Additions:
CategoryProjects CategoryPoidsy CategoryPHP
Edited on 2008-02-24 17:02:01 by ChrisSmith
Additions:
Provider details
Implementor-defined functions:- isAuthed(identity, serverInfo)
- doAuth(identity, token, serverInfo)
- continueAuth(token, authed, [sreg info])
- URL - openid.return_to
- realm - trust root/realm, falling back to openid.return_to
- version - OpenID version they're using
- mode - dumb/associate
- associate[since] - the time the server associated
- associate[sessiontype] - encryption used to transmit the MAC key
- associate[hashtype] - the hashing algo used for message verification
- sreg[X] = {optional,required} - any sreg info they've requested
Edited on 2008-02-23 19:56:31 by ChrisSmith
Additions:
| Code | Reason |
| noimmediate | OPENID_IMMEDIATE is set but couldn't perform immediate auth |
| throttled | User is trying to auth too often |
| discovery | There was an error during discovery (down site, protocol not supported, etc) |
| notvalid | The identity entered isn't valid (no openid.server link) |
| nonce | Nonce didn't match - either the user is trying to do a replay attack, or they tried to access an old page |
| diffid | The IdP validated a different identity (= broken provider?) |
| autherror | Error while trying to POST data to authenticate a request in dumb mode |
| noauth | The provider didn't authenticate the signature of the id_res message (or it didn't match the one we were expecting in associate mode) = something's broken or someone's trying one of several attacks |
| cancelled | Provider indicated that the attempt was cancelled |
| perror | Error returned by the provider |
Deletions:
| **Code** | **Reason** |
| noimmediate | OPENID_IMMEDIATE is set but couldn't perform immediate auth |
Edited on 2008-02-23 19:16:32 by ChrisSmith
Additions:
Error Codes
| **Code** | **Reason** |
| noimmediate | OPENID_IMMEDIATE is set but couldn't perform immediate auth |
Edited on 2008-02-23 15:33:44 by ChrisSmith
Additions:
- Spec: V1.1 V2.0
Deletions:
- Spec: http://openid.net/specs/openid-authentication-1_1.html
Edited on 2008-02-22 15:22:20 by ChrisSmith
Additions:
OpenID todo list (edit)
- Add support for D-H key exchange
- Tidy up processor code
- Look at how authentication logic is abstracted
- Tidy up keymanager
- Move D-H processing to association routine
- Tidy up bigmath library
- Revoke all old keys periodically
- Alternate data store
Version 2.0 changes
- Association attempts may fail
- Verify openid.op_endpoint
- Investigate YARIS/XRI stuff
- Realm instead of trust_root
Provider requirements
- Check with user it's ok to continue
- Show as much information about the server as possible (associate/dumb mode, trust root, return url)
- Allow the user to select which (if any) of the sreg details are returned
- Ability to remember both login and sreg details for each server (based on trust root?)
- List of authorised sites (options to revoke auth)
- List of recent sites
- Anti-phishing message on the main page
CategoryPoidsy
Deletions:
TODO
- Build request URL
- Determine current URL and use that for redirection instead of hardcoding
- Download and scrape html pages for openid server/delegate information
- Validate identity responses with provider
- Implement session stuff
- Add support for a db backend for non-dumb mode
- Implement non-dumb node
- Investigate YARIS/XRI stuff
- Add nonce to prevent people reusing the requests
- Validate that the provider doesn't randomly change identity
- Manually request ID page so we can obtain the end ID
- Add neccessary arguments to setup_url
- Throttling to prevent denial of service attacks
- Investigate v2.0 changes
- Support simple registration extension
- Decouple form processing
Edited on 2008-02-22 02:02:43 by ChrisSmith
Additions:
- Decouple form processing
Edited on 2008-02-22 01:50:19 by ChrisSmith
Additions:
- Add nonce to prevent people reusing the requests
Deletions:
- Add nonce to prevent muppets reusing the requests
Edited on 2008-02-22 01:49:35 by ChrisSmith
Additions:
- Simple registration extension: http://openid.net/specs/openid-simple-registration-extension-1_0.html
Edited on 2008-02-21 22:09:47 by ChrisSmith
Additions:
- Throttling to prevent denial of service attacks
Deletions:
- Throttling to prevent DoS attacks
Edited on 2008-02-21 22:05:08 by ChrisSmith
Additions:
- Throttling to prevent DoS attacks
Edited on 2008-02-21 20:17:25 by ChrisSmith
Additions:
- Manually request ID page so we can obtain the end ID
Edited on 2008-02-21 20:11:14 by ChrisSmith
Additions:
- Validate identity responses with provider
Deletions:
- Validate identity responses with provider
Edited on 2008-02-21 19:21:33 by ChrisSmith
Additions:
- Add neccessary arguments to setup_url
Deletions:
- Add neccessary arguments to setup_url
Edited on 2008-02-21 19:13:52 by ChrisSmith
Deletions:
- Check hash in identity responses
Edited on 2008-02-21 19:09:02 by ChrisSmith
Additions:
- Add neccessary arguments to setup_url
Edited on 2008-02-21 18:47:13 by ChrisSmith
Additions:
- Download and scrape html pages for openid server/delegate information
Deletions:
- Download and scrape html pages for openid server/delegate information
Edited on 2008-02-21 18:03:05 by ChrisSmith
Additions:
- Build request URL
Edited on 2008-02-21 18:01:38 by ChrisSmith
Additions:
- Determine current URL and use that for redirection instead of hardcoding
Deletions:
- Determine current URL and use that for redirection instead of hardcoding
Oldest known version of this page was edited on 2008-02-21 18:01:31 by ChrisSmith []
Page view:
OpenID library
TODO
- Determine current URL and use that for redirection instead of hardcoding
- Download and scrape html pages for openid server/delegate information
- Check hash in identity responses
- Validate identity responses with provider
- Implement session stuff (nonce, etc)
- Add support for a db backend for non-dumb mode
- Implement non-dumb node