source: TI12-security/trunk/python/ndg.security.server/ndg/security/server/wsgi/openid_provider.py @ 4132

"""NDG Security OpenID Provider Middleware

Compliments AuthKit OpenID Middleware used for OpenID *Relying Party*

NERC Data Grid Project

This software may be distributed under the terms of the Q Public License,
version 1.0 or later.
"""
__author__ = "P J Kershaw"
__date__ = "01/08/08"
__copyright__ = "(C) 2008 STFC & NERC"
__contact__ = "P.J.Kershaw@rl.ac.uk"
__revision__ = "$Id$"

import logging
log = logging.getLogger(__name__)
_debugLevel = log.getEffectiveLevel() <= logging.DEBUG

import paste.request
from paste.util.import_string import eval_import

from authkit.authenticate import AuthKitConfigError

from openid.extensions import sreg, ax
from openid.server import server
from openid.store.filestore import FileOpenIDStore
from openid.consumer import discover

import httplib
import sys
import cgi
quoteattr = lambda s: '"%s"' % cgi.escape(s, 1)
getInvalidKw = lambda kw: [k for k in kw if k not in \
                           OpenIDProviderMiddleware.defKw]

class OpenIDProviderMiddlewareError(Exception):
    """OpenID Provider WSGI Middleware Error"""

class OpenIDProviderConfigError(Exception):
    """OpenID Provider Configuration Error"""
   
class OpenIDProviderMiddleware(object):
    """WSGI Middleware to implement an OpenID Provider"""

    defKw = dict(path_openidserver='/openidserver',
               path_login='/login',
               path_loginsubmit='/loginsubmit',
               path_id='/id',
               path_yadis='/yadis',
               path_serveryadis='/serveryadis',
               path_allow='/allow',
               path_decide='/decide',
               path_mainpage='/',
               session_middleware='beaker.session', 
               base_url='',
               consumer_store_dirpath='./',
               charset=None,
               trace=False,
               renderingClass=None,
               sregResponseHandler=None,
               axResponseHandler=None)
    
    defPaths=dict([(k,v) for k,v in defKw.items() if k.startswith('path_')])
     
    def __init__(self, app, app_conf=None, prefix='openid_provider.', **kw):
        '''       
        @type app_conf: dict        
        @param app_conf: PasteDeploy application configuration dictionary
        '''

        opt = OpenIDProviderMiddleware.defKw.copy()
        kw2AppConfOpt = {}
        if app_conf is not None:
            # Update from application config dictionary - filter from using
            # prefix
            for k,v in app_conf.items():
                if k.startswith(prefix):
                    subK = k.replace(prefix, '')                    
                    filtK = '_'.join(subK.split('.'))                    
                    opt[filtK] = v
                    kw2AppConfOpt[filtK] = k
                    
            invalidOpt = getInvalidKw(opt)
            if len(invalidOpt) > 0:
                raise TypeError("Unexpected app_conf option(s): %s" % \
                        (", ".join([kw2AppConfOpt[i] for i in invalidOpt])))
            
            # Convert from string type where required   
            opt['charset'] = eval(opt.get('charset', 'None'))     
            opt['trace'] = bool(eval(opt.get('trace', 'False'))) 
             
            renderingClassVal = opt.get('renderingClass', None)      
            if renderingClassVal:
                opt['renderingClass'] = eval_import(renderingClassVal)
            
            sregResponseHandlerVal = opt.get('sregResponseHandler', None)  
            if sregResponseHandlerVal:
                opt['sregResponseHandler']=eval_import(sregResponseHandlerVal)  
            else:
                 opt['sregResponseHandler'] = None

            axResponseHandlerVal = opt.get('axResponseHandler', None)  
            if axResponseHandlerVal:
                opt['axResponseHandler'] = eval_import(axResponseHandlerVal)
            else:
                opt['axResponseHandler'] = None
                          
        invalidKw = getInvalidKw(kw)
        if len(invalidKw) > 0:
            raise TypeError("Unexpected keyword(s): %s" % ", ".join(invalidKw))
        
        # Update options from keywords - matching app_conf ones will be 
        # overwritten
        opt.update(kw)

        # Paths relative to base URL - Nb. remove trailing '/'
        self.paths = dict([(k, opt[k].rstrip('/')) \
                           for k in OpenIDProviderMiddleware.defPaths])
        
        if not opt['base_url']:
            raise TypeError("base_url is not set")
        
        self.base_url = opt['base_url']

        # Full Paths
        self.urls = dict([(k.replace('path_', 'url_'), self.base_url+v) \
                          for k,v in self.paths.items()])

        self.method = dict([(v, k.replace('path_', 'do_')) \
                            for k,v in self.paths.items()])

        self.session_middleware = opt['session_middleware']

        if opt['charset'] is None:
            self.charset = ''
        else:
            self.charset = '; charset='+charset
        
        # If True and debug log level is set display content of response
        self._trace = opt['trace']

        log.debug("opt=%r", opt)        
       
        # Pages can be customised by setting external rendering interface
        # class
        renderingClass = opt.get('renderingClass', None) or RenderingInterface         
        if not issubclass(renderingClass, RenderingInterface):
            raise OpenIDProviderMiddlewareError("Rendering interface "
                                                "class %r is not a %r "
                                                "derived type" % \
                                                (renderingClass, 
                                                 RenderingInterface))

        try:
            self._renderer = renderingClass(self.base_url, self.urls)
        except Exception, e:
            log.error("Error instantiating rendering interface...")
            raise
            
        # Callable for setting of Simple Registration attributes in HTTP header
        # of response to Relying Party
        self.sregResponseHandler = opt.get('sregResponseHandler', None)
        if self.sregResponseHandler and not callable(self.sregResponseHandler):
            raise OpenIDProviderMiddlewareError("Expecting callable for "
                                                "sregResponseHandler keyword, "
                                                "got %r" % \
                                                self.sregResponseHandler)
            
        # Callable to handle OpenID Attribute Exchange (AX) requests from
        # the Relying Party
        self.axResponseHandler = opt.get('axResponseHandler', None)
        if self.axResponseHandler and not callable(self.axResponseHandler):
            raise OpenIDProviderMiddlewareError("Expecting callable for "
                                                "axResponseHandler keyword, "
                                                "got %r" % \
                                                self.axResponseHandler)
        
        self.app = app
        
        # Instantiate OpenID consumer store and OpenID consumer.  If you
        # were connecting to a database, you would create the database
        # connection and instantiate an appropriate store here.
        store = FileOpenIDStore(opt['consumer_store_dirpath'])
        self.oidserver = server.Server(store, self.urls['url_openidserver'])

    
    def __call__(self, environ, start_response):
        
        if not environ.has_key(self.session_middleware):
            raise OpenIDProviderConfigError('The session middleware %r is not '
                                            'present. Have you set up the '
                                            'session middleware?' % \
                                            self.session_middleware)

        self.path = environ.get('PATH_INFO').rstrip('/')
        self.environ = environ
        self.start_response = start_response
        self.session = environ[self.session_middleware]
        self._renderer.session = self.session
        
        if self.path in (self.paths['path_id'], self.paths['path_yadis']):
            log.debug("No user id given in URL %s" % self.path)
            
            # Disallow identifier and yadis URIs where no ID was specified
            return self.app(environ, start_response)
            
        elif self.path.startswith(self.paths['path_id']) or \
           self.path.startswith(self.paths['path_yadis']):
            
