTrue($e->hasReturnTo());
$expected_args = array('openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.mode' => 'error',
'openid.error' => 'plucky');
list($rt_base, $result_args_s) = explode('?', $e->encodeToURL(), 2);
$result_args = Auth_OpenID::parse_str($result_args_s);
$this->assertEquals($result_args, $expected_args);
}
function test_browserWithReturnTo_OpenID2_POST()
{
$return_to = "http://rp.unittest/consumer" . str_repeat('x', Auth_OpenID_OPENID1_URL_LIMIT);
// will be a ProtocolError raised by Decode or
// CheckIDRequest.answer
$args = Auth_OpenID_Message::fromPostArgs(array(
'openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.mode' => 'monkeydance',
'openid.identity' => 'http://wagu.unittest/',
'openid.claimed_id' => 'http://wagu.unittest/',
'openid.return_to' => $return_to));
$e = new Auth_OpenID_ServerError($args, "plucky");
$this->assertTrue($e->hasReturnTo());
$expected_args = array('openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.mode' => 'error',
'openid.error' => 'plucky');
$this->assertTrue($e->whichEncoding() == Auth_OpenID_ENCODE_HTML_FORM);
$msg = $e->toMessage();
$this->assertTrue($e->toFormMarkup() ==
$msg->toFormMarkup($args->getArg(Auth_OpenID_OPENID_NS, 'return_to')));
}
function test_browserWithReturnTo_OpenID1_exceeds_limit()
{
$return_to = "http://rp.unittest/consumer" . str_repeat('x', Auth_OpenID_OPENID1_URL_LIMIT);
// will be a ProtocolError raised by Decode or
// CheckIDRequest.answer
$args = Auth_OpenID_Message::fromPostArgs(array(
'openid.mode' => 'monkeydance',
'openid.identity' => 'http://wagu.unittest/',
'openid.return_to' => $return_to));
$this->assertTrue($args->isOpenID1());
$e = new Auth_OpenID_ServerError($args, "plucky");
$this->assertTrue($e->hasReturnTo());
$expected_args = array('openid.mode' => 'error',
'openid.error' => 'plucky');
$this->assertTrue($e->whichEncoding() == Auth_OpenID_ENCODE_URL);
list($rt_base, $result_args_s) = explode('?', $e->encodeToURL(), 2);
$result_args = Auth_OpenID::parse_str($result_args_s);
$this->assertEquals($result_args, $expected_args);
}
function test_noReturnTo()
{
// will be a ProtocolError raised by Decode or CheckIDRequest.answer
$args = array(
'openid.mode' => 'zebradance',
'openid.identity' => 'http://wagu.unittest/');
$e = new Auth_OpenID_ServerError(
Auth_OpenID_Message::fromPostArgs($args),
"waffles");
$this->assertFalse($e->hasReturnTo());
$expected = "error:waffles\nmode:error\n";
$this->assertEquals($e->encodeToKVForm(), $expected);
}
function test_noMessage()
{
$e = new Auth_OpenID_ServerError();
$this->assertFalse($e->hasReturnTo());
$this->assertEquals($e->whichEncoding(), null);
$this->assertEquals($e->getReturnTo(), null);
}
}
class Tests_Auth_OpenID_Test_Decode extends PHPUnit_Framework_TestCase {
function setUp()
{
$this->id_url = "http://decoder.am.unittest/";
$this->rt_url = "http://rp.unittest/foobot/?qux=zam";
$this->tr_url = "http://rp.unittest/";
$this->assoc_handle = "{assoc}{handle}";
$this->claimed_id = 'http://de.legating.de.coder.unittest/';
$this->op_endpoint = 'http://endpoint.unittest/encode';
$this->store = new Tests_Auth_OpenID_MemStore();
$this->server = new Auth_OpenID_Server($this->store,
$this->op_endpoint);
$this->decoder = new Auth_OpenID_Decoder($this->server);
}
function test_none()
{
$args = array();
$r = $this->decoder->decode($args);
$this->assertEquals($r, null);
}
function test_irrelevant()
{
$args = array(
'pony' => 'spotted',
'sreg.mutant_power' => 'decaffinator');
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_ServerError'));
}
function test_bad()
{
$args = array(
'openid.mode' => 'twos-compliment',
'openid.pants' => 'zippered');
// Be sure that decoding the args returns an error.
$result = $this->decoder->decode($args);
$this->assertTrue(Auth_OpenID_isError($result));
}
function test_checkidImmediate()
{
$args = array(
'openid.mode' => 'checkid_immediate',
'openid.identity' => $this->id_url,
'openid.assoc_handle' => $this->assoc_handle,
'openid.return_to' => $this->rt_url,
'openid.trust_root' => $this->tr_url,
# should be ignored
'openid.some.extension' => 'junk');
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_CheckIDRequest'));
$this->assertEquals($r->mode, "checkid_immediate");
$this->assertEquals($r->immediate, true);
$this->assertEquals($r->identity, $this->id_url);
$this->assertEquals($r->trust_root, $this->tr_url);
$this->assertEquals($r->return_to, $this->rt_url);
$this->assertEquals($r->assoc_handle, $this->assoc_handle);
}
function test_checkidSetup()
{
$args = array(
'openid.mode' => 'checkid_setup',
'openid.identity' => $this->id_url,
'openid.assoc_handle' => $this->assoc_handle,
'openid.return_to' => $this->rt_url,
'openid.trust_root' => $this->tr_url);
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_CheckIDRequest'));
$this->assertEquals($r->mode, "checkid_setup");
$this->assertEquals($r->immediate, false);
$this->assertEquals($r->identity, $this->id_url);
$this->assertEquals($r->trust_root, $this->tr_url);
$this->assertEquals($r->return_to, $this->rt_url);
}
function test_checkidSetupOpenID2()
{
$args = array(
'openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.mode' => 'checkid_setup',
'openid.identity' => $this->id_url,
'openid.claimed_id' => $this->claimed_id,
'openid.assoc_handle' => $this->assoc_handle,
'openid.return_to' => $this->rt_url,
'openid.realm' => $this->tr_url
);
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_CheckIDRequest'));
$this->assertEquals($r->mode, "checkid_setup");
$this->assertEquals($r->immediate, False);
$this->assertEquals($r->identity, $this->id_url);
$this->assertEquals($r->claimed_id, $this->claimed_id);
$this->assertEquals($r->trust_root, $this->tr_url);
$this->assertEquals($r->return_to, $this->rt_url);
}
function test_checkidSetupNoClaimedIDOpenID2()
{
$args = array(
'openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.mode' => 'checkid_setup',
'openid.identity' => $this->id_url,
'openid.assoc_handle' => $this->assoc_handle,
'openid.return_to' => $this->rt_url,
'openid.realm' => $this->tr_url
);
$result = $this->decoder->decode($args);
$this->assertTrue(is_a($result, "Auth_OpenID_ServerError"));
}
function test_checkidSetupNoIdentityOpenID2()
{
$args = array(
'openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.mode' => 'checkid_setup',
'openid.assoc_handle' => $this->assoc_handle,
'openid.return_to' => $this->rt_url,
'openid.realm' => $this->tr_url);
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_CheckIDRequest'));
$this->assertEquals($r->mode, "checkid_setup");
$this->assertEquals($r->immediate, false);
$this->assertEquals($r->identity, null);
$this->assertEquals($r->trust_root, $this->tr_url);
$this->assertEquals($r->return_to, $this->rt_url);
}
function test_checkidSetupNoReturnOpenID1()
{
$args = array(
'openid.mode' => 'checkid_setup',
'openid.identity' => $this->id_url,
'openid.assoc_handle' => $this->assoc_handle,
'openid.trust_root' => $this->tr_url);
$result = $this->decoder->decode($args);
if (!Auth_OpenID_isError($result)) {
$this->fail("Expected Auth_OpenID_ServerError");
}
}
function test_checkidSetupNoReturnOpenID2()
{
// Make sure an OpenID 2 request with no return_to can be
// decoded, and make sure a response to such a request raises
// NoReturnToError.
$args = array(
'openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.mode' => 'checkid_setup',
'openid.identity' => $this->id_url,
'openid.claimed_id' => $this->id_url,
'openid.assoc_handle' => $this->assoc_handle,
'openid.realm' => $this->tr_url);
$req = $this->decoder->decode($args);
$this->assertTrue(is_a($req,
'Auth_OpenID_CheckIDRequest'));
$this->assertTrue(is_a($req->answer(false), 'Auth_OpenID_NoReturnToError'));
$this->assertTrue(is_a($req->encodeToURL('bogus'), 'Auth_OpenID_NoReturnToError'));
$this->assertTrue(is_a($req->getCancelURL(), 'Auth_OpenID_NoReturnToError'));
}
function test_checkidSetupRealmRequiredOpenID2()
{
// Make sure that an OpenID 2 request which lacks return_to
// cannot be decoded if it lacks a realm. Spec: This value
// (openid.realm) MUST be sent if openid.return_to is omitted.
$args = array(
'openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.mode' => 'checkid_setup',
'openid.identity' => $this->id_url,
'openid.assoc_handle' => $this->assoc_handle);
$this->assertTrue(is_a($this->decoder->decode($args),
'Auth_OpenID_ServerError'));
}
function test_checkidSetupBadReturn()
{
$args = array(
'openid.mode' => 'checkid_setup',
'openid.identity' => $this->id_url,
'openid.assoc_handle' => $this->assoc_handle,
'openid.return_to' => 'not a url');
$result = $this->decoder->decode($args);;
if (Auth_OpenID_isError($result)) {
$this->assertTrue($result->message);
} else {
$this->fail(sprintf("Expected ProtocolError, instead " .
