How do I sign a google federated login?

Question

Ok Im having more luck with G'oogle's federated log in, I'm at the point where you get the following params back from Google.

[openid_ns] => http://specs.openid.net/auth/2.0
[openid_mode] => id_res
[openid_op_endpoint] => https://www.google.com/accounts/o8/ud
[openid_response_nonce] => 2010-01-02T14:58:22ZvP-t8tJXqGWaPw
[openid_return_to] => http://localhost/blablabla/index.php?c=google
[openid_assoc_handle] => AOQobUdTUUFVqQ9PeC9r19-rHOlEg_xvFmiIUahkmhNQ7Blrh14w2-eb
[openid_signed] => op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle,ns.ext1,ext1.mode,ext1.type.firstname,ext1.value.firstname,ext1.type.email,ext1.value.email,ext1.type.lastname,ext1.value.lastname
[openid_sig] => tUZtUtVcvOfrodpPEx4bItcxVME=
[openid_identity] => https://www.google.com/accounts/o8/id?id=xxxxxxxxxxxxxxxxxx
[openid_claimed_id] => https://www.google.com/accounts/o8/id?id=xxxxxxxxxxxxxxxxxx
[openid_ns_ext1] => http://openid.net/srv/ax/1.0
[openid_ext1_mode] => fetch_response
[openid_ext1_type_firstname] => http://axschema.org/namePerson/first
[openid_ext1_value_firstname] => myName
[openid_ext1_type_email] => http://axschema.org/contact/email
[openid_ext1_value_email] => [email protected]
[openid_ext1_type_lastname] => http://axschema.org/namePerson/last
[openid_ext1_value_lastname] => MySurname

The only thing I need to do now is sign it and' If I understand this correctly google is giving me a clue with [openid_signed]

ie: string those params together and then creating the hash out of the concatenated strin the should equal [openid_sig] => tUZtUtVcvOfrodpPEx4bItcxVME=

But Im sure there is more to the signature generating formula - anyone know what it is since I cant find it in Google's documentation anywhere?

Answer 1

You can use JanRain's RPX-Now for the same. It has a much simpler and allows almost all OpenID providers. https://rpxnow.com/

Answer 2

Google Federated Login is, with a few minor changes, OpenID. Rather than looking for docs on Google Federated Login's signature protocol, look for information on what how to generate a signature and how to verify the signature.

Even if you don't want to use the JanRain code, you could still get some answers to these questions by looking at the code. For instance, the verify function on line 1320 of /Auth/OpenID/Server.php seems to be where the code for verifying the signature starts.