            # Match against path minus ID as this is not known in advance            
            pathMatch = self.path[:self.path.rfind('/')]
        else:
            pathMatch = self.path
            
        if pathMatch in self.method:
            self.query = dict(paste.request.parse_formvars(environ)) 
            log.debug("Calling method %s ..." % self.method[pathMatch]) 
            
            action = getattr(self, self.method[pathMatch])
            response = action(environ, start_response) 
            if self._trace and _debugLevel:
                if isinstance(response, list):
                    log.debug('Output for %s:\n%s', self.method[pathMatch],
                                                    ''.join(response))
                else:
                    log.debug('Output for %s:\n%s', self.method[pathMatch],
                                                    response)
                    
            return response
        else:
            log.debug("No match for path %s" % self.path)
            return self.app(environ, start_response)


    def do_id(self, environ, start_response):
        '''Handle ID request'''
        response = self._renderer.renderIdentityPage(environ)

        start_response("200 OK", 
                       [('Content-type', 'text/html'+self.charset),
                        ('Content-length', str(len(response)))])
        return response


    def do_yadis(self, environ, start_response):
        """Generate Yadis document"""
        response = self._renderer.renderYadis(environ)
     
        start_response('200 OK',
                       [('Content-type', 'application/xrds+xml'+self.charset),
                        ('Content-length', str(len(response)))])
        return response


    def do_openidserver(self, environ, start_response):
        """Handle OpenID Server Request"""

        try:
            oidRequest = self.oidserver.decodeRequest(self.query)
            
        except server.ProtocolError, why:
            response = self._displayResponse(why)
            
        else:
            if oidRequest is None:
                # Display text indicating that this is an endpoint.
                response = self.do_mainpage(environ, start_response)
                
            # Check mode is one of "checkid_immediate", "checkid_setup"
            if oidRequest.mode in server.BROWSER_REQUEST_MODES:
                response = self._handleCheckIDRequest(oidRequest)
            else:
                oidResponse = self.oidserver.handleRequest(oidRequest)
                response = self._displayResponse(oidResponse)
            
        return response
            

    def do_allow(self, environ, start_response):
        """Handle allow request - user allow credentials to be passed back to
        the Relying Party?"""
        
        oidRequest = self.session.get('lastCheckIDRequest')

        if 'Yes' in self.query:
            if oidRequest.idSelect():
                identity = self.urls['url_id']+'/'+self.session['username']
            else:
                identity = oidRequest.identity

            trust_root = oidRequest.trust_root
            if self.query.get('remember', 'no') == 'yes':
                self.session['approved'] = {trust_root: 'always'}
                self.session.save()
             
            oidResponse = self._identityApproved(oidRequest, identity)
            response = self._displayResponse(oidResponse)
            log.debug("do_allow response = \n%s" % response)
            return response
        
        elif 'No' in self.query:
            # TODO: Check 'no' response is OK - no causes AuthKit's Relying 
            # Party implementation to crash with 'openid.return_to' KeyError
            # in Authkit.authenticate.open_id.process
            oidResponse = oidRequest.answer(False)
            return self._displayResponse(oidResponse)
            #response = self._renderer.renderMainPage(environ)

        else:
            raise OpenIDProviderMiddlewareError('Expecting yes/no in allow '
                                                'post.  %r' % self.query)


    def do_serveryadis(self, environ, start_response):
        """Handle Server Yadis call"""
        response = self._renderer.renderServerYadis(environ)
        start_response("200 OK", 
                       [('Content-type', 'application/xrds+xml'),
                        ('Content-length', str(len(response)))])
        return response


    def do_login(self, environ, start_response, **kw):
        """Display Login form"""
        
        response = self._renderer.renderLogin(environ, **kw)
        start_response('200 OK', 
                       [('Content-type', 'text/html'+self.charset),
                        ('Content-length', str(len(response)))])
        return response


    def do_loginsubmit(self, environ, start_response):
        """Handle user submission from login and logout"""
        
        if 'submit' in self.query:
            if 'username' in self.query:
                # login
                if 'username' in self.session:
                    log.error("Attempting login for user %s: user %s is "
                              "already logged in", self.session['username'],
                              self.session['username'])
                    return self._redirect(start_response,self.query['fail_to'])
                    