"returned with %s", gettype($result)));
}
}
function test_checkidSetupUntrustedReturn()
{
$args = array(
'openid.mode' => 'checkid_setup',
'openid.identity' => $this->id_url,
'openid.assoc_handle' => $this->assoc_handle,
'openid.return_to' => $this->rt_url,
'openid.trust_root' => 'http://not-the-return-place.unittest/');
$result = $this->decoder->decode($args);
$this->assertTrue(is_a($result, 'Auth_OpenID_UntrustedReturnURL'));
}
function test_checkAuth()
{
$args = array(
'openid.mode' => 'check_authentication',
'openid.assoc_handle' => '{dumb}{handle}',
'openid.sig' => 'sigblob',
'openid.signed' => 'foo,bar,mode',
'openid.foo' => 'signedval1',
'openid.bar' => 'signedval2',
'openid.baz' => 'unsigned');
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_CheckAuthRequest'));
$this->assertEquals($r->mode, 'check_authentication');
$this->assertEquals($r->sig, 'sigblob');
}
function test_checkAuthMissingSignature()
{
$args = array(
'openid.mode' => 'check_authentication',
'openid.assoc_handle' => '{dumb}{handle}',
'openid.signed' => 'foo,bar,mode',
'openid.foo' => 'signedval1',
'openid.bar' => 'signedval2',
'openid.baz' => 'unsigned');
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_ServerError'));
}
function test_checkAuthAndInvalidate()
{
$args = array(
'openid.mode' => 'check_authentication',
'openid.assoc_handle' => '{dumb}{handle}',
'openid.invalidate_handle' => '[[SMART_handle]]',
'openid.sig' => 'sigblob',
'openid.signed' => 'foo,bar,mode',
'openid.foo' => 'signedval1',
'openid.bar' => 'signedval2',
'openid.baz' => 'unsigned');
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_CheckAuthRequest'));
$this->assertEquals($r->invalidate_handle, '[[SMART_handle]]');
}
function test_associateDH()
{
if (defined('Auth_OpenID_NO_MATH_SUPPORT')) {
print "(Skipping test_associateDH)";
return;
}
$args = array(
'openid.mode' => 'associate',
'openid.session_type' => 'DH-SHA1',
'openid.dh_consumer_public' => "Rzup9265tw==");
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_AssociateRequest'));
$this->assertEquals($r->mode, "associate");
$this->assertEquals($r->session->session_type, "DH-SHA1");
$this->assertEquals($r->assoc_type, "HMAC-SHA1");
$this->assertTrue($r->session->consumer_pubkey);
}
function test_associateDHMissingKey()
{
if (defined('Auth_OpenID_NO_MATH_SUPPORT')) {
print "(Skipping test_associateDHMissingKey)";
return;
}
$args = array(
'openid.mode' => 'associate',
'openid.session_type' => 'DH-SHA1');
// Using DH-SHA1 without supplying dh_consumer_public is an error.
$result = $this->decoder->decode($args);
if (!Auth_OpenID_isError($result)) {
$this->fail(sprintf("Expected Auth_OpenID_ServerError, got %s",
gettype($result)));
}
}
/**
* XXX: Cannot produce a value to break base64_decode
function test_associateDHpubKeyNotB64()
{
$args = array(
'openid.mode' => 'associate',
'openid.session_type' => 'DH-SHA1',
'openid.dh_consumer_public' => "donkeydonkeydonkey");
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_ServerError'));
}
*/
function test_associateDHModGen()
{
if (defined('Auth_OpenID_NO_MATH_SUPPORT')) {
print "(Skipping test_associateDHModGen)";
return;
}
global $ALT_GEN;
// test dh with non-default but valid values for dh_modulus
// and dh_gen
$lib = Auth_OpenID_getMathLib();
$args = array(
'openid.mode' => 'associate',
'openid.session_type' => 'DH-SHA1',
'openid.dh_consumer_public' => "Rzup9265tw==",
'openid.dh_modulus' => $lib->longToBase64(altModulus()),
'openid.dh_gen' => $lib->longToBase64($ALT_GEN));
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_AssociateRequest'));
$this->assertEquals($r->mode, "associate");
$this->assertEquals($r->session->session_type, "DH-SHA1");
$this->assertEquals($r->assoc_type, "HMAC-SHA1");
$this->assertTrue($lib->cmp($r->session->dh->mod, altModulus()) === 0);
$this->assertTrue($lib->cmp($r->session->dh->gen, $ALT_GEN) === 0);
$this->assertTrue($r->session->consumer_pubkey);
}
/**
* XXX: Can't test invalid base64 values for mod and gen because
* PHP's base64 decoder is much too forgiving or just plain
* broken.
function test_associateDHCorruptModGen()
{
// test dh with non-default but valid values for dh_modulus
// and dh_gen
$args = array(
'openid.mode' => 'associate',
'openid.session_type' => 'DH-SHA1',
'openid.dh_consumer_public' => "Rzup9265tw==",
'openid.dh_modulus' => 'pizza',
'openid.dh_gen' => 'gnocchi');
$r = $this->decoder->decode($args);
print_r($r);
$this->assertTrue(is_a($r, 'Auth_OpenID_ServerError'));
}
*/
function test_associateDHMissingModGen()
{
if (defined('Auth_OpenID_NO_MATH_SUPPORT')) {
print "(Skipping test_associateDHMissingModGen)";
return;
}
// test dh with non-default but valid values for dh_modulus
// and dh_gen
$args = array(
'openid.mode' => 'associate',
'openid.session_type' => 'DH-SHA1',
'openid.dh_consumer_public' => "Rzup9265tw==",
'openid.dh_modulus' => 'pizza');
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_ServerError'));
}
function test_associateWeirdSession()
{
$args = array(
'openid.mode' => 'associate',
'openid.session_type' => 'FLCL6',
'openid.dh_consumer_public' => "YQ==\n");
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_ServerError'));
}
function test_associatePlain()
{
$args = array('openid.mode' => 'associate');
$r = $this->decoder->decode($args);
$this->assertTrue(is_a($r, 'Auth_OpenID_AssociateRequest'));
$this->assertEquals($r->mode, "associate");
$this->assertEquals($r->session->session_type, "no-encryption");
$this->assertEquals($r->assoc_type, "HMAC-SHA1");
}
function test_nomode()
{
$args = array(
'openid.session_type' => 'DH-SHA1',
'openid.dh_consumer_public' => "my public keeey");
$result = $this->decoder->decode($args);
if (!Auth_OpenID_isError($result)) {
$this->fail(sprintf("Expected Auth_OpenID_Error. Got %s",
gettype($result)));
}
}
function test_invalidns()
{
$args = array('openid.ns' => 'Tuesday',
'openid.mode' => 'associate');
$result = $this->decoder->decode($args);
$this->assertTrue(is_a($result, 'Auth_OpenID_ServerError'));
// Assert that the ProtocolError does have a Message attached
// to it, even though the request wasn't a well-formed Message.
$this->assertTrue($result->message);
// The error message contains the bad openid.ns.
$this->assertTrue(strpos($result->text, 'Tuesday') != -1);
}
}
class Tests_Auth_OpenID_Test_Encode extends PHPUnit_Framework_TestCase {
function setUp()
{
$this->encoder = new Auth_OpenID_Encoder();
$this->encode = $this->encoder;
$this->op_endpoint = 'http://endpoint.unittest/encode';
$this->store = new Tests_Auth_OpenID_MemStore();
$this->server = new Auth_OpenID_Server($this->store,
$this->op_endpoint);
}
function encode($thing) {
return $this->encoder->encode($thing);
}
function test_id_res_OpenID2_GET()
{
/* Check that when an OpenID 2 response does not exceed the
OpenID 1 message size, a GET response (i.e., redirect) is
issued. */
$request = new Auth_OpenID_CheckIDRequest(
'http://bombom.unittest/',
'http://burr.unittest/999',
'http://burr.unittest/',
false,
$this->server->op_endpoint);
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(array(
'ns' => Auth_OpenID_OPENID2_NS,
'mode' => 'id_res',
'identity' => $request->identity,
'claimed_id' => $request->identity,
'return_to' => $request->return_to));
$this->assertFalse($response->renderAsForm());
$this->assertTrue($response->whichEncoding() == Auth_OpenID_ENCODE_URL);
$webresponse = $this->encode($response);
$this->assertTrue(array_key_exists('location', $webresponse->headers));
}
function test_id_res_OpenID2_POST()
{
/* Check that when an OpenID 2 response exceeds the OpenID 1
message size, a POST response (i.e., an HTML form) is
returned. */
$request = new Auth_OpenID_CheckIDRequest(
'http://bombom.unittest/',
'http://burr.unittest/999',
'http://burr.unittest/',
false,
$this->server->op_endpoint);
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(array(
'ns' => Auth_OpenID_OPENID2_NS,
'mode' => 'id_res',
'identity' => $request->identity,
'claimed_id' => $request->identity,
'return_to' => str_repeat('x', Auth_OpenID_OPENID1_URL_LIMIT)));
$this->assertTrue($response->renderAsForm());
$this->assertTrue(strlen($response->encodeToURL()) > Auth_OpenID_OPENID1_URL_LIMIT);
$this->assertTrue($response->whichEncoding() == Auth_OpenID_ENCODE_HTML_FORM);
$webresponse = $this->encode($response);
$this->assertEquals($webresponse->body, $response->toFormMarkup());
}
function test_id_res_OpenID1_exceeds_limit()
{
/* Check that when an OpenID 1 response exceeds the OpenID 1
message size, a GET response is issued. Technically, this
