我最近在尝试让 OpenID 在 Java(servlet)中工作时遇到了一些麻烦。我正在尝试让用户能够使用他们的 Steam 帐户登录我的网站。我尝试过多个库，但其中一些库已经过时，而另一些库几乎没有可用的文档，因此我现在正在尝试的库是 JOpenID。它按预期工作，直到我需要验证 Steam 发回的信息 ( http://steamcommunity.com/openid )。这是我的 Servlet:
@WebServlet("/LoginServlet")
public class LoginServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
private OpenIdManager manager;
static final long ONE_HOUR = 3600000L;
static final long TWO_HOUR = ONE_HOUR * 2L;
static final String ATTR_MAC = "openid_mac";
static final String ATTR_ALIAS = "openid_alias";
public LoginServlet() {
super();
}
@Override
public void init() throws ServletException {
super.init();
manager = new OpenIdManager();
manager.setRealm("http://localhost:8080/TestServletProject/LoginServlet");
manager.setReturnTo("http://localhost:8080/TestServletProject/LoginServlet?login=verify");
}
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
PrintWriter out = response.getWriter();
String login = request.getParameter("login");
if(login != null){
if(login.equals("steam")){
out.print("<h2>Redirecting</h2>");
Endpoint endpoint = manager.lookupEndpoint("http://steamcommunity.com/openid");
Association association = manager.lookupAssociation(endpoint);
request.getSession().setAttribute(ATTR_MAC, association.getRawMacKey());
request.getSession().setAttribute(ATTR_ALIAS, endpoint.getAlias());
String url = manager.getAuthenticationUrl(endpoint, association);
response.sendRedirect(url);
}else if(login.equals("verify")){
checkNonce(request.getParameter("openid.response_nonce"));
byte[] mac_key = (byte[]) request.getSession().getAttribute(ATTR_MAC);
String alias = (String) request.getSession().getAttribute(ATTR_ALIAS);
Authentication authentication = manager.getAuthentication(request, mac_key, alias);
response.setContentType("text/html; charset=UTF-8");
showAuthentication(response.getWriter(), authentication);
return;
}else if(login.equals("logout")){
out.print("<h2>Loggin out</h2>");
}
return;
}
String id = (String) request.getSession().getAttribute("steamid");
if (id != null) {
out.print("<h2>Welcome ");
out.print(id);
out.print("</h2>");
out.print("<a href=\"LoginServlet?login=logout\">Logout</a>");
} else {
out.print("<a href=\"LoginServlet?login=steam\">Login</a>");
}
}
void showAuthentication(PrintWriter pw, Authentication auth) {
pw.print("<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" /><title>Test JOpenID</title></head><body><h1>You have successfully signed on!</h1>");
pw.print("<p>Identity: " + auth.getIdentity() + "</p>");
pw.print("<p>Email: " + auth.getEmail() + "</p>");
pw.print("<p>Full name: " + auth.getFullname() + "</p>");
pw.print("<p>First name: " + auth.getFirstname() + "</p>");
pw.print("<p>Last name: " + auth.getLastname() + "</p>");
pw.print("<p>Gender: " + auth.getGender() + "</p>");
pw.print("<p>Language: " + auth.getLanguage() + "</p>");
pw.print("</body></html>");
pw.flush();
}
void checkNonce(String nonce) {
// check response_nonce to prevent replay-attack:
if (nonce==null || nonce.length()<20)
throw new OpenIdException("Verify failed.");
// make sure the time of server is correct:
long nonceTime = getNonceTime(nonce);
long diff = Math.abs(System.currentTimeMillis() - nonceTime);
if (diff > ONE_HOUR)
throw new OpenIdException("Bad nonce time.");
if (isNonceExist(nonce))
throw new OpenIdException("Verify nonce failed.");
storeNonce(nonce, nonceTime + TWO_HOUR);
}
private Set<String> nonceDb = new HashSet<String>();
// check if nonce is exist in database:
boolean isNonceExist(String nonce) {
return nonceDb.contains(nonce);
}
// store nonce in database:
void storeNonce(String nonce, long expires) {
nonceDb.add(nonce);
}
long getNonceTime(String nonce) {
try {
return new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ")
.parse(nonce.substring(0, 19) + "+0000")
.getTime();
}
catch(ParseException e) {
throw new OpenIdException("Bad nonce time.");
}
}
}
我在第 65 行收到 org.expressme.openid.OpenIdException: Invalidate handle:Authenticationauthentication = manager.getAuthentication(request, mac_key, alias);
在进行一些研究时，我发现这与发送到 steam 的 Assosiaction 已过期有关。这是导致 OpenIdException 的 JOpenID 类:https://github.com/michaelliao/jopenid/blob/master/src/main/java/org/expressme/openid/OpenIdManager.java
有人知道我如何让它工作，或者知道一个更好的库可以使用。我对此很陌生，不确定我是否使用了正确的库，或者是否有更好的方法来做到这一点。
最佳答案
对于仍然想知道的人:我查看了 JOpenID 代码，它似乎是 getAuthentication() 方法中的代码，位于引发异常的代码之前足以检索 Steam ID(这是我试图从 Steam 获取的)。因此，我现在只输入 String Identity = request.getParameter("openid.identity");，而不是 Authenticationauthentication = manager.getAuthentication(request, mac_key, alias);。这将返回http://steamcommunity.com/openid/id/76561198206376959，最后一部分是Steam ID。
关于Java - OpenID(使用 Steam 登录)，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/35563338/