                self.session['username'] = self.query['username']
                self.session['approved'] = {}
                self.session.save()
            else:
                # logout
                if 'username' not in self.session:
                    log.error("No user is logged in")
                    return self._redirect(start_response,self.query['fail_to'])
                
                del self.session['username']
                self.session.pop('approved', None)
                self.session.save()
                
            return self._redirect(start_response, self.query['success_to'])
        
        elif 'cancel' in self.query:
            return self._redirect(start_response, self.query['fail_to'])
        else:
            log.error('Login input not recognised %r' % self.query)
            return self._redirect(start_response, self.query['fail_to'])
            

    def do_mainpage(self, environ, start_response):

        response = self._renderer.renderMainPage(environ)
        start_response('200 OK', 
                       [('Content-type', 'text/html'+self.charset),
                        ('Content-length', str(len(response)))])
        return response


    def do_decide(self, environ, start_response):
        """Display page prompting the user to decide whether to trust the site
        requesting their credentials"""

        oidRequest = self.session.get('lastCheckIDRequest')
        if oidRequest is None:
            log.error("No OpenID request set in session")
            return self.do_mainpage(environ, start_response)
        
        approvedRoots = self.session.get('approved', {})
        
        if oidRequest.trust_root in approvedRoots and \
           not oidRequest.idSelect():
            response = self._identityApproved(oidRequest, oidRequest.identity)
            return self._displayResponse(response)
        else:
            response = self._renderer.renderDecidePage(environ, oidRequest)
            
            start_response('200 OK', 
                           [('Content-type', 'text/html'+self.charset),
                            ('Content-length', str(len(response)))])
            return response
        
        
    def _identityIsAuthorized(self, oidRequest):
        '''The given identity URL matches with a logged in user'''

        username = self.session.get('username')
        if username is None:
            return False

        if oidRequest.idSelect():
            log.debug("OpenIDProviderMiddleware._identityIsAuthorized - "
                      "ID Select mode set but user is already logged in")
            return True
        
        identityURL = self.urls['url_id']+'/'+username
        if oidRequest.identity != identityURL:
            log.debug("OpenIDProviderMiddleware._identityIsAuthorized - "
                      "user is already logged in with a different ID=%s" % \
                      username)
            return False
        
        log.debug("OpenIDProviderMiddleware._identityIsAuthorized - "
                  "user is logged in with ID matching ID URL")
        return True
    
    
    def _trustRootIsAuthorized(self, trust_root):
        '''The given trust root (Relying Party) has previously been approved
        by the user'''
        approvedRoots = self.session.get('approved', {})
        return approvedRoots.get(trust_root) is not None


    def _addSRegResponse(self, request, response):
        '''Add Simple Registration attributes to response to Relying Party'''
        if self.sregResponseHandler is None:
            return
        
        sreg_req = sreg.SRegRequest.fromOpenIDRequest(request)

        # Callout to external callable sets additional user attributes to be
        # returned in response to Relying Party        
        sreg_data = self.sregResponseHandler(self.session.get('username'))
        sreg_resp = sreg.SRegResponse.extractResponse(sreg_req, sreg_data)
        response.addExtension(sreg_resp)


    def _addAXResponse(self, request, response):
        '''Add attributes to response based on the OpenID Attribute Exchange 
        interface'''

        ax_req = ax.FetchRequest.fromOpenIDRequest(request)
        if ax_req is None:
            log.debug("No Attribute Exchange extension set in request")
            return
        
        ax_resp = ax.FetchResponse(request=ax_req)
        
        if self.axResponseHandler is None:
            requiredAttr = ax_req.getRequiredAttrs()
            if len(requiredAttr) > 0:
                log.error("Relying party requires these attributes: %s; but no"
                          "Attribute exchange handler 'axResponseHandler' has "
                          "been set" % requiredAttr)
            return
        