shouldn't be permitted by the library, but this test is in
place to preserve the status quo for OpenID 1. */
$request = new Auth_OpenID_CheckIDRequest(
'http://bombom.unittest/',
'http://burr.unittest/999',
'http://burr.unittest/',
false,
$this->server->op_endpoint);
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(array(
'mode' => 'id_res',
'identity' => $request->identity,
'return_to' => str_repeat('x', Auth_OpenID_OPENID1_URL_LIMIT)));
$this->assertFalse($response->renderAsForm());
$this->assertTrue(strlen($response->encodeToURL()) > Auth_OpenID_OPENID1_URL_LIMIT);
$this->assertTrue($response->whichEncoding() == Auth_OpenID_ENCODE_URL);
$webresponse = $this->encode($response);
$this->assertEquals($webresponse->headers['location'], $response->encodeToURL());
}
function test_id_res()
{
$request = new Auth_OpenID_CheckIDRequest(
'http://bombom.unittest/',
'http://burr.unittest/',
'http://burr.unittest/999',
false,
$this->server);
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(
array(
'mode' => 'id_res',
'identity' => $request->identity,
'return_to' => $request->return_to));
$webresponse = $this->encoder->encode($response);
$this->assertEquals($webresponse->code, AUTH_OPENID_HTTP_REDIRECT);
$this->assertTrue(array_key_exists('location',
$webresponse->headers));
$location = $webresponse->headers['location'];
$this->assertTrue(strpos($location, $request->return_to) === 0);
// "%s does not start with %s" % ($location,
// $request->return_to));
$parsed = parse_url($location);
$query = array();
$query = Auth_OpenID::parse_str($parsed['query']);
$expected = $response->fields->toPostArgs();
$this->assertEquals($query, $expected);
}
function test_cancel()
{
$request = new Auth_OpenID_CheckIDRequest(
'http://bombom.unittest/',
'http://burr.unittest/',
'http://burr.unittest/999',
false, null,
$this->server);
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(array('mode' => 'cancel'));
$webresponse = $this->encoder->encode($response);
$this->assertEquals($webresponse->code, AUTH_OPENID_HTTP_REDIRECT);
$this->assertTrue(array_key_exists('location', $webresponse->headers));
}
function test_cancelToForm()
{
$request = new Auth_OpenID_CheckIDRequest(
'http://bombom.unittest/',
'http://burr.unittest/999',
'http://burr.unittest/',
false, null,
$this->server);
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(array('mode' => 'cancel'));
$form = $response->toFormMarkup();
$pos = strpos($form, 'http://burr.unittest/999');
$this->assertTrue($pos !== false, var_export($pos, true));
}
function test_assocReply()
{
if (!defined('Auth_OpenID_NO_MATH_SUPPORT')) {
$message = new Auth_OpenID_Message(Auth_OpenID_OPENID2_NS);
$message->setArg(Auth_OpenID_OPENID2_NS, 'session_type',
'no-encryption');
$request = Auth_OpenID_AssociateRequest::fromMessage($message,
$this->server);
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(
array('assoc_handle' => "every-zig"));
$webresponse = $this->encoder->encode($response);
$body = "assoc_handle:every-zig\n";
$this->assertEquals($webresponse->code, AUTH_OPENID_HTTP_OK);
$this->assertEquals($webresponse->headers, array());
$this->assertEquals($webresponse->body, $body);
}
}
function test_checkauthReply()
{
$request = new Auth_OpenID_CheckAuthRequest('a_sock_monkey',
'siggggg',
array());
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(array(
'is_valid' => 'true',
'invalidate_handle' => 'xXxX:xXXx'));
$body = "invalidate_handle:xXxX:xXXx\nis_valid:true\n";
$webresponse = $this->encoder->encode($response);
$this->assertEquals($webresponse->code, AUTH_OPENID_HTTP_OK);
$this->assertEquals($webresponse->headers, array());
$this->assertEquals($webresponse->body, $body);
}
function test_unencodableError()
{
$args = array('openid.identity' => 'http://limu.unittest/');
$e = new Auth_OpenID_ServerError(Auth_OpenID_Message::fromPostArgs($args),
"wet paint");
$result = $this->encoder->encode($e);
if (!Auth_OpenID_isError($result, 'Auth_OpenID_EncodingError')) {
$this->fail(sprintf("Expected Auth_OpenID_ServerError, got %s",
gettype($result)));
}
}
function test_encodableError()
{
$args = array(
'openid.mode' => 'associate',
'openid.identity' => 'http://limu.unittest/');
$body="error:snoot\nmode:error\n";
$err = new Auth_OpenID_ServerError(Auth_OpenID_Message::fromPostArgs($args),
"snoot");
$webresponse = $this->encoder->encode($err);
$this->assertEquals($webresponse->code, AUTH_OPENID_HTTP_ERROR);
$this->assertEquals($webresponse->headers, array());
$this->assertEquals($webresponse->body, $body);
}
}
class Tests_Auth_OpenID_SigningEncode extends PHPUnit_Framework_TestCase {
function setUp()
{
// Use filestore here instead of memstore
$this->store = new Tests_Auth_OpenID_MemStore();
$this->op_endpoint = 'http://endpoint.unittest/encode';
$this->server = new Auth_OpenID_Server($this->store,
$this->op_endpoint);
$this->request = new Auth_OpenID_CheckIDRequest(
'http://bombom.unittest/',
'http://burr.unittest/',
'http://burr.unittest/999',
false,
null,
$this->server);
$this->response = new Auth_OpenID_ServerResponse($this->request);
$this->response->fields = Auth_OpenID_Message::fromOpenIDArgs(array(
'mode' => 'id_res',
'identity' => $this->request->identity,
'return_to' => $this->request->return_to));
$this->signatory = new Auth_OpenID_Signatory($this->store);
$this->dumb_key = $this->signatory->dumb_key;
$this->normal_key = $this->signatory->normal_key;
$this->encoder = new Auth_OpenID_SigningEncoder($this->signatory);
}
function test_idres()
{
$assoc_handle = '{bicycle}{shed}';
$assoc = Auth_OpenID_Association::fromExpiresIn(60, $assoc_handle,
'sekrit', 'HMAC-SHA1');
$this->store->storeAssociation($this->normal_key, $assoc);
$this->request->assoc_handle = $assoc_handle;
$webresponse = $this->encoder->encode($this->response);
$this->assertEquals($webresponse->code, AUTH_OPENID_HTTP_REDIRECT);
$this->assertTrue(array_key_exists('location',
$webresponse->headers));
$location = $webresponse->headers['location'];
$parsed = parse_url($location);
$query = Auth_OpenID::getQuery($parsed['query']);
$this->assertTrue(array_key_exists('openid.sig', $query));
$this->assertTrue(array_key_exists('openid.assoc_handle', $query));
$this->assertTrue(array_key_exists('openid.signed', $query));
}
function test_idresDumb()
{
$webresponse = $this->encoder->encode($this->response);
$this->assertEquals($webresponse->code, AUTH_OPENID_HTTP_REDIRECT);
$this->assertTrue(array_key_exists('location', $webresponse->headers));
$location = $webresponse->headers['location'];
$parsed = parse_url($location);
$query = Auth_OpenID::getQuery($parsed['query']);
$this->assertTrue(array_key_exists('openid.sig', $query));
$this->assertTrue(array_key_exists('openid.assoc_handle', $query));
$this->assertTrue(array_key_exists('openid.signed', $query));
}
function test_forgotStore()
{
$this->encoder->signatory = null;
$result = $this->encoder->encode($this->response);
if (!is_a($result, 'Auth_OpenID_ServerError')) {
$this->fail(sprintf("Expected Auth_OpenID_ServerError, got %s",
gettype($result)));
}
}
function test_cancel()
{
$request = new Auth_OpenID_CheckIDRequest(
'http://bombom.unittest/',
'http://burr.unittest/',
'http://burr.unittest/999',
false,
null,
$this->server);
$response = new Auth_OpenID_ServerResponse($request, 'cancel');
$webresponse = $this->encoder->encode($response);
$this->assertEquals($webresponse->code, AUTH_OPENID_HTTP_REDIRECT);
$this->assertTrue(array_key_exists('location', $webresponse->headers));
$location = $webresponse->headers['location'];
$parsed = parse_url($location);
$query = Auth_OpenID::getQuery($parsed['query']);
$this->assertFalse(array_key_exists('openid.sig', $query));
}
function test_assocReply()
{
if (!defined('Auth_OpenID_NO_MATH_SUPPORT')) {
$message = new Auth_OpenID_Message(Auth_OpenID_OPENID1_NS);
$request = Auth_OpenID_AssociateRequest::fromMessage($message,
$this->server);
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(
array('assoc_handle' => "every-zig"));
$webresponse = $this->encoder->encode($response);
$body = "assoc_handle:every-zig\n";
$this->assertEquals($webresponse->code, AUTH_OPENID_HTTP_OK);
$this->assertEquals($webresponse->headers, array());
$this->assertEquals($webresponse->body, $body);
}
}
function test_alreadySigned()
{
$this->response->fields->setArg(Auth_OpenID_OPENID_NS, 'sig', 'priorSig==');
$result = $this->encoder->encode($this->response);
if (!is_a($result, 'Auth_OpenID_AlreadySigned')) {
$this->fail(sprintf("Expected Auth_OpenID_AlreadySigned " .
"instance, got %s", gettype($result)));
}
}
}
class Tests_Auth_OpenID_CheckID extends PHPUnit_Framework_TestCase {
function setUp()
{
$this->store = new Tests_Auth_OpenID_MemStore();
$this->op_endpoint = 'http://endpoint.unittest/encode';
$this->server = new Auth_OpenID_Server($this->store,
$this->op_endpoint);
$this->request = new Auth_OpenID_CheckIDRequest(
'http://bambam.unittest/',
'http://bar.unittest/999',
'http://bar.unittest/',
false, null,
$this->server);
$this->request->message = new Auth_OpenID_Message(
Auth_OpenID_OPENID2_NS);
}
function test_fromMessageClaimedIDWithoutIdentityOpenID2()
{
$name = 'https://example.myopenid.com';
$msg = new Auth_OpenID_Message(Auth_OpenID_OPENID2_NS);
$msg->setArg(Auth_OpenID_OPENID_NS, 'mode', 'checkid_setup');
$msg->setArg(Auth_OpenID_OPENID_NS, 'return_to',
'http://invalid:8000/rt');
$msg->setArg(Auth_OpenID_OPENID_NS, 'claimed_id', $name);
$result = Auth_OpenID_CheckIDRequest::fromMessage(
$msg, $this->server);
$this->assertTrue(is_a($result, 'Auth_OpenID_ServerError'));
}
function test_fromMessageIdentityWithoutClaimedIDOpenID2()
{
$name = 'https://example.myopenid.com';
$msg = new Auth_OpenID_Message(Auth_OpenID_OPENID2_NS);
$msg->setArg(Auth_OpenID_OPENID_NS, 'mode', 'checkid_setup');
$msg->setArg(Auth_OpenID_OPENID_NS, 'return_to',
'http://invalid:8000/rt');
$msg->setArg(Auth_OpenID_OPENID_NS, 'identity', $name);
$result = Auth_OpenID_CheckIDRequest::fromMessage(
$msg, $this->server);
$this->assertTrue(is_a($result, 'Auth_OpenID_ServerError'));
}
function test_fromMessageWithEmptyTrustRoot()
{
$return_to = 'http://does.not.matter/';
$msg = Auth_OpenID_Message::fromPostArgs(array(
'openid.assoc_handle' => '{blah}{blah}{OZivdQ==}',
'openid.claimed_id' => 'http://delegated.invalid/',
'openid.identity' => 'http://op-local.example.com/',
'openid.mode' => 'checkid_setup',
'openid.ns' => 'http://openid.net/signon/1.0',
'openid.return_to' => $return_to,
'openid.trust_root' => ''
));
$result = Auth_OpenID_CheckIDRequest::fromMessage(
$msg, $this->server);
$this->assertEquals($return_to, $result->trust_root);
}
function test_trustRootInvalid()
{
$this->request->trust_root = "http://foo.unittest/17";
$this->request->return_to = "http://foo.unittest/39";
$this->assertFalse($this->request->trustRootValid());
}
function test_trustRootValid()
{
$this->request->trust_root = "http://foo.unittest/";
$this->request->return_to = "http://foo.unittest/39";
$this->assertTrue($this->request->trustRootValid());
}
function test_malformedTrustRoot()
{
$this->request->trust_root = "invalid://trust*root/";
$this->request->return_to = "http://foo.unittest/39";
$sentinel = 'Sentinel';
$this->request->message = $sentinel;
$result = $this->request->trustRootValid();
$this->assertTrue(Auth_OpenID_isError($result));
$this->assertEquals($result->message, $sentinel);
}
function _verify($trust_root, $return_to, $value)
{
$this->assertEquals($this->request->trust_root, $trust_root);
$this->assertEquals($this->request->return_to, $return_to);
return $value;
}
function _verifyTrue($trust_root, $return_to)
{
return $this->_verify($trust_root, $return_to, true);
}
function _verifyFalse($trust_root, $return_to)
{
return $this->_verify($trust_root, $return_to, false);
}
/*
* Make sure that verifyReturnTo is calling
* Auth_OpenID_verifyReturnTo
*/
function test_returnToVerified_callsVerify()
{
// Ensure that True and False are passed through unchanged
$this->request->verifyReturnTo = array($this, '_verifyTrue');
$this->assertEquals(true, $this->request->returnToVerified());
$this->request->verifyReturnTo = array($this, '_verifyFalse');
$this->assertEquals(false, $this->request->returnToVerified());
}
function test_answerToInvalidRoot()
{
$this->request->trust_root = "http://foo.unittest/17";
$this->request->return_to = "http://foo.unittest/39";
$result = $this->request->answer(true);
if (!is_a($result, 'Auth_OpenID_UntrustedReturnURL')) {
$this->fail(sprintf("Expected Auth_OpenID_UntrustedReturnURL, " .
"got %s", gettype($result)));
}
$this->assertTrue($this->request->answer(false));
}
function _expectAnswer($answer, $identity=null, $claimed_id=null)
{
if (is_a($answer, 'Auth_OpenID_ServerError')) {
$this->fail("Got ServerError, expected valid response in ".$this->getName());
return;
}
$expected_list = array(
array('mode', 'id_res'),
array('return_to', $this->request->return_to),
array('op_endpoint', $this->op_endpoint));
if ($identity) {
$expected_list[] = array('identity', $identity);
if ($claimed_id) {
$expected_list[] = array('claimed_id', $claimed_id);
} else {
$expected_list[] = array('claimed_id', $identity);
}
}
foreach ($expected_list as $pair) {
list($k, $expected) = $pair;
$actual = $answer->fields->getArg(Auth_OpenID_OPENID_NS, $k);
$this->assertEquals($expected, $actual,
"Got wrong value for field '".$k."'");
}
$this->assertTrue($answer->fields->hasKey(Auth_OpenID_OPENID_NS, 'response_nonce'));
$this->assertTrue($answer->fields->getOpenIDNamespace() == Auth_OpenID_OPENID2_NS);
# One for nonce, one for ns
$this->assertEquals(count($answer->fields->toPostArgs()),
count($expected_list) + 2);
}
function test_answerAllow()
{
$answer = $this->request->answer(true);
if (Auth_OpenID_isError($answer)) {
$this->fail($answer->toString());
return;
}
$this->assertEquals($answer->request, $this->request);
$this->_expectAnswer($answer, $this->request->identity);
}
function test_answerAllowDelegatedIdentity()
{
$this->request->claimed_id = 'http://delegating.unittest/';
$answer = $this->request->answer(true);
$this->_expectAnswer($answer, $this->request->identity,
$this->request->claimed_id);
}
function test_answerAllowWithoutIdentityReally()
{
$this->request->identity = null;
$answer = $this->request->answer(true);
$this->assertEquals($answer->request, $this->request);
$this->_expectAnswer($answer);
}
function test_answerAllowAnonymousFail()
{
$this->request->identity = null;
// XXX - Check on this, I think this behavior is legal in
// OpenID 2.0?
// $this->failUnlessRaises(
// ValueError, $this->request->answer, true, identity="=V");
$this->assertTrue(is_a($this->request->answer(true, null, "=V"),
'Auth_OpenID_ServerError'));
}
function test_answerAllowWithIdentity()
{
$this->request->identity = Auth_OpenID_IDENTIFIER_SELECT;
$selected_id = 'http://anon.unittest/9861';
$answer = $this->request->answer(true, null, $selected_id);
$this->_expectAnswer($answer, $selected_id);
}
function test_fromMessageWithoutTrustRoot()
{
$msg = new Auth_OpenID_Message(Auth_OpenID_OPENID2_NS);;
$msg->setArg(Auth_OpenID_OPENID_NS, 'mode', 'checkid_setup');
$msg->setArg(Auth_OpenID_OPENID_NS, 'return_to',
'http://real_trust_root/foo');
$msg->setArg(Auth_OpenID_OPENID_NS, 'assoc_handle', 'bogus');
$msg->setArg(Auth_OpenID_OPENID_NS, 'identity', 'george');
$msg->setArg(Auth_OpenID_OPENID_NS, 'claimed_id', 'george');
$result = Auth_OpenID_CheckIDRequest::fromMessage(
$msg, $this->server->op_endpoint);
$this->assertEquals($result->trust_root,
'http://real_trust_root/foo');
}
function test_fromMessageWithoutTrustRootOrReturnTo()
{
$msg = new Auth_OpenID_Message(Auth_OpenID_OPENID2_NS);
$msg->setArg(Auth_OpenID_OPENID_NS, 'mode', 'checkid_setup');
$msg->setArg(Auth_OpenID_OPENID_NS, 'assoc_handle', 'bogus');
$msg->setArg(Auth_OpenID_OPENID_NS, 'identity', 'george');
$msg->setArg(Auth_OpenID_OPENID_NS, 'claimed_id', 'george');
$result = Auth_OpenID_CheckIDRequest::fromMessage(
$msg, $this->server);
$this->assertTrue(is_a($result, 'Auth_OpenID_ServerError'));
}
function test_answerAllowNoEndpointOpenID1()
{
$identity = 'http://bambam.unittest/';
$reqmessage = Auth_OpenID_Message::fromOpenIDArgs(array(
'identity' => $identity,
'trust_root' => 'http://bar.unittest/',
'return_to' => 'http://bar.unittest/999',
));
$this->server->op_endpoint = null;
$this->request = Auth_OpenID_CheckIDRequest::fromMessage($reqmessage, $this->server);
$answer = $this->request->answer(true);
$expected_list = array('mode' => 'id_res',
'return_to' => $this->request->return_to,
'identity' => $identity,
);
foreach ($expected_list as $k => $expected) {
$actual = $answer->fields->getArg(Auth_OpenID_OPENID_NS, $k);
$this->assertEquals($expected, $actual);
}
$this->assertTrue($answer->fields->hasKey(Auth_OpenID_OPENID_NS,
'response_nonce'));
$this->assertTrue($answer->fields->getOpenIDNamespace(),
Auth_OpenID_OPENID1_NS);
$this->assertTrue(
$answer->fields->namespaces->isImplicit(Auth_OpenID_OPENID1_NS));
// One for nonce (OpenID v1 namespace is implicit)
$this->assertEquals(count($answer->fields->toPostArgs()),
count($expected_list) + 1,
var_export($answer->fields->toPostArgs(), true));
}
function test_answerAllowWithDelegatedIdentityOpenID2()
{
// Answer an IDENTIFIER_SELECT case with a delegated
// identifier. claimed_id delegates to selected_id here.
$this->request->identity = Auth_OpenID_IDENTIFIER_SELECT;
$selected_id = 'http://anon.unittest/9861';
$claimed_id = 'http://monkeyhat.unittest/';
$answer = $this->request->answer(true, null, $selected_id,
$claimed_id);
$this->_expectAnswer($answer, $selected_id, $claimed_id);
}
function test_answerAllowWithDelegatedIdentityOpenID1()
{
// claimed_id parameter doesn't exist in OpenID 1.
$msg = new Auth_OpenID_Message(Auth_OpenID_OPENID1_NS);
$this->request->message = $msg;
// claimed_id delegates to selected_id here.
$this->request->identity = Auth_OpenID_IDENTIFIER_SELECT;
$selected_id = 'http://anon.unittest/9861';
$claimed_id = 'http://monkeyhat.unittest/';
$result = $this->request->answer(true,
null,
$selected_id,
$claimed_id);
$this->assertTrue(is_a($result, "Auth_OpenID_ServerError"),
var_export($result, true));
}
function test_answerAllowWithAnotherIdentity()
{
// XXX - Check on this, I think this behavior is legal is
// OpenID 2.0?
