Command line options
The right sintax for EasyMesh is:
EasyMesh NAME [options]
Where NAME is the name of the
input file with or without extension.
You must separate command line options with spaces. If none of the options is specified, the default values are assumed, which means that relaxation and smoothing will be applied, the messages will be displayed, and that neither the DXF or fig will be created.
As you can see there are only four command line options, from which
the first three being more or less useless. So I think that in most cases
EasyMesh will be used with +dxf
option only. That is one of the reasons why the program is called EasyMesh.


ZACHARY- Leighton -
This Cali-born dude moved to Connecticut where he began tinkering around with computers. He later moved to Niskayuna NY, where he then graduated from Nisky High School. Zach attended Binghamton University and majored and received his BS in none other than Computer/Electrical Engineering (Shocker!) Fast forward a few years and Zachary ended up working at the same place as Stefanie's brother-in-law. He was invited to a party where he met Stefanie, and as they say, the rest is history.
STEFANIE- Bailund-Witty -
Stefanie started her days making a mess in the kitchen and pretending to cook. She attended Afikei Torah in Jerusalem, where she learned all about the intricacies of kashrut, among other Judaic studies. On the weekends she would visit her sister and family in Zichron Ya'akov. After Israel, she took The Kosher Culinary Institute by storm where she learned to create delicious glatt Kosher appetizers, entrees, and anything in between. When her sister and brother-in-law decided to move to Albany for a year, she came up to nanny for the youngest baby Yedidyah. Once she met Zachary.. as they say the rest is history.
WHEN & WHERE (SIMCHA)
This momentous occasion will take place in Schenectady, New York (or "Snickity" as some San Diegan's call it). Our beautiful synagogue Beth Israel will be opening its doors for all to share in this great simcha. We hope to see you there.
BEDEKEN
Veiling the bride
Stefanie is seated on a bridal chair, and is greeted by friends and family members. Feel free to come see Stefanie and wish her a Mazal Tov! Once the ketubah is signed, the fathers of the bride and groom escort the groom to the bride, where everyone is welcomed to sing and dance. There, Zach will place the veil over Stefanie’s face. The roots of this custom date back at least 600 years, and is based on Talmudic sources. Perhaps the ceremony signifies modesty or Zach’s responsibility, defined in the Ketubah, for clothing Stefanie. Or Zach may be symbolically confirming the identity of the bride. Zach and Stefanie will be blessed by their fathers, as they prepare for their life together. At this point, Zach is again escorted by everyone singing and dancing, to prepare for the ceremony.
TISCH
Breaking the plate
In a room down the hall, Zach meets with his friends and family who may sing and share the celebration. He may attempt to give a brief lecture on some issue in Jewish law; if so, custom dictates that he be interrupted by his friends and family singing. At the Tisch, the Tena’im- literally translated as “The Engagement”, is read by a close friend or rabbi. In Jewish law, the engagement is more than just the intention to marry; it carries considerable legal and social significance. Then, the mothers of the bride and groom break a china plate, signifying the completion of the engagement agreement. Feel free to greet Zach and wish him a Mazal Tov!
CHUPPAH
The marriage ceremony
The ceremony itself is a combination of symbolism, traditions and religiously binding acts. The central physical symbol is the Chuppah, the marriage canopy. It represents the home that they will create together, and the Divine Presence under which they will be married.
The seating at the Chuppah is separate, men are welcome to sit on one side, and women on the other side. Just as men and women sit separately during religious services.
OTHER INFORMATION
Zach’s Aufruf
The shabbat before the wedding it is customary for the groom to lead the services at the synagogue. This includes leading the prayers, and being called up to the Torah for an Aliyah as a “Chatan”, a groom. It is customary to throw candy at Zach after he concludes the blessings, as a way to “shower him with sweetness and blessings” before his wedding. For our Shomer Shabbat family and friends, and anyone else who wishes to join, meals and places to stay can be arranged.
Accommodations
For our guests joining us from far away, we have blocked off rooms in the Marriott on Wolf Road in Albany, NY. Please make reservations under the party B-W/Leighton Wedding at our reduced group rate of 115$. This reduced rate extends from Friday April 8th, to Monday April 11th. Please make reservations directly with the hotel here.
Transportation
For guests staying at the hotel, we will be providing a "party bus" service to and from the reception. If you would like to be on the "party bus" please let us know so we can arrange the proper number of trips.
Don't Miss It!
We'd love to see you there!


'use strict';
var Events = {
CONNECTED : 'connected',
/**
* The event *ready* is triggered when all the servers informations have been loaded and the notification module is ready. This event isn't triggered when the notifier drops and reconnect.
* @event Client.ready
*/
READY: 'ready',
NOTIFIER_CONNECTED: 'notifier_connected',
/**
* The event *message_received* is triggered everytime the client receive a message, the callback gives a messageNotification as first and only argument.
* @event Client.message_received
* @param {MessageNotification} message Message received
*/
MESSAGERECEIVED: 'message_received',
/**
* The event *message_edited* is triggered everytime the client receive an edited message, the callback gives a messageNotification as first and only argument.
* @event Client.message_edited
* @param {MessageNotification} message Message edited
*/
MESSAGEEDITED: 'message_edited',
/**
* The event *message_liked* is triggered everytime the client receive a like, the callback gives a messageNotification as first and only argument.
* @event Client.message_liked
* @param {MessageNotification} message Message liked
*/
MESSAGELIKED: 'message_liked',
/**
* The event *message_deleted* is triggered everytime the client receive a deleted message, the callback gives a messageNotification as first and only argument.
* @event Client.message_deleted
* @param {MessageNotification} message Message deleted
*/
MESSAGEDELETED: 'message_deleted',
/**
* The event *server_change* is triggered when a server information is changed inside the server, it can be a channel name, a reorganization of the channels, a role modified..
* The library doesn't inform yet which information have been modified, but handle the modification internally.
* @event Client.server_change
* @param {Server} server Server changed
*/
SERVERCHANGE: 'server_change'
}
exports.Events = Events;


damianh/ProxyKit A toolkit to create code-first HTTP reverse proxies on ASP.NET Core - damianh/ProxyKit
Sinclair ZX Spectrum Prototype - Computer - Computing History This is the absolute original build of the Sinclair Spectrum, probably dating from late 1981 to early 1982. This is the absolute original build of the Sinclair Spectrum, probably dating from late 1...
r/videos - Can You Trust Kurzgesagt Videos? - YouTube 49,548 votes and 2,271 comments so far on Reddit
chrislgarry/Apollo-11 Original Apollo 11 Guidance Computer (AGC) source code for the command and lunar modules. - chrislgarry/Apollo-11
🐢 wacky Twitter: https://www.twitter.com/_stickfab_ Instagram: https://www.instagram.com/stickfab Discord: https://discord.gg/ereAFax
NuGet Support in Visual Studio for Mac 7.8 - Matt Ward Changes NuGet package diagnostics displayed in Solution window Support restoring multi-target framework projects Display summary of NuGet restore …
Status as a Service (StaaS) — Remains of the Day Editor's Note 1 : I have no editor. Editor’s Note 2 : I would like to assure new subscribers to this blog that most my posts are not as long as this one. Or as long as my previous one . My long break from posting here means that this piece is a collec...
The Death of Final Tagless Final tagless. The topic strikes fear into the hearts of Scala developers everywhere—and not without reason. Final tagless allows developers to build composabl…


Sjögren’s (“SHOW-grins”) is a systemic autoimmune disease that affects the entire body. Along with symptoms of extensive dryness, other serious complications include profound fatigue, chronic pain, major organ involvement,
neuropathies and lymphomas. Today, as many as four million Americans are living with this disease. Learn more at our About Sjögren’s page.
Nine out of ten Sjögren’s patients are women. The average age of diagnosis is late 40s, although it can occur in all age groups, including children, and in both sexes.
The most common symptoms include dry eyes, dry mouth, fatigue and musculoskeletal pain. However, no two people have the exact same set of symptoms so patients should remember to share all their symptoms with their primary
healthcare provider to receive a proper diagnosis.
Sjögren’s often is undiagnosed or misdiagnosed.
The symptoms of Sjögren’s may mimic those of menopause, drug side effects, allergies, or medical conditions such as lupus, rheumatoid arthritis, fibromyalgia, chronic fatigue syndrome, and multiple sclerosis. Because all symptoms are not always present at the same time and because Sjögren’s can involve several body systems, physicians, eye care providers and dentists sometimes treat each symptom individually and do not recognize that a systemic disease is present.
The average time from onset of symptoms to diagnosis is 3 years.
Sjögren’s can be difficult to diagnose.
No single test will confirm the diagnosis and Sjögren’s may appear in many different forms in different patients.


Welcome to RPi Dashboard! To access detailed information, choose a category in the menu above.
You are not logged in, click here to login.


class Gem::Resolver::Specification
A Resolver::Specification contains a subset of the information contained in a Gem::Specification. Only the information necessary for dependency resolution in the resolver is included.
Attributes
The dependencies of the gem for this specification
The name of the gem for this specification
The platform this gem works on.
The set this specification came from.
The source for this specification
The Gem::Specification for this Resolver::Specification.
Implementers, note that install updates @spec, so be sure to cache the Gem::Specification in @spec when overriding.
The version of the gem for this specification.
Public Class Methods
Sets default instance variables for the specification.
# File lib/rubygems/resolver/specification.rb, line 49 def initialize @dependencies = nil @name = nil @platform = nil @set = nil @source = nil @version = nil end
Public Instance Methods
The name and version of the specification.
Unlike Gem::Specification#full_name, the platform is not included.
# File lib/rubygems/resolver/specification.rb, line 70 def full_name "#{@name}-#{@version}" end
Installs this specification using the Gem::Installer options
. The
install method yields a Gem::Installer
instance, which indicates the gem will be installed, or nil
,
which indicates the gem is already installed.
After installation spec is updated to point to the just-installed specification.
# File lib/rubygems/resolver/specification.rb, line 83 def install options = {} require 'rubygems/installer' destination = options[:install_dir] || Gem.dir Gem.ensure_gem_subdirectories destination gem = source.download spec, destination installer = Gem::Installer.at gem, options yield installer if block_given? @spec = installer.install end
Returns true if this specification is installable on this platform.
# File lib/rubygems/resolver/specification.rb, line 102 def installable_platform? Gem::Platform.match spec.platform end


