2012-11-17 21:13:44 +00:00
|
|
|
<?php
|
2012-11-21 11:10:57 +00:00
|
|
|
/**
|
|
|
|
* OAuth
|
|
|
|
*
|
|
|
|
* @package OAuth
|
|
|
|
* @author Andy Smith
|
|
|
|
* @author Gary Jones <gary@garyjones.co.uk>
|
2013-02-08 10:32:26 +00:00
|
|
|
* @license https://raw.github.com/jacobkiers/OAuth/master/LICENSE MIT
|
|
|
|
* @link https://github.com/jacobkiers/OAuth
|
2012-11-21 11:10:57 +00:00
|
|
|
*/
|
|
|
|
|
2013-02-11 14:02:14 +00:00
|
|
|
namespace JacobKiers\OAuth\SignatureMethod;
|
|
|
|
|
|
|
|
use \JacobKiers\OAuth\Consumer\ConsumerInterface;
|
|
|
|
use \JacobKiers\OAuth\Token\TokenInterface;
|
|
|
|
use \JacobKiers\OAuth\Request\RequestInterface;
|
2012-11-17 21:13:44 +00:00
|
|
|
|
|
|
|
/**
|
2012-11-21 11:10:57 +00:00
|
|
|
* The RSA-SHA1 signature method.
|
|
|
|
*
|
2012-11-17 21:13:44 +00:00
|
|
|
* The RSA-SHA1 signature method uses the RSASSA-PKCS1-v1_5 signature algorithm as defined in
|
|
|
|
* [RFC3447] section 8.2 (more simply known as PKCS#1), using SHA-1 as the hash function for
|
2013-02-11 14:02:14 +00:00
|
|
|
* EMSA-PKCS1-v1_5. It is assumed that the Consumer has provided its RSA public key in a
|
2012-11-17 21:13:44 +00:00
|
|
|
* verified way to the Service Provider, in a manner which is beyond the scope of this
|
|
|
|
* specification.
|
|
|
|
* - Chapter 9.3 ("RSA-SHA1")
|
2012-11-21 11:10:57 +00:00
|
|
|
*
|
|
|
|
* @package OAuth
|
|
|
|
* @author Andy Smith
|
2012-11-17 21:13:44 +00:00
|
|
|
*/
|
|
|
|
abstract class RsaSha1 extends SignatureMethod
|
|
|
|
{
|
2012-11-21 11:10:57 +00:00
|
|
|
/**
|
|
|
|
* Return the name of the Signature Method.
|
|
|
|
*
|
|
|
|
* @return string
|
|
|
|
*/
|
2012-11-17 21:13:44 +00:00
|
|
|
public function getName()
|
|
|
|
{
|
2012-11-22 16:27:47 +00:00
|
|
|
return 'RSA-SHA1';
|
2012-11-17 21:13:44 +00:00
|
|
|
}
|
|
|
|
|
2012-11-21 11:10:57 +00:00
|
|
|
/**
|
|
|
|
* Up to the SP to implement this lookup of keys. Possible ideas are:
|
2013-02-11 14:02:14 +00:00
|
|
|
* (1) do a lookup in a table of trusted certs keyed off of consumer
|
2012-11-21 11:10:57 +00:00
|
|
|
* (2) fetch via http using a url provided by the requester
|
|
|
|
* (3) some sort of specific discovery code based on request
|
|
|
|
*
|
|
|
|
* Either way should return a string representation of the certificate
|
|
|
|
*
|
|
|
|
*/
|
2012-11-17 21:13:44 +00:00
|
|
|
abstract protected function fetchPublicCert(&$request);
|
|
|
|
|
2012-11-21 11:10:57 +00:00
|
|
|
/**
|
|
|
|
* Up to the SP to implement this lookup of keys. Possible ideas are:
|
2013-02-11 14:02:14 +00:00
|
|
|
* (1) do a lookup in a table of trusted certs keyed off of consumer
|
2012-11-21 11:10:57 +00:00
|
|
|
*
|
|
|
|
* Either way should return a string representation of the certificate
|
|
|
|
*/
|
2012-11-17 21:13:44 +00:00
|
|
|
abstract protected function fetchPrivateCert(&$request);
|
|
|
|
|
2012-11-21 11:10:57 +00:00
|
|
|
/**
|
|
|
|
* Build up the signature.
