import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
private void reconnectToMxID() {
	LOG.info("Starting OpenId handler ... OpenIDReturnURL = " + OPENID_RETURN_URL + "; OpenIdProvider: " + OPENID_PROVIDER);
	try {

		manager = new ConsumerManager();
		manager.setAssociations(new InMemoryConsumerAssociationStore());
		manager.setNonceVerifier(new InMemoryNonceVerifier(5000));
		manager.setMinAssocSessEnc(AssociationSessionType.DH_SHA256);
		manager.getRealmVerifier().setEnforceRpId(true);

		discoveries = manager.discover(OPENID_PROVIDER);
		discovered = manager.associate(discoveries);

		started = true;
		LOG.info("Starting OpenId handler ... DONE");

	} catch (DiscoveryException e) {
		LOG.error("Failed to discover OpenId service: " + e.getMessage(), e);
	}
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
public static AssociationError createAssociationError(
        String msg, AssociationSessionType type)
{
    AssociationError err = new AssociationError(msg, type);

    try
    {
        err.validate();
    }
    catch (MessageException e)
    {
        _log.error("Invalid association error message created, " +
                   "type: " + type + " message: " + msg, e);
    }

    return err;
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
public static AssociationRequest createAssociationRequest(
        AssociationSessionType type, DiffieHellmanSession dhSess)
        throws MessageException
{
    AssociationRequest req = new AssociationRequest(type, dhSess);

    // make sure the association / session type matches the dhSess
    if ( type == null ||
            (dhSess == null && type.getHAlgorithm() != null) ||
            (dhSess != null && ! dhSess.getType().equals(type) ) )
        throw new MessageException(
                "Invalid association / session combination specified: " +
                        type + "DH session: " + dhSess);

    req.validate();

    if (DEBUG) _log.debug("Created association request:\n"
                          + req.keyValueFormEncoding());

    return req;
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
@Inject
public ConsumerManager(RealmVerifierFactory realmFactory, Discovery discovery,
    HttpFetcherFactory httpFetcherFactory)
{
    _realmVerifier = realmFactory.getRealmVerifierForConsumer();
    // don't verify own (RP) identity, disable RP discovery
    _realmVerifier.setEnforceRpId(false);

    _discovery = discovery;
    _httpFetcher = httpFetcherFactory.createFetcher(HttpRequestOptions.getDefaultOptionsForOpCalls());

    if (Association.isHmacSha256Supported())
        _prefAssocSessEnc = AssociationSessionType.DH_SHA256;
    else
        _prefAssocSessEnc = AssociationSessionType.DH_SHA1;
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * {@inheritDoc}
 */
public void init(ServletConfig config) throws ServletException {
	super.init(config);

	context = config.getServletContext();

	LOG.debug("context: " + context);

	// --- Forward proxy setup (only if needed) ---
	ProxyProperties proxyProps = getProxyProperties(config);
	if (proxyProps != null) {
		LOG.debug("ProxyProperties: " + proxyProps);
		HttpClientFactory.setProxyProperties(proxyProps);
	}

	this.manager = new ConsumerManager();
	manager.setAssociations(new InMemoryConsumerAssociationStore());
	manager.setNonceVerifier(new InMemoryNonceVerifier(5000));
	manager.setMinAssocSessEnc(AssociationSessionType.DH_SHA256);
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
private void reconnectToMxID() {
	log.info("Starting OpenId handler ... OpenIDReturnURL = " + OpenIDReturnURL + "; OpenIdProvider: " + OPENID_PROVIDER);
	try {

		manager = new ConsumerManager();
		manager.setAssociations(new InMemoryConsumerAssociationStore());
		manager.setNonceVerifier(new InMemoryNonceVerifier(5000));
		manager.setMinAssocSessEnc(AssociationSessionType.DH_SHA256);
		manager.getRealmVerifier().setEnforceRpId(true);

		discoveries = manager.discover(OPENID_PROVIDER);
		discovered = manager.associate(discoveries);

		started = true;
		log.info("Starting OpenId handler ... DONE");

	} catch (Exception e) {
		log.error("Failed to discover OpenId service: " + e.getMessage(), e);
	}
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
public void init(FilterConfig config) throws ServletException {
    super.init(config);
    try 
    {
        this.manager = new ConsumerManager();
    } catch (ConsumerException ex) {
        throw new ServletException(ex);
    }
    manager.setAssociations(new InMemoryConsumerAssociationStore());
    manager.setNonceVerifier(new InMemoryNonceVerifier(5000));
    manager.setMinAssocSessEnc(AssociationSessionType.DH_SHA256);
    manager.setImmediateAuth(true);
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * Constructs an AssociationResponse for a given association request.
 *
 * @param assocReq      The association request that needs to be responded.
 * @param assoc         The association which will be used to sign
 *                      authentication responses.
 */
protected AssociationResponse(AssociationRequest assocReq, Association assoc)
        throws AssociationException
{
    if (DEBUG)
        _log.debug("Creating association response, type: " + assocReq.getType()
                   + " association handle: " + assoc.getHandle());

    if (assocReq.isVersion2()) set("ns", OPENID2_NS);

    AssociationSessionType type = assocReq.getType();
    setType(type);

    setAssocHandle(assoc.getHandle());

    Long expiryIn = new Long( ( assoc.getExpiry().getTime() -
                                System.currentTimeMillis() ) / 1000 );
    setExpire(expiryIn);

    if (type.getHAlgorithm() != null) // DH session, encrypt the MAC key
    {
        DiffieHellmanSession dhSess = DiffieHellmanSession.create(
                type, assocReq.getDhModulus(), assocReq.getDhGen() );

        setPublicKey(dhSess.getPublicKey());

        setMacKeyEnc(dhSess.encryptMacKey(
                assoc.getMacKey().getEncoded(),
                assocReq.getDhPublicKey() ));
    }
    else // no-encryption session, unecrypted MAC key
    {
        setMacKey(new String(
                Base64.encodeBase64(assoc.getMacKey().getEncoded())));
    }
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
protected AssociationError(String msg, AssociationSessionType type)
{
    super(msg);

    set("ns", OPENID2_NS);
    set("error_code", ASSOC_ERR);
    set("session_type", type.getSessionType());
    set("assoc_type", type.getAssociationType());
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * Constructs an AssociationRequest message with the
 * specified association type and Diffie-Hellman session.
 *
 * @param dhSess    Diffie-Hellman session to be used for this association;
 *                  if null, a "no-encryption" session is created.
 */
protected AssociationRequest(AssociationSessionType type,
                             DiffieHellmanSession dhSess)
{
    if (DEBUG)
        _log.debug("Creating association request, type: " + type +
                   "DH session: " + dhSess);

    if (type.isVersion2())
        set("openid.ns", OPENID2_NS);

    set("openid.mode", MODE_ASSOC);
    set("openid.session_type", type.getSessionType());
    set("openid.assoc_type", type.getAssociationType());

    _dhSess = dhSess;

    if (dhSess != null )
    {
        set("openid.dh_consumer_public", _dhSess.getPublicKey());

        // send both diffie-hellman generator and modulus if either are not the default values
        // (this meets v1.1 spec and is compatible with v2.0 spec)

        if (!DiffieHellmanSession.DEFAULT_GENERATOR_BASE64.equals(_dhSess.getGenerator())
                || !DiffieHellmanSession.DEFAULT_MODULUS_BASE64.equals(_dhSess.getModulus()))
        {
            set("openid.dh_gen", _dhSess.getGenerator());
            set("openid.dh_modulus", _dhSess.getModulus());
        }
    }
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * Constructs an Association Request message of the specified session and
 * association type, taking into account the user preferences (encryption
 * level, default Diffie-Hellman parameters).
 *
 * @param type      The type of the association (session and association)
 * @param opUrl    The OP for which the association request is created
 * @return          An AssociationRequest message ready to be sent back
 *                  to the OpenID Provider, or null if an association
 *                  of the requested type cannot be built.
 */
private AssociationRequest createAssociationRequest(
        AssociationSessionType type, URL opUrl)
{
    try
    {
        if (_minAssocSessEnc.isBetter(type))
            return null;

        AssociationRequest assocReq = null;

        DiffieHellmanSession dhSess;
        if (type.getHAlgorithm() != null) // DH session
        {
            dhSess = DiffieHellmanSession.create(type, _dhParams);
            if (DiffieHellmanSession.isDhSupported(type)
                && Association.isHmacSupported(type.getAssociationType()))
                assocReq = AssociationRequest.createAssociationRequest(type, dhSess);
        }

        else if ( opUrl.getProtocol().equals("https") && // no-enc sess
                 Association.isHmacSupported(type.getAssociationType()))
                assocReq = AssociationRequest.createAssociationRequest(type);

        if (assocReq == null)
            _log.warn("Could not create association of type: " + type);

        return assocReq;
    }
    catch (OpenIDException e)
    {
        _log.error("Error trying to create association request.", e);
        return null;
    }
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * Sets the preferred association / session type.
 *
 * @see AssociationSessionType
 */
public void setPrefAssocSessEnc(AssociationSessionType type)
        throws ServerException
{
    if (! Association.isHmacSupported(type.getAssociationType()) ||
        ! DiffieHellmanSession.isDhSupported(type) )
        throw new ServerException("Unsupported association / session type: "
        + type.getSessionType() + " : " + type.getAssociationType());

    if (_minAssocSessEnc.isBetter(type) )
        throw new ServerException(
                "Minimum encryption settings cannot be better than the preferred");

    this._prefAssocSessEnc = type;
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
public void testPerferredAssociation() throws Exception {
	manager.setPrefAssocSessEnc(AssociationSessionType.DH_SHA1);
	DiscoveryInformation disc = new DiscoveryInformation(new URL(server.createAbsoluteUrl("/op/endpoint")), null);
	DiscoveryInformation info = manager.associate(Collections.singletonList(disc));
	assertEquals(1,server.getRequestParams().size());
	Map request = (Map)server.getRequestParams().get(0);
	assertEquals(manager.getPrefAssocSessEnc().getAssociationType(),((String[])request.get("openid.assoc_type"))[0]);
	assertEquals(manager.getPrefAssocSessEnc().getSessionType(),((String[])request.get("openid.session_type"))[0]);
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * Sets the association / session type for the association response.
 */
public void setType(AssociationSessionType type)
{
    set("session_type", type.getSessionType());
    set("assoc_type", type.getAssociationType());
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * Gets the association / session type of the association response.
 *
 * @throws AssociationException
 */
public AssociationSessionType getType() throws AssociationException
{
    return AssociationSessionType.create(
            getSessionType(), getAssociationType(), ! isVersion2() );
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * Checks if the message is a valid OpenID Association Response..
 *
 * @throws MessageException if message validation failed.
 */
public void validate() throws MessageException
{
    // basic checks
    super.validate();

    // association / session type checks
    // (includes most of the compatibility stuff)
    AssociationSessionType type;
    try
    {
        // throws exception for invalid session / association types
        type = getType();

        // make sure compatibility mode is the same for type and message
        if (type.isVersion2() ^ isVersion2())
        {
            throw new MessageException(
                "Protocol verison mismatch between association " +
                "session type: " + type +
                " and AssociationResponse message type.",
                OpenIDException.ASSOC_ERROR);
        }

    }
    catch (AssociationException e)
    {
        throw new MessageException(
            "Error verifying association response validity.",
            OpenIDException.ASSOC_ERROR, e);
    }

    // additional compatibility checks
    if (! isVersion2() && getAssociationType() == null)
    {
        throw new MessageException(
            "assoc_type cannot be omitted in OpenID1 responses",
            OpenIDException.ASSOC_ERROR);
    }

    String macKey;
    if (type.getHAlgorithm() != null) // DH session
    {
        if ( ! hasParameter("dh_server_public") ||
                ! hasParameter("enc_mac_key") )
        {
            throw new MessageException(
                "DH public key or encrypted MAC key missing.",
                OpenIDException.ASSOC_ERROR);
        }
        else
            macKey = getParameterValue("enc_mac_key");
    } else // no-enc session
    {
        if ( !hasParameter("mac_key") )
        {
            throw new MessageException("Missing MAC key.",
                OpenIDException.ASSOC_ERROR);
        }
        else
            macKey = getParameterValue("mac_key");
    }

