Seperti yang saya janjikan sebelumnya, kali ini akan saya jelaskan lebih dalam lagi tentang OpenID. Apa saja yang akan saya bahas? Saya akan mengajak anda untuk melihat lebih dalam lagi komunikasi yang terjadi antara provider,consumer dan user browser. Jika pada artikel sebelumnya saya hanya menceritakan bahwa consumer berkomunikasi secara langsung atau tidak langsung dengan provider, kali ini saya akan tunjukkan data apa saja kah yang dipertukarkan di antara mereka untuk memastikan identitas seseorang?
Setup the Lab
Agar mudah melakukan sniffing, saya harus mensetup lab sederhana yang bisa saya kendalikan sepenuhnya. Dari ke-3 entitas yang terlibat dalam openid, lebih mudah bagi saya untuk membuat consumer website di komputer saya sendiri daripada membuat provider. Sebab sniffing di sisi consumer atau di sisi provider hasilnya akan sama saja, jadi buat apa merepotkan diri dengan membuat provider.
Dalam lab ini consumer adalah wordpress dengan plugin OpenID yang saya install di localhost dengan XAMPP (php+mysql+apache), sedangkan provider saya pakai provider yang sama dengan artikel sebelumnya, yaitu PIP.VerisignLabs.com. Lengkap sudah, consumer dan provider sudah ada, kini saya siap mensniff komunikasi antara consumer dan provider dari sisi consumer.
Untuk melakukan sniffing komunikasi langsung antara consumer dan provider saya menggunakan tools Wireshark. Sedangkan komunikasi yang melalui browser (tidak langsung), saya menggunakan addon Firefox Live HTTP Header sebagai sniffer (walaupun addon ini hanya bisa menampilkan header http). Diagram lab saya bisa dilihat pada gambar berikut ini:
my lab
Untuk memahami detil komunikasi dalam openid, saya akan mensimulasikan pemakaian openid. Jadi skenarionya sederhana saja, saya akan login ke wordpress yang sudah saya install di komputer sendiri (localhost) menggunakan OpenID identifier: masrizki.ilmuhacking.com. Setelah itu saya akan diredirect ke halaman login PIP Verisignlabs dan juga melakukan otorisasi trust relationship. Kemudian saya akan dikembalikan ke halaman administrasi wordpress sebagai seorang contributor.
Login to WordPress using OpenID Saya akan mulai simulasinya dengan login ke wordpress pada URL http://localhost/wordpress/wp-login.php. Pada kolom openid saya masukkan masrizki.ilmuhacking.com sedangkan kolom lainnya saya kosongkan. Berikut adalah gambar dari halaman login wordpress yang sudah mendukung openid di localhost.
wordpress login page
Komunikasi http yang berhasil disniff ketika tombol Login diklik adalah (beberapa header yang tidak penting saya hapus):
1 2 3 4 5 6 7 8 9 10 11 12 13 | http://localhost/wordpress/wp-login.php POST /wordpress/wp-login.php HTTP/1.1 Host: localhost Referer: http://localhost/wordpress/wp-login.php Cookie: wordpress_test_cookie=WP+Cookie+check; wp-settings-time-1=1234937131; wp-settings-time-2=1234936984; PHPSESSID=d4d55ee29f62239a347be3a04dc8f8a4 Content-Type: application/x-www-form-urlencoded Content-Length: 143 log=&pwd=&openid_identifier=masrizki.ilmuhacking.com&wp-submit=Log+In&redirect_to=http%3A%2F%2Flocalhost%2Fwordpress%2Fwp-admin%2F&testcookie=1 HTTP/1.x 200 OK Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/wordpress/ Content-Length: 1718 |
Pada baris ke-9 terlihat parameter POST yang dikirim, diantara yang penting adalah:
- openid_identifier: masrizki.ilmuhacking.com
- redirect_to: http://localhost/wordpress/wp-admin/
openid_identifier menunjukkan identifier (url) openid yang dipakai untuk login, dan redirect_to menunjukkan url ketika semua proses authentication berhasil (bila login berhasil user akan masuk ke url tersebut). Setelah user mengklik submit, consumer akan mendownload file html yang ada di http://masrizki.ilmuhacking.com. Berikut sniffing download file tersebut:
GET / HTTP/1.0
User-Agent: php-openid/2.1.2 (php/5.2.6)
Host: masrizki.ilmuhacking.com
Range: 0-1048576
Port: 80
Accept: application/xrds+xml, text/html; q=0.3, application/xhtml+xml; q=0.5
HTTP/1.1 200 OK
Date: Wed, 18 Feb 2009 06:03:43 GMT
Server: Apache/2.2.11 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Last-Modified: Wed, 11 Feb 2009 08:51:39 GMT
ETag: "3fe00c5-2b2-462a0b6435cc0"
Accept-Ranges: bytes
Content-Length: 690
Connection: close
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<link rel="openid.server" href="http://pip.verisignlabs.com/server" />
<link rel="openid.delegate" href="http://masrizki.pip.verisignlabs.com" />
<link rel="openid2.provider" href="http://pip.verisignlabs.com/server" />
<link rel="openid2.local_id" href="http://masrizki.pip.verisignlabs.com" />
<meta http-equiv="X-XRDS-Location" content="http://pip.verisignlabs.com/user/masrizki/yadisxrds" />
<title>OpenID MasRizki</title>
</head>
<body>
<h1>OpenID MasRizki</h1>
</body>
</html> File html yang didapatkan dari masrizki.ilmuhacking.com mengandung informasi server openid provider yang dipakai, yaitu http://pip.verisignlabs.com/server. Selain itu juga didapatkan lokasi file XRDS, di http://pip.verisignlabs.com/user/masrizki/yadisxrds, berikutnya consumer akan mendownload file XRDS dari url tersebut. Berikut sniffing komunikasi yang terjadi:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 | GET /user/masrizki/yadisxrds HTTP/1.0
User-Agent: php-openid/2.1.2 (php/5.2.6)
Host: pip.verisignlabs.com
Range: 0-1048576
Port: 80
HTTP/1.1 200 OK
Date: Wed, 18 Feb 2009 06:04:01 GMT
X-XRDS-Location: http://pip.verisignlabs.com/user/masrizki/yadisxrds
Content-Type: application/xrds+xml;charset=ISO-8859-1
Content-Length: 1118
Connection: close
<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS
xmlns:xrds="xri://$xrds"
xmlns:openid="http://openid.net/xmlns/1.0"
xmlns="xri://$xrd*($v*2.0)">
<XRD>
<Service priority="0">
<Type>http://specs.openid.net/auth/2.0/signon</Type>
<Type>http://openid.net/sreg/1.0</Type>
<Type>http://openid.net/extensions/sreg/1.1</Type>
<Type>http://schemas.openid.net/pape/policies/2007/06/phishing-resistant</Type>
<Type>http://schemas.openid.net/pape/policies/2007/06/multi-factor</Type>
<Type>http://schemas.openid.net/pape/policies/2007/06/multi-factor-physical</Type>
<URI>http://pip.verisignlabs.com/server</URI>
<LocalID>http://masrizki.pip.verisignlabs.com/</LocalID>
</Service>
<Service priority="1">
<Type>http://openid.net/signon/1.1</Type>
<Type>http://openid.net/sreg/1.0</Type>
<Type>http://openid.net/extensions/sreg/1.1</Type>
<URI>http://pip.verisignlabs.com/server</URI>
<openid:Delegate>http://masrizki.pip.verisignlabs.com/</openid:Delegate>
</Service>
</XRD>
</xrds:XRDS> |
Setelah mendownload file html dari XRDS, berikutnya consumer akan meminta provider untuk melakukan authentication terhadap user tersebut. Untuk melakukannya consumer akan meminta browser untuk membuat request ke openid server provider di url: http://pip.verisignlabs.com/server. Ada dua cara untuk melakukan itu, yaitu dengan memberi response 302 Redirect atau memberi response 200 OK namun diberi html form auto-submit. Openid pada wordpress memilih memakai form auto-submit, dengan cara mengirimkan file html berikut sebagai response dari klik tombol Login di halaman login wordpress :
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 | <html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" lang="en-US"><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>OpenID Authentication Redirect</title> <link rel="stylesheet" href="http://localhost/wordpress/wp-admin/css/install.css?ver=20081210" type="text/css" media="all"> </head><body id="openid-page"> <noscript><p>Since your browser does not support JavaScript, you must press the Continue button once to proceed.</p></noscript> <form action="http://pip.verisignlabs.com/server" method="post"> <input name="openid.ns" value="http://specs.openid.net/auth/2.0" type="hidden"> <input name="openid.realm" value="http://localhost/wordpress/" type="hidden"> <input name="openid.mode" value="checkid_setup" type="hidden"> <input name="openid.return_to" value="http://localhost/wordpress/?openid=consumer&janrain_nonce=2009-02-18T06%3A38%3A05ZrtUK3x" type="hidden"> <input name="openid.identity" value="http://masrizki.pip.verisignlabs.com/" type="hidden"> <input name="openid.claimed_id" value="http://masrizki.ilmuhacking.com/" type="hidden"> <input name="openid.assoc_handle" value="dec470c0-fd80-11dd-8f5a-d5350139866a" type="hidden"> <noscript><div><input value="Continue" type="submit"></div></noscript> </form> <script type="text/javascript"> document.write("<h2>Please Wait...</h2>"); document.forms[0].submit() </script></body></html> |