Thank you for your interest in Bio Santafe Lifecare Pvt Ltd. In order for us to respond to all customer inquiries as quickly and helpfully as possible, please direct your inquiry to the appropriate office for your country or region. (For global-related issues, please contact our Global Head Office in Mexico, United States.)
1399 Hyde Park Rd
Santa Fe, NM 87501, United States
Email<EMAIL_ADDRESS>Phone no.: +1<PHONE_NUMBER> / +1<PHONE_NUMBER>
For a list of Bio Santafe Lifecare Pvt Ltd offices for each country and region along with website links and our Contact Form, simply click on the appropriate button below.
No. 2 AB Building,6th Floor,1-17 Roppongi,3-chome,Minato-Ku,Tokyo,106-0032 Japan
+(81-3)3589 6666
Via Cristoforo Sabbadino,163-00148 Ponte Galeria,Rome,Italy
+39 06 6500 4000
Office 5,First Floor,Building 16,The Woodlands Office Park,20 Woodlandds Drive,Woodlands,Johannesburg,2191,South africa
+39 06 6500 4000


bmon -a- Display data transfer rates in bits per second:
bmon -b- Set policy to define which network interface(s) is/are displayed:
bmon -p interface_1,interface_2,interface_3- Set interval (in seconds) in which rate per counter is calculated:
bmon -R 2.0


Confidence Level Routine¶
Although the general, mass conservation, and semi-diffusive approaches can quickly provide confirmation of bistability for most examples, this may not always be the case. In fact, an important item of discussion is that these approaches cannot exclude bistability, even if a large amount of random decision vectors are explored. It is this uncertainty that we wish to address. This is done by assigning a probability that the minimum objective function value achieved is equal to the true global minimum. We achieve this probability by considering a slightly modified version of the unified Bayesian stopping rule in [BGS04] and Theorem 4.1 of [SF87], where the rule was first established.
Let and denote the probability that the optimization routine has converged to the local minimum objective function value, say , and global minimum objective function value, say . Assuming that for all local minimum values we may then state that the probability that is as follows:
,
where is the number of initial decision vectors that are considered, , and are parameters of the Beta distribution , and is the confidence level. We then let be the number of for that are in the neighborhood of .
Given our minimum objective function value is zero, for some networks it may be the case that the are nearly zero with respect to machine precision. For this reason, we say that is in the neighborhood of if
.
This means that is in the neighborhood of if the relative error of and is less than 1%. If is considered zero with respect to the system’s minimum positive normalized float, then we consider this value zero and provide , skipping the computation of . Thus, we can state that the probability that the obtained is the global minimum (for the prescribed bounds of the decision vector) is greater than or equal to the confidence level . Using the standard practice in statistics, it should be noted that is often considered an acceptable confidence level to make the conclusion that is the global minimum of the objective function.
For information on how to enable the construction of a confidence level for each of the approaches, please refer to the following for each approach:
- Mass conservation approach:
- If using
crnt4sbml.MassConservationApproach.run_optimization()
set confidence_level_flag = True and and prescribe a value to change_in_rel_error (if applicable) - If using
crnt4sbml.MassConservationApproach.run_mpi_optimization()
set confidence_level_flag = True and and prescribe a value to change_in_rel_error (if applicable)
- If using
- Semi-diffusive approach:
- If using
crnt4sbml.SemiDiffusiveApproach.run_optimization()
set confidence_level_flag = True and prescribe a value to change_in_rel_error (if applicable) - If using
crnt4sbml.SemiDiffusiveApproach.run_mpi_optimization()
set confidence_level_flag = True and and prescribe a value to change_in_rel_error (if applicable)
- If using
- General approach:
- If using
crnt4sbml.GeneralApproach.run_optimization()
set confidence_level_flag = True and prescribe a value to change_in_rel_error (if applicable)
- If using


Thanks for logging in to ReciFlix Web, We are following a mobile first approach, also actively working on making this website ready for you, meanwhile please continue to use ReciFlix mobile app, we will announce soon when this website is ready with the functionality.


Listen to Narration
FOLLOW THE SCIENCE: LEARN MORE HERE
JOIN OUR CRUSADE
Explore AR: inside the world of hair
Learn More About AVERtek's XR-NOW


CRAFT BEER THAT SATIFIES
about us
Blyth Cowbell Brewing Co. is Canada’s destination craft brewery. Purposeful. Sustainable. Fun. An award winning state-of-the-art brewing facility, restaurant with indoor and outdoor seating, retail store, and entertainment spaces. Cowbell’s accessible, family-friendly restaurant and brewery is located on 120-acres south of the historic village of Blyth, and our commitment is simple and clear - to provide you with a one-of-a-kind Guest experience, highlighted by delicious craft beer, Truly Local food and warm hospitality. Every time.
our beers
OUR BEERS SERIES
FOUNDERS SERIES
SESSION SERIES
ANNIVERSARY SERIES
our promise
Cowbell contributes 5¢ from the sale of every pint and can, from the very first can of beer sold in May 2016, to support partners in our communities.
Community fund
First and foremost, Cowbell is about people. The Greener Pastures Community Fund is Cowbell's initiative to give back to local communities and charitable organizations. Cowbell has been donating 5¢ from the sale of every can and every pint to the Fund, from the very first pint sold in May of 2016. Cowbell is pleased to support remarkable organizations that make a positive impact on the lives of thousands of people each year, from the city to the country. Your support makes this possible - thank you.


Regulations & standards
{{item.title}}
Global regulators
Upcoming events (3)
29
AUG
Other
FINMA
Basel IV-Caoital Floor
Saved documents (4)


Favorite Things List
Who's your favourite musician?
Who's your favourite actor?
Who's your favourite author?
submit
Your favourite musician is
. Your favorite actor/actress is
. Your favorite author is


We were warned. The trailer for Godzilla had a little man cast his fishing line off a pier in N.Y. harbor. He gets a bite, and then the water starts to swell -- hundreds of yards away. The swell heads right for his spot, explosively destroying the pier as the man runs for his life. What did we just see? Godzilla was clearly beyond the range of the fisherman, and why would the creature choose to bulldoze the pier, shoving his face into the wooden pilings? The whole scene was staged so we could see the baggy-pants comic figure run from a special effect. It makes no sense. Now imagine two hours like that.
The movie starts with a trawler being attacked in the South Pacific. Later, the lone survivor lies in shock in a hospital. With a match waved in his face, the the old Japanese man weakly says: "Gojira, Gojira." This is a poor version of the "Keyser Soze" scene from The Usual Suspects, but the film editors like it enough to reprise the video tape a couple of times. Later, in Panama, huge footprints are found, crossing a plain in an unnatural, cookie-cutter manner. Next thing we know, it's closing in on New York. Showdown time, right? Wrong. A better paced film would stage skirmishes in several places, leading to a big climax in Gotham, but our boy gets there in the first half hour. The last ninety minutes cannot be non-stop action, so what do we do?
The lizard gets to stomp around a bit, in a classically Godzilla fashion, but then the military loses him. Yes, a twenty-story dinosaur just steps in off the street, "hiding" in some buildings. Think that's bad? He also gets to move around in underground tunnels. Hellooooo!? Suspension of disbelief is necessary in many Sci-Fi films, but this is a bit much. The design of the creature is pretty impossible, too, but I do not think the producers care about alienating the bio-engineers the audience. Okay, okay, who cares? We all just want to see the special effects. Good news, bad news.
There is a reasonable amount of screen time devoted to creature effects, but a lot of them are repetitive. Seeing Godzilla lope down Manhattan streets is entertaining, but we just get to see more similar scenes of Godzilla zipping around town like he was marching through K-Mart. Other scenes have a staged awkwardness about them. Some variety is provided by the little godzillas that hatch later in the film. They behave much like Spielberg's raptors, but their stalking gets overused, too. Enough action, but not much interaction.
There are some decent actors who may not welcome this entry on their resume, so let me just mention Hank Azaria, who has been doing a fine job for years, most notably in The Birdcage. His character here is a little more alive than the rest, so maybe people will learn his name. In closing, I leave you with one thought: We have been told that we get the government we deserve, and that may be true. But we certainly get the movies we deserve -- if enough people buy tickets, Hollywood does it again. The end of Godzilla has a setup for a sequel. Godzilla may be worth checking out, just to see what it looks like, but repeat viewing will send the producers the message that you are ready for that sequel. Think about it.
The review above was posted to the
rec.arts.movies.reviews newsgroup (de.rec.film.kritiken for German reviews).
The Internet Movie Database accepts no responsibility for the contents of the
review and has no editorial control. Unless stated otherwise, the copyright
belongs to the author.
Please direct comments/criticisms of the review to relevant newsgroups.
Broken URLs inthe reviews are the responsibility of the author.
The formatting of the review is likely to differ from the original due
to ASCII to HTML conversion.
Related links: index of all rec.arts.movies.reviews reviews


In this section you can view how to create, edit, delete and manage basket items.
Create new Basket Item
To create new basket item you first must select "Add Item" button
It will open new section for adding basket item details:
-
-
- Name (Required) - Name of the basket item
- Article number (Required) - Article number
- Unit price (Required) - Price for one unit
- Quantity (Required) - Quantity
- Tax (Required) - Tax in percents
- Discount - Discount in Euro
- Total price (disabled for edit)- Total price without Tax
- Unit Price With Tax (disabled for edit)- Unit Price With Tax
- Total Price With Tax (disabled for edit)- Total Price With Tax
After you fill required fields, You will see calculated prices:
To save the item click on save button:
You will see just saved item information
If you want to add another item click on "Add Item" button again
Edit Basket Item
To edit basket item you must select edit icon for selected item
It will open new section for editing basket item details:
-
-
- Name (Required) - Name of the basket item
- Article number (Required) - Article number
- Unit price (Required) - Price for one unit
- Quantity (Required) - Quantity
- Tax (Required) - Tax in percents
- Discount - Discount in Euro
- Total price (disabled for edit)- Total price without Tax
- Unit Price With Tax (disabled for edit)- Unit Price With Tax
- Total Price With Tax (disabled for edit)- Total Price With Tax
After you edit needed fields, you will see recalculated prices:
To save edited item click on save button:
You will see just saved item information
Delete Basket Item
To delete basket Item you must select delete icon for selected basket
When you click it, basket item will disappear from items list
Basket Details in Order transactions
In Order view you can find basket details in transactions details section:
If you click on the arrow of the basket item you can see additional detals
- Name - Name of the basket item
- Article number - Article number
- Unit price - Price for one unit without tax
- Quantity - Quantity
- Tax - Tax in percents
- Total price- Total price without Tax
- Unit Price With Tax - Unit Price With Tax
- Total Price With Tax- Total Price With Tax
Capture basket Items
On Capture transaction, merchant can capture all or partial items from basket
When you are on Capture screen you will see basket section:
If you click on the arrow of the basket item you can see additional detals
It will open full details about the selected basket item:
- Name - Name of the basket item
- Article number - Article number
- Unit price - Price for one unit without tax
- Quantity - Quantity
- Tax - Tax in percents
- Total price- Total price without Tax
- Unit Price With Tax - Unit Price With Tax
- Total Price With Tax- Total Price With Tax
To Capture basket items you must check on "Capture" checkbox for selected item
It will enable selection of Quantity and calculate Amount to capture:
Important! - By default It will capture all units of selected item. If you want partial capture you can change wanted quantity.
If you don't want to capture all units, you can change quantity:
When you change quantity, the Amount to capture will be recalculated:
Now you can continue with capturing wanted amount, by selecting capture button:
Now you can see successfully captured items in Transaction details section:
Cancel basket Items
On Cancel transaction, merchant can cancel all or partial items from basket
When you are on Cancel screen you will see basket section:
If you click on the arrow of the basket item you can see additional detals
It will open full details about the selected basket item:
- Name - Name of the basket item
- Article number - Article number
- Unit price - Price for one unit without tax
- Quantity - Quantity
- Tax - Tax in percents
- Total price- Total price without Tax
- Unit Price With Tax - Unit Price With Tax
- Total Price With Tax- Total Price With Tax
To Cancel basket items you must check on "Cancel" checkbox for selected item
It will enable selection of Quantity and calculate Amount to cancel:
Important! - By default It will cancel all units of selected item. If you want partial cancel you can change wanted quantity.
If you don't want to cancel all units, you can change quantity:
When you change quantity, the Amount to cancel will be recalculated:
Now you can continue with capturing wanted amount, by selecting "Submit" button:
After submitting you can view successful Cancel transaction in Transaction details section:
Refund basket Items
On Refund transaction, merchant can refund all or partial items from basket
When you are on Refund screen you will see basket section:
If you click on the arrow of the basket item you can see additional details
It will open full details about the selected basket item:
- Name - Name of the basket item
- Article number - Article number
- Unit price - Price for one unit without tax
- Quantity - Quantity
- Tax - Tax in percents
- Total price- Total price without Tax
- Unit Price With Tax - Unit Price With Tax
- Total Price With Tax- Total Price With Tax
To Refund basket items you must check on "Refund" checkbox for selected item
It will enable selection of Quantity and calculate Amount to refund:
Important! - By default It will refund all units of selected item. If you want partial refund you can change wanted quantity.
If you don't want to refund all units, you can change quantity:
When you change quantity, the Amount to refund will be recalculated:
Now you can continue with capturing wanted amount, by selecting "Submit" button:
After submitting you can view successful Refund transaction in Transaction details section:


| [ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
text.unicode
- Unicode[eBeBThis module provides various operations on a sequence of Unicode codepoints.
Gauche can be compiled with a native encoding other than Unicode, and the full Unicode-compatible behavior on characters and strings may not be available on such systems. So we provide most operations in two flavors: Operations on characters and strings, or operations on codepoints represented as a sequence of integers.
If Gauche is compiled with its native encoding being none
,
euc-jp
or sjis
, character-and-string operations
are likely to be partial functions of the operations defined
in Unicode standard. That is, if the operation can yield a
character that are not supported in the native encoding, it
may be remapped to an alternative character. Each manual entry
explains the detailed behavior.
The codepoint operations are independent from Gauchefs native
encoding and supports full spec as defined in Unicode standard.
If Gauche is compiled with the utf-8
native encoding,
the operations are essentially the same as character-and-string flavors
when you convert codepoints and characters by char->integer
and
integer->char
. The codepoint operations are handy when
you need to support the algorithms described in Unicode standard
fully, no matter what the running Gauchefs native encoding is.
| 11.47.1 Unicode transfer encodings | ||
| 11.47.2 Unicode text segmentation | ||
| 11.47.3 Full string case conversion |
| [ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
The procedures in this group operate on codepoints represented as integers. In the following descriptions, eoctetsf refers to an integer between 0 to 255, inclusive.
They take optional strictness argument. It specifies what to do when the procedure encounters a datum outside of the defined domain. Its value can be either one of the following symbols:
strict
Raises an error when the procedure encounters such input. This is the default behavior.
permissive
Whenever possible, treat the date as if it is a valid value.
For example, codepoint value beyond #x10ffff
is invalid
in Unicode standard, but it may be useful for some other purpose
that just want to use UTF-8 as an encoding scheme of binary data.
ignore
Whenver possible, treat the invalid input as if they do not exist.
The procedure may still raise an error in permissive
or
ignore
strictness mode, if there canft be a sensible
way to handle the input data.
Takes an integer codepoint and returns list of octets that encodes the input in UTF-8.
(ucs4->utf8 #x3bb) Λ (206 187) (ucs4->utf8 #x3042) Λ (227 129 130) |
If strictness is strict
(default), input codepoint
between #xd800
to #xdfff
, and beyond #x110000
,
are rejected. If strictness is permissive
, it accepts
input between 0
and #x7fffffff
, inclusive; it may produce
5 or 6 octets if the input is large (as the original UTF-8 definition).
If strictness is ignore
, it returns an empty list
for invalid codepoints.
Takes octet as the first octet of UTF-8 sequence, and returns the number of total octets requried to decode the codepoint.
If strictness is strict
(default), this
procedure returns either 1, 2, 3 or 4. An error is
thrown if octet cannot be a leading octet of
a proper UTF-8 encoded Unicode codepoint.
If strictness is permissive
, this procedure
may return an integer between 0 and 6, inclusive.
It allows the codepoint range #x110000
to
#x7fffffff
as the original utf-8 spec, so
the maximum number of octets can be up to 6.
If the input is in the range between #xc0
and #xdf
, inclusive, this procedure returns
1?itfs up to the application how to treat these illegal
octets. For other values, it returns 0
.
If strictness is ignore, this procedure
returns 0
when it would raise an error if
strictness is strict
. Other than that,
it works the same as the default case.
Takes a list of octets, and decodes it as a utf-8 sequence. Returns two values: The decoded ucs4 codepoint, and the rest of the input list.
An invalid utf8 sequence causes an error if strictness
is strict
, or skipped if it is ignore
.
If strictness is permissive
, the procedure accepts
the original utf-8 sequence which can produce surrogated pair
range (between #xd800
and #dfff
) and the range
between #x110000
to #x7fffffff
. The invalid
octet sequence is still an error with permissive
mode.
| [ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
These procedures implements grapheme-cluster and word breaking algorithms defined in UAX #29: Unicode Text Segmentation.
From given string or codepoint sequence (a <sequence>
object containing list of codepoints), returns a list of
words. Each cluster is represented as a string, or
a sequence of the same type as input, respectively.
(string->words "That's it.") Λ ("That's" " " "it" ".") (codepoints->words '(84 104 97 116 39 115 32 105 116 46) Λ ((84 104 97 116 39 115) (32) (105 116) (46)) |
In the second example, the list is a list of codepoints of characters in "Thatfs it."
From given string or codepoint sequence (a <sequence>
object containing list of codepoints), returns a list of
grapheme clusters. Each cluster is represented as a string,
or a sequence of the same type as input, respectively.
The following procedures are low-level building blocks
to build the above string->words
etc.
A generator argument is a procedure
with no arguments, and returns a value (or some values) at at time
for every call, until it returns EOF.
From given generator is a generator of characters or codepoints,
returns a generator that returns two values: The first value is the
character or codepoint generated from the original generator, and the
second value is a boolean flag, which is #t
if a word
or a grapheme cluster
breaks before the character/codepoint, and #f
otherwise.
Suppose a generator g returns characters in a string
That's it.
, one at a time. Then the created generator
will work as follows:
(define brk (make-word-breaker g)) (brk) Λ #\T and #t (brk) Λ #\h and #f (brk) Λ #\a and #f (brk) Λ #\t and #f (brk) Λ #\' and #f (brk) Λ #\s and #f (brk) Λ #\space and #t (brk) Λ #\i and #t (brk) Λ #\t and #f (brk) Λ #\. and #t (brk) Λ #<eof> and #t |
It shows the word breaks at those character boundaries shown
by the caret ^
below (for clearity, I use _
to indicate
the space).
T h a t ' s _ i t . ^ ^ ^ ^ ^ |
The input generator is a generator of characters or codepoints, and return is a procedure that takes a list of characters or codepoints, and returns an object. These procedures creates a generator that returns an object at at time, each consists of a word or a grapheme cluster, respectively.
Suppose a generator g returns characters in a string
That's it.
, one at a time, again.
Then the created generator works as follows:
(define brk (make-word-reader g list->string)) (brk) Λ "That's" (brk) Λ " " (brk) Λ "it" (brk) Λ "." (brk) Λ #<eof> |
| [ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
[R6RS] Converts given string to upper case, using language-independent full case folding defined by Unicode standard. They differ from srfi-13fs procedures with the same names (See section ΆρΜP[X(εΆ¬Ά)}bsO), which simply uses character-by-character case mapping. Notably, the length of resulting string may differ from the source string, and some conversions are sensitive to whether the character is at the word boundary or not. The word boundaries are determined according to UAX #29 text segmentation rules.
(string-upcase "strase") Λ "STRASSE" (string-downcase "΄°΄°.΄°. °.") Λ "ΤΏΝΠΤΏΝΠ.ΤΏΝ?. Π." (string-titlecase "You're talking about R6RS, right?") Λ "You're Talking About R6rs, Right?" (string-foldcase "strase") Λ "strasse" (string-foldcase "΄°°") Λ "ΤΏΝΠΠ" |
Like string-upcase
etc, but these work on a sequence of
codepoints instead. Returns a sequence of the same type of the input.
(codepoints-upcase '#(115 116 114 97 223 101)) Λ #(83 84 82 65 83 83 69) |
| [ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] |
This document was generated by Shiro Kawai on May 28, 2012 using texi2html 1.82.


@TODO
is a convention I have used to tag anything that needs looking into. Using VSCode I open a global search panel with @TODO
and it provides me a todo list. I then check each of the todos before a release and use the todos to ensure refactorings and similar tech debt do not get forgotten.let global = <iGlobalModel>services.get("globalmodel")
which will allow TypeScript static checking to work as well as your IDE intellisense.


Working with us speeds up the development process for you because we do all the work for you. We make simplistic designs for professional and personal use and they are highly customizable to perfectly fit with your needs.
Our websites are cross-platform and thus can be appealing on any device that you might be using. We make mobile responsive websites with a great user experience that makes it easy for your targetted people to navigate around your site. We keep it simple and fast.
We are focused on giving you the best customer service that can get you whatever you need at the least stressful way. Afterall we are at your service and thus it is our duty to satisfy your needs in the best way possible.


property Position: Integer;
Specifies the current position of the scrollbar.
Read Position to determine the current position of the thumb tab.
Set Position to programmatically move the handle. The available range of positions is determined by the difference between the Max property and the Min property.
When Position is changed programmatically, gauge bar will generate OnChange event, when it is changed by user (by clicking scrolling buttons, dragging the handle or clicking on the background area), the control will additionally generate OnUserChange event.


IHSAA Football State Finals to be televised live by FOX Sports Indiana
by FOX Sports IndianaThe IHSAA Football State Finals will be televised live on FOX Sports Indiana and FOX Sports Indiana Plus on Thanksgiving Friday and Saturday.
The Class A, 3A and 5A State Finals take place Friday, Nov. 29, at Lucas Oil Stadium. Class 2A, 4A and 6A games will be played Saturday, Nov. 30. Coverage begins each day at 12 p.m. ET/11 a.m. CT.
The Class A, 2A and 3A games will air on FOX Sports Indiana. The 4A, 5A and 6A games will air on FOX Sports Indiana Plus, an alternate channel, due to overlap with Indiana Pacers telecasts on FOX Sports Indiana.
Viewers within the FOX Sports Indiana coverage area can also stream the championships live on the FOX Sports GO app and FOXSportsGO.com. Those outside the FOX Sports Indiana coverage area can stream the championships at IHSAAtv.org. The games will also be available at IHSAAtv.org on a delayed basis following the conclusion of the telecasts.
In addition, all six games will be televised nationally on FOX College Sports.
A full schedule is below. Click HERE for FOX Sports Indiana channel numbers. Fans with questions about the telecasts can email<EMAIL_ADDRESS>or tweet @FSIndiana.
IHSAA Football State Finals Telecast Schedule (times Eastern)
| LIVE, Friday, Nov. 29 | ||||
| Time | Game | TV | FSGO streaming link | Announcers |
| 12 p.m. | Class A | FOX Sports Indiana FOX College Sports Pacific |
https://a.fsgo.com/IqZZkeW1D1 | Jeremiah Johnson, Jan Boser, Ryan Myrehn |
| 3:30 p.m. | Class 3A | FOX Sports Indiana FOX College Sports Pacific |
https://a.fsgo.com/zyVZ5SHiE1 | Mark Jaynes, Lance Scheib, Mark Foerster |
| 7 p.m. | Class 5A | FOX Sports Indiana Plus FOX College Sports Pacific |
https://a.fsgo.com/WEdyLVfxE1 | Mark Jaynes, Lance Scheib, Mark Foerster |
| LIVE, Saturday, Nov. 30 | ||||
| 12 p.m. | Class 2A | FOX Sports Indiana FOX College Sports Central |
https://a.fsgo.com/UpfdfnQIF1 | Pat Boylan, Jan Boser, Ryan Myrehn |
| 3:30 p.m. | Class 4A | FOX Sports Indiana Plus FOX College Sports Central |
https://a.fsgo.com/ILKTGOA7F1 | Greg Rakestraw, Joe Reitz, John Herrick |
| 7 p.m. | Class 6A | FOX Sports Indiana Plus FOX College Sports Central |
https://a.fsgo.com/EFI0EpbgG1 | Greg Rakestraw, Lance Scheib, John Herrick |
Replays (times Eastern)
| Day, Date | Time | Game | TV |
| Monday, Dec. 2 | 11 a.m. | Class A | FOX Sports Indiana, FOX Sports Midwest |
| Tuesday, Dec. 3 | 12 p.m. 2 p.m. |
Class 2A Class 3A |
FOX Sports Indiana, FOX Sports Midwest |
| Wednesday, Dec. 4 | 12 p.m. 2 p.m. 4 p.m. |
Class 4A Class 5A Class 6A |
FOX Sports Indiana, FOX Sports Midwest |
| Thursday, Dec. 5 | 6 p.m. 8 p.m. |
Class 5A Class 6A |
FOX Sports Indiana, FOX Sports Midwest |
| Friday, Dec. 6 | 10 a.m. 12 p.m. 2 p.m. |
Class A Class 2A Class 3A |
FOX Sports Indiana, FOX Sports Midwest |


artist
Zhashua
bio
Artist. Designer. Coder.
Title
Framed
Story
As global average temperatures continued to rise and industry pumped out more CO2 than ever, the world shifted focus onto the carbon output of NFTs, its underlying technology, and the artists minting them. Many artists felt targeted, misrepresented, and … framed.
Framed, is the the genesis piece by one of the founders of Nifty Offset. It contains coded messages and Easter eggs. 100% of the sale will be used for our first offset and grants for new artists.
GET


◆ __init__()
| def response_functions.airfoil_2d_responses.PerimeterResponseFunction.__init__ |
( |
|
self, |
|
|
|
response_id, |
|
|
|
response_settings, |
|
|
|
model |
|
) |
| |
◆ CalculateGradient()
| def response_functions.airfoil_2d_responses.PerimeterResponseFunction.CalculateGradient |
( |
|
self | ) |
|
◆ CalculateValue()
| def response_functions.airfoil_2d_responses.PerimeterResponseFunction.CalculateValue |
( |
|
self | ) |
|
◆ GetNodalGradient()
| def response_functions.airfoil_2d_responses.PerimeterResponseFunction.GetNodalGradient |
( |
|
self, |
|
|
|
variable |
|
) |
| |
◆ GetValue()
| def response_functions.airfoil_2d_responses.PerimeterResponseFunction.GetValue |
( |
|
self | ) |
|
◆ Initialize()
| def response_functions.airfoil_2d_responses.PerimeterResponseFunction.Initialize |
( |
|
self | ) |
|
◆ main_model_part
| response_functions.airfoil_2d_responses.PerimeterResponseFunction.main_model_part |
◆ model
| response_functions.airfoil_2d_responses.PerimeterResponseFunction.model |
◆ model_part_name
| response_functions.airfoil_2d_responses.PerimeterResponseFunction.model_part_name |
◆ step_size
| response_functions.airfoil_2d_responses.PerimeterResponseFunction.step_size |
The documentation for this class was generated from the following file:
- /home/runner/work/Documentation/Documentation/master/applications/ShapeOptimizationApplication/python_scripts/response_functions/airfoil_2d_responses.py


