protected function verify()
    {
        # Firstly, we need to make sure that there's an association.
        # Otherwise the verification will fail, 
        # because we've signed assoc_handle in the assertion
        if(empty($this->assoc)) {
            return false;
        }
        
        # Next, we check that it's a private association, 
        # i.e. one made without RP input.
        # Otherwise, the RP shouldn't ask us to verify.
        if(empty($this->assoc['private'])) {
            return false;
        }
        
        # Now we have to check if the nonce is correct, to prevent replay attacks.
        if($this->data['openid_response_nonce'] != $this->assoc['nonce']) {
            return false;
        }
        
        # Getting the signed fields for signature.
        $sig = array();
        $signed = explode(',', $this->data['openid_signed']);
        foreach($signed as $field) {
            $name = strtr($field, '.', '_');
            if(!isset($this->data['openid_' . $name])) {
                return false;
            }
            
            $sig[$field] = $this->data['openid_' . $name];
        }
        
        # Computing the signature and checking if it matches.
        $sig = $this->keyValueForm($sig);
        if ($this->data['openid_sig'] != 
            base64_encode(hash_hmac($this->assoc['hash'], $sig, $this->assoc['mac'], true))
        ) {
            return false;
        }
        
        # Clearing the nonce, so that it won't be used again.
        $this->assoc['nonce'] = null;
        
        if(empty($this->assoc['private'])) {
            # Commiting changes to the association.
            $this->setAssoc($this->assoc['handle'], $this->assoc);
        } else {
            # Private associations shouldn't be used again, se we can as well delete them.
            $this->delAssoc($this->assoc['handle']);
        }
        
        # Nothing has failed, so the verification was a success.
        return true;
    }
protected function verify()
    {
        # Firstly, we need to make sure that there's an association.
        # Otherwise the verification will fail, 
        # because we've signed assoc_handle in the assertion
        if(empty($this->assoc)) {
            return false;
        }
        
        # Next, we check that it's a private association, 
        # i.e. one made without RP input.
        # Otherwise, the RP shouldn't ask us to verify.
        if(empty($this->assoc['private'])) {
            return false;
        }
        
        # Now we have to check if the nonce is correct, to prevent replay attacks.
        if($this->data['openid_response_nonce'] != $this->assoc['nonce']) {
            return false;
        }
        
        # Getting the signed fields for signature.
        $sig = array();
        $signed = explode(',', $this->data['openid_signed']);
        foreach($signed as $field) {
            $name = strtr($field, '.', '_');
            if(!isset($this->data['openid_' . $name])) {
                return false;
            }
            
            $sig[$field] = $this->data['openid_' . $name];
        }
        
        # Computing the signature and checking if it matches.
        $sig = $this->keyValueForm($sig);
        if ($this->data['openid_sig'] != 
            base64_encode(hash_hmac($this->assoc['hash'], $sig, $this->assoc['mac'], true))
        ) {
            return false;
        }
        
        # Clearing the nonce, so that it won't be used again.
        $this->assoc['nonce'] = null;
        
        if(empty($this->assoc['private'])) {
            # Commiting changes to the association.
            $this->setAssoc($this->assoc['handle'], $this->assoc);
        } else {
            # Private associations shouldn't be used again, se we can as well delete them.
            $this->delAssoc($this->assoc['handle']);
        }
        
        # Nothing has failed, so the verification was a success.
        return true;
    }
protected function verify ( ) { # Firstly, we need to make sure that there's an association. # Otherwise the verification will fail,  # because we've signed assoc_handle in the assertion if ( empty ( $ this -> assoc ) ) { return false ; } # Next, we check that it's a private association,  # i.e. one made without RP input. # Otherwise, the RP shouldn't ask us to verify. if ( empty ( $ this -> assoc [ 'private' ] ) ) { return false ; } # Now we have to check if the nonce is correct, to prevent replay attacks. if ( $ this -> data [ 'openid_response_nonce' ] != $ this -> assoc [ 'nonce' ] ) { return false ; } # Getting the signed fields for signature. $ sig = array ( ) ; $ signed = explode ( ',' , $ this -> data [ 'openid_signed' ] ) ; foreach ( $ signed as $ field ) { $ name = strtr ( $ field , '.' , '_' ) ; if ( ! isset ( $ this -> data [ 'openid_' . $ name ] ) ) { return false ; } $ sig [ $ field ] = $ this -> data [ 'openid_' . $ name ] ; } # Computing the signature and checking if it matches. $ sig = $ this -> keyValueForm ( $ sig ) ; if ( $ this -> data [ 'openid_sig' ] != base64_encode ( hash_hmac ( $ this -> assoc [ 'hash' ] , $ sig , $ this -> assoc [ 'mac' ] , true ) ) ) { return false ; } # Clearing the nonce, so that it won't be used again. $ this -> assoc [ 'nonce' ] = null ; if ( empty ( $ this -> assoc [ 'private' ] ) ) { # Commiting changes to the association. $ this -> setAssoc ( $ this -> assoc [ 'handle' ] , $ this -> assoc ) ; } else { # Private associations shouldn't be used again, se we can as well delete them. $ this -> delAssoc ( $ this -> assoc [ 'handle' ] ) ; } # Nothing has failed, so the verification was a success. return true ; }
Aids an RP in assertion verification.
@return bool Information whether the verification suceeded.
Aids an RP in assertion verification .