Class to represent an OAuth Server. More...

Collaboration diagram for IMSGlobal\LTI\OAuth\OAuthServer:

Public Member Functions
	__construct ($data_store)

	add_signature_method ($signature_method)

	fetch_request_token (&$request)
	process a request_token request returns the request token on success More...

	fetch_access_token (&$request)
	process an access_token request returns the access token on success More...

	verify_request (&$request)
	verify an api call, checks all the parameters More...

Protected Attributes
	$timestamp_threshold = 300

	$version = '1.0'

	$signature_methods = array()

	$data_store

Private Member Functions
	get_version (&$request)
	version 1 More...

	get_signature_method ($request)
	figure out the signature with some defaults More...

	get_consumer ($request)
	try to find the consumer for the provided request's consumer key More...

	get_token ($request, $consumer, $token_type="access")
	try to find the token for the provided request's token key More...

	check_signature ($request, $consumer, $token)
	all-in-one function to check the signature on a request should guess the signature method appropriately More...

	check_timestamp ($timestamp)
	check that the timestamp is new enough More...

	check_nonce ($consumer, $token, $nonce, $timestamp)
	check that the nonce is not repeated More...

Detailed Description

Class to represent an OAuth Server.

Copyright: Andy Smith

Version: 2008-08-04 https://opensource.org/licenses/MIT The MIT License

Definition at line 12 of file OAuthServer.php.

Constructor & Destructor Documentation

◆ __construct()

IMSGlobal\LTI\OAuth\OAuthServer::__construct ( $data_store )

Definition at line 20 of file OAuthServer.php.

References IMSGlobal\LTI\OAuth\OAuthServer\$data_store.

                                       {
         $this->data_store = $data_store;
     }

Member Function Documentation

◆ add_signature_method()

IMSGlobal\LTI\OAuth\OAuthServer::add_signature_method ( $signature_method )

Definition at line 24 of file OAuthServer.php.

                                                             {
         $this->signature_methods[$signature_method->get_name()] = $signature_method;
     }

◆ check_nonce()

IMSGlobal\LTI\OAuth\OAuthServer::check_nonce	(	$consumer,
		$token,
		$nonce,
		$timestamp
	)

private

check that the nonce is not repeated

Definition at line 220 of file OAuthServer.php.

References $timestamp, and PHPMailer\PHPMailer\$token.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\check_signature().

                                                                         {
 
         if(!$nonce)
           throw new OAuthException('Missing nonce parameter. The parameter is required');
 
         // verify that the nonce is uniqueish
         $found = $this->data_store->lookup_nonce($consumer, $token, $nonce, $timestamp);
         if ($found) {
             throw new OAuthException("Nonce already used: $nonce");
         }
 
     }

Here is the caller graph for this function:

◆ check_signature()

IMSGlobal\LTI\OAuth\OAuthServer::check_signature	(	$request,
		$consumer,
		$token
	)

private

all-in-one function to check the signature on a request should guess the signature method appropriately

Definition at line 179 of file OAuthServer.php.

References $request, $timestamp, PHPMailer\PHPMailer\$token, IMSGlobal\LTI\OAuth\OAuthServer\check_nonce(), IMSGlobal\LTI\OAuth\OAuthServer\check_timestamp(), and IMSGlobal\LTI\OAuth\OAuthServer\get_signature_method().

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\fetch_access_token(), IMSGlobal\LTI\OAuth\OAuthServer\fetch_request_token(), and IMSGlobal\LTI\OAuth\OAuthServer\verify_request().

                                                                   {
 
         // this should probably be in a different method
         $timestamp = $request instanceof OAuthRequest
             ? $request->get_parameter('oauth_timestamp')
             : NULL;
         $nonce = $request instanceof OAuthRequest
             ? $request->get_parameter('oauth_nonce')
             : NULL;
 
         $this->check_timestamp($timestamp);
         $this->check_nonce($consumer, $token, $nonce, $timestamp);
 
         $signature_method = $this->get_signature_method($request);
 
         $signature = $request->get_parameter('oauth_signature');
         $valid_sig = $signature_method->check_signature($request, $consumer, $token, $signature);
 
         if (!$valid_sig) {
             throw new OAuthException('Invalid signature');
         }
     }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ check_timestamp()

IMSGlobal\LTI\OAuth\OAuthServer::check_timestamp ( $timestamp )

private

check that the timestamp is new enough

Definition at line 205 of file OAuthServer.php.

