// we're only interested if this is a successful auth response.
if (!"id_res".equals(authResponse.getParameterValue("openid.mode"))) {
return null;
}
AuthSuccess authResp = AuthSuccess.createAuthSuccess(authResponse);
// also, if the auth response isn't well-formed, we're not bothering with
// the discovery. The consumer manager will reject this later on.
if (authResp == null || ! authResp.isVersion2() ||
authResp.getIdentity() == null || authResp.getClaimed() == null) {
return null;
}
// asserted identifier in the AuthResponse
String assertId = authResp.getIdentity();
// claimed identifier in the AuthResponse, without fragment
Identifier respClaimed =
consumerManager.getDiscovery().parseIdentifier(authResp.getClaimed(), true);
// the OP endpoint sent in the response
String respEndpoint = authResp.getOpEndpoint();
// now let's check whether we already have new-style discovery information
// for this claimed id
if ((discovered instanceof SecureDiscoveryInformation) // implies non-null
&& discovered.hasClaimedIdentifier()
&& discovered.getClaimedIdentifier().equals(respClaimed)) {
// OP-endpoint, OP-specific ID and protocol version must match
String opSpecific = discovered.hasDelegateIdentifier()
? discovered.getDelegateIdentifier()
: discovered.getClaimedIdentifier().getIdentifier();
if (opSpecific.equals(assertId)
&& discovered.isVersion2()
&& discovered.getOPEndpoint().toString().equals(respEndpoint)) {
return (SecureDiscoveryInformation) discovered;
}
}
// ok, the discovery information provided was either not new-style,
// or didn't match the auth response.
// perform discovery on the claimed identifier in the assertion
@SuppressWarnings("unchecked")
List<SecureDiscoveryInformation> discoveries =
consumerManager.getDiscovery().discover(respClaimed);
SecureDiscoveryInformation firstServiceMatch = null;
// find the newly discovered service endpoint that matches the assertion
// - OP endpoint, OP-specific ID and protocol version must match
// - prefer (first = highest priority) endpoint with an association
for (SecureDiscoveryInformation service : discoveries) {
if (DiscoveryInformation.OPENID2_OP.equals(service.getVersion())) {
continue;
}
String opSpecific = service.hasDelegateIdentifier()
? service.getDelegateIdentifier()
: service.getClaimedIdentifier().getIdentifier();
if (!opSpecific.equals(assertId)
|| !service.isVersion2()
|| !service.getOPEndpoint().toString().equals(respEndpoint)) {
continue;
}
// keep the first endpoint that matches
if (firstServiceMatch == null) {
firstServiceMatch = service;
}
// we'll keep looking for a service for which we already have an
// association. Only if we don't find any do we return the first match
Association assoc = consumerManager.getPrivateAssociationStore().load(
service.getOPEndpoint().toString(),
authResp.getHandle());
// don't look further if there is an association with this endpoint
if (assoc != null) {
return service;
}