| TOC |
|
OpenID Connect is an identity framework that provides authentication, authorization, and attribute transmition capability. It allows third party attested claims from distributed sources. The specification suite consists of Building Blocks (Core, JSON Web Token, JSON Web Signatures, JSON WEB Encryption, JSON Web Keys, Simple Web Discovery), Protocol Bindings (e.g, Artifact Binding, Web App Binding, User Agent Binding) and Extensions. This specification is the "Core" of the suite that defines the messages used and abstract flow which will be further constrained or extended in the companion specifications in the suite.
1.
Requirements Notation and Conventions
2.
Terminology
3.
Overview
4.
Messages
4.1.
Authorization Endpoint
4.2.
Token Endpoint
4.3.
UserInfo Endpoint
4.4.
Session Management Endpoints
5.
serializations
5.1.
Query String serialization
5.2.
JSON Serialization
5.3.
Conversions of OpenID 2.0 encodings
6.
Signatures
7.
Encryption
8.
Requests and Responses
9.
Verification
9.1.
Authorization Request Verification
9.2.
Authorization Response Verification
9.3.
UserInfo Request Verification
9.4.
UserInfo Response Verification
10.
Extensions
11.
Security Considerations
11.1.
Assertion manufacture/modification
11.2.
Assertion disclosure
11.3.
Assertion repudiation
11.4.
Assertion redirect
11.5.
Assertion reuse
11.6.
Secondary authenticator manufacture
11.7.
Secondary authenticator capture
11.8.
Assertion substitution
11.9.
Authentication Request Disclosure
11.10.
Timing Attack
11.11.
Authentication Process Threats
12.
IANA Considerations
12.1.
OAuth Parameters Registry
13.
Open Issues and Things To Be Done (TBD)
Appendix A.
Acknowledgements
Appendix B.
Document History
14.
Normative References
§
Authors' Addresses
| TOC |
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] (Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” March 1997.) .
Throughout this document, values are quoted to indicate that they are to be taken literally. When using these values in protocol messages, the quotes MUST NOT be used as part of the value.
| TOC |
- Protected Resource
- An access-restricted resource which can be obtained using an OAuth-authenticated request.
- Resource Server
- A server capable of accepting and responding to protected resource requests.
- Client
- An application obtaining authorization and making protected resource requests on behalf of the resource owner and with its authorization.
- Resource Owner
- An entity capable of granting access to a protected resource. When the resource owner is a person, it is referred to as an End-user.
- End-user
- A human resource owner.
- Authentication
- An act of verifying End-User's identity through the verification of the credential.
- Access Token
- A string representing an access authorization issued to the client. The string is usually opaque to the client. Tokens represent specific scopes and durations of access, granted by the resource owner, and enforced by the resource server and authorization servers.
- Refresh Token
- A token used by the client to obtain a new access token without having to involve the resource owner.
- Authorization Code
- A short-lived token representing the authorization provided by the end-user. The authorization code is used to obtain an access token and a refresh token.
- Authorization Grant
- A general term used to describe the intermediate credentials (such as an end-user password or authorization code) representing the resource owner authorization. Access grants are used by the client to obtain an access token. By exchanging access grants of different types for an access token, the resource server is only required to support a single authentication scheme.
- Authorization Server
- A server capable of authenticating the resource owner and issuing tokens after obtaining authorization from the authenticated Resource Owner. The authorization server may be the same server as Resource Server or a separate entity. A single authorization server may issue tokens for multiple resource servers.
- OpenID Provider (OP)
- Authorization Servers that are able to support OpenID Connect Messages.
- Relying Party (RP)
- Client and Resource Servers.
- Authorization Endpoint
- The Authorization Server's endpoint capable of authenticating the End-User and obtaining authorization.
- Client Identifier
- An unique identifier that the client to identify itself to the OP.
- Client Secret
- A shared secret established between the OP and client.
- Token Endpoint
- The Authorization Server's HTTP endpoint capable of issuing tokens.
- OP Endpoints
- End-User Authentication, Authorization, and Token Endpoint.
- RP Endpoints
- The endpoint to which the OP responses are returned through redirect.
- UserInfo Endpoint
- A protected resource that when presented with a token by the client returns authorized information about the current user.
- Claims
- A statement that something is true or factual.
- Assertion
- A set of Claims about the End-User which is attested by the OP and Resource Servers.
- Compact Serialization
- Compact Serialization defined in JSON Web Token (Jones, M., Belfanz, D., Bradeley, J., Goland, Y., Panzer, J., Sakimura, N., and P. Tarjan, “JSON Web Token,” January 2011.) [jwt].
- Base64url
- Base 64 Encoding [RFC3548] (Josefsson, S., “The Base16, Base32, and Base64 Data Encodings,” July 2003.) with URL and Filename Safe Alphabet without padding.
| TOC |
OpenID Connect protocol in abstract follows the following steps.
Each message may be signed and encrypted. When the message is encrypted, it MUST be signed first then encrypted. This specification only defines the abstract messsage flow and message formats. The actual use MUST base on one of the companion protocol bindings specifications such as OpenID Connect Artifact Binding 1.0 (Sakimura, N., Ed., Bradley, J., de Madeiros, B., Ito, R., and M. Jones, “OpenID Connect Artifact Binding 1.0,” January 2011.) [OpenID.AB] or OpenID Connect Authorization Code Binding 1.0 (Mortimore, C., Ed., Sakimura, N., Bradley, J., de Madeiros, B., Ito, R., and M. Jones, “OpenID Connect Authorization Code Binding 1.0,” January 2011.) [OpenID.AC].
| TOC |
In OpenID Connect protocols in abstract, the process proceeds by the Client interacting with Endpoints. There are number of Endpoints involved.
Both Request and Response may either be serialized into Query String serialization (Query String serialization) or JSON (Crockford, D., “The application/json Media Type for JavaScript Object Notation (JSON),” July 2006.) [RFC4627].
| TOC |
Autorization Code Request / Response interacts with Authorization Endpoint.
| TOC |
Following is the list of variables to be sent as the top level keys:
- response_type
- REQUIRED. The parameter value MUST be set to code for requesting an Authorization Code, token for requesting an Access Token. The Authorization Server MAY decline to provide one or more of these response types.
- client_id
- REQUIRED. The client identifier recognized by the Authorization Server.
- redirect_uri
- REQUIRED unless a redirection URI has been established between the client and authorization server via other means. An absolute URI to which the authorization server will redirect the user-agent to when the End-User authorization step is completed. The authorization server SHOULD require the client to pre-register their redirection URI.
- scope
- OPTIONAL. The scope of the access request expressed as a list of space-delimited strings. The value of the scope parameter is defined by the authorization server. If the value contains multiple space-delimited strings, their order does not matter, and each string adds an additional access range to the requested scope. It MUST include openid as one of the string. [[ToDo: Maybe we do not need it, as openid param is required.]]
- state
- OPTIONAL. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client.
- openid
- REQUIRED. A JSON object that holds OpenID request variables.
- type
- REQUIRED. A type identifier that identifies the message type. A URI http://openid.net/specs/cc/1.0#env .
Following is the list of OpenID Authentication 2.0<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.) [OpenID.authentication‑2.0] variables are to be sent under the key "openid": when OpenID 2.0 identifier compatibility is sought.
- type
- REQUIRED. A type identifier that identifies the message type. Set to "http://openid.net/specs/cc/1.0/#req".
- immediate
- OPTIONAL. indicates if the authorization server should display the authorization user interface. "True" if it should not display the user interface or "False" to display. Default is "False".
- claimed_id
- OPTIONAL. The claimed_id as in OpenID 2.0<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.) [OpenID.authentication‑2.0]
- identity
- OPTIONAL. The local identifier as in OpenID Authentication 2.0<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.) [OpenID.authentication‑2.0].
- realm
- REQUIRED if PPID were used in previous authentications. URL pattern the OP SHOULD ask the end user to trust. See Section 9.2 of OpenID Authentication 2.0<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.) [OpenID.authentication‑2.0].
- server_id
- OPTIONAL. The intended recipient of this request.
- pubkey
- OPTIONAL. The base64url encoded DER format X.509 certificate of the RP.
- atype
- OPTIONAL. Type of assertion to be returned at the end. Values are one of the following:
- openid2json : (Default) OpenID Artifact Binding's default assertion format, which is JSON.
- openid2jsonp : openid2json wrapped in "openidjsonp();" so that it will be a JSONP format.
- openid2json+sig: openid2json assertion signed.
- openid2json+sig+enc: openid2json assertion signed and encrypted.
- saml2: SAML ver.2 assertion.
- wss : WS-Security assertion.
These variables are sent from the client to the end-user authorization endpoint according to the protocol bindings of this specification. There are two serialization of the above variables: Query Parameters serialization and JSON serialization.
Following is a non-normative example when they are sent in the query parameters serialization.
GET /authorize?scope=openid&response_type=code &openid.type=http%3A%2F%2Fopenid.net%2Fspecs%2Fcc%2F1.0%2F%23req &client_id=s6BhdRkqt3&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb HTTP/1.1 Host: server.example.com
Following is a non-normative example when they are sent as a JSON object serialization.
{ "type": "http://openid.net/specs/cc/1.0#env, "openid": { "type": "http://openid.net/specs/cc/1.0#req", "server_id": "http://example.com/op/", "immediate": "true", "claimed_id":"http://specs.openid.net/auth/2.0/identifier_select", "identity": "http://specs.openid.net/auth/2.0/identifier_select", "ns.pape": "http://specs.openid.net/extensions/pape/1.0", "pape.auth_level.ns.nist": "http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf", "pape.preferred_auth_level_types": "nist" }, "redirect_uri": "https://example.com/rp/endpoint_url", "response_type":"code", "client_id": "http://example.com/rp/", "scope": "openid", "state": "af0ifjsldkj" }
| TOC |
If the End-User grants the access request, the Authorization Server issues an Authorization Code or an Access Token and delivers them to the Client. Following are the list of the parameter included in the Response message when the response_type in the request was code. Note that if the response_type in the request was token, the Access Token Response (Access Token Response) defined later MUST be returned instead.
- code
- REQUIRED. The authorization code generated by the authorization server. The authorization code SHOULD expire shortly after it is issued to minimize the risk of leaks. The client MUST NOT reuse the authorization code. If an authorization code is used more than once, the authorization server MAY revoke all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI.
- state
- REQUIRED if the state parameter was present in the client authorization request. Set to the exact value received from the client.
For example, the Authorization Server redirects the End-User's user-agent by sending the following HTTP response:
HTTP/1.1 302 Found Location: https://client.example.com/cb?code=i1WsRn1uB1
Clients SHOULD ignore unrecognized response parameters. The sizes of tokens and other values received from the authorization server, are left undefined by this specification. Clients should avoid making assumptions about value sizes. Servers should document the expected size of any value they issue.
| TOC |
If the end-user denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the client by adding the following parameters to the redirection URI query component using the application/x-www-form-urlencoded format as defined by W3C.REC&nbhy;html401&nbhy;19991224 (Ragget, D., “HTML 4.01 Specification,” December 1999.) [html401]:
- error
- REQUIRED. A single error code as described below.
- error_description
- OPTIONAL. A human-readable text providing additional information, used to assist in the understanding and resolution of the error occurred.
- error_uri
- OPTIONAL. A URI identifying a human-readable web page with information about the error, used to provide the end-user with additional information about the error.
- state
- REQUIRED if the state parameter was present in the client authorization request. Set to the exact value received from the client.
| TOC |
The Authorization Server includes one of the following error codes with the error response:
- invalid_request
- The request is missing a required parameter, includes an unsupported parameter or parameter value, repeats a parameter, includes multiple credentials, utilizes more than one mechanism for authenticating the client, or is otherwise malformed.
- invalid_client
- The client identifier provided is invalid, the client failed to authenticate, the client did not include its credentials, provided multiple client credentials, or used unsupported credentials type.
- unauthorized_client
- The authenticated client is not authorized to use the access grant type provided.
- invalid_grant
- The provided access grant is invalid, expired, or revoked (e.g. invalid assertion, expired authorization token, bad end-user password credentials, or mismatching authorization code and redirection URI).
- unsupported_grant_type
- The access grant included - its type or another attribute - is not supported by the authorization server.
- invalid_scope
- The requested scope is invalid, unknown, malformed, or exceeds the previously granted scope.
- invalid_request_response_type
- The requested response type is unsupported or is missing.
- invalid_request_type
- The request type is unsupported.
- invalid_request_openid_type
- The openid type in the the request is not supported.
- invalid_request_redirect_uri
- The redirect_uri in the request is missing or malformed.
- invalid_request_signature
- The request has an invalid signature.
- invalid_request_realm
- The openid request realm is missing or malformed.
- invalid_request_atype
- The request contains an unsupported response assertion type.
- invalid_request_recipient
- The recipient of the request is invalid or does not match.
The error codes can be extended by the string prefixed by x_. If custome error code are used, error_uri MUST be provided.
| TOC |
Access Token Request / Response interacts with an OpenID Token Endpoint. Upon the successful request, the OpenID returns two tokens, Access Token and OpenID Token.
| TOC |
The client obtains an access token by authenticating with the authorization server and presenting its access grant (in the form of an authorization code, resource owner credentials, an assertion, or a refresh token).
To make the Access Token Request, the Client sends the following parameters to the Token Endpoint:
- grant_type
- REQUIRED. The access grant type included in the request. Value MUST be one of authorization_code, refresh_token, or an absolute URI identifying an assertion format supported by the authorization server.
- client_id
- REQUIRED. The client identifier.
- client_secret
- REQUIRED. Client Secret. If the secret_type is "shared", send the pre-shared secret. If the secret_type is "jwt", send the compact serealization of the JWT (Jones, M., Belfanz, D., Bradeley, J., Goland, Y., Panzer, J., Sakimura, N., and P. Tarjan, “JSON Web Token,” January 2011.) [jwt] Signature over the 'code'.
- secret_type
- OPTIONAL. Type of the client_secret. "shared" or "jwt". Defaults to "shared".
In addition, the client MUST include the appropriate parameters specified in the bindings used.
| TOC |
After receiving and verifying a valid and authorized access token request from the client, the Authorization Server returns a Positive Assertion that includes an Access Token.
The token response contains the following parameters which are serialized into a JSON structure by adding each parameter at the highest structure level. Parameter names and string values are included as JSON strings. Numerical values are included as JSON numbers.
- access_token
- REQUIRED if the response type is token or code_and_token, otherwise MUST NOT be included. The Access Token issued by the Authorization Server.
- token_type
- REQUIRED. The type of the token issued. Value is case insensitive.
- refresh_token
- OPTIONAL. The Refresh Token used to obtain new Access Tokens using the same End-User authorization. The authorization server SHOULD NOT issue a Refresh Token when the access grant type is set to none.
- expires_in
- OPTIONAL. The duration in seconds of the access token lifetime if an access token is included. For example, the value 3600 denotes that the access token will expire in one hour from the time the response was generated by the authorization server.
- scope
- OPTIONAL. The scope of the access token as a list of space-delimited strings. The value of the scope parameter is defined by the authorization server. If the value contains multiple space-delimited strings, their order does not matter, and each string adds an additional access range to the requested scope. The authorization server SHOULD include the parameter if the requested scope is different from the one requested by the client.
- openid
- REQUIRED if it was requested in the request. An OpenID Token. It is a JWS (Jones, M., Belfanz, D., Bradeley, J., Goland, Y., Panzer, J., Sakimura, N., and P. Tarjan, “JSON Web Signatures,” March 2011.) [jws] signed claim described below.
It MAY include any other extension parameters.
Following is a non-normative example.
{ "access_token": "SlAV32hkKG", "token_type": "jwt", "refresh_token": "8xLOxBtZp8", "user_id": "http://op.example.com/alice#1234", "domain": "op.example.com", "expires_in": 3600, "openid":"jwtheader.jwtpayload.jwtcrypto" }
Clients SHOULD ignore unrecognized response parameters. The sizes of tokens and other values received from the authorization server, are left undefined by this specification. Clients should avoid making assumptions about value sizes. Servers should document the expected size of any value they issue.
| TOC |
The OpenID Token is a JWS signed claim that attests the following:
- server_id
- REQUIRED. The unique identifier of the authorization server such that when paired with the user_id creates a globally unique and never reassigned identifier.
- user_id
- REQUIRED. A locally unique and never reassigned identifier for the user, which is intended to be consumed by the Client. e.g. "24400320" or "AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4". It MUST NOT exceed 255 ASCII characters in length.
- client_id
- REQUIRED. The client identifier recognized by the authorization server.
- aud
- REQUIRED. The JWT (Jones, M., Belfanz, D., Bradeley, J., Goland, Y., Panzer, J., Sakimura, N., and P. Tarjan, “JSON Web Token,” January 2011.) [jwt]aud (audience) claim.
- exp
- REQUIRED. The JWT (Jones, M., Belfanz, D., Bradeley, J., Goland, Y., Panzer, J., Sakimura, N., and P. Tarjan, “JSON Web Token,” January 2011.) [jwt] exp (expiration time) claim.
- pape
- OPTIONAL. (TBD) If we want this token to be short, we probably want to define a shorter equivalent of PAPE.
| TOC |
If the assertion request is invalid or unauthorized, the authorization server constructs the response by adding the following parameter to the entity body of the HTTP response using the "application/json" media type:
- error
- REQUIRED. A single error code as described below.
- error_description
- OPTIONAL. A human-readable text providing additional information, used to assist in the understanding and resolution of the error occurred.
- error_uri
- OPTIONAL. A URI identifying a human-readable web page with information about the error, used to provide the end-user with additional information about the error.
| TOC |
The Authorization Server includes one of the following error codes with the error response:
- invalid_request
- The request is missing a required parameter, includes an unsupported parameter or parameter value, repeats a parameter, includes multiple credentials, utilizes more than one mechanism for authenticating the client, or is otherwise malformed.
- invalid_client
- The client identifier provided is invalid, the client failed to authenticate, the client did not include its credentials, provided multiple client credentials, or used unsupported credentials type.
- unauthorized_client
- The authenticated client is not authorized to use the access grant type provided.
- invalid_grant
- The provided access grant is invalid, expired, or revoked (e.g. invalid assertion, expired authorization token, bad end-user password credentials, or mismatching authorization code and redirection URI).
- unsupported_grant_type
- The access grant included - its type or another attribute - is not supported by the authorization server.
- invalid_scope
- The requested scope is invalid, unknown, malformed, or exceeds the previously granted scope.
- invalid_client_secret
- The client secret does not matched pre-shared secret code, is of a different type, or has an invalid signature.
- invalid_secret_type
- The specified secret type is unsupported.
- invalid_request_signature
- The request has an invalid signature.
- invalid_request_code
- The authorization code is missing, malformed, or invalid.
- invalid_request_openid_type
- The openid type in the the request is not supported.
The error codes can be extended by the string prefixed by x_. If custome error code are used, error_uri MUST be provided.
| TOC |
UserInfo Request/Response interacts with UserInfo Endpoint.
| TOC |
Client MAY send request with following parameters to the UserInfo Endpoint to obtain further information about the user.
[[TBD: How to ask the attributes the Client is requesting?]]
- access_token
- REQUIRED. The access_token obtained above.
- user_id
- REQUIRED. A locally unique and never reassigned identifier for the user. e.g. "24400320" or "AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4". It MUST NOT exceed 255 ASCII characters in length. It could be a pairwise private identifier of the enduser between the Client and the Server.