        # Set requested values - need user intervention here to confirm 
        # release of attributes + assignment based on required attributes - 
        # possibly via FetchRequest.getRequiredAttrs()
#        for typeURI, attrInfo in ax_req.requested_attributes.items():
#            # Value input must be list type
#            ax_resp.setValues(typeURI, [attrInfo.alias+"Value"])
        self.axResponseHandler(ax_req, ax_resp, self.session.get('username'))
        
        response.addExtension(ax_resp)
        
        
    def _identityApproved(self, request, identifier=None):
        '''Action following approval of a Relying Party by the user'''
        response = request.answer(True, identity=identifier)
        self._addSRegResponse(request, response)
        self._addAXResponse(request, response)
        return response


    def _handleCheckIDRequest(self, oidRequest):
        
        log.debug("OpenIDProviderMiddleware._handleCheckIDRequest ...")

        if self._identityIsAuthorized(oidRequest):
            
            # User is logged in - check for ID Select type request i.e. the
            # user entered their IdP address at the Relying Party and not their
            # OpenID Identifier.  In this case, the identity they wish to use
            # must be confirmed.
            if oidRequest.idSelect():
                # OpenID identifier must be confirmed
                return self.do_decide(self.environ, self.start_response)
            
            elif self._trustRootIsAuthorized(oidRequest.trust_root):
                # User has approved this Relying Party
                oidResponse = self._identityApproved(oidRequest)
                return self._displayResponse(oidResponse)
            else:
                return self.do_decide(self.environ, self.start_response)
                
        elif oidRequest.immediate:
            oidResponse = oidRequest.answer(False)
            return self._displayResponse(oidResponse)
        
        else:
            # User is not logged in - save request
            self.session['lastCheckIDRequest'] = oidRequest
            self.session.save()
            
            # Call login and if successful then call decide page to confirm
            # user wishes to trust the Relying Party.
            response = self.do_login(self.environ,
                                     self.start_response,
                                     success_to=self.urls['url_decide'])
            return response

    # If the response to the Relying Party is too long it's rendered as form
    # with the POST method instead of query arguments in a GET 302 redirect.
    # Wrap the form in this document to make the form submit automatically
    # without user intervention.  See _displayResponse method below...
    formRespWrapperTmpl = """<html>
    <head>
        <script type="text/javascript">
            function doRedirect()
            {
                document.forms[0].submit();
            }
        </script>
    </head>
    <body onLoad="doRedirect()">
        %s
    </body>
</html>"""

    def _displayResponse(self, oidResponse):
        try:
            webresponse = self.oidserver.encodeResponse(oidResponse)
        except server.EncodingError, why:
            text = why.response.encodeToKVForm()
            return self.showErrorPage(text)
        
        hdr = webresponse.headers.items()
        
        lenWebResponseBody = len(webresponse.body)
        if lenWebResponseBody:
            # Wrap in HTML with JAvascript OnLoad to submit the form
            # automatically without user intervention
            response = OpenIDProviderMiddleware.formRespWrapperTmpl % \
                                                        webresponse.body
        else:
            response = ''
            
        hdr += [('Content-type', 'text/html'+self.charset),
                ('Content-length', str(lenWebResponseBody))]
            
        log.debug("webresponse.code = %d" % webresponse.code)
        self.start_response('%d %s' % (webresponse.code, 
                                       httplib.responses[webresponse.code]), 
                            hdr)
        return response


    def _redirect(self, start_response, url):
        start_response('302 %s' % httplib.responses[302], 
                       [('Content-type', 'text/html'+self.charset),
                        ('Location', url)])
        return []


    def _showErrorPage(self, msg, code=500):
        response = self._renderer.renderErrorPage(self.environ,cgi.escape(msg))
        self.start_response('%d %s' % (code, httplib.responses[code]), 
                            [('Content-type', 'text/html'+self.charset),
                             ('Content-length', str(len(msg)))])
        return response
    