// $this->failUnlessRaises(ValueError, $this->request->answer, true,
// identity="http://pebbles.unittest/");
$result = $this->request->answer(true, null, "http://pebbles.unittest/");
$this->assertTrue(is_a($result, "Auth_OpenID_ServerError"));
}
function test_answerAllowNoIdentityOpenID1()
{
$msg = new Auth_OpenID_Message(Auth_OpenID_OPENID1_NS);
$this->request->message = $msg;
$this->request->identity = null;
// $this->failUnlessRaises(ValueError, $this->request->answer, true,
// identity=null);
$result = $this->request->answer(true);
$this->assertTrue(is_a($result, "Auth_OpenID_ServerError"));
}
function test_answerAllowForgotEndpoint()
{
$this->request->server->op_endpoint = null;
$result = $this->request->answer(true);
$this->assertTrue(is_a($result, "Auth_OpenID_ServerError"));
}
function test_checkIDWithNoIdentityOpenID1()
{
$msg = new Auth_OpenID_Message(Auth_OpenID_OPENID1_NS);
$msg->setArg(Auth_OpenID_OPENID_NS, 'return_to', 'bogus');
$msg->setArg(Auth_OpenID_OPENID_NS, 'trust_root', 'bogus');
$msg->setArg(Auth_OpenID_OPENID_NS, 'mode', 'checkid_setup');
$msg->setArg(Auth_OpenID_OPENID_NS, 'assoc_handle', 'bogus');
// $this->failUnlessRaises(server->ProtocolError,
// server->CheckIDRequest->fromMessage,
// msg, $this->server);
$result = Auth_OpenID_CheckIDRequest::fromMessage($msg, $this->server);
$this->assertTrue(is_a($result, 'Auth_OpenID_ServerError'));
}
function test_trustRootOpenID1()
{
// Ignore openid.realm in OpenID 1
$msg = new Auth_OpenID_Message(Auth_OpenID_OPENID1_NS);
$msg->setArg(Auth_OpenID_OPENID_NS, 'mode', 'checkid_setup');
$msg->setArg(Auth_OpenID_OPENID_NS, 'trust_root', 'http://real_trust_root/');
$msg->setArg(Auth_OpenID_OPENID_NS, 'realm', 'http://fake_trust_root/');
$msg->setArg(Auth_OpenID_OPENID_NS, 'return_to', 'http://real_trust_root/foo');
$msg->setArg(Auth_OpenID_OPENID_NS, 'assoc_handle', 'bogus');
$msg->setArg(Auth_OpenID_OPENID_NS, 'identity', 'george');
$result = Auth_OpenID_CheckIDRequest::fromMessage($msg, $this->server);
$this->assertTrue($result->trust_root == 'http://real_trust_root/');
}
function test_trustRootOpenID2()
{
// Ignore openid.trust_root in OpenID 2
$msg = new Auth_OpenID_Message(Auth_OpenID_OPENID2_NS);
$msg->setArg(Auth_OpenID_OPENID_NS, 'mode', 'checkid_setup');
$msg->setArg(Auth_OpenID_OPENID_NS, 'realm', 'http://real_trust_root/');
$msg->setArg(Auth_OpenID_OPENID_NS, 'trust_root', 'http://fake_trust_root/');
$msg->setArg(Auth_OpenID_OPENID_NS, 'return_to', 'http://real_trust_root/foo');
$msg->setArg(Auth_OpenID_OPENID_NS, 'assoc_handle', 'bogus');
$msg->setArg(Auth_OpenID_OPENID_NS, 'identity', 'george');
$msg->setArg(Auth_OpenID_OPENID_NS, 'claimed_id', 'george');
$result = Auth_OpenID_CheckIDRequest::fromMessage($msg, $this->server);
$this->assertTrue($result->trust_root == 'http://real_trust_root/');
}
function test_encodeToURL()
{
$server_url = 'http://openid-server.unittest/';
$result = $this->request->encodeToURL($server_url);
$this->assertFalse(is_a($result, 'Auth_OpenID_ServerError'));
// How to check? How about a round-trip test.
list($base, $result_args) = explode("?", $result, 2);
$args = Auth_OpenID::getQuery($result_args);
$message = Auth_OpenID_Message::fromPostArgs($args);
$rebuilt_request = Auth_OpenID_CheckIDRequest::fromMessage($message,
$this->server);
// argh, lousy hack
$this->assertTrue($rebuilt_request->equals($this->request));
}
function test_answerAllowNoTrustRoot()
{
$this->request->trust_root = null;
$answer = $this->request->answer(true);
$this->assertEquals($answer->request, $this->request);
$this->_expectAnswer($answer, $this->request->identity);
}
function test_answerImmediateDenyOpenID1()
{
$msg = new Auth_OpenID_Message(Auth_OpenID_OPENID1_NS);
$this->request->message = $msg;
$this->request->namespace = $msg->getOpenIDNamespace();
$this->request->mode = 'checkid_immediate';
$this->request->claimed_id = 'http://claimed-id.test/';
$this->request->immediate = true;
$server_url = "http://setup-url.unittest/";
$answer = $this->request->answer(false, $server_url);
$this->assertEquals($answer->request, $this->request);
$this->assertEquals(count($answer->fields->toPostArgs()), 2);
$this->assertEquals($answer->fields->getOpenIDNamespace(),
Auth_OpenID_OPENID1_NS);
$this->assertTrue(
$answer->fields->namespaces->isImplicit(Auth_OpenID_OPENID1_NS));
$this->assertEquals($answer->fields->getArg(Auth_OpenID_OPENID_NS, 'mode'),
'id_res');
$usu = $answer->fields->getArg(Auth_OpenID_OPENID_NS,'user_setup_url');
$this->assertTrue(strpos($usu, $server_url) == 0);
$expected_substr = 'openid.claimed_id=http%3A%2F%2Fclaimed-id.test%2F';
$this->assertTrue(strpos($usu, $expected_substr), $usu);
}
function test_answerImmediateDenyOpenID2()
{
$this->request->mode = 'checkid_immediate';
$this->request->immediate = true;
$server_url = "http://setup-url.unittest/";
$answer = $this->request->answer(false, $server_url);
$this->assertEquals($answer->request, $this->request);
$this->assertEquals(count($answer->fields->toPostArgs()), 3);
$this->assertEquals($answer->fields->getOpenIDNamespace(),
Auth_OpenID_OPENID2_NS);
$this->assertEquals($answer->fields->getArg(Auth_OpenID_OPENID_NS, 'mode'),
'setup_needed');
}
function test_answerSetupDeny()
{
$answer = $this->request->answer(false);
$this->assertEquals($answer->fields->getArgs(Auth_OpenID_OPENID_NS),
array('mode' => 'cancel'));
}
function test_getCancelURL()
{
$url = $this->request->getCancelURL();
$parsed = parse_url($url);
$query = Auth_OpenID::getQuery($parsed['query']);
$this->assertEquals(array('openid.mode' => 'cancel',
'openid.ns' => Auth_OpenID_OPENID2_NS),
$query);
}
function test_getCancelURLimmed()
{
$this->request->mode = 'checkid_immediate';
$this->request->immediate = true;
$result = $this->request->getCancelURL();
if (!is_a($result, 'Auth_OpenID_ServerError')) {
$this->fail(sprintf("Expected Auth_OpenID_ServerError, got %s",
gettype($result)));
}
}
}
class Tests_Auth_OpenID_CheckIDExtension extends PHPUnit_Framework_TestCase {
function setUp()
{
$this->op_endpoint = 'http://endpoint.unittest/ext';
$this->store = new Tests_Auth_OpenID_MemStore();
$this->server = new Auth_OpenID_Server($this->store, $this->op_endpoint);
$this->request = new Auth_OpenID_CheckIDRequest(
'http://bambam.unittest/',
'http://bar.unittest/',
'http://bar.unittest/999',
false,
null,
$this->server);
$this->response = new Auth_OpenID_ServerResponse($this->request);
$this->response->fields->setArg(Auth_OpenID_OPENID_NS, 'mode', 'id_res');
$this->response->fields->setArg(Auth_OpenID_OPENID_NS, 'blue', 'star');
}
function test_addField()
{
$namespace = 'something:';
$this->response->fields->setArg($namespace, 'bright', 'potato');
$this->assertEquals($this->response->fields->getArgs(Auth_OpenID_OPENID_NS),
array('blue' => 'star',
'mode' => 'id_res'));
$this->assertEquals($this->response->fields->getArgs($namespace),
array('bright' => 'potato'));
}
function test_addFields()
{
$namespace = 'mi5:';
$args = array('tangy' => 'suspenders',
'bravo' => 'inclusion');
$this->response->fields->updateArgs($namespace, $args);
$this->assertEquals($this->response->fields->getArgs(Auth_OpenID_OPENID_NS),
array('blue' => 'star',
'mode' => 'id_res'));
$this->assertEquals($this->response->fields->getArgs($namespace), $args);
}
}
class _MockSignatory {
var $isValid = true;
function _MockSignatory($assoc)
{
$this->assocs = array($assoc);
}
function verify($assoc_handle, $message)
{
if (!$message->hasKey(Auth_OpenID_OPENID_NS, 'sig')) {
return false;
}
if (in_array(array(true, $assoc_handle), $this->assocs)) {
return $this->isValid;
} else {
return false;
}
}
function getAssociation($assoc_handle, $dumb)
{
if (in_array(array($dumb, $assoc_handle), $this->assocs)) {
// This isn't a valid implementation for many uses of this
// function, mind you.