- client_id
- REQUIRED. The client identifier recognized by the authorization server.
| TOC |
The response is a JSON object which contains some (or all) of the following reserved keys:
- user_id
- REQUIRED. A locally unique and never reassigned identifier for the user. e.g. "24400320" or "AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4". It MUST NOT exceed 255 ASCII characters in length. It MUST NOT be reassigned to another user.
- server_id
- REQUIRED. The unique identifier of the authorization server such that when paired with the user_id creates a globally unique and never reassigned identifier.
- client_id
- REQUIRED. The client identifier recognized by the authorization server.
- asserted_user
- REQUIRED. One of "true" if the access was issued for this user or "false" if it is for a different user.
- profile_urls
- OPTIONAL. An array of URLs that belong to the user across any number of domains.
- display_name
- OPTIONAL. The display name of the user. e.g., "David Recordon".
- given_name
- OPTIONAL. The first name of the user. e.g., "David".
- family_name
- OPTIONAL. The family name of the user. e.g., "Recordon".
- OPTIONAL. The verified email address of the user. e.g<EMAIL_ADDRESS>- language
- OPTIONAL. End User's preferred language as specified by ISO639.
- picture
- OPTIONAL. The URL of End User's Picture. e.g., "http://graph.facebook.com/davidrecordon/picture".
- openid
- REQUIRED if OpenID variables were specified in the Authorization Request. It is a JSON Object.
If the OP desires to provide the identifier transition service from OpenID 2.0, it SHOULD provide the following parameters in addition under the key openid. The key openid includes the following parameters.
- claimed_id
- OPTIONAL. The OpenID 2.0 verified identifier of this user, if the user has OpenID 2.0 account.
- identity
- OPTIONAL. The OpenID 2.0 Local ID that this user was verified against, if the user has OpenID 2.0 account.
- op_endpoint
- OPTIONAL. The OP Endpoint URL.
Upon receipt of these parameters, the Client MUST migrate the user to the new user_id.
If the Authorization Server supports authorization for distributed resources from different entities, it needs to provide different Access Tokens to each resource endpoints. To do this, it returns a JSON object access_tokens.
- access_tokens
- OPTIONAL. An array of JSON objects that has "endpoint", "access_token", "user_id" and "expires_in" as its subkey.
The key "access_tokens" holds an array of JSON object composed of the following parameters.
- endpoint
- REQUIRED. Resource Endpoint URL to which the token is used to access.
- access_token
- REQUIRED. Access token used to access the resource. [Alternatively: An array of JSON objects that has "user_id", "expires_in" and other variables that the resource requires, which is encoded into Encrypted JWT.]
- token_type
- OPTIONAL. "plain", "jwt", or a fully qualified type URI of the token's type. Defaults to "plain".
- expires_in
- OPTIONAL. The duration in seconds of the access token lifetime if an access token is included. For example, the value 3600 denotes that the access token will expire in one hour from the time the response was generated by the authorization server. If token type is "jwt", then it MUST NOT be specified.
| TOC |
(TBD)
The Authorization Server includes one of the following error codes with the error response:
- invalid_request
- The request is missing a required parameter, includes an unsupported parameter or parameter value, repeats a parameter, includes multiple credentials, utilizes more than one mechanism for authenticating the client, or is otherwise malformed.
- invalid_client
- The client identifier provided is invalid, the client failed to authenticate, the client did not include its credentials, provided multiple client credentials, or used unsupported credentials type.
- unauthorized_client
- The authenticated client is not authorized to use the access grant type provided.
- invalid_grant
- The provided access grant is invalid, expired, or revoked (e.g. invalid assertion, expired authorization token, bad end-user password credentials, or mismatching authorization code and redirection URI).
- unsupported_grant_type
- The access grant included - its type or another attribute - is not supported by the authorization server.
- invalid_scope
- The requested scope is invalid, unknown, malformed, or exceeds the previously granted scope.
- invalid_access_token
- The access token is not valid for the requested resource, malformed, is in an incorrect format, outside the valid scope, or expired.
- invalid_refresh_token
- The refresh token is not valid, malformed, is in an incorrect format, outside the valid scope, or expired.
- invalid_request_signature
- The request has an invalid signature.
- invalid_request_type
- The request type is unsupported.
- invalid_request_atype
- The request contains an unsupported response assertion type.
- invalid_request_recipient
- The recipient of the request is invalid or does not match.
| TOC |
To manage a session, the client sends a request to the session management endpoints at the authorization server. The session management endpoints at the authorization server are:
- Session Refresh
- Refreshes an expired ID Token
- Check Session
- Get a plain text JSON structure from a ID Token
- End Session
- Ends a session
The sequences for session management are as follows:
| TOC |
To refresh a ID Token session that has expired, the client sends a request to the Refresh Session endpoint with an ID Token. A new ID Token is returned in JWS signed format.
Request Parameters:
- openid
- REQUIRED. A previously issued ID Token from a session request
- state
- REQUIRED. An opaque value used by the Client to maintain state between the request and callback. If provided, the Authorization Server MUST include this value when redirecting the user-agent back to the Client. Clients are strongly advised to use this variable to relate the request and response.
- redirect_uri
- REQUIRED. An absolute URI to which the authorization server will redirect the user-agent to with the new ID Token.
Response:
The response is a new ID Token. In a typical HTTP binding, an HTTP 302 redirect to the specified redirect_uri in the request with a new ID Token.
- openid
- A new ID Token
The following is a non-normative session refresh request:
Request: GET /op/refresh_token?openid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6ImNsaWVudC5leGFtcGxlLmNvbSJ9.eyJpc3N1ZXIiOiJodHRwOlwvXC9zZXJ2ZXIuZXhhbXBsZS5jb20iLCJjbGllbnRfaWQiOiJjbGllbnQuZXhhbXBsZS5jb20iLCJhdWRpZW5jZSI6ImNsaWVudC5leGFtcGxlLmNvbSIsImlkIjoidXNlcl8yMzQyMzQiLCJleHAiOjEzMDM4NTI3MzJ9.Vdj-sU3xxwHRd9rF6gjBTw3YMm1BqmT43fGDCpa96jo &state=bar&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fidtoken_cb Host: server.example.com Response: HTTP/1.1 302 OK Location: http://client.example.com/idtoken_cb?openid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6ImNsaWVudC5leGFtcGxlLmNvbSJ9.eyJpc3N1ZXIiOiJodHRwOlwvXC9zZXJ2ZXIuZXhhbXBsZS5jb20iLCJjbGllbnRfaWQiOiJjbGllbnQuZXhhbXBsZS5jb20iLCJhdWRpZW5jZSI6ImNsaWVudC5leGFtcGxlLmNvbSIsImlkIjoidXNlcl8yMzQyMzQiLCJleHAiOjEzMDM4NTI4ODB9.aJwagC6501Da-zK-X8Az9B-Y625aSEfxVuBpFEDjOxQ&state=bar&expires_in=3600
| TOC |
For clients that are not capable of dealing with JWS signed ID Tokens, they can send the ID Token to the Check Session endpoint. It will validate the ID Token and return a plain text JSON structure of the ID Token.
Request Parameters:
- openid
- REQUIRED. A previously issued ID Token from a session request
Response:
The response body is a plain text JSON structure of the base64url decoded payload of the signed ID Token. In a typical HTTP binding, the response is a HTTP 200 response code with the content-type header set to "application/json".
The following is a non-normative example of a check session request:
Request: POST /op/check_openid?openid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6ImNsaWVudC5leGFtcGxlLmNvbSJ9.eyJpc3N1ZXIiOiJodHRwOlwvXC9zZXJ2ZXIuZXhhbXBsZS5jb20iLCJjbGllbnRfaWQiOiJjbGllbnQuZXhhbXBsZS5jb20iLCJhdWRpZW5jZSI6ImNsaWVudC5leGFtcGxlLmNvbSIsImlkIjoidXNlcl8yMzQyMzQiLCJleHAiOjEzMDM4NTI4ODB9.aJwagC6501Da-zK-X8Az9B-Y625aSEfxVuBpFEDjOxQ Response: HTTP/1.1 200 OK Content-Type: application/json { "iss":"http://server.example.com", "client_id","http://client.example.com", "audience", "http://client.example.com", "user_id":"user_328723", "exp":1303852880 }
| TOC |
To end the session, the client sends a ID Token to the End Session endpoint. Upon receiving the request, the authorization server performs the logout flow for the user and then redirects the user-agent to the specified redirect_uri.
Request Parameters:
- openid
- REQUIRED. A previously issued ID Token from a session request
- state
- REQUIRED. An opaque value used by the Client to maintain state between the request and callback. If provided, the Authorization Server MUST include this value when redirecting the user-agent back to the Client. Clients are strongly advised to use this variable to relate the request and response.
- redirect_uri
- REQUIRED. An absolute URI to which the authorization server will redirect the user-agent to with the new ID Token.
Response:
The response is dependant on the particular binding. In HTTP binding, the response is a HTTP 302 redirect response to the redirect_uri specified in the request.
The following is a non-normative session refresh request:
Request: GET /op/end_session?openid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6ImNsaWVudC5leGFtcGxlLmNvbSJ9.eyJpc3N1ZXIiOiJodHRwOlwvXC9zZXJ2ZXIuZXhhbXBsZS5jb20iLCJjbGllbnRfaWQiOiJjbGllbnQuZXhhbXBsZS5jb20iLCJhdWRpZW5jZSI6ImNsaWVudC5leGFtcGxlLmNvbSIsImlkIjoidXNlcl8yMzQyMzQiLCJleHAiOjEzMDM4NTI4ODB9.aJwagC6501Da-zK-X8Az9B-Y625aSEfxVuBpFEDjOxQ&state=bar&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fendtoken_cb Host: server.example.com ... Authorizion server performs logout flow ... Response: HTTP/1.1 302 OK Location: http://client.example.com/endtoken_cb?state=bar
| TOC |
Each message can be serialized either in query parameter serialization or JSON serialization unless it was explicitly stated in the previous sections.
| TOC |
In order to serialize the parameters into Query String Serialization, the client constructs the string by adding the following parameters to the end-user authorization endpoint URI query component using the application/x-www-form-urlencoded format as defined by HTML 4.01 Specification (Ragget, D., “HTML 4.01 Specification,” December 1999.) [html401]:
Following is a non-normative example of such Serialization.
GET /authorize?scope=openid&response_type=code&openid.type=http%3A%2F%2Fopenid.net%2Fspecs%2Fcc%2F1.0%2F%23req& client_id=s6BhdRkqt3&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb HT TP/1.1 Host: server.example.com
| TOC |
The parameters are serialized into a JSON structure by adding each parameter at the highest structure level. Parameter names and string values are included as JSON strings. Numerical values are included as JSON numbers. Each parameter may have JSON Structure as its value.
Following is a non-normative example of such Serialization.
{ "access_token":"SlAV32hkKG", "expires_in":3600, "refresh_token":"8xLOxBtZp8", "openid": { "type": "http://openid.net/specs/ab/1.0#id_res", "mode": "id_res", "op_endpoint": "https://op.example.com/op_endpoint", "client_id": "http://rp.example.com/", "server_id": "http://op.example.com/", "claimed_id": "https://example.com/alice#1234", "identity": "alice", "issued_at":<PHONE_NUMBER> } }
| TOC |
The two encoding form used in [OpenID.authentication‑2.0]<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.), "HTTP encoding" and "key-value form encoding" can be converted to the OpenID Connect JSON form as follows:
| TOC |
Section 4.1.1 of [OpenID.authentication‑2.0]<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.) defines key-value form encoding. Each line begins with a key, followed by a colon, and the value associated with the key. The line is terminated by a single newline (UCS codepoint 10, "\n"). A key or value MUST NOT contain a newline and a key also MUST NOT contain a colon.
This encoding can be trivially converted to JSON objects by making the key the JSON key and the value the JSON value. The resulting JSON object is stored as the value of the top-level key "openid".
For example, the key-value form encoding
mode:error error:This is an example message
is converted to a OpenID JSON Encoding as
{ "openid": { "mode": "error", "error": "This is an example message" } }
| TOC |
In [OpenID.authentication‑2.0]<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.), OpenID query parameters are prefixed by "openid." : e.g., openid.sreg.fname and openid.pape.level. They can be translated into a JSON object by listing all the query parameters under the key "openid". Subkeys are constructed by removing "openid." prefix from each parameters. For values, strings are converted to JSON String and num
For example, a query string openid.sreg.fname=Nat&openid.pape.level=1 are converted to JSON as follows:
{ "openid":{ "sreg.fname":"Nat", "pape.level":1 } }
| TOC |
To simplify the implementations, the following practice is strongly RECOMMENDED.
| TOC |
Depending on the transport through wich the messages are transported, the integrity of the message may not be guaranteed, nor the originator of the message is not authenticated. To mitigate these risks, OpenID Connect supports JSON Web Signatures(JWS) (Jones, M., Belfanz, D., Bradeley, J., Goland, Y., Panzer, J., Sakimura, N., and P. Tarjan, “JSON Web Signatures,” March 2011.) [jws].
Following is the parameters for JWT.
- typ
- OPTIONAL. One of "JWT", "openid2json+sig".
- alg
- REQUIRED. One of the algorithm specified in Table 4 of JWT (Jones, M., Belfanz, D., Bradeley, J., Goland, Y., Panzer, J., Sakimura, N., and P. Tarjan, “JSON Web Token,” January 2011.) [jwt]
Compact Serialization SHOULD BE used when passing it through query parameters, while JSON serialization SHOULD BE used when returning it in HTTP Body.
Following is a non-normative example of such signature in Compact serialization, where HS256 algorithm was used (with line breaks for display purposes only):
eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9 . eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ . dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
Following is a non-normative example of such signature in JSON serialization, where ES256 algorithm was used.
{ "header": [ "eyJhbGciOiJFUzI1NiJ9" ], "payload": "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ", "signature": [ "DtEhU3ljbEg8L38VWAfUAqOyKAM6-Xx-F4GawxaepmXFCgfTjDxw5djxLa8ISlSApmWQxfKTUJqPP3-Kg6NU1Q" ] }
| TOC |
To achieve message confidentiality and audience restriction, OpenID Connect uses JSON Web Encryption (JWE) (Jones, M., Belfanz, D., Bradeley, J., Goland, Y., Panzer, J., Sakimura, N., and P. Tarjan, “JSON Web Encryption,” March 2011.) [jwe].
| TOC |
Requests and Responses can either be plain, signed or encrypted. Signature should be applied to the entire request or response. Signed request and responses in the query are sent in the parameter "signed" together with other parameters. If the request and responses are in the JSON Serialization, the JWS signed version MUST use the JSON serialization.
If the request and responses are to be encrypted with JSON Web Encryption (JWE) (Jones, M., Belfanz, D., Bradeley, J., Goland, Y., Panzer, J., Sakimura, N., and P. Tarjan, “JSON Web Encryption,” March 2011.) [jwe], non-encrypted payload MUST NOT be sent. The parameter name for the encrypted payload MUST be 'jwe'.
| TOC |
| TOC |
If the request was signed, the Server MUST verify the signature as in JWT.
| TOC |
To verify the validity of the Authorization Response, the client MUST to the following:
Note: An authorization server MUST only issue assertions about user identifiers on its domain. The authorization server is responsible for managing its own local namespace and enforcing that each user_id is locally unique and never reassigned.
If the client does not verify the signature, it MUST make a User Info API request.
| TOC |
If the request was signed, the Server MUST verify the signature as in JWT (Jones, M., Belfanz, D., Bradeley, J., Goland, Y., Panzer, J., Sakimura, N., and P. Tarjan, “JSON Web Token,” January 2011.) [jwt].
| TOC |
To verify the validity of the UserInfo Response, the client MUST to the following:
| TOC |
OpenID Connect supports the extensions that are as defined in Section 12 of [OpenID.authentication‑2.0]<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.) . This specification adds following list to the disallowed aliases.
request_uri, refresh_uri, op_endpoint, user_id, redirect_uri, client_id, server_id, client_meta_uri, server_meta_uri, client_secret, immediate, pubkey, certs_uri, state, code, atype, proofkey, enc_data, enc_key, enc_iv, enc_type, enc_ref, access_token, access_token_secret, issued_at, expires_in, refresh_token.
| TOC |
Followings are the list of attack vectors and remedies that were considered for this specification.
For details of the attack vector, see [SP800‑63] (National Institute of Standards and Technology, “NIST SP800-63rev.1: Electronic Authentication Guideline,” .).
| TOC |
To mitigate this attack, there are two ways to mitigate it.
| TOC |
The Assertion disclosure can be mitigated in the following two ways.
| TOC |
To mitigate this threat, the assertion may be digitally signed by the OP using a key that supports non-repudiation. The RP SHOULD check the digital signature to verify that it was issued by a legitimate OP.
| TOC |
To mitigate this threat, the assertion includes the identity of the RP for whom it was generated as "client_id". The RP verifies that incoming assertions include its identity as the recipient of the assertion.
| TOC |
The assertion includes a timestamp and a short lifetime of validity. The Relying Party checks the timestamp and lifetime values to ensure that the assertion is currently valid.
| TOC |
Due to the large entropy requirement of the Artifact ("code") and short life nature of its validity, the success probability of this attack is extremely low.
| TOC |
Secondary authenticator (="code") is transmitted only through HTTPS, thus it is protected between the OP and the User-Agent, and User-Agent and the RP.
Only the place it can be captured is the User-Agent where the TLS session is terminated, and is possible if the User-Agent is infested by malwares. However, it renders no usefulness as long as the profile in use either RP authentication or assertion encryption.
| TOC |
Responses to assertion requests is bound to the corresponding requests by message order in HTTP, as both assertions and requests are protected by TLS that can detect and disallow malicious reordering of packets.
| TOC |
If the authentication request is POSTed directly through a protected channel, it is not possible to disclose the authentication request.
If the Request File is encrypted by the OP's public key, the authentication request will not be disclosed unless OP's private key gets compromised or the encryption algorithm becomes vulnerable.
| TOC |
Timing attack can be used to reduce the effctive key length of the signature if the time required to return the response in case of signature error and correct signature exists. Care should be taken in the implementation to avoid this attack.
| TOC |
In the category of Authentication Process Threats, following threats exists.
Authentication process per se as described in NIST SP800-63-rev1 is out of scope for this protocol, but care SHOULD be taken to achieve appropriate protection.
| TOC |
| TOC |
The following is the parameter registration request for the "scope" parameter as defined in this specification:
Parameter name: openid
Parameter usage location: The End-User Authorization Endpoint request, the End-User Authorization Endpoint response, the Token Endpoint request, the Token Endpoint response, and the WWW-Authenticate header field.
Change controller: IETF
Specification document(s): [[ this document ]]
Related information: None
| TOC |
[[To be removed from the final specification.]]
Following items remains to be done in this draft.
| TOC |
As a successor version of OpenID Authentication 2.0<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.) [OpenID.authentication‑2.0], this specification heavily relies on OpenID Authentication 2.0<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.) [OpenID.authentication‑2.0]. Please refer to Appendix C of OpenID Authentication 2.0<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.) [OpenID.authentication‑2.0] for the full list of the contributors for OpenID Authentication 2.0<EMAIL_ADDRESS>“OpenID Authentication 2.0,” 2007.) [OpenID.authentication‑2.0].
This specification is largely compliant with OAuth 2.0 draft 15. As the draft is not yet referenceable, relevant text has been incorporated into this draft. Please refer to the OAuth 2.0 specification for the list of contributors.
In addition, the OpenID Community would like to thank the following people for the work they've done in the drafting and editing of this specification.
Anthony Nadalin (tonynad@microsoft.com), Microsoft.
Breno de Medeiros (breno@gmail.com), Google.
Chuck Mortimore (cmortimore@salesforce.com), Salesforce.com.
David Recordon (dr@fb.com)<author>, Facebook.
George Fletcher (george.fletcher@corp.aol.com), AOL.
Hideki Nara (hideki.nara@gmail.com), Takt Communications.
John Bradley<EMAIL_ADDRESS><author>, Protiviti Government Service.
Mike Jones (Michael.Jones@microsoft.com), Microsoft.
Nat Sakimura<EMAIL_ADDRESS><author/editor>, Nomura Research Institute, Ltd.
Paul Tarjan (pt@fb.com), Facebook.
Ryo Itou (ritou@yahoo-corp.jp), Yahoo! Japan.
| TOC |
- -01
- First Draft that incorporates the core of both openidonnect.com proposal and OpenID Artifact Binding RC3 and abstracted.
- -02
- Catch up to OAuth 2.0 d15. Replaced JSS and JSE to JWS and JWE. Section grouping and reorganizations. Added more contributors.
- -03
- Combined with Session Management. Moved "openid" back to Token Endpoint. Renaming the sections according to the Endpoint names. Rewrote intro to the Messages section to be more approacheable.
- -04
- To keep the ID Token small so that it fits cookie more easily, moved OPTIONAL parameters to UserInfo endpoint response.
| TOC |
| TOC |
| Nat Sakimura (editor) | |
| Nomura Research Institute, Ltd. | |
| Email: |<EMAIL_ADDRESS>|
| David Recordon | |
| Facebook Inc. | |
| Email: |<EMAIL_ADDRESS>|
| John Bradley | |
| Protiviti Government Services | |
| Email: |<EMAIL_ADDRESS>|
| Breno de Madeiros | |
| Google Inc. | |
| Email: |<EMAIL_ADDRESS>|
| Mike Jones | |
| Microsoft Corporation | |
| Email: |<EMAIL_ADDRESS>|
| Edmund Jay (editor) | |
| MGI1 | |
| Email: |<EMAIL_ADDRESS>|