    
class RenderingInterface(object):
    """Interface class for rendering of OpenID Provider pages.  Create a
    derivative from this class to override the default look and feel and 
    behaviour of these pages.  Pass the new class name via the renderClass
    keyword to OpenIDProviderMiddleware.__init__"""
    
    def __init__(self, base_url, urls):
        self.base_url = base_url
        self.urls = urls

    def renderIdentityPage(self, environ):
        """Render the identity page."""
        path = environ.get('PATH_INFO').rstrip('/')
        username = path[len(self.paths['path_id'])+1:]
        
        link_tag = '<link rel="openid.server" href="%s">' % \
              self.urls['url_openidserver']
              
        yadis_loc_tag = '<meta http-equiv="x-xrds-location" content="%s">'%\
            (self.urls['url_yadis']+'/'+path[4:])
            
        disco_tags = link_tag + yadis_loc_tag
        ident = self.base_url + path

        msg = ''
        return self._showPage(environ, 
                              'Identity Page', 
                              head_extras=disco_tags, 
                              msg='''<p>This is the identity page for %s.</p>
                                %s
                                ''' % (ident, msg))
    
    tmplServerYadis = """\
<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS
    xmlns:xrds="xri://$xrds"
    xmlns="xri://$xrd*($v*2.0)">
  <XRD>

    <Service priority="0">
      <Type>%(openid20type)s</Type>
      <URI>%(endpoint_url)s</URI>
    </Service>

  </XRD>
</xrds:XRDS>
"""

    def renderServerYadis(self, environ):
        '''Render Yadis info'''
        endpoint_url = self.urls['url_openidserver']
        return RenderingInterface.tmplServerYadis % \
            {'openid20type': discover.OPENID_IDP_2_0_TYPE, 
             'endpoint_url': endpoint_url}
        
    tmplYadis = """\
<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS
    xmlns:xrds="xri://$xrds"
    xmlns="xri://$xrd*($v*2.0)">
  <XRD>

    <Service priority="0">
      <Type>%(openid20type)s</Type>
      <Type>%(openid10type)s</Type>
      <URI>%(endpoint_url)s</URI>
      <LocalID>%(user_url)s</LocalID>
    </Service>

  </XRD>
</xrds:XRDS>"""    
    
    
    def renderYadis(self, environ):
        """Render Yadis document"""
        username = environ['PATH_INFO'].rstrip('/').split('/')[-1]
        
        endpoint_url = self.urls['url_openidserver']
        user_url = self.urls['url_id'] + '/' + username
        
        yadisDict = dict(openid20type=discover.OPENID_2_0_TYPE, 
                         openid10type=discover.OPENID_1_0_TYPE,
                         endpoint_url=endpoint_url, 
                         user_url=user_url)
        
        return RenderingInterface.tmplYadis % yadisDict

        
    def renderLogin(self, environ, success_to=None, fail_to=None):
        """Render the login form."""
        
        if success_to is None:
            success_to = self.urls['url_mainpage']
            
        if fail_to is None:
            fail_to = self.urls['url_mainpage']
        
        return self._showPage(environ,
                              'Login Page', form='''\
            <h2>Login</h2>
            <form method="GET" action="%s">
              <input type="hidden" name="success_to" value="%s" />
              <input type="hidden" name="fail_to" value="%s" />
              <input type="text" name="username" value="" />
              <input type="submit" name="submit" value="Log In" />
              <input type="submit" name="cancel" value="Cancel" />
            </form>
            ''' % (self.urls['url_loginsubmit'], success_to, fail_to))


    def renderMainPage(self, environ):
        """Rendering the main page."""
        