return true;
} else {
return null;
}
}
function invalidate($assoc_handle, $dumb)
{
if (in_array(array($dumb, $assoc_handle), $this->assocs)) {
$i = 0;
foreach ($this->assocs as $pair) {
if ($pair == array($dumb, $assoc_handle)) {
unset($this->assocs[$i]);
break;
}
$i++;
}
}
}
}
class Tests_Auth_OpenID_CheckAuth extends PHPUnit_Framework_TestCase {
function setUp()
{
$this->assoc_handle = 'mooooooooo';
$this->message = Auth_OpenID_Message::fromPostArgs(
array('openid.sig' => 'signarture',
'one' => 'alpha',
'two' => 'beta'));
$this->request = new Auth_OpenID_CheckAuthRequest(
$this->assoc_handle, $this->message);
$this->signatory = new _MockSignatory(array(true, $this->assoc_handle));
}
function test_valid()
{
$this->request->namespace = Auth_OpenID_OPENID1_NS;
$r = $this->request->answer($this->signatory);
$this->assertEquals($r->fields->getArgs(Auth_OpenID_OPENID1_NS),
array('is_valid' => 'true'));
$this->assertEquals($r->request, $this->request);
}
function test_invalid()
{
$this->request->namespace = Auth_OpenID_OPENID1_NS;
$this->signatory->isValid = false;
$r = $this->request->answer($this->signatory);
$this->assertEquals($r->fields->getArgs(Auth_OpenID_OPENID1_NS),
array('is_valid' => 'false'));
}
function test_replay()
{
$this->request->namespace = Auth_OpenID_OPENID1_NS;
$r = $this->request->answer($this->signatory);
$r = $this->request->answer($this->signatory);
$this->assertEquals($r->fields->getArgs(Auth_OpenID_OPENID1_NS),
array('is_valid' => 'false'));
}
function test_invalidatehandle()
{
$this->request->namespace = Auth_OpenID_OPENID1_NS;
$this->request->invalidate_handle = "bogusHandle";
$r = $this->request->answer($this->signatory);
$this->assertEquals($r->fields->getArgs(Auth_OpenID_OPENID1_NS),
array('is_valid' => 'true',
'invalidate_handle' => "bogusHandle"));
$this->assertEquals($r->request, $this->request);
}
function test_invalidatehandleNo()
{
$this->request->namespace = Auth_OpenID_OPENID1_NS;
$assoc_handle = 'goodhandle';
$this->signatory->assocs[] = array(false, 'goodhandle');
$this->request->invalidate_handle = $assoc_handle;
$r = $this->request->answer($this->signatory);
$this->assertEquals($r->fields->getArgs(Auth_OpenID_OPENID1_NS),
array('is_valid' => 'true'));
}
}
class Tests_Auth_OpenID_Associate extends PHPUnit_Framework_TestCase {
// TODO: test DH with non-default values for modulus and gen.
// (important to do because we actually had it broken for a
// while.)
function setUp()
{
$message = new Auth_OpenID_Message(Auth_OpenID_OPENID1_NS);
$this->request = Auth_OpenID_AssociateRequest::fromMessage($message);
$this->store = new Tests_Auth_OpenID_MemStore();
$this->signatory = new Auth_OpenID_Signatory($this->store);
}
function test_dhSHA1()
{
if (!defined('Auth_OpenID_NO_MATH_SUPPORT')) {
$this->assoc = $this->signatory->createAssociation(false,
'HMAC-SHA1');
$dh = new Auth_OpenID_DiffieHellman();
$ml = Auth_OpenID_getMathLib();
$cpub = $dh->public;
$session = new Auth_OpenID_DiffieHellmanSHA1ServerSession(
new Auth_OpenID_DiffieHellman(),
$cpub);
$this->request = new Auth_OpenID_AssociateRequest($session,
'HMAC-SHA1');
$response = $this->request->answer($this->assoc);
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "assoc_type"),
"HMAC-SHA1");
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "assoc_handle"),
$this->assoc->handle);
$this->assertFalse(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "mac_key"));
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "session_type"),
"DH-SHA1");
$this->assertTrue(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "enc_mac_key"));
$this->assertTrue(
$response->fields->getArg(Auth_OpenID_OPENID_NS,
"dh_server_public"));
$enc_key = base64_decode(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "enc_mac_key"));
$spub = $ml->base64ToLong(
$response->fields->getArg(Auth_OpenID_OPENID_NS,
"dh_server_public"));
$secret = $dh->xorSecret($spub, $enc_key, $session->hash_func);
$this->assertEquals($secret, $this->assoc->secret);
}
}
function test_dhSHA256()
{
if (defined('Auth_OpenID_NO_MATH_SUPPORT') ||
!Auth_OpenID_SHA256_SUPPORTED) {
print "(Skipping test_dhSHA256)";
return;
}
$this->assoc = $this->signatory->createAssociation(false,
'HMAC-SHA256');
$consumer_dh = new Auth_OpenID_DiffieHellman();
$cpub = $consumer_dh->public;
$server_dh = new Auth_OpenID_DiffieHellman();
$session = new Auth_OpenID_DiffieHellmanSHA256ServerSession($server_dh, $cpub);
$this->request = new Auth_OpenID_AssociateRequest($session, 'HMAC-SHA256');
$response = $this->request->answer($this->assoc);
$this->assertFalse($response->fields->getArg(Auth_OpenID_OPENID_NS, "mac_key"));
$this->assertTrue($response->fields->getArg(Auth_OpenID_OPENID_NS, "enc_mac_key"));
$this->assertTrue($response->fields->getArg(Auth_OpenID_OPENID_NS, "dh_server_public"));
$fields = array(
'assoc_type' => 'HMAC-SHA256',
'assoc_handle' => $this->assoc->handle,
'session_type' => 'DH-SHA256',
);
foreach ($fields as $k => $v) {
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, $k), $v);
}
$enc_key = base64_decode(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "enc_mac_key"));
$lib = Auth_OpenID_getMathLib();
$spub = $lib->base64ToLong($response->fields->getArg(Auth_OpenID_OPENID_NS,
"dh_server_public"));
$secret = $consumer_dh->xorSecret($spub, $enc_key, 'Auth_OpenID_SHA256');
$s = base64_encode($secret);
$assoc_s = base64_encode($this->assoc->secret);
$this->assertEquals($s, $assoc_s);
}
function test_protoError256()
{
if (defined('Auth_OpenID_NO_MATH_SUPPORT') ||
!Auth_OpenID_HMACSHA256_SUPPORTED) {
print "(Skipping test_protoError256)";
return;
}
$s256_session = new Auth_OpenID_DiffieHellmanSHA256ConsumerSession();
$invalid_s256 = array('openid.assoc_type' => 'HMAC-SHA1',
'openid.session_type' => 'DH-SHA256');
$invalid_s256 = array_merge($invalid_s256, $s256_session->getRequest());
$invalid_s256_2 = array('openid.assoc_type' => 'MONKEY-PIRATE',
'openid.session_type' => 'DH-SHA256');
$invalid_s256_2 = array_merge($invalid_s256_2, $s256_session->getRequest());
$bad_request_argss = array(
$invalid_s256,
$invalid_s256_2);
foreach ($bad_request_argss as $request_args) {
$message = Auth_OpenID_Message::fromPostArgs($request_args);
$result = Auth_OpenID_Associaterequest::fromMessage($message);
$this->assertTrue(is_a($result, 'Auth_OpenID_ServerError'));
}
}
function test_plaintext()
{
$this->assoc = $this->signatory->createAssociation(false,
'HMAC-SHA1');
$response = $this->request->answer($this->assoc);
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "assoc_type"),
"HMAC-SHA1");
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "assoc_handle"),
$this->assoc->handle);
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "expires_in"),
sprintf("%d", $this->signatory->SECRET_LIFETIME));
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "mac_key"),
base64_encode($this->assoc->secret));
$this->assertFalse($response->fields->getArg(Auth_OpenID_OPENID_NS,
"session_type"));
$this->assertFalse($response->fields->getArg(Auth_OpenID_OPENID_NS,
"enc_mac_key"));
$this->assertFalse($response->fields->getArg(Auth_OpenID_OPENID_NS,
"dh_server_public"));
}
function test_plaintextV2()
{
// The main difference between this and the v1 test is that
// the session_typ is always returned in v2.
$args = array('openid.mode' => 'associate',
'openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.assoc_type' => 'HMAC-SHA1',
'openid.session_type' => 'no-encryption');
$this->request = Auth_OpenID_AssociateRequest::fromMessage(
Auth_OpenID_Message::fromPostArgs($args));
$this->assertFalse($this->request->message->isOpenID1());
$this->assoc = $this->signatory->createAssociation(false,
'HMAC-SHA1');
$response = $this->request->answer($this->assoc);
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "assoc_type"),
"HMAC-SHA1");
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "assoc_handle"),
$this->assoc->handle);
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "expires_in"),
sprintf("%d", $this->signatory->SECRET_LIFETIME));
$this->assertEquals(
$response->fields->getArg(Auth_OpenID_OPENID_NS, "mac_key"),
base64_encode($this->assoc->secret));
$session_type = $response->fields->getArg(Auth_OpenID_OPENID_NS,
"session_type");
$this->assertEquals('no-encryption', $session_type);
$this->assertFalse($response->fields->getArg(Auth_OpenID_OPENID_NS,
"enc_mac_key"));
$this->assertFalse($response->fields->getArg(Auth_OpenID_OPENID_NS,
"dh_server_public"));
}
function test_protoError()
{
$s1_session = new Auth_OpenID_DiffieHellmanSHA1ConsumerSession();
$invalid_s1 = array('openid.assoc_type' => 'HMAC-SHA256',
'openid.session_type' => 'DH-SHA1');
$invalid_s1 = array_merge($invalid_s1, $s1_session->getRequest());
$invalid_s1_2 = array('openid.assoc_type' => 'ROBOT-NINJA',
'openid.session_type' => 'DH-SHA1');
$invalid_s1_2 = array_merge($invalid_s1_2, $s1_session->getRequest());
$bad_request_argss = array(array('openid.assoc_type' => 'Wha?'),
$invalid_s1,
$invalid_s1_2);
foreach ($bad_request_argss as $request_args) {
$message = Auth_OpenID_Message::fromPostArgs($request_args);
$result = Auth_OpenID_AssociateRequest::fromMessage($message);
$this->assertTrue(is_a($result, 'Auth_OpenID_ServerError'));
}
}
function test_protoErrorFields()
{
$contact = 'user@example.invalid';
$reference = 'Trac ticket number MAX_INT';
$error = 'poltergeist';
$openid1_args = array(
'openid.identitiy' => 'invalid',
'openid.mode' => 'checkid_setup');
$openid2_args = $openid1_args;
$openid2_args = array_merge($openid2_args,
array('openid.ns' => Auth_OpenID_OPENID2_NS));
// Check presence of optional fields in both protocol versions
$openid1_msg = Auth_OpenID_Message::fromPostArgs($openid1_args);
$p = new Auth_OpenID_ServerError($openid1_msg, $error,
$reference, $contact);
$reply = $p->toMessage();
$this->assertEquals($reply->getArg(Auth_OpenID_OPENID_NS, 'reference'),
$reference);
$this->assertEquals($reply->getArg(Auth_OpenID_OPENID_NS, 'contact'),
$contact);
$openid2_msg = Auth_OpenID_Message::fromPostArgs($openid2_args);
$p = new Auth_OpenID_ServerError($openid2_msg, $error,
$reference, $contact);
$reply = $p->toMessage();
$this->assertEquals($reply->getArg(Auth_OpenID_OPENID_NS, 'reference'),
$reference);
$this->assertEquals($reply->getArg(Auth_OpenID_OPENID_NS, 'contact'),
$contact);
}
function failUnlessExpiresInMatches($msg, $expected_expires_in)
{
$expires_in_str = $msg->getArg(Auth_OpenID_OPENID_NS, 'expires_in');
if ($expires_in_str === null) {
$this->fail("Expected expires_in value.");
return;
}
$expires_in = intval($expires_in_str);
// Slop is necessary because the tests can sometimes get run
// right on a second boundary
$slop = 1; // second
$difference = $expected_expires_in - $expires_in;
$error_message = sprintf('"expires_in" value not within %s of expected: '.