References $timestamp.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\check_signature().

                                                  {
         if(!$timestamp)
             throw new OAuthException('Missing timestamp parameter. The parameter is required');
 
         // verify that timestamp is recentish
         $now = time();
         if (abs($now - $timestamp) > $this->timestamp_threshold) {
             throw new OAuthException("Expired timestamp, yours $timestamp, ours $now");
         }
 
     }

Here is the caller graph for this function:

◆ fetch_access_token()

IMSGlobal\LTI\OAuth\OAuthServer::fetch_access_token ( & $request )

process an access_token request returns the access token on success

Definition at line 57 of file OAuthServer.php.

References $request, PHPMailer\PHPMailer\$token, IMSGlobal\LTI\OAuth\OAuthServer\check_signature(), IMSGlobal\LTI\OAuth\OAuthServer\get_consumer(), IMSGlobal\LTI\OAuth\OAuthServer\get_token(), and IMSGlobal\LTI\OAuth\OAuthServer\get_version().

                                                   {
 
         $this->get_version($request);
 
         $consumer = $this->get_consumer($request);
 
         // requires authorized request token
         $token = $this->get_token($request, $consumer, "request");
 
         $this->check_signature($request, $consumer, $token);
 
         // Rev A change
         $verifier = $request->get_parameter('oauth_verifier');
         $new_token = $this->data_store->new_access_token($token, $consumer, $verifier);
 
         return $new_token;
 
     }

Here is the call graph for this function:

◆ fetch_request_token()

IMSGlobal\LTI\OAuth\OAuthServer::fetch_request_token ( & $request )

process a request_token request returns the request token on success

Definition at line 34 of file OAuthServer.php.

References $request, PHPMailer\PHPMailer\$token, IMSGlobal\LTI\OAuth\OAuthServer\check_signature(), IMSGlobal\LTI\OAuth\OAuthServer\get_consumer(), and IMSGlobal\LTI\OAuth\OAuthServer\get_version().

                                                    {
 
         $this->get_version($request);
 
         $consumer = $this->get_consumer($request);
 
         // no token required for the initial token request
         $token = NULL;
 
         $this->check_signature($request, $consumer, $token);
 
         // Rev A change
         $callback = $request->get_parameter('oauth_callback');
         $new_token = $this->data_store->new_request_token($consumer, $callback);
 
         return $new_token;
 
     }

Here is the call graph for this function:

◆ get_consumer()

IMSGlobal\LTI\OAuth\OAuthServer::get_consumer ( $request )

private

try to find the consumer for the provided request's consumer key

Definition at line 140 of file OAuthServer.php.

References $request.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\fetch_access_token(), IMSGlobal\LTI\OAuth\OAuthServer\fetch_request_token(), and IMSGlobal\LTI\OAuth\OAuthServer\verify_request().

                                             {
 
         $consumer_key = $request instanceof OAuthRequest
             ? $request->get_parameter('oauth_consumer_key') : NULL;
 
         if (!$consumer_key) {
             throw new OAuthException('Invalid consumer key');
         }
 
         $consumer = $this->data_store->lookup_consumer($consumer_key);
         if (!$consumer) {
             throw new OAuthException('Invalid consumer');
         }
 
         return $consumer;
 
     }

Here is the caller graph for this function:

◆ get_signature_method()

IMSGlobal\LTI\OAuth\OAuthServer::get_signature_method ( $request )

private

figure out the signature with some defaults

Definition at line 113 of file OAuthServer.php.

References $request.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\check_signature().