        yadis_tag = '<meta http-equiv="x-xrds-location" content="%s">' % \
                    self.urls['url_serveryadis']
        username = environ['beaker.session']['username']    
        if username:
            openid_url = self.urls['url_id'] + '/' + username
            user_message = """\
            <p>You are logged in as %s. Your OpenID identity URL is
            <tt><a href=%s>%s</a></tt>. Enter that URL at an OpenID
            consumer to test this server.</p>
            """ % (username, quoteattr(openid_url), openid_url)
        else:
            user_message = "<p>You are not <a href='%s'>logged in</a>.</p>" % \
                            self.urls['url_login']

        return self._showPage(environ,
                              'Main Page', head_extras=yadis_tag, msg='''\
            <p>OpenID server</p>
    
            %s
    
            <p>The URL for this server is <a href=%s><tt>%s</tt></a>.</p>
        ''' % (user_message, quoteattr(self.base_url), self.base_url))
    
    def renderDecidePage(self, environ, oidRequest):
        id_url_base = self.urls['url_id'] + '/'
        
        # XXX: This may break if there are any synonyms for id_url_base,
        # such as referring to it by IP address or a CNAME.
        
        # TODO: OpenID 2.0 Allows oidRequest.identity to be set to 
        # http://specs.openid.net/auth/2.0/identifier_select.  See,
        # http://openid.net/specs/openid-authentication-2_0.html.  This code
        # implements this overriding the behaviour of the example code on
        # which this is based.  - Check is the example code based on OpenID 1.0
        # and therefore wrong for this behaviour?
#        assert oidRequest.identity.startswith(id_url_base), \
#               repr((oidRequest.identity, id_url_base))
        expected_user = oidRequest.identity[len(id_url_base):]
        username = environ['beaker.session']['username']
        
        if oidRequest.idSelect(): # We are being asked to select an ID
            msg = '''\
            <p>A site has asked for your identity.  You may select an
            identifier by which you would like this site to know you.
            On a production site this would likely be a drop down list
            of pre-created accounts or have the facility to generate
            a random anonymous identifier.
            </p>
            '''
            fdata = {
                'path_allow': self.urls['url_allow'],
                'id_url_base': id_url_base,
                'trust_root': oidRequest.trust_root,
                }
            form = '''\
            <form method="POST" action="%(path_allow)s">
            <table>
              <tr><td>Identity:</td>
                 <td>%(id_url_base)s<input type='text' name='identifier'></td></tr>
              <tr><td>Trust Root:</td><td>%(trust_root)s</td></tr>
            </table>
            <p>Allow this authentication to proceed?</p>
            <input type="checkbox" id="remember" name="remember" value="yes"
                /><label for="remember">Remember this
                decision</label><br />
            <input type="submit" name="yes" value="yes" />
            <input type="submit" name="no" value="no" />
            </form>
            '''%fdata
            
        elif expected_user == username:
            msg = '''\
            <p>A new site has asked to confirm your identity.  If you
            approve, the site represented by the trust root below will
            be told that you control identity URL listed below. (If
            you are using a delegated identity, the site will take
            care of reversing the delegation on its own.)</p>'''

            fdata = {
                'path_allow': self.urls['url_allow'],
                'identity': oidRequest.identity,
                'trust_root': oidRequest.trust_root,
                }
            form = '''\
            <table>
              <tr><td>Identity:</td><td>%(identity)s</td></tr>
              <tr><td>Trust Root:</td><td>%(trust_root)s</td></tr>
            </table>
            <p>Allow this authentication to proceed?</p>
            <form method="POST" action="%(path_allow)s">
              <input type="checkbox" id="remember" name="remember" value="yes"
                  /><label for="remember">Remember this
                  decision</label><br />
              <input type="submit" name="yes" value="yes" />
              <input type="submit" name="no" value="no" />
            </form>''' % fdata
        else:
            mdata = {
                'expected_user': expected_user,
                'username': username,
                }
            msg = '''\
            <p>A site has asked for an identity belonging to
            %(expected_user)s, but you are logged in as %(username)s.  To
            log in as %(expected_user)s and approve the login oidRequest,
            hit OK below.  The "Remember this decision" checkbox
            applies only to the trust root decision.</p>''' % mdata

