Question

我无法验证OpenID签名。这就是我做的，请告诉我出了什么问题：

这些是关联时获得的值：

mac_key 3E2FH8mCR/OJ3/T6N3UPqD8iYf0fXyQ0c4io5psTC7s=
assoc_handle AMlYA9WWc0Jk8BnTg9E0cvczK8DYBediGvu5snBaYec9uFlTj3wbY9ezQepX-kFv2foRGQC6

我将客户端重定向到：

https://www.google.com/accounts/o8/ud?openid.ns=http://specs.openid.net/auth/2.0&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.return_to=http://www.sdfanq.com/checkauth&openid.realm=http://www.sdfanq.com/&openid.mode=checkid_setup&openid.assoc_handle=AMlYA9WWc0Jk8BnTg9E0cvczK8DYBediGvu5snBaYec9uFlTj3wbY9ezQepX-kFv2foRGQC6

Uppon接受，客户端重定向回：

http://www.sdfanq.com/checkauth?openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.mode=id_res&openid.op_endpoint=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fud&openid.response_nonce=2012-05-23T05%3A54%3A30Z0Sv8nDqIrrWYeQ&openid.return_to=http%3A%2F%2Fwww.sdfanq.com%2Fcheckauth&openid.assoc_handle=AMlYA9WWc0Jk8BnTg9E0cvczK8DYBediGvu5snBaYec9uFlTj3wbY9ezQepX-kFv2foRGQC6&openid.signed=op_endpoint%2Cclaimed_id%2Cidentity%2Creturn_to%2Cresponse_nonce%2Cassoc_handle&openid.sig=HtlEGDEmee1UsH9fZg%2BQXt3JCyk11Lb7RMTNEcxbCKo%3D&openid.identity=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid%3Fid%3DAItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY&openid.claimed_id=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid%3Fid%3DAItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY

为了验证签名我连接了这样的键：

op_endpoint:https://www.google.com/accounts/o8/ud\nclaimed_id:https://www.google.com/accounts/o8/id?id=AItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY\nidentity:https://www.google.com/accounts/o8/id?id=AItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY\nreturn_to:http://www.sdfanq.com/checkauth\nresponse_nonce:2012-05-23T05:54:30Z0Sv8nDqIrrWYeQ\nassoc_handle:AMlYA9WWc0Jk8BnTg9E0cvczK8DYBediGvu5snBaYec9uFlTj3wbY9ezQepX-kFv2foRGQC6\n

现在当我base64.encode（hmac256（“3E2FH8mCR / OJ3 / T6N3UPqD8iYf0fXyQ0c4io5psTC7s =”，S）），其中'S'是连接字符串时，我得到一个错误的值。

Answer 1

你忘记了base64解密密钥。作为一般的经验法则：如果某些东西看起来像base64，至少尝试解码它并不是一个坏主意。

试试这个：

<?php
$string="op_endpoint:https://www.google.com/accounts/o8/ud
claimed_id:https://www.google.com/accounts/o8/id?id=AItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY
identity:https://www.google.com/accounts/o8/id?id=AItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY
return_to:http://www.sdfanq.com/checkauth
response_nonce:2012-05-23T05:54:30Z0Sv8nDqIrrWYeQ
assoc_handle:AMlYA9WWc0Jk8BnTg9E0cvczK8DYBediGvu5snBaYec9uFlTj3wbY9ezQepX-kFv2foRGQC6
"; //first we take the string to be signed

$key=base64_decode("3E2FH8mCR/OJ3/T6N3UPqD8iYf0fXyQ0c4io5psTC7s="); //the key needs to be Base64 decoded.

$orisig="HtlEGDEmee1UsH9fZg+QXt3JCyk11Lb7RMTNEcxbCKo="; //take the original signature to check it later

$truesig=base64_encode(hash_hmac("sha256",$string,$key,true)); //calculate the signature you get

echo $truesig."<br>".$orisig."<br>"; //output both
var_dump($orisig==$truesig) //and show they are the same.
?>

我希望解决这些非常古老的问题不是问题。

验证OpenID签名

1 个答案: