Class to represent an OAuth Server. More...

Collaboration diagram for IMSGlobal\LTI\OAuth\OAuthServer:

Public Member Functions
	__construct ($data_store)

	add_signature_method ($signature_method)

	fetch_request_token (&$request)
	process a request_token request returns the request token on success More...

	fetch_access_token (&$request)
	process an access_token request returns the access token on success More...

	verify_request (&$request)
	verify an api call, checks all the parameters More...

Protected Attributes
	$timestamp_threshold = 300

	$version = '1.0'

	$signature_methods = array()

	$data_store

Private Member Functions
	get_version (&$request)
	version 1 More...

	get_signature_method ($request)
	figure out the signature with some defaults More...

	get_consumer ($request)
	try to find the consumer for the provided request's consumer key More...

	get_token ($request, $consumer, $token_type="access")
	try to find the token for the provided request's token key More...

	check_signature ($request, $consumer, $token)
	all-in-one function to check the signature on a request should guess the signature method appropriately More...

	check_timestamp ($timestamp)
	check that the timestamp is new enough More...

	check_nonce ($consumer, $token, $nonce, $timestamp)
	check that the nonce is not repeated More...

Detailed Description

Class to represent an OAuth Server.

Copyright: Andy Smith

Version: 2008-08-04 @license https://opensource.org/licenses/MIT The MIT License

Definition at line 12 of file OAuthServer.php.

Constructor & Destructor Documentation

◆ __construct()

IMSGlobal\LTI\OAuth\OAuthServer::__construct ( $data_store )

Definition at line 20 of file OAuthServer.php.

                                      {
        $this->data_store = $data_store;
    }

References IMSGlobal\LTI\OAuth\OAuthServer\$data_store.

Member Function Documentation

◆ add_signature_method()

IMSGlobal\LTI\OAuth\OAuthServer::add_signature_method ( $signature_method )

Definition at line 24 of file OAuthServer.php.

                                                            {
        $this->signature_methods[$signature_method->get_name()] = $signature_method;
    }

◆ check_nonce()

IMSGlobal\LTI\OAuth\OAuthServer::check_nonce	(	$consumer,
		$token,
		$nonce,
		$timestamp
	)

private

check that the nonce is not repeated

Definition at line 220 of file OAuthServer.php.

                                                                        {
 
        if(!$nonce)
          throw new OAuthException('Missing nonce parameter. The parameter is required');
 
        // verify that the nonce is uniqueish
        $found = $this->data_store->lookup_nonce($consumer, $token, $nonce, $timestamp);
        if ($found) {
            throw new OAuthException("Nonce already used: $nonce");
        }
 
    }

References $timestamp, and PHPMailer\PHPMailer\$token.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\check_signature().

Here is the caller graph for this function:

◆ check_signature()

IMSGlobal\LTI\OAuth\OAuthServer::check_signature	(	$request,
		$consumer,
		$token
	)

private

all-in-one function to check the signature on a request should guess the signature method appropriately

Definition at line 179 of file OAuthServer.php.

                                                                  {
 
        // this should probably be in a different method
        $timestamp = $request instanceof OAuthRequest
            ? $request->get_parameter('oauth_timestamp')
            : NULL;
        $nonce = $request instanceof OAuthRequest
            ? $request->get_parameter('oauth_nonce')
            : NULL;
 
        $this->check_timestamp($timestamp);
        $this->check_nonce($consumer, $token, $nonce, $timestamp);
 
        $signature_method = $this->get_signature_method($request);
 
        $signature = $request->get_parameter('oauth_signature');
        $valid_sig = $signature_method->check_signature($request, $consumer, $token, $signature);
 
        if (!$valid_sig) {
            throw new OAuthException('Invalid signature');
        }
    }

References $request, $timestamp, PHPMailer\PHPMailer\$token, IMSGlobal\LTI\OAuth\OAuthServer\check_nonce(), IMSGlobal\LTI\OAuth\OAuthServer\check_timestamp(), and IMSGlobal\LTI\OAuth\OAuthServer\get_signature_method().