Source code for hemlock.load_scripts.csv_to_mysql
#!/usr/bin/env python
#
# Copyright (c) 2013 In-Q-Tel, Inc/Lab41, All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
import csv, getpass, sys, time
import MySQLdb as mdb
[docs]def get_auth():
user = raw_input("Username:")
pw = getpass.getpass("Password:")
return user, pw
[docs]def mysql_server(server, user, pw, db):
# connect to the mysql server
try:
m_server = mdb.connect(server, user, pw, db)
except:
print "MySQL server failure"
sys.exit(0)
return m_server
[docs]def process_csv(input, m_server, table):
j = 0
with open(input, 'rb') as csvfile:
reader = csv.reader(csvfile, delimiter=',', quotechar='"')
hrow = reader.next()
with m_server:
cur = m_server.cursor()
create_table = "CREATE TABLE IF NOT EXISTS `"+table+"`(Id INT PRIMARY KEY AUTO_INCREMENT, "
i = 0
while i < len(hrow):
create_table += "`"+hrow[i]+"` VARCHAR(200), "
i += 1
create_table = create_table[:-2]+")"
cur.execute(create_table)
for row in reader:
data = "INSERT INTO `"+table+"`("
i = 0
while i < len(hrow):
data += "`"+hrow[i]+"`, "
i += 1
data = data[:-2]+") VALUES("
i = 0
while i < len(hrow):
data += "\""+row[i]+"\", "
i += 1
data = data[:-2]+")"
cur.execute(data)
j += 1
m_server.commit()
m_server.close()
print str(j), "keys added."
[docs]def print_help():
print "-i \t<input file> (default is input.csv)"
print "-s \t<mysql server> (default is localhost)"
print "-d \t<database name> (default is test)"
print "-t \t<table name> (default is table1)"
print "-h \thelp\n"
sys.exit(0)
[docs]def process_args(args):
# default initialization
input = "input.csv"
server = "localhost"
db = "test"
table = "table1"
# process args
i = 0
while i < len(args):
if args[i] == "-s":
try:
server = args[i+1]
i += 1
except:
print_help()
elif args[i] == "-d":
try:
db = args[i+1]
i += 1
except:
print_help()
elif args[i] == "-t":
try:
table = args[i+1]
i += 1
except:
print_help()
elif args[i] == "-i":
try:
input = args[i+1]
i += 1
except:
print_help()
else:
print_help()
i += 1
try:
f = open(input, 'r')
f.close()
except:
print_help()
return input, server, db, table
[docs]def get_args():
args = []
for arg in sys.argv:
args.append(arg)
return args[1:]
if __name__ == "__main__":
start_time = time.time()
args = get_args()
input, server, db, table = process_args(args)
user, pw = get_auth()
m_server = mysql_server(server, user, pw, db)
process_csv(input, m_server, table)
print "Took",time.time() - start_time,"seconds to complete."