'expected=%s, actual=%s',
$slop, $expected_expires_in, $expires_in);
$this->assertTrue((0 <= $difference &&
$difference <= $slop), $error_message);
}
function test_plaintext256()
{
if (defined('Auth_OpenID_NO_MATH_SUPPORT') ||
!Auth_OpenID_SHA256_SUPPORTED) {
print "(Skipping test_plaintext256)";
return;
}
$this->assoc = $this->signatory->createAssociation(false,
'HMAC-SHA256');
$response = $this->request->answer($this->assoc);
$f = $response->fields;
$this->assertEquals($f->getArg(Auth_OpenID_OPENID_NS, "assoc_type"),
"HMAC-SHA1");
$this->assertEquals($f->getArg(Auth_OpenID_OPENID_NS, "assoc_handle"),
$this->assoc->handle);
$this->failUnlessExpiresInMatches(
$f,
$this->signatory->SECRET_LIFETIME);
$this->assertEquals(
$f->getArg(Auth_OpenID_OPENID_NS, "mac_key"),
base64_encode($this->assoc->secret));
$this->assertFalse($f->hasKey(Auth_OpenID_OPENID_NS, "session_type"));
$this->assertFalse($f->hasKey(Auth_OpenID_OPENID_NS, "enc_mac_key"));
$this->assertFalse($f->hasKey(Auth_OpenID_OPENID_NS, "dh_server_public"));
}
function test_unsupportedPrefer()
{
$allowed_assoc = 'COLD-PET-RAT';
$allowed_sess = 'FROG-BONES';
$message = 'This is a unit test';
// Set an OpenID 2 message so answerUnsupported doesn't raise
// ProtocolError.
$this->request->message = new Auth_OpenID_Message(Auth_OpenID_OPENID2_NS);
$response = $this->request->answerUnsupported(
$message,
$allowed_assoc,
$allowed_sess);
$f = $response->fields;
$this->assertEquals($f->getArg(Auth_OpenID_OPENID_NS, 'error_code'),
'unsupported-type');
$this->assertEquals($f->getArg(Auth_OpenID_OPENID_NS, 'assoc_type'),
$allowed_assoc);
$this->assertEquals($f->getArg(Auth_OpenID_OPENID_NS, 'error'),
$message);
$this->assertEquals($f->getArg(Auth_OpenID_OPENID_NS, 'session_type'),
$allowed_sess);
}
function test_unsupported()
{
$message = 'This is a unit test';
$this->request->message = new Auth_OpenID_Message(Auth_OpenID_OPENID2_NS);
$response = $this->request->answerUnsupported($message);
$f = $response->fields;
$this->assertEquals($f->getArg(Auth_OpenID_OPENID_NS, 'error_code'),
'unsupported-type');
$this->assertEquals($f->getArg(Auth_OpenID_OPENID_NS, 'assoc_type'), null);
$this->assertEquals($f->getArg(Auth_OpenID_OPENID_NS, 'error'), $message);
$this->assertEquals($f->getArg(Auth_OpenID_OPENID_NS, 'session_type'), null);
}
}
class Counter {
function Counter()
{
$this->count = 0;
}
function inc()
{
$this->count += 1;
}
}
class Tests_Auth_OpenID_ServerTest extends PHPUnit_Framework_TestCase {
function setUp()
{
$this->store = new Tests_Auth_OpenID_MemStore();
$this->server = new Auth_OpenID_Server($this->store);
}
function test_associate()
{
if (!defined('Auth_OpenID_NO_MATH_SUPPORT')) {
$message = new Auth_OpenID_Message(Auth_OpenID_OPENID1_NS);
$request = Auth_OpenID_AssociateRequest::fromMessage($message);
$response = $this->server->openid_associate($request);
$this->assertTrue($response->fields->hasKey(Auth_OpenID_OPENID_NS,
'assoc_handle'));
}
}
function test_associate2()
{
// Associate when the server has no allowed association types
//
// Gives back an error with error_code and no fallback session
// or assoc types.
$this->server->negotiator->setAllowedTypes(array());
$msg = Auth_OpenID_Message::fromPostArgs(array(
'openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.session_type' => 'no-encryption'));
$request = Auth_OpenID_AssociateRequest::fromMessage($msg);
$response = $this->server->openid_associate($request);
$this->assertTrue($response->fields->hasKey(Auth_OpenID_OPENID_NS, "error"));
$this->assertTrue($response->fields->hasKey(Auth_OpenID_OPENID_NS, "error_code"));
$this->assertFalse($response->fields->hasKey(Auth_OpenID_OPENID_NS, "assoc_handle"));
$this->assertFalse($response->fields->hasKey(Auth_OpenID_OPENID_NS, "assoc_type"));
$this->assertFalse($response->fields->hasKey(Auth_OpenID_OPENID_NS, "session_type"));
}
function test_associate3()
{
if (defined('Auth_OpenID_NO_MATH_SUPPORT') ||
!Auth_OpenID_HMACSHA256_SUPPORTED) {
print "(Skipping test_associate3)";
return;
}
// Request an assoc type that is not supported when there are
// supported types.
//
// Should give back an error message with a fallback type.
$this->server->negotiator->setAllowedTypes(array(array('HMAC-SHA256', 'DH-SHA256')));
$msg = Auth_OpenID_Message::fromPostArgs(array(
'openid.ns' => Auth_OpenID_OPENID2_NS,
'openid.session_type' => 'no-encryption'));
$request = Auth_OpenID_AssociateRequest::fromMessage($msg);
$response = $this->server->openid_associate($request);
$this->assertTrue($response->fields->hasKey(Auth_OpenID_OPENID_NS, "error"));
$this->assertTrue($response->fields->hasKey(Auth_OpenID_OPENID_NS, "error_code"));
$this->assertFalse($response->fields->hasKey(Auth_OpenID_OPENID_NS, "assoc_handle"));
$this->assertEquals($response->fields->getArg(Auth_OpenID_OPENID_NS, "assoc_type"),
'HMAC-SHA256');
$this->assertEquals($response->fields->getArg(Auth_OpenID_OPENID_NS, "session_type"),
'DH-SHA256');
}
function test_associate4()
{
if (defined('Auth_OpenID_NO_MATH_SUPPORT') ||
!Auth_OpenID_HMACSHA256_SUPPORTED) {
print "(Skipping test_associate4)";
return;
}
$this->assertTrue($this->server->negotiator->setAllowedTypes(
array(array('HMAC-SHA256', 'DH-SHA256'))));
$query = array(
'openid.dh_consumer_public' =>
'ALZgnx8N5Lgd7pCj8K86T/DDMFjJXSss1SKoLmxE72kJTzOtG6I2PaYrHX'.
'xku4jMQWSsGfLJxwCZ6280uYjUST/9NWmuAfcrBfmDHIBc3H8xh6RBnlXJ'.
