Sam Ruby: OpenID code complete on Rails

OpenID code complete on Rails

Wed 12 Oct 2005 at 00:15

I’ve now got basic function test coverage for the OpenID consumer functionality. It required me to intercept get and post requests to the test.host, and get rails to recognize and process them. I also had to add two methods to ActionController::TestResponse to make it more closely emulate Net::HTTPResponse.

I can test degrading from smart to dumb consumer, but in order to test things like non-DiffieHellman session types, further alterations to the consumer will be required. Also test complete means that at this point I should expect to interop with well behaved implementations, not that this code is fully immune to attacks. For example, I don’t yet verify TrustRoots.

Inevitably, there will be bugs, but at this point each bug should be expressible as a test case.

The most interesting bug that was found during this process was a case where the signatures did not match, where the difference was only in trailing blanks. The root cause was running with MYSQL version <= 5.0. Such a problem would have been very difficult to track down in production. But it was easy to fix.

The complete set of unit and function tests (several of which includes multiple virtual HTTP requests) takes about 7.5 seconds to execute on my three year old ThinkPad — comparable to how long it would take to compile a similar sized application written in Java. And this includes my weblog tests as it hardly seemed worthwhile to remove them.

Ruby on Rails continues to impress me.

Hey Sam,

If you don’t mind, I’ll add those methods to rails for the next release?

Posted by Michael Koziarski at 01:02

Michael: excellent! Absolutely. Treat everything as if it under the same license as Rails itself.

Note: as currently implemented, the URI.parse implementation prereqs the URI::HTTP get and post methods that can be found here. For completeness (and to match test_process.rb), put, delete, and head should also be added.

I’d also suggest that Test::Unit::TestCase.url_for method be picked up.

Note that while I have been pointing at individual files, the whole implementation is present online for browsing, or as a tgz for downloading.

Posted by Sam Ruby at 01:48

Possible bug report:
I was trying to use your implementation to allow LiveJournal users to login to my site. It fails with “Signature not valid” error. May by there is a interoperability issue.

Posted by Dmitry Erkin at 16:27