Source code for astropy.coordinates.name_resolve
# Licensed under a 3-clause BSD style license - see LICENSE.rst
"""
This module contains convenience functions for getting a coordinate object
for a named object by querying SESAME and getting the first returned result.
Note that this is intended to be a convenience, and is very simple. If you
need precise coordinates for an object you should find the appropriate
reference for that measurement and input the coordinates manually.
"""
from __future__ import division, print_function
# Standard library
import os
import re
import sys
import httplib
import urllib
import urllib2
from urlparse import urlparse
import socket
# Third party
import numpy as np
# Astropy
from ..config import ConfigurationItem
from .builtin_systems import ICRSCoordinates
from .. import units as u
__all__ = ["get_icrs_coordinates"]
SESAME_URL = ConfigurationItem("sesame_url",
["http://cdsweb.u-strasbg.fr/cgi-bin/nph-sesame/",
"http://vizier.cfa.harvard.edu/viz-bin/nph-sesame/"],
"The URL to Sesame's web-queryable database.",
cfgtype='string_list')
SESAME_DATABASE = ConfigurationItem("sesame_database", ['all', 'simbad', 'ned',
'vizier'],
"This specifies the default database that "
"SESAME will query when using the name "
"resolve mechanism in the coordinates "
"subpackage. Default is to search all "
"databases, but this can be 'all', "
"'simbad', 'ned', or 'vizier'.")
NAME_RESOLVE_TIMEOUT = ConfigurationItem('name_resolve_timeout', 5,
"This is the maximum time to wait "
"for a response from a name resolve "
"query to SESAME in seconds.")
class NameResolveError(Exception):
pass
def _parse_response(resp_data):
"""
Given a string response from SESAME, parse out the coordinates by looking
for a line starting with a J, meaning ICRS J2000 coordinates.
Parameters
----------
resp_data : str
The string HTTP response from SESAME.
Returns
-------
ra : str
The string Right Ascension parsed from the HTTP response.
dec : str
The string Declination parsed from the HTTP response.
"""
pattr = re.compile(r"%J\s*([0-9\.]+)\s*([\+\-\.0-9]+)")
matched = pattr.search(resp_data.decode('utf-8'))
if matched == None:
return None, None
else:
ra,dec = matched.groups()
return ra,dec
[docs]def get_icrs_coordinates(name):
"""
Retrieve an ICRSCoordinates object by using an online name resolving
service to retrieve coordinates for the specified name. By default,
this will search all available databases until a match is found. If
you would like to specify the database, use the configuration item
`name_resolve.SESAME_DATABASE` . You can also specify a list of servers
to use for querying Sesame using the configuration item
`name_resolve.SESAME_URL`. This will try each one in order until a valid
response is returned. By default, this list includes the main Sesame
host and a mirror at vizier. A final configuration item,
`name_resolve.NAME_RESOLVE_TIMEOUT`, is the number of seconds to wait
for a response from the server before giving up. By default this is
5 seconds.
Parameters
----------
name : str
The name of the object to get coordinates for, e.g. M42.
Returns
-------
coord : SphericalCoordinatesBase
An `ICRSCoordinates` instance for the object name specified.
"""
database = SESAME_DATABASE()
# The web API just takes the first letter of the database name
db = database.upper()[0]
# Make sure we don't have duplicates in the url list
urls = []
domains = []
for url in SESAME_URL():
domain = urlparse(url).netloc
# Check for duplicates
if domain not in domains:
domains.append(domain)
# Add the query to the end of the url, add to url list
fmt_url = os.path.join(url, "{db}?{name}")
fmt_url = fmt_url.format(name=urllib.quote(name), db=db)
urls.append(fmt_url)
for url in urls:
try:
# Retrieve ascii name resolve data from CDS
resp = urllib2.urlopen(url, timeout=NAME_RESOLVE_TIMEOUT())
break
except urllib2.URLError, e:
# This catches a timeout error, see:
# http://stackoverflow.com/questions/2712524/handling-urllib2s-timeout-python
if isinstance(e.reason, socket.timeout):
# If it was a timeout, try with the next URL
continue
else:
raise NameResolveError("Unable to retrieve coordinates for name "
"'{0}'".format(name))
# All Sesame URL's timed out...
else:
raise NameResolveError("All Sesame queries timed out. Unable to "
"retrieve coordinates.")
resp_data = resp.read()
ra,dec = _parse_response(resp_data)
if ra == None and dec == None:
if db == "A":
err = "Unable to find coordinates for name '{0}'".format(name)
else:
err = "Unable to find coordinates for name '{0}' in database {1}"\
.format(name, database)
raise NameResolveError(err)
return ICRSCoordinates(ra, dec, unit=(u.degree, u.degree))


Restorative Justice is a process in which someone who has committed a crime meets their victim to help both people come to terms with what has happened. So what would you say if you came face to face with the person who has been bullying you online?


Alumni & Student of Color Association
Welcome to the beginning of a new community
About
Featuring the latest build of the new Bootstrap 4 framework!
Contact
Signup for updates!