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\fetch_access_token(), IMSGlobal\LTI\OAuth\OAuthServer\fetch_request_token(), and IMSGlobal\LTI\OAuth\OAuthServer\verify_request().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ check_timestamp()

IMSGlobal\LTI\OAuth\OAuthServer::check_timestamp ( $timestamp )

private

check that the timestamp is new enough

Definition at line 205 of file OAuthServer.php.

                                                 {
        if(!$timestamp)
            throw new OAuthException('Missing timestamp parameter. The parameter is required');
 
        // verify that timestamp is recentish
        $now = time();
        if (abs($now - $timestamp) > $this->timestamp_threshold) {
            throw new OAuthException("Expired timestamp, yours $timestamp, ours $now");
        }
 
    }

References $timestamp.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\check_signature().

Here is the caller graph for this function:

◆ fetch_access_token()

IMSGlobal\LTI\OAuth\OAuthServer::fetch_access_token ( & $request )

process an access_token request returns the access token on success

Definition at line 57 of file OAuthServer.php.

                                                  {
 
        $this->get_version($request);
 
        $consumer = $this->get_consumer($request);
 
        // requires authorized request token
        $token = $this->get_token($request, $consumer, "request");
 
        $this->check_signature($request, $consumer, $token);
 
        // Rev A change
        $verifier = $request->get_parameter('oauth_verifier');
        $new_token = $this->data_store->new_access_token($token, $consumer, $verifier);
 
        return $new_token;
 
    }

References $request, PHPMailer\PHPMailer\$token, IMSGlobal\LTI\OAuth\OAuthServer\check_signature(), IMSGlobal\LTI\OAuth\OAuthServer\get_consumer(), IMSGlobal\LTI\OAuth\OAuthServer\get_token(), and IMSGlobal\LTI\OAuth\OAuthServer\get_version().

Here is the call graph for this function:

◆ fetch_request_token()

IMSGlobal\LTI\OAuth\OAuthServer::fetch_request_token ( & $request )

process a request_token request returns the request token on success

Definition at line 34 of file OAuthServer.php.

                                                   {
 
        $this->get_version($request);
 
        $consumer = $this->get_consumer($request);
 
        // no token required for the initial token request
        $token = NULL;
 
        $this->check_signature($request, $consumer, $token);
 
        // Rev A change
        $callback = $request->get_parameter('oauth_callback');
        $new_token = $this->data_store->new_request_token($consumer, $callback);
 
        return $new_token;
 
    }

References $request, PHPMailer\PHPMailer\$token, IMSGlobal\LTI\OAuth\OAuthServer\check_signature(), IMSGlobal\LTI\OAuth\OAuthServer\get_consumer(), and IMSGlobal\LTI\OAuth\OAuthServer\get_version().

Here is the call graph for this function:

◆ get_consumer()

IMSGlobal\LTI\OAuth\OAuthServer::get_consumer ( $request )

private

try to find the consumer for the provided request's consumer key

Definition at line 140 of file OAuthServer.php.

                                            {
 
        $consumer_key = $request instanceof OAuthRequest
            ? $request->get_parameter('oauth_consumer_key') : NULL;
 
        if (!$consumer_key) {
            throw new OAuthException('Invalid consumer key');
        }
 
        $consumer = $this->data_store->lookup_consumer($consumer_key);
        if (!$consumer) {
            throw new OAuthException('Invalid consumer');
        }
 
        return $consumer;
 
    }

References $request.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\fetch_access_token(), IMSGlobal\LTI\OAuth\OAuthServer\fetch_request_token(), and IMSGlobal\LTI\OAuth\OAuthServer\verify_request().

Here is the caller graph for this function:

◆ get_signature_method()

IMSGlobal\LTI\OAuth\OAuthServer::get_signature_method ( $request )

private

figure out the signature with some defaults

Definition at line 113 of file OAuthServer.php.

                                                    {
 
        $signature_method = $request instanceof OAuthRequest
            ? $request->get_parameter('oauth_signature_method') : NULL;
 
        if (!$signature_method) {
            // According to chapter 7 ("Accessing Protected Ressources") the signature-method
            // parameter is required, and we can't just fallback to PLAINTEXT
            throw new OAuthException('No signature method parameter. This parameter is required');
        }
 
        if (!in_array($signature_method,
                      array_keys($this->signature_methods))) {
            throw new OAuthException(
              "Signature method '$signature_method' not supported " .
              'try one of the following: ' .
              implode(', ', array_keys($this->signature_methods))
            );
        }
 
        return $this->signature_methods[$signature_method];
 
    }

References $request.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\check_signature().