|
|
|
|
*
|
2013-02-11 14:02:14 +00:00
|
|
|
* @param JacobKiers\OAuth\Request\RequestInterface $request
|
|
|
|
* @param JacobKiers\OAuth\Consumer\ConsumerInterface $consumer
|
|
|
|
* @param JacobKiers\OAuth\Token\TokenInterface $token
|
2012-11-21 11:10:57 +00:00
|
|
|
*
|
|
|
|
* @return string
|
|
|
|
*/
|
2013-02-11 14:02:14 +00:00
|
|
|
public function buildSignature(RequestInterface $request, ConsumerInterface $consumer, TokenInterface $token = null)
|
2012-11-17 21:13:44 +00:00
|
|
|
{
|
2013-02-08 10:57:53 +00:00
|
|
|
$base_string = $request->getOAuthSignatureBaseString();
|
2012-11-17 21:13:44 +00:00
|
|
|
|
|
|
|
// Fetch the private key cert based on the request
|
|
|
|
$cert = $this->fetchPrivateCert($request);
|
|
|
|
|
|
|
|
// Pull the private key ID from the certificate
|
|
|
|
$privatekeyid = openssl_get_privatekey($cert);
|
|
|
|
|
|
|
|
// Sign using the key
|
|
|
|
$ok = openssl_sign($base_string, $signature, $privatekeyid);
|
|
|
|
|
|
|
|
// Release the key resource
|
|
|
|
openssl_free_key($privatekeyid);
|
|
|
|
|
|
|
|
return base64_encode($signature);
|
|
|
|
}
|
|
|
|
|
2012-11-21 11:10:57 +00:00
|
|
|
/**
|
|
|
|
* Verifies that a given signature is correct.
|
|
|
|
*
|
2013-02-11 14:02:14 +00:00
|
|
|
* @param JacobKiers\OAuth\Request\RequestInterface $request
|
|
|
|
* @param JacobKiers\OAuth\Consumer\ConsumerInterface $consumer
|
|
|
|
* @param JacobKiers\OAuth\Token\TokenInterface $token
|
|
|
|
* @param string $signature
|
2012-11-21 11:10:57 +00:00
|
|
|
*
|
|
|
|
* @return bool
|
|
|
|
*/
|
2013-02-11 14:02:14 +00:00
|
|
|
public function checkSignature(RequestInterface $request, ConsumerInterface $consumer, TokenInterface $token, $signature)
|
2012-11-17 21:13:44 +00:00
|
|
|
{
|
2013-02-08 10:57:53 +00:00
|
|
|
$base_string = $request->getOAuthSignatureBaseString();
|
2012-11-17 21:13:44 +00:00
|
|
|
|
2012-11-21 11:10:57 +00:00
|
|
|
$decoded_sig = base64_decode($signature);
|
|
|
|
|
2012-11-17 21:13:44 +00:00
|
|
|
// Fetch the public key cert based on the request
|
|
|
|
$cert = $this->fetchPublicCert($request);
|
|
|
|
|
|
|
|
// Pull the public key ID from the certificate
|
|
|
|
$publickeyid = openssl_get_publickey($cert);
|
|
|
|
|
|
|
|
// Check the computed signature against the one passed in the query
|
|
|
|
$ok = openssl_verify($base_string, $decoded_sig, $publickeyid);
|
|
|
|
|
|
|
|
// Release the key resource
|
|
|
|
openssl_free_key($publickeyid);
|
|
|
|
|
|
|
|
return $ok == 1;
|
|
|
|
}
|
|
|
|
}
|