Class: OpenID::Server::CheckIDRequest

Class | OpenID::Server::CheckIDRequest
In: | lib/openid/server.rb
Parent: | OpenIDRequest

A request to confirm the identity of a user.

This class handles requests for openid modes `checkid_immediate` and `checkid_setup` .

### Methods

answer cancel_url encode_to_url from_message id_select new return_to_verified to_s trust_root_valid

### Attributes

assoc_handle | [RW] | Provided in smart mode requests, a handle for a previously established association. nil for dumb mode requests.
claimed_id | [RW] | The claimed identifier. Not present in OpenID 1.x messages.
identity | [RW] | The OP-local identifier being checked.
immediate | [RW] | Is this an immediate-mode request?
mode | [RW] |
mode: | `checkid_immediate` or `checkid_setup`
op_endpoint | [RW] |
return_to | [RW] | The URL to send the user agent back to to reply to this request.
trust_root | [RW] | This URL identifies the party making the request, and the user will use that to make her decision about what answer she trusts them to have. Referred to as "realm" in OpenID 2.0.

### Public Class methods

from_message(message, op_endpoint)

Construct me from an OpenID message.

message: | An OpenID checkid_* request Message
op_endpoint: | The endpoint URL of the server that this message was sent to.

Raises:

ProtocolError: | When not all required parameters are present in the message.
MalformedReturnURL: | When the `return_to` URL is not a URL.
UntrustedReturnURL: | When the `return_to` URL is outside the `trust_root`.

new(identity, return_to, op_endpoint, trust_root=nil, immediate=false, assoc_handle=nil)

These parameters are assigned directly as attributes, see the CheckIDRequest class documentation for their descriptions.

Raises MalformedReturnURL when the `return_to` URL is not a URL.

### Public Instance methods

answer(allow, server_url=nil, identity=nil, claimed_id=nil)

Respond to this request.

allow: | Allow this user to claim this identity, and allow the consumer to have this information?
server_url: | DEPRECATED. Passing op_endpoint to the Server constructor makes this optional. When an OpenID 1.x immediate mode request does not succeed, it gets back a URL where the request may be carried out in a not-so-immediate fashion. Pass my URL in here (the fully qualified address of this server‘s endpoint, i.e. `example.com/server`), and I will use it as a base for the URL for a new request. Optional for requests where CheckIDRequest.immediate is false or `allow` is true.
identity: | The OP-local identifier to answer with. Only for use when the relying party requested identifier selection.
claimed_id: | The claimed identifier to answer with, for use with identifier selection in the case where the claimed identifier and the OP-local identifier differ, i.e. when the claimed_id uses delegation. If `identity` is provided but this is not, `claimed_id` will default to the value of `identity`. When answering requests that did not ask for identifier selection, the response `claimed_id` will default to that of the request. This parameter is new in OpenID 2.0.

Returns an OpenIDResponse object containing a OpenID id_res message.

Raises NoReturnToError if the return_to is missing.

Version 2.0 deprecates `server_url` and adds `claimed_id`.

cancel_url()
encode_to_url(server_url)
id_select()

Is the identifier to be selected by the IDP?

return_to_verified()

Does the relying party publish the return_to URL for this response under the realm? It is up to the provider to set a policy for what kinds of realms should be allowed. This return_to URL verification reduces vulnerability to data-theft attacks based on open proxies, corss-site-scripting, or open redirectors.

This check should only be performed after making sure that the return_to URL matches the realm.

Raises DiscoveryFailure if the realm URL does not support Yadis discovery (and so does not support the verification process).

Returns true if the realm publishes a document with the return_to URL listed

to_s()
trust_root_valid()

Is my return_to under my trust_root?

[Validate]