Here is the caller graph for this function:

◆ get_token()

IMSGlobal\LTI\OAuth\OAuthServer::get_token	(	$request,
		$consumer,
		$token_type = `"access"`
	)

private

try to find the token for the provided request's token key

Definition at line 161 of file OAuthServer.php.

                                                                          {
 
        $token_field = $request instanceof OAuthRequest
             ? $request->get_parameter('oauth_token') : NULL;
 
        $token = $this->data_store->lookup_token($consumer, $token_type, $token_field);
        if (!$token) {
            throw new OAuthException("Invalid $token_type token: $token_field");
        }
 
        return $token;
 
    }

References $request, and PHPMailer\PHPMailer\$token.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\fetch_access_token(), and IMSGlobal\LTI\OAuth\OAuthServer\verify_request().

Here is the caller graph for this function:

◆ get_version()

IMSGlobal\LTI\OAuth\OAuthServer::get_version ( & $request )

private

version 1

Definition at line 94 of file OAuthServer.php.

                                            {
 
        $version = $request->get_parameter("oauth_version");
        if (!$version) {
            // Service Providers MUST assume the protocol version to be 1.0 if this parameter is not present.
            // Chapter 7.0 ("Accessing Protected Ressources")
            $version = '1.0';
        }
        if ($version !== $this->version) {
            throw new OAuthException("OAuth version '$version' not supported");
        }
 
        return $version;
 
    }

References $request, and IMSGlobal\LTI\OAuth\OAuthServer\$version.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\fetch_access_token(), IMSGlobal\LTI\OAuth\OAuthServer\fetch_request_token(), and IMSGlobal\LTI\OAuth\OAuthServer\verify_request().

Here is the caller graph for this function:

◆ verify_request()

IMSGlobal\LTI\OAuth\OAuthServer::verify_request ( & $request )

verify an api call, checks all the parameters

Definition at line 79 of file OAuthServer.php.

                                              {
 
        $this->get_version($request);
        $consumer = $this->get_consumer($request);
        $token = $this->get_token($request, $consumer, "access");
        $this->check_signature($request, $consumer, $token);
 
        return array($consumer, $token);
 
    }

References $request, PHPMailer\PHPMailer\$token, IMSGlobal\LTI\OAuth\OAuthServer\check_signature(), IMSGlobal\LTI\OAuth\OAuthServer\get_consumer(), IMSGlobal\LTI\OAuth\OAuthServer\get_token(), and IMSGlobal\LTI\OAuth\OAuthServer\get_version().

Here is the call graph for this function:

Field Documentation

◆ $data_store

IMSGlobal\LTI\OAuth\OAuthServer::$data_store

protected

Definition at line 18 of file OAuthServer.php.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\__construct().

◆ $signature_methods

IMSGlobal\LTI\OAuth\OAuthServer::$signature_methods = array()

protected

Definition at line 16 of file OAuthServer.php.

◆ $timestamp_threshold

IMSGlobal\LTI\OAuth\OAuthServer::$timestamp_threshold = 300

protected

Definition at line 14 of file OAuthServer.php.

◆ $version

IMSGlobal\LTI\OAuth\OAuthServer::$version = '1.0'

protected

Definition at line 15 of file OAuthServer.php.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\get_version().

The documentation for this class was generated from the following file:

libs/composer/vendor/imsglobal/lti/src/OAuth/OAuthServer.php

Public Member Functions

Protected Attributes

Private Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ __construct()

Member Function Documentation

◆ add_signature_method()

◆ check_nonce()

◆ check_signature()

◆ check_timestamp()

◆ fetch_access_token()

◆ fetch_request_token()

◆ get_consumer()

◆ get_signature_method()

◆ get_token()

◆ get_version()

◆ verify_request()

Field Documentation

◆ $data_store

◆ $signature_methods

◆ $timestamp_threshold

◆ $version