            fdata = {
                'path_allow': self.urls['url_allow'],
                'identity': oidRequest.identity,
                'trust_root': oidRequest.trust_root,
                'expected_user': expected_user,
                }
            form = '''\
            <table>
              <tr><td>Identity:</td><td>%(identity)s</td></tr>
              <tr><td>Trust Root:</td><td>%(trust_root)s</td></tr>
            </table>
            <p>Allow this authentication to proceed?</p>
            <form method="POST" action="%(path_allow)s">
              <input type="checkbox" id="remember" name="remember" value="yes"
                  /><label for="remember">Remember this
                  decision</label><br />
              <input type="hidden" name="login_as" value="%(expected_user)s"/>
              <input type="submit" name="yes" value="yes" />
              <input type="submit" name="no" value="no" />
            </form>''' % fdata

        return self._showPage(environ,
                              'Approve OpenID request?', 
                              msg=msg, form=form)
        

    def _showPage(self, environ, 
                  title, head_extras='', msg=None, err=None, form=None):

        username = environ['beaker.session'].get('username')
        if username is None:
            user_link = '<a href="/login">not logged in</a>.'
        else:
            user_link = 'logged in as <a href="%s/%s">%s</a>.<br />'\
                        '<a href="%s?submit=true&'\
                        'success_to=%s">Log out</a>' % \
                        (self.urls['url_id'], username, username, 
                         self.urls['url_loginsubmit'],
                         self.urls['url_login'])

        body = ''

        if err is not None:
            body +=  '''\
            <div class="error">
              %s
            </div>
            ''' % err

        if msg is not None:
            body += '''\
            <div class="message">
              %s
            </div>
            ''' % msg

        if form is not None:
            body += '''\
            <div class="form">
              %s
            </div>
            ''' % form

        contents = {
            'title': 'Python OpenID Server - ' + title,
            'head_extras': head_extras,
            'body': body,
            'user_link': user_link,
            }

        response = '''<html>
  <head>
    <title>%(title)s</title>
    %(head_extras)s
  </head>
  <style type="text/css">
      h1 a:link {
          color: black;
          text-decoration: none;
      }
      h1 a:visited {
          color: black;
          text-decoration: none;
      }
      h1 a:hover {
          text-decoration: underline;
      }
      body {
        font-family: verdana,sans-serif;
        width: 50em;
        margin: 1em;
      }
      div {
        padding: .5em;
      }
      table {
        margin: none;
        padding: none;
      }
      .banner {
        padding: none 1em 1em 1em;
        width: 100%%;
      }
      .leftbanner {
        text-align: left;
      }
      .rightbanner {
        text-align: right;
        font-size: smaller;
      }
      .error {
        border: 1px solid #ff0000;
        background: #ffaaaa;
        margin: .5em;
      }
      .message {
        border: 1px solid #2233ff;
        background: #eeeeff;
        margin: .5em;
      }
      .form {
        border: 1px solid #777777;
        background: #ddddcc;
        margin: .5em;
        margin-top: 1em;
        padding-bottom: 0em;
      }
      dd {
        margin-bottom: 0.5em;
      }
  </style>
  <body>
    <table class="banner">
      <tr>
        <td class="leftbanner">
          <h1><a href="/">Python OpenID Server</a></h1>
        </td>
        <td class="rightbanner">
          You are %(user_link)s
        </td>
      </tr>
    </table>
%(body)s
  </body>
</html>
''' % contents

        return response

    def renderErrorPage(self, environ, msg):
        response = self._showPage(environ, 'Error Processing Request', err='''\
        <p>%s</p>
        <!--

        This is a large comment.  It exists to make this page larger.
        That is unfortunately necessary because of the "smart"
        handling of pages returned with an error code in IE.

        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************
        *************************************************************

        -->
        ''' % msg)
        
        return response