                                                     {
 
         $signature_method = $request instanceof OAuthRequest
             ? $request->get_parameter('oauth_signature_method') : NULL;
 
         if (!$signature_method) {
             // According to chapter 7 ("Accessing Protected Ressources") the signature-method
             // parameter is required, and we can't just fallback to PLAINTEXT
             throw new OAuthException('No signature method parameter. This parameter is required');
         }
 
         if (!in_array($signature_method,
                       array_keys($this->signature_methods))) {
             throw new OAuthException(
               "Signature method '$signature_method' not supported " .
               'try one of the following: ' .
               implode(', ', array_keys($this->signature_methods))
             );
         }
 
         return $this->signature_methods[$signature_method];
 
     }

Here is the caller graph for this function:

◆ get_token()

IMSGlobal\LTI\OAuth\OAuthServer::get_token	(	$request,
		$consumer,
		$token_type = `"access"`
	)

private

try to find the token for the provided request's token key

Definition at line 161 of file OAuthServer.php.

References $request, and PHPMailer\PHPMailer\$token.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\fetch_access_token(), and IMSGlobal\LTI\OAuth\OAuthServer\verify_request().

                                                                           {
 
         $token_field = $request instanceof OAuthRequest
              ? $request->get_parameter('oauth_token') : NULL;
 
         $token = $this->data_store->lookup_token($consumer, $token_type, $token_field);
         if (!$token) {
             throw new OAuthException("Invalid $token_type token: $token_field");
         }
 
         return $token;
 
     }

Here is the caller graph for this function:

◆ get_version()

IMSGlobal\LTI\OAuth\OAuthServer::get_version ( & $request )

private

version 1

Definition at line 94 of file OAuthServer.php.

References $request, and IMSGlobal\LTI\OAuth\OAuthServer\$version.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\fetch_access_token(), IMSGlobal\LTI\OAuth\OAuthServer\fetch_request_token(), and IMSGlobal\LTI\OAuth\OAuthServer\verify_request().

                                             {
 
         $version = $request->get_parameter("oauth_version");
         if (!$version) {
             // Service Providers MUST assume the protocol version to be 1.0 if this parameter is not present.
             // Chapter 7.0 ("Accessing Protected Ressources")
             $version = '1.0';
         }
         if ($version !== $this->version) {
             throw new OAuthException("OAuth version '$version' not supported");
         }
 
         return $version;
 
     }

Here is the caller graph for this function:

◆ verify_request()

IMSGlobal\LTI\OAuth\OAuthServer::verify_request ( & $request )

verify an api call, checks all the parameters

Definition at line 79 of file OAuthServer.php.

References $request, PHPMailer\PHPMailer\$token, IMSGlobal\LTI\OAuth\OAuthServer\check_signature(), IMSGlobal\LTI\OAuth\OAuthServer\get_consumer(), IMSGlobal\LTI\OAuth\OAuthServer\get_token(), and IMSGlobal\LTI\OAuth\OAuthServer\get_version().

                                               {
 
         $this->get_version($request);
         $consumer = $this->get_consumer($request);
         $token = $this->get_token($request, $consumer, "access");
         $this->check_signature($request, $consumer, $token);
 
         return array($consumer, $token);
 
     }

Here is the call graph for this function:

Field Documentation

◆ $data_store

IMSGlobal\LTI\OAuth\OAuthServer::$data_store

protected

Definition at line 18 of file OAuthServer.php.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\__construct().

◆ $signature_methods

IMSGlobal\LTI\OAuth\OAuthServer::$signature_methods = array()

protected

Definition at line 16 of file OAuthServer.php.

◆ $timestamp_threshold

IMSGlobal\LTI\OAuth\OAuthServer::$timestamp_threshold = 300

protected

Definition at line 14 of file OAuthServer.php.

◆ $version

IMSGlobal\LTI\OAuth\OAuthServer::$version = '1.0'

protected

Definition at line 15 of file OAuthServer.php.

Referenced by IMSGlobal\LTI\OAuth\OAuthServer\get_version().

The documentation for this class was generated from the following file:

libs/composer/vendor/imsglobal/lti/src/OAuth/OAuthServer.php

Public Member Functions

Protected Attributes

Private Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ __construct()

Member Function Documentation

◆ add_signature_method()

◆ check_nonce()

◆ check_signature()

◆ check_timestamp()

◆ fetch_access_token()

◆ fetch_request_token()

◆ get_consumer()

◆ get_signature_method()

◆ get_token()

◆ get_version()

◆ verify_request()

Field Documentation

◆ $data_store

◆ $signature_methods

◆ $timestamp_threshold

◆ $version