'1WxJY3jHd5k1/ZReyRZOxZTKdF/dnIqwF8ZXUwI6peV0TyS/K1fOfF/s',
'openid.assoc_type' => 'HMAC-SHA256',
'openid.session_type' => 'DH-SHA256');
$message = Auth_OpenID_Message::fromPostArgs($query);
$request = Auth_OpenID_AssociateRequest::fromMessage($message);
$response = $this->server->openid_associate($request);
$this->assertTrue($response->fields->hasKey(Auth_OpenID_OPENID_NS, "assoc_handle"));
}
function test_missingSessionTypeOpenID2()
{
// Make sure session_type is required in OpenID 2
$msg = Auth_OpenID_Message::fromPostArgs(array('openid.ns' => Auth_OpenID_OPENID2_NS));
$result = Auth_OpenID_AssociateRequest::fromMessage($msg);
$this->assertTrue(is_a($result, 'Auth_OpenID_ServerError'));
}
function test_checkAuth()
{
$request = new Auth_OpenID_CheckAuthRequest('arrrrrf',
'0x3999', array());
$response = $this->server->openid_check_authentication($request);
$this->assertTrue($response->fields->hasKey(Auth_OpenID_OPENID_NS, 'is_valid'));
}
}
class Tests_Auth_OpenID_Signatory extends PHPUnit_Framework_TestCase {
function setUp()
{
$this->store = new Tests_Auth_OpenID_MemStore();
$this->signatory = new Auth_OpenID_Signatory($this->store);
$this->dumb_key = $this->signatory->dumb_key;
$this->normal_key = $this->signatory->normal_key;
}
function test_sign()
{
$request = new Auth_OpenID_ServerRequest();
$request->namespace = Auth_OpenID_OPENID1_NS;
$assoc_handle = '{assoc}{lookatme}';
$assoc = Auth_OpenID_Association::fromExpiresIn(60, $assoc_handle,
'sekrit', 'HMAC-SHA1');
$this->store->storeAssociation($this->normal_key, $assoc);
$request->assoc_handle = $assoc_handle;
$request->namespace = Auth_OpenID_OPENID1_NS;
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(array(
'foo' => 'amsigned',
'bar' => 'notsigned',
'azu' => 'alsosigned'));
$sresponse = $this->signatory->sign($response);
$this->assertEquals($sresponse->fields->getArg(Auth_OpenID_OPENID_NS,
'assoc_handle'),
$assoc_handle);
$this->assertEquals($sresponse->fields->getArg(Auth_OpenID_OPENID_NS, 'signed'),
'assoc_handle,azu,bar,foo,signed');
$this->assertTrue($sresponse->fields->hasKey(Auth_OpenID_OPENID_NS, 'sig'));
}
function test_signDumb()
{
$request = new Auth_OpenID_ServerRequest();
$request->assoc_handle = null;
$request->namespace = Auth_OpenID_OPENID1_NS;
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(array(
'foo' => 'amsigned',
'bar' => 'notsigned',
'azu' => 'alsosigned'));
$sresponse = $this->signatory->sign($response);
$assoc_handle = $sresponse->fields->getArg(Auth_OpenID_OPENID_NS,
'assoc_handle');
$this->assertTrue($assoc_handle);
$assoc = $this->signatory->getAssociation($assoc_handle, true);
$this->assertTrue($assoc);
$this->assertEquals($sresponse->fields->getArg(Auth_OpenID_OPENID_NS, 'signed'),
'assoc_handle,azu,bar,foo,signed');
$this->assertTrue($sresponse->fields->hasKey(Auth_OpenID_OPENID_NS, 'sig'));
}
function test_signExpired()
{
$request = new Auth_OpenID_ServerRequest();
$assoc_handle = '{assoc}{lookatme}';
$assoc = Auth_OpenID_Association::fromExpiresIn(-10, $assoc_handle,
'sekrit', 'HMAC-SHA1');
$this->store->storeAssociation($this->normal_key, $assoc);
$this->assertTrue($this->store->getAssociation($this->normal_key,
$assoc_handle));
$request->assoc_handle = $assoc_handle;
$request->namespace = Auth_OpenID_OPENID1_NS;
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(array(
'foo' => 'amsigned',
'bar' => 'notsigned',
'azu' => 'alsosigned'));
$sresponse = $this->signatory->sign($response);
$new_assoc_handle = $sresponse->fields->getArg(Auth_OpenID_OPENID_NS,
'assoc_handle');
$this->assertTrue($new_assoc_handle);
$this->assertFalse($new_assoc_handle == $assoc_handle);
$this->assertEquals($sresponse->fields->getArg(Auth_OpenID_OPENID_NS,
'invalidate_handle'),
$assoc_handle);
$this->assertEquals($sresponse->fields->getArg(Auth_OpenID_OPENID_NS,
'signed'),
'assoc_handle,azu,bar,foo,invalidate_handle,signed');
$this->assertTrue($sresponse->fields->hasKey(Auth_OpenID_OPENID_NS,
'sig'));
// make sure the expired association is gone
$this->assertFalse($this->store->getAssociation($this->normal_key,
$assoc_handle));
// make sure the new key is a dumb mode association
$this->assertTrue($this->store->getAssociation($this->dumb_key,
$new_assoc_handle));
$this->assertFalse($this->store->getAssociation($this->normal_key,
$new_assoc_handle));
}
function test_signInvalidHandle()
{
$request = new Auth_OpenID_ServerRequest();
$assoc_handle = '{bogus-assoc}{notvalid}';
$request->assoc_handle = $assoc_handle;
$request->namespace = Auth_OpenID_OPENID1_NS;
$response = new Auth_OpenID_ServerResponse($request);
$response->fields = Auth_OpenID_Message::fromOpenIDArgs(array(
'foo' => 'amsigned',
'bar' => 'notsigned',
'azu' => 'alsosigned'));
$response->signed = array('foo', 'azu');
$sresponse = $this->signatory->sign($response);
$new_assoc_handle = $sresponse->fields->getArg(Auth_OpenID_OPENID_NS,
'assoc_handle');
$this->assertTrue($new_assoc_handle);
$this->assertFalse($new_assoc_handle == $assoc_handle);
$this->assertEquals($sresponse->fields->getArg(Auth_OpenID_OPENID_NS,
'invalidate_handle'),
$assoc_handle);
$this->assertEquals($sresponse->fields->getArg(Auth_OpenID_OPENID_NS,
'signed'),
'assoc_handle,azu,bar,foo,invalidate_handle,signed');
$this->assertTrue($sresponse->fields->hasKey(Auth_OpenID_OPENID_NS,
'sig'));
// make sure the new key is a dumb mode association
$this->assertTrue($this->store->getAssociation($this->dumb_key,
$new_assoc_handle));
$this->assertFalse($this->store->getAssociation($this->normal_key,
$new_assoc_handle));
}
function test_verify()
{
$assoc_handle = '{vroom}{zoom}';
$assoc = Auth_OpenID_Association::fromExpiresIn(60, $assoc_handle,
'sekrit', 'HMAC-SHA1');
$this->store->storeAssociation($this->dumb_key, $assoc);
$signed = Auth_OpenID_Message::fromPostArgs(array(
'openid.foo' => 'bar',
'openid.apple' => 'orange',
'openid.assoc_handle' => $assoc_handle,
'openid.signed' => 'apple,assoc_handle,foo,signed',
'openid.sig' => 'uXoT1qm62/BB09Xbj98TQ8mlBco='));
$verified = $this->signatory->verify($assoc_handle, $signed);
$this->assertTrue($verified);
}
function test_verifyBadSig()
{
$assoc_handle = '{vroom}{zoom}';
$assoc = Auth_OpenID_Association::fromExpiresIn(60, $assoc_handle,
'sekrit', 'HMAC-SHA1');
$this->store->storeAssociation($this->dumb_key, $assoc);
$signed = Auth_OpenID_Message::fromPostArgs(array(
'openid.foo' => 'bar',
'openid.apple' => 'orange',
'openid.assoc_handle' => $assoc_handle,
'openid.signed' => 'apple,assoc_handle,foo,signed',
'openid.sig' => str_rot13('uXoT1qm62/BB09Xbj98TQ8mlBco=')));
$verified = $this->signatory->verify($assoc_handle, $signed);
$this->assertFalse($verified);
}
function test_verifyBadHandle()
{
$assoc_handle = '{vroom}{zoom}';
$signed = Auth_OpenID_Message::fromPostArgs(
array('foo' => 'bar',
'apple' => 'orange',
'openid.sig' => "Ylu0KcIR7PvNegB/K41KpnRgJl0="));
$verified = $this->signatory->verify($assoc_handle, $signed);
$this->assertFalse($verified);
}
function test_verifyAssocMismatch()
{
// Attempt to validate sign-all message with a signed-list
// assoc.
$assoc_handle = '{vroom}{zoom}';
$assoc = Auth_OpenID_Association::fromExpiresIn(
60, $assoc_handle, 'sekrit', 'HMAC-SHA1');
$this->store->storeAssociation($this->dumb_key, $assoc);
$signed = Auth_OpenID_Message::fromPostArgs(array(
'foo' => 'bar',
'apple' => 'orange',
'openid.sig' => "d71xlHtqnq98DonoSgoK/nD+QRM="
));
$verified = $this->signatory->verify($assoc_handle, $signed);
$this->assertFalse($verified);
}
function test_getAssoc()
{
$assoc_handle = $this->makeAssoc(true);
$assoc = $this->signatory->getAssociation($assoc_handle, true);
$this->assertTrue($assoc);
$this->assertEquals($assoc->handle, $assoc_handle);
}
function test_getAssocExpired()
{
$assoc_handle = $this->makeAssoc(true, -10);
$assoc = $this->signatory->getAssociation($assoc_handle, true);
$this->assertFalse($assoc);
}
function test_getAssocInvalid()
{
$ah = 'no-such-handle';
$this->assertEquals(
$this->signatory->getAssociation($ah, false), null);
}
function test_getAssocDumbVsNormal()
{
$assoc_handle = $this->makeAssoc(true);
$this->assertEquals(
$this->signatory->getAssociation($assoc_handle, false), null);
}
function test_createAssociation()
{
$assoc = $this->signatory->createAssociation(false);
$this->assertTrue($this->signatory->getAssociation($assoc->handle,
false));
}
function makeAssoc($dumb, $lifetime = 60)
{
$assoc_handle = '{bling}';
$assoc = Auth_OpenID_Association::fromExpiresIn(
$lifetime, $assoc_handle,
'sekrit', 'HMAC-SHA1');
$this->store->storeAssociation((($dumb) ? $this->dumb_key :
$this->normal_key), $assoc);
return $assoc_handle;
}
function test_invalidate()
{
$assoc_handle = '-squash-';
$assoc = Auth_OpenID_Association::fromExpiresIn(60, $assoc_handle,
'sekrit', 'HMAC-SHA1');
$this->store->storeAssociation($this->dumb_key, $assoc);
$assoc = $this->signatory->getAssociation($assoc_handle, true);
$this->assertTrue($assoc);
$assoc = $this->signatory->getAssociation($assoc_handle, true);
$this->assertTrue($assoc);
$this->signatory->invalidate($assoc_handle, true);
$assoc = $this->signatory->getAssociation($assoc_handle, true);
$this->assertFalse($assoc);
}
}
class Tests_Auth_OpenID_Server extends PHPUnit_Framework_TestSuite {
function getName()
{
return "Tests_Auth_OpenID_Server";
}
function Tests_Auth_OpenID_Server()
{
$this->addTestSuite('Tests_Auth_OpenID_Signatory');
$this->addTestSuite('Tests_Auth_OpenID_ServerTest');
if (!defined('Auth_OpenID_NO_MATH_SUPPORT')) {
$this->addTestSuite('Tests_Auth_OpenID_Associate');
}
$this->addTestSuite('Tests_Auth_OpenID_CheckAuth');
$this->addTestSuite('Tests_Auth_OpenID_CheckIDExtension');
$this->addTestSuite('Tests_Auth_OpenID_CheckAuth');
$this->addTestSuite('Tests_Auth_OpenID_SigningEncode');
$this->addTestSuite('Tests_Auth_OpenID_Test_Encode');
$this->addTestSuite('Tests_Auth_OpenID_Test_Decode');
$this->addTestSuite('Tests_Auth_OpenID_Test_ServerError');
$this->addTestSuite('Tests_Auth_OpenID_CheckID');
}
}
Reference in New Issue View Git Blame Copy Permalink