Pada file html tersebut terdapat tag FORM dengan method POST ke action url: http://pip.verisignlabs.com/server. Tadi saya menyebut auto-submit karena pada baris di paling bawah terdapat javascript yang melakukan submit, jadi tanpa perlu user klik tombol submit, form tersebut sudah automatically submit. Namun bila di browser user tidak mendukung javascript, maka user harus mengklik tombol “Continue” secara manual. Ketika HTTP POST ini disubmit, berikut sniffing komunikasi yang terjadi:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 | http://pip.verisignlabs.com/server POST /server HTTP/1.1 Host: pip.verisignlabs.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6 ImageShackToolbar/5.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: http://localhost/wordpress/wp-login.php Cookie: __utma=182045240.1255127474965694500.1234512662.1234523895.1234936800.3; __utmz=182045240.1234512662.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmb=182045240.9.10.1234936800; __utmc=182045240; JSESSIONID=4F3B5E2D447C07B6D616CCFFF1DF3663.pip1 Content-Type: application/x-www-form-urlencoded Content-Length: 549 openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.sreg=http%3A%2F%2Fopenid.net%2Fextensions%2Fsreg%2F1.1&openid.sreg.optional=nickname%2Cemail%2Cfullname&openid.realm=http%3A%2F%2Flocalhost%2Fwordpress%2F&openid.mode=checkid_setup&openid.return_to=http%3A%2F%2Flocalhost%2Fwordpress%2F%3Fopenid%3Dconsumer%26janrain_nonce%3D2009-02-18T06%253A07%253A10Z4ZW4Xj&openid.identity=http%3A%2F%2Fmasrizki.pip.verisignlabs.com%2F&openid.claimed_id=http%3A%2F%2Fmasrizki.ilmuhacking.com%2F&openid.assoc_handle=dec470c0-fd80-11dd-8f5a-d5350139866a HTTP/1.x 302 Moved Temporarily Date: Wed, 18 Feb 2009 06:04:07 GMT Location: http://pip.verisignlabs.com/login.do Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html |
Ternyata submit post ke URL http://pip.verisignlabs.com/server, dibalas dengan 302 Redirect ke URL: http://pip.verisignlabs.com/login.do, yang tidak lain adalah halaman login. Hal ini terjadi karena user tersebut belum login di PIP sehingga diarahkan ke halaman login, bila user sudah login maka tidak diarahkan ke halaman login, tapi langsung ke halaman authorize trust relationship.
Login to OpenID Provider
PIP login page
Perhatikan pada gambar tersebut halaman login menggunakan https. Ternyata pada saat browser request ke http://pip.verisignlabs.com/login.do lagi-lagi diresponse dengan 302 Redirect ke url https://pip.verisignlabs.com/login.do. PIP meredirect request ke halaman login selalu ke halaman yang menggunakan https demi menghindarkan user dari serangan sniffing dan mitm attack. Setelah user memasukkan username dan password dan mengklik tombol “sign in”, berikut adalah sniffing komunikasi yang terjadi:
https://pip.verisignlabs.com/login_user.do POST /login_user.do HTTP/1.1 Host: pip.verisignlabs.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6 ImageShackToolbar/5.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: https://pip.verisignlabs.com/login.do Cookie: __utma=182045240.1255127474965694500.1234512662.1234523895.1234936800.3; __utmz=182045240.1234512662.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); JSESSIONID=4F3B5E2D447C07B6D616CCFFF1DF3663.pip1; __utmb=182045240.10.10.1234936800; __utmc=182045240; JSESSIONID=4F3B5E2D447C07B6D616CCFFF1DF3663.pip1 Content-Type: application/x-www-form-urlencoded Content-Length: 38 username=ilmuhacking&password=<sensor> HTