source: TI12-security/trunk/python/ndg.security.server/ndg/security/server/wsgi/openid_provider.py @ 4123

"""NDG Security OpenID Provider Middleware

Compliments AuthKit OpenID Middleware used for OpenID *Relying Party*

NERC Data Grid Project

This software may be distributed under the terms of the Q Public License,
version 1.0 or later.
"""
__author__ = "P J Kershaw"
__date__ = "27/05/08"
__copyright__ = "(C) 2008 STFC & NERC"
__contact__ = "P.J.Kershaw@rl.ac.uk"
__revision__ = "$Id$"

import logging
log = logging.getLogger(__name__)
_debugLevel = log.getEffectiveLevel() <= logging.DEBUG

import paste.request
from paste.util.import_string import eval_import

from authkit.authenticate import AuthKitConfigError

from openid.extensions import sreg
from openid.server import server
from openid.store.filestore import FileOpenIDStore
from openid.consumer import discover

import httplib
import sys
import cgi
quoteattr = lambda s: '"%s"' % cgi.escape(s, 1)
getInvalidKw = lambda kw: [k for k in kw if k not in \
                           OpenIDProviderMiddleware.defKw]

class OpenIDProviderMiddlewareError(Exception):
    """OpenID Provider WSGI Middleware Error"""
    
class OpenIDProviderMiddleware(object):
    """WSGI Middleware to implement an OpenID Provider"""

    defKw = dict(path_openidserver='/openidserver',
               path_login='/login',
               path_loginsubmit='/loginsubmit',
               path_id='/id',
               path_yadis='/yadis',
               path_serveryadis='/serveryadis',
               path_allow='/allow',
               path_decide='/decide',
               path_mainpage='/',
               session_middleware='beaker.session', 
               base_url='',
               consumer_store_dirpath='./',
               charset=None,
               trace=False,
               renderingClass=None,
               getSRegData=None)
    
    defPaths=dict([(k,v) for k,v in defKw.items() if k.startswith('path_')])
    method = dict([(v, k.replace('path_', 'do_')) for k,v in defPaths.items()])
     
    def __init__(self, app, app_conf=None, prefix='openid_provider.', **kw):
        '''       
        @type app_conf: dict        
        @param app_conf: PasteDeploy application configuration dictionary
        '''

        opt = OpenIDProviderMiddleware.defKw.copy()
        kw2AppConfOpt = {}
        if app_conf is not None:
            # Update from application config dictionary - filter from using
            # prefix
            for k,v in app_conf.items():
                if k.startswith(prefix):
                    subK = k.replace(prefix, '')                    
                    filtK = '_'.join(subK.split('.'))                    
                    opt[filtK] = v
                    kw2AppConfOpt[filtK] = k
                    
            invalidOpt = getInvalidKw(opt)
            if len(invalidOpt) > 0:
                raise TypeError("Unexpected app_conf option(s): %s" % \
                        (", ".join([kw2AppConfOpt[i] for i in invalidOpt])))
            
            # Convert from string type where required   
            opt['charset'] = eval(opt.get('charset', 'None'))     
            opt['trace'] = bool(eval(opt.get('trace', 'False'))) 
             
            renderingClassVal = opt.get('renderingClass', None)      
            if renderingClassVal:
                opt['renderingClass'] = eval_import(renderingClassVal)
            
            getSRegDataVal = opt.get('getSRegData', None)  
            if getSRegDataVal:
                opt['getSRegData'] = eval_import(getSRegDataVal)  
            else:
                 opt['getSRegData'] = None
                     
        invalidKw = getInvalidKw(kw)
        if len(invalidKw) > 0:
            raise TypeError("Unexpected keyword(s): %s" % ", ".join(invalidKw))
        
        # Update options from keywords - matching app_conf ones will be 
        # overwritten
        opt.update(kw)
        log.debug("opt=%r", opt)        

        # Paths relative to base URL
        self.paths = dict([(k, opt[k]) \
                           for k in OpenIDProviderMiddleware.defPaths])
        
        if not opt['base_url']:
            raise TypeError("base_url is not set")
        
        self.base_url = opt['base_url']

        # Full Paths
        self.urls = dict([(k.replace('path_', 'url_'), self.base_url+v) \
                          for k,v in self.paths.items()])

        self.session_middleware = opt['session_middleware']

        if opt['charset'] is None:
            self.charset = ''
        else:
            self.charset = '; charset='+charset
        
        # If True and debug log level is set display content of response
        self._trace = opt['trace']
        
        # Pages can be customised by setting external rendering interface
        # class
        renderingClass = opt.get('renderingClass', None) or RenderingInterface         
        if not issubclass(renderingClass, RenderingInterface):
            raise OpenIDProviderMiddlewareError("Rendering interface "
                                                "class %r is not a %r "
                                                "derived type" % \
                                                (renderingClass, 
                                                 RenderingInterface))

        try:
            self._renderer = renderingClass(self.base_url, self.urls)
        except Exception, e:
            log.error("Error instantiating rendering interface...")
            raise
            
        # Callable for setting of additional attributes in HTTP header of
        # response to Relying Party
        self.getSRegData = opt.get('getSRegData', None)
        if self.getSRegData and not callable(self.getSRegData):
            raise OpenIDProviderMiddlewareError("Expecting callable for "
                                                "getSRegData keyword, got %r"%\
                                                self.getSRegData)
        
        self.app = app
        
        # Instantiate OpenID consumer store and OpenID consumer.  If you
        # were connecting to a database, you would create the database
        # connection and instantiate an appropriate store here.
        store = FileOpenIDStore(opt['consumer_store_dirpath'])
        self.oidserver = server.Server(store, self.urls['url_openidserver'])

    
    def __call__(self, environ, start_response):
        if not environ.has_key(self.session_middleware):
            raise AuthKitConfigError(
                'The session middleware %r is not present. '
                'Have you set up the session middleware?'%(
                    self.session_middleware
                )
            )

        self.path = environ.get('PATH_INFO')
        self.environ = environ
        self.start_response = start_response
        self.session = environ[self.session_middleware]
        self._renderer.session = self.session
        
        # Strip trailing slashes
        if self.path[-1] == '/':
            self.path = self.path[:-1]
            
        # Match against the first level in the path only to allow for the 'id'
        # and 'yadis' cases where a sub-level could contain a user ID
        if self.path in (self.paths['path_id'], self.paths['path_yadis']):
            log.debug("No user id given in URL %s" % self.path)
            return self.app(environ, start_response)
            
        elif self.path.startswith(self.paths['path_id']) or \
           self.path.startswith(self.paths['path_yadis']):
            
            pathMatch = '/' + self.path[1:].split('/')[0]
        else:
            pathMatch = self.path
            
        if pathMatch in self.method:
            self.query = dict(paste.request.parse_formvars(environ)) 
            log.debug("Calling method %s ..." % self.method[pathMatch]) 
            
            action = getattr(self, self.method[pathMatch])
            response = action(environ, start_response) 
            if self._trace and _debugLevel:
                if isinstance(response, list):
                    log.debug('Output for %s:\n%s', self.method[pathMatch],
                                                    ''.join(response))
                else:
                    log.debug('Output for %s:\n%s', self.method[pathMatch],
                                                    response)
                    
            return response
        else:
            log.debug("No match for path %s" % self.path)
            return self.app(environ, start_response)


    def do_id(self, environ, start_response):
        '''Handle ID request'''
        response = self._renderer.renderIdentityPage(environ)

        start_response("200 OK", [('Content-length', str(len(response)))])
        return response

    tmplYadis = """\
<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS
    xmlns:xrds="xri://$xrds"
    xmlns="xri://$xrd*($v*2.0)">
  <XRD>

    <Service priority="0">
      <Type>%(openid20type)s</Type>
      <Type>%(openid10type)s</Type>
      <URI>%(endpoint_url)s</URI>
      <LocalID>%(user_url)s</LocalID>
    </Service>

  </XRD>
</xrds:XRDS>"""

    def do_yadis(self, environ, start_response):
        """Generate Yadis document"""

        username = self.path.split('/')[-1]
        
        endpoint_url = self.urls['url_openidserver']
        user_url = self.urls['url_id'] + '/' + username
        
        yadisDict = dict(openid20type=discover.OPENID_2_0_TYPE, 
                         openid10type=discover.OPENID_1_0_TYPE,
                         endpoint_url=endpoint_url, 
                         user_url=user_url)
        
        response = OpenIDProviderMiddleware.tmplYadis % yadisDict
     
        start_response('200 OK',
                    [('Content-type', 'application/xrds+xml' + self.charset),
                     ('Content-length', str(len(response)))])
        return response


    def do_openidserver(self, environ, start_response):
        """Handle OpenID Server Request"""

        try:
            oidRequest = self.oidserver.decodeRequest(self.query)
            
        except server.ProtocolError, why:
            response = self._displayResponse(why)
            
        else:
            if oidRequest is None:
                # Display text indicating that this is an endpoint.
                response = self.do_mainpage(environ, start_response)
                
            # Check mode is one of "checkid_immediate", "checkid_setup"
            if oidRequest.mode in server.BROWSER_REQUEST_MODES:
                response = self._handleCheckIDRequest(oidRequest)
            else:
                oidResponse = self.oidserver.handleRequest(oidRequest)
                response = self._displayResponse(oidResponse)
            
        return response
            

    def do_allow(self, environ, start_response):
        """Handle allow request - user allow credentials to be passed back to
        the Relying Party?"""
        
        oidRequest = self.session.get('lastCheckIDRequest')

        if 'Yes' in self.query:
            if oidRequest.idSelect():
                identity = self.urls['url_id']+'/'+self.session['username']
            else:
                identity = oidRequest.identity

            trust_root = oidRequest.trust_root
            if self.query.get('remember', 'no') == 'yes':
                self.session['approved'] = {trust_root: 'always'}
                self.session.save()
                
            oidResponse = self._identityApproved(oidRequest, identity)
            return self._displayResponse(oidResponse)
        
        elif 'No' in self.query:
            # TODO: Check 'no' response is OK - no causes AuthKit's Relying 
            # Party implementation to crash with 'openid.return_to' KeyError
            # in Authkit.authenticate.open_id.process
            oidResponse = oidRequest.answer(False)
            return self._displayResponse(oidResponse)
            #response = self._renderer.renderMainPage(environ)

        else:
            raise OpenIDProviderMiddlewareError('Expecting yes/no in allow '
                                                'post.  %r' % self.query)

    
    tmplServerYadis = """\
<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS
    xmlns:xrds="xri://$xrds"
    xmlns="xri://$xrd*($v*2.0)">
  <XRD>

    <Service priority="0">
      <Type>%(openid20type)s</Type>
      <URI>%(endpoint_url)s</URI>
    </Service>

  </XRD>
</xrds:XRDS>
"""

    def do_serveryadis(self, environ, start_response):
        """Handle Server Yadis call"""
        start_response("200 OK", [('Content-type', 'application/xrds+xml')])
        
        endpoint_url = self.urls['url_openidserver']
        return [OpenIDProviderMiddleware.tmplServerYadis % \
                {'openid20type': discover.OPENID_IDP_2_0_TYPE, 
                 'endpoint_url': endpoint_url}]


    def do_login(self, environ, start_response, **kw):
        """Display Login form"""
        
        response = self._renderer.renderLogin(environ, **kw)
        start_response('200 OK', 
                       [('Content-type', 'text/html'+self.charset),
                        ('Content-length', str(len(response)))])
        return response


    def do_loginsubmit(self, environ, start_response):
        """Handle user submission from login and logout"""
        
        if 'submit' in self.query:
            if 'username' in self.query:
                # login
                if 'username' in self.session:
                    log.error("Attempting login for user %s: user %s is "
                              "already logged in", self.session['username'],
                              self.session['username'])
                    return self._redirect(start_response,self.query['fail_to'])
                    
                self.session['username'] = self.query['username']
                self.session['approved'] = {}
                self.session.save()
            else:
                # logout
                if 'username' not in self.session:
                    log.error("No user is logged in")
                    return self._redirect(start_response,self.query['fail_to'])
                
                del self.session['username']
                self.session.pop('approved', None)
                self.session.save()
                
            return self._redirect(start_response, self.query['success_to'])
        
        elif 'cancel' in self.query:
            return self._redirect(start_response, self.query['fail_to'])
        else:
            log.error('Login input not recognised %r' % self.query)
            return self._redirect(start_response, self.query['fail_to'])
            

    def do_mainpage(self, environ, start_response):

        response = self._renderer.renderMainPage(environ)
        start_response('200 OK', 
                       [('Content-type', 'text/html'+self.charset),
                        ('Content-length', str(len(response)))])
        return response


    def do_decide(self, environ, start_response):
        """Display page prompting the user to decide whether to trust the site
        requesting their credentials"""

        oidRequest = self.session.get('lastCheckIDRequest')
        if oidRequest is None:
            log.error("No OpenID request set in session")
            return self.do_mainpage(environ, start_response)
        
        approvedRoots = self.session.get('approved', {})
        
        if oidRequest.trust_root in approvedRoots and \
           not oidRequest.idSelect():
            response = self._identityApproved(oidRequest, oidRequest.identity)
            return self._displayResponse(response)
        else:
            response = self._renderer.renderDecidePage(environ, oidRequest)
            
            start_response('200 OK', 
                           [('Content-type', 'text/html'+self.charset),
                            ('Content-length', str(len(response)))])
            return response
        
        
    def _identityIsAuthorized(self, oidRequest):
        '''The given identity URL matches with a logged in user'''

        username = self.session.get('username')
        if username is None:
            return False

        if oidRequest.idSelect():
            log.debug("OpenIDProviderMiddleware._identityIsAuthorized - "
                      "ID Select mode set but user is already logged in")
            return True
        
        identityURL = self.urls['url_id']+'/'+username
        if oidRequest.identity != identityURL:
            log.debug("OpenIDProviderMiddleware._identityIsAuthorized - "
                      "user is already logged in with a different ID=%s" % \
                      username)
            return False
        
        log.debug("OpenIDProviderMiddleware._identityIsAuthorized - "
                  "user is logged in with ID matching ID URL")
        return True
    
    
    def _trustRootIsAuthorized(self, trust_root):
        '''The given trust root (Relying Party) has previously been approved
        by the user'''
        approvedRoots = self.session.get('approved', {})
        return approvedRoots.get(trust_root) is not None


    def _addSRegResponse(self, request, response):
        '''Add additional attributes to response to Relying Party'''
        if self.getSRegData is None:
            return
        
        sreg_req = sreg.SRegRequest.fromOpenIDRequest(request)

        # Callout to external callable sets additional user attributes to be
        # returned in response to Relying Party        
        sreg_data = self.getSRegData(self.session.get('username'))

        sreg_resp = sreg.SRegResponse.extractResponse(sreg_req, sreg_data)
        response.addExtension(sreg_resp)


    def _identityApproved(self, request, identifier=None):
        '''Action following approval of a Relying Party by the user'''
        response = request.answer(True, identity=identifier)
        self._addSRegResponse(request, response)
        return response


    def _handleCheckIDRequest(self, oidRequest):
        
        log.debug("OpenIDProviderMiddleware._handleCheckIDRequest ...")

        if self._identityIsAuthorized(oidRequest):
            
            # User is logged in - check for ID Select type request i.e. the
            # user entered their IdP address at the Relying Party and not their
            # OpenID Identifier.  In this case, the identity they wish to use
            # must be confirmed.
            if oidRequest.idSelect():
                # OpenID identifier must be confirmed
                return self.do_decide(self.environ, self.start_response)
            
            elif self._trustRootIsAuthorized(oidRequest.trust_root):
                # User has approved this Relying Party
                oidResponse = self._identityApproved(oidRequest)
                return self._displayResponse(oidResponse)
            else:
                return self.do_decide(self.environ, self.start_response)
                
        elif oidRequest.immediate:
            oidResponse = oidRequest.answer(False)
            return self._displayResponse(oidResponse)
        
        else:
            # User is not logged in - save request
            self.session['lastCheckIDRequest'] = oidRequest
            self.session.save()
            
            # Call login and if successful then call decide page to confirm
            # user wishes to trust the Relying Party.
            response = self.do_login(self.environ,
                                     self.start_response,
                                     success_to=self.urls['url_decide'])
            return response


    def _displayResponse(self, response):
        try:
            webresponse = self.oidserver.encodeResponse(response)
        except server.EncodingError, why:
            text = why.response.encodeToKVForm()
            return self.showErrorPage(text)
        
        hdr = webresponse.headers.items()
        
        lenWebResponseBody = len(webresponse.body)
        if lenWebResponseBody:
            response = webresponse.body
        else:
            response = []
            
        hdr += [('Content-length', str(lenWebResponseBody))]
            
        self.start_response('%d %s' % (webresponse.code, 
                                       httplib.responses[webresponse.code]), 
                            hdr)
        return response


    def _redirect(self, start_response, url):
        start_response('302 %s' % httplib.responses[302], 
                       [('Content-type', 'text/html'+self.charset),
                        ('Location', url)])
        return []


    def _showErrorPage(self, msg, code=500):
        response = self._renderer.renderErrorPage(self.environ,cgi.escape(msg))
        self.start_response('%d %s' % (code, httplib.responses[code]), 
                            [('Content-type', 'text/html'+self.charset),
                             ('Content-length', str(len(msg)))])
        return response
    
    
class RenderingInterface(object):
    """Interface class for rendering of OpenID Provider pages.  Create a
    derivative from this class to override the default look and feel and 
    behaviour of these pages.  Pass the new class name via the renderClass
    keyword to OpenIDProviderMiddleware.__init__"""
    
    def __init__(self, base_url, urls):
        self.base_url = base_url
        self.urls = urls

    def renderIdentityPage(self, environ):
        """Render the identity page."""
        path = environ.get('PATH_INFO')
        
        link_tag = '<link rel="openid.server" href="%s">' % \
              self.urls['url_openidserver']
              
        yadis_loc_tag = '<meta http-equiv="x-xrds-location" content="%s">'%\
            (self.urls['url_yadis']+'/'+path[4:])
            
        disco_tags = link_tag + yadis_loc_tag
        ident = self.base_url + path

        msg = ''
        return self._showPage(environ, 
                              'Identity Page', 
                              head_extras=disco_tags, 
                              msg='''<p>This is the identity page for %s.</p>
                                %s
                                ''' % (ident, msg))
        
        
    def renderLogin(self, environ, success_to=None, fail_to=None):
        """Render the login form."""
        
        if success_to is None:
            success_to = self.urls['url_mainpage']
            
        if fail_to is None:
            fail_to = self.urls['url_mainpage']
        
        return self._showPage(environ,
                              'Login Page', form='''\
            <h2>Login</h2>
            <form method="GET" action="%s">
              <input type="hidden" name="success_to" value="%s" />
              <input type="hidden" name="fail_to" value="%s" />
              <input type="text" name="username" value="" />
              <input type="submit" name="submit" value="Log In" />
              <input type="submit" name="cancel" value="Cancel" />
            </form>
            ''' % (self.urls['url_loginsubmit'], success_to, fail_to))


    def renderMainPage(self, environ):
        """Rendering the main page."""
        
        yadis_tag = '<meta http-equiv="x-xrds-location" content="%s">' % \
                    self.urls['url_serveryadis']
        username = environ['beaker.session']['username']    
        if username:
            openid_url = self.urls['url_id'] + '/' + username
            user_message = """\
            <p>You are logged in as %s. Your OpenID identity URL is
            <tt><a href=%s>%s</a></tt>. Enter that URL at an OpenID
            consumer to test this server.</p>
            """ % (username, quoteattr(openid_url), openid_url)
        else:
            user_message = "<p>You are not <a href='%s'>logged in</a>.</p>" % \
                            self.urls['url_login']

        return self._showPage(environ,
                              'Main Page', head_extras=yadis_tag, msg='''\
            <p>OpenID server</p>
    
            %s
    
            <p>The URL for this server is <a href=%s><tt>%s</tt></a>.</p>
        ''' % (user_message, quoteattr(self.base_url), self.base_url))
    
    def renderDecidePage(self, environ, oidRequest):
        id_url_base = self.urls['url_id'] + '/'
        
        # XXX: This may break if there are any synonyms for id_url_base,
        # such as referring to it by IP address or a CNAME.
        
        # TODO: OpenID 2.0 Allows oidRequest.identity to be set to 
        # http://specs.openid.net/auth/2.0/identifier_select.  See,
        # http://openid.net/specs/openid-authentication-2_0.html.  This code
        # implements this overriding the behaviour of the example code on
        # which this is based.  - Check is the example code based on OpenID 1.0
        # and therefore wrong for this behaviour?
#        assert oidRequest.identity.startswith(id_url_base), \
#               repr((oidRequest.identity, id_url_base))
        expected_user = oidRequest.identity[len(id_url_base):]
        username = environ['beaker.session']['username']
        
        if oidRequest.idSelect(): # We are being asked to select an ID
            msg = '''\
            <p>A site has asked for your identity.  You may select an
            identifier by which you would like this site to know you.
            On a production site this would likely be a drop down list
            of pre-created accounts or have the facility to generate
            a random anonymous identifier.
            </p>
            '''
            fdata = {
                'path_allow': self.urls['url_allow'],
                'id_url_base': id_url_base,
                'trust_root': oidRequest.trust_root,
                }
            form = '''\
            <form method="POST" action="%(path_allow)s">
            <table>
              <tr><td>Identity:</td>
                 <td>%(id_url_base)s<input type='text' name='identifier'></td></tr>
              <tr><td>Trust Root:</td><td>%(trust_root)s</td></tr>
            </table>
            <p>Allow this authentication to proceed?</p>
            <input type="checkbox" id="remember" name="remember" value="yes"
                /><label for="remember">Remember this
                decision</label><br />
            <input type="submit" name="yes" value="yes" />
            <input type="submit" name="no" value="no" />
            </form>
            '''%fdata
            
        elif expected_user == username:
            msg = '''\
            <p>A new site has asked to confirm your identity.  If you
            approve, the site represented by the trust root below will
            be told that you control identity URL listed below. (If
            you are using a delegated identity, the site will take
            care of reversing the delegation on its own.)</p>'''

            fdata = {
                'path_allow': self.urls['url_allow'],
                'identity': oidRequest.identity,
                'trust_root': oidRequest.trust_root,
                }
            form = '''\
            <table>
              <tr><td>Identity:</td><td>%(identity)s</td></tr>
              <tr><td>Trust Root:</td><td>%(trust_root)s</td></tr>
            </table>
            <p>Allow this authentication to proceed?</p>
            <form method="POST" action="%(path_allow)s">
              <input type="checkbox" id="remember" name="remember" value="yes"
                  /><label for="remember">Remember this
                  decision</label><br />
              <input type="submit" name="yes" value="yes" />
              <input type="submit" name="no" value="no" />
            </form>''' % fdata
        else:
            mdata = {
                'expected_user': expected_user,
                'username': username,
                }
            msg = '''\
            <p>A site has asked for an identity belonging to
            %(expected_user)s, but you are logged in as %(username)s.  To
            log in as %(expected_user)s and approve the login oidRequest,
            hit OK below.  The "Remember this decision" checkbox
            applies only to the trust root decision.</p>''' % mdata

            fdata = {
                'path_allow': self.urls['url_allow'],
                'identity': oidRequest.identity,
                'trust_root': oidRequest.trust_root,
                'expected_user': expected_user,
                }
            form = '''\
            <table>
              <tr><td>Identity:</td><td>%(identity)s</td></tr>
              <tr><td>Trust Root:</td><td>%(trust_root)s</td></tr>
            </table>
            <p>Allow this authentication to proceed?</p>
            <form method="POST" action="%(path_allow)s">
              <input type="checkbox" id="remember" name="remember" value="yes"
                  /><label for="remember">Remember this
                  decision</label><br />
              <input type="hidden" name="login_as" value="%(expected_user)s"/>
              <input type="submit" name="yes" value="yes" />
              <input type="submit" name="no" value="no" />
            </form>''' % fdata

        return self._showPage(environ,
                              'Approve OpenID request?', 
                              msg=msg, form=form)
        

    def _showPage(self, environ, 
                  title, head_extras='', msg=None, err=None, form=None):

        username = environ['beaker.session'].get('username')
        if username is None:
            user_link = '<a href="/login">not logged in</a>.'
        else:
            user_link = 'logged in as <a href="%s/%s">%s</a>.<br />'\
                        '<a href="%s?submit=true&'\
                        'success_to=%s">Log out</a>' % \
                        (self.urls['url_id'], username, username, 
                         self.urls['url_loginsubmit'],
                         self.urls['url_login'])

        body = ''

        if err is not None:
            body +=  '''\
            <div class="error">
              %s
            </div>
            ''' % err

        if msg is not None:
            body += '''\
            <div class="message">
              %s
            </div>
            ''' % msg

        if form is not None:
            body += '''\
            <div class="form">
              %s
            </div>
            ''' % form

        contents = {
            'title': 'Python OpenID Server - ' + title,
            'head_extras': head_extras,
            'body': body,
            'user_link': user_link,
            }

        response = '''<html>
  <head>
    <title>%(title)s</title>
    %(head_extras)s
  </head>
  <style type="text/css">
      h1 a:link {
          color: black;
          text-decoration: none;
      }
      h1 a:visited {
          color: black;
          text-decoration: none;
      }
      h1 a:hover {
          text-decoration: underline;
      }
      body {
        font-family: verdana,sans-serif;
        width: 50em;
        margin: 1em;
      }
      div {
        padding: .5em;
      }
      table {
        margin: none;
        padding: none;
      }
      .banner {
        padding: none 1em 1em 1em;
        width: 100%%;
      }
      .leftbanner {
        text-align: left;
      }
      .rightbanner {
        text-align: right;
        font-size: smaller;
      }
      .error {
        border: 1px solid #ff0000;
        background: #ffaaaa;
        margin: .5em;
      }
      .message {
        border: 1px solid #2233ff;
        background: #eeeeff;
        margin: .5em;
      }
      .form {
        border: 1px solid #777777;
        background: #ddddcc;
        margin: .5em;
        margin-top: 1em;
        padding-bottom: 0em;
      }
      dd {
        margin-bottom: 0.5em;
      }
  </style>
  <body>
    <table class="banner">
      <tr>
        <td class="leftbanner">
          <h1><a href="/">Python OpenID Server</a></h1>
        </td>
        <td class="rightbanner">
          You are %(user_link)s
        </td>
      </tr>
    </table>
%(body)s
  </body>
</html>
''' % contents

        return response

    def renderErrorPage(self, environ, msg):
        response = self._showPage(environ, 'Error Processing Request', err='''\
        <p>%s</p>
        <!--

        This is a large comment.  It exists to make this page larger.
        That is unfortunately necessary because of the "smart"
        handling of pages returned with an error code in IE.

        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************

        -->
        ''' % msg)
        
        return response