CL-OpenID

As an alternative to ASDF-Install, a CL-Librarian shelf definition for dependencies is provided. To use it, run following shell commands in CL-OpenID directory:

darcs get http://www.pasternacki.net/repos/cl-librarian/ lib
cd lib
sh bootstrap.sh
cd ..

Then start your favourite Lisp implementation and call:

(load "shelf")
(cl-librarian:download-shelf 'cl-openid.deps) ; for the first time or when new dependency is added
(cl-librarian:use-shelf 'cl-openid.deps) ; when libraries are already downloaded
(asdf:oos 'asdf:load-op :cl-openid)
(asdf:oos 'asdf:test-op :cl-openid) ; run 5am unit tests

Relying Party class.

Name of HTTP GET parameter, sent in return_to URI, which contains AUTH-PROCESS object unique handle.

Initiate authentication process by relying-party for identifier given-id received from user.

If immediate-p is true, initiates immediate authentication process.

The extra-parameters is an optional key-value list to be added to the authentication request message. The list format is the same as for the MAKE-MESSAGE function. This parameter is needed for OpenID extensions, for example OAuth or Attribute Exchange.

Returns multiple values:

• the URI to redirect the user's browser to;
• Unique handle (string) identifying the started authentication process;
• the AUTH-PROCESS structure identified by the handle.

The latter two values are useful if the client code needs to track the process.

Handle indirect response message for relying-party, coming at request-uri, concerning authproc.

authproc can be a literal AUTH-PROCESS object, or a string (unique authproc handle, sent earlier by Relying Party). When authproc is NIL or not supplied, its handle is taken from message field named +AUTHPROC-HANDLE-PARAMETER+.

Returns claimed ID URI on success, NIL on failure. As second value, always returns AUTH-PROCESS object.

Error signaled by Relying Party when indirect response cannot be verified correctly.

Data structure gathering information about an ongoing authentication process.

OpenID Provider server abstract class.

This class should be subclassed, and specialized methods should be provided at least for HANDLE-CHECKID-SETUP (preferably also for HANDLE-CHECKID-IMMEDIATE).

HTTP code used for indirect response redirections.

Handle request message for OpenID Provider instance op.

secure-p should be passed by caller to indicate whether it is secure to use unencrypted association method.

Returns two values: first is body, and second is HTTP code. If second value is not returned, 200 OK HTTP code should be assumed.

On HTTP redirections (second value between 300 and 399 inclusive, actually it will be +INDIRECT-RESPONSE-CODE+), primary returned value will be an URI to redirect user to.

The same rules apply to all *-RESPONSE functions and WITH-INDIRECT-ERROR-HANDLER form return values.

Send cancel (authenticaction failure) response to MESSAGE from OP.

Return successful response to message by op.

Handle INDIRECT-ERROR in body.

When INDIRECT-ERROR condition is signaled, immediately return indirect error response.

Signal INDIRECT-ERROR condition as reply to message, effectively returning indirect error reply from WITH-INDIRECT-ERROR-HANDLER block.

Reason is textual error message format string, with reason-args being its arguments.

Handle checkid_immediate requests.

This generic should be specialized on concrete Provider classes to perform immediate login checks on MESSAGE. It should return at once, either true value (to indicate successful login), or NIL (to indicate immediate login failure).

Default method always fails.

This generic is called within scope of WITH-INDIRECT-ERROR-HANDLER.

URI for user setup to return on failed immediate request.

When NIL is returned, no user_setup_url is sent in setup_needed responses.

This generic should be specialized on concrete Provider classes to provide entry point to user authentication dialogue.

Default method always returns NIL.

Handle checkid_setup requests.

This generic should be specialized on concrete Provider classes to perform login checks with user dialogue, that would (possibly after some HTTP request-response cycles) end in either SUCCESSFUL-RESPONSE, or in CANCEL-RESPONSE.

Default method always fails.

This generic is called within scope of WITH-INDIRECT-ERROR-HANDLER.

Messages passed between OpenID Provider and the Relying Party are composed of key-value pairs. Natural Lisp representation of those, and the one used in CL-OpenID, is an association list. A handful of conveniense function is provided to avoid tweaking messages on cons level.