    // mac key size
    int macSize = Base64.decodeBase64(macKey.getBytes()).length * 8;

    if ( macSize != type.getKeySize())
    {
        throw new MessageException("MAC key size: " + macSize +
            " doesn't match the association/session type: " + type,
            OpenIDException.ASSOC_ERROR);
    }
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * Generates an Association object from an Association Response.
 *
 * @param dhSess        The Diffie-Helman session containing the private key
 *                      used to encrypt / decrypt the MAC key exchange.
 *                      Should be null for no-encryption sessions.
 */
public Association getAssociation(DiffieHellmanSession dhSess)
        throws AssociationException
{
    if (DEBUG) _log.debug("Retrieving MAC key from association response...");

    String handle = getParameterValue("assoc_handle");
    int expiresIn = Integer.parseInt(
            getParameterValue("expires_in") );

    // get (and decrypt) the MAC key
    byte[] macKey;

    AssociationSessionType type = getType();

    if ( type.getHAlgorithm() != null )
    {
        macKey = dhSess.decryptMacKey(
                getParameterValue("enc_mac_key"),
                getParameterValue("dh_server_public") );
        if (DEBUG) _log.debug("Decrypted MAC key (base64): " +
                              new String(Base64.encodeBase64(macKey)));
    }
    else
    {
        macKey = Base64.decodeBase64(
                getParameterValue("mac_key").getBytes() );

        if (DEBUG) _log.debug("Unencrypted MAC key (base64): "
                              + getParameterValue("mac_key"));
    }

    Association assoc;

    if (Association.TYPE_HMAC_SHA1.equals(type.getAssociationType()))
        assoc = Association.createHmacSha1(handle, macKey, expiresIn);

    else if (Association.TYPE_HMAC_SHA256.equals(type.getAssociationType()))
        assoc = Association.createHmacSha256(handle, macKey, expiresIn);

    else
        throw new AssociationException("Unknown association type: " + type);

    if (DEBUG) _log.debug("Created association for handle: " + handle);

    return assoc;
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
public void setAssociationSessionType(AssociationSessionType type)
{
    set("session_type", type.getSessionType());
    set("assoc_type", type.getAssociationType());
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * Gets the association / session type of the association request.
 *
 * @throws AssociationException
 */
public AssociationSessionType getType() throws AssociationException
{
    return AssociationSessionType.create(
            getSessionType(), getAssociationType(), ! isVersion2() );
}
 

import org.openid4java.association.AssociationSessionType; //导入依赖的package包/类
/**
 * Checks if the message is a valid OpenID Association Request.
 *
 * @throws MessageException if message validation failed.
 */
public void validate() throws MessageException
{
    // basic checks
    super.validate();

    // association / session type checks
    // (includes most of the compatibility stuff)
    AssociationSessionType type;
    try
    {
        // throws exception for invalid session / association types
        type = getType();

        // make sure compatibility mode is the same for type and message
        if (type.isVersion2() != isVersion2())
        {
            throw new MessageException("Protocol verison mismatch " +
                "between association session type: " + type +
                " and AssociationRequest message type.",
                OpenIDException.ASSOC_ERROR);
        }

    }
    catch (AssociationException e)
    {
        throw new MessageException(
            "Error verifying association request validity.",
            OpenIDException.ASSOC_ERROR, e);
    }

    // additional compatibility checks
    if (! isVersion2() && getSessionType() == null)
    {
        throw new MessageException(
            "sess_type cannot be omitted in OpenID1 association requests",
            OpenIDException.ASSOC_ERROR);
    }

    // DH seesion parameters
    if ( type.getHAlgorithm() != null && getDhPublicKey() == null)
    {
        throw new MessageException("DH consumer public key not specified.",
            OpenIDException.ASSOC_ERROR);
    }

    // no-enc session
    if (type.getHAlgorithm() == null && (getDhGen() != null ||
            getDhModulus() != null || getDhPublicKey() != null) )
    {
        throw new MessageException(
            "No-encryption session, but DH parameters specified.",
            OpenIDException.ASSOC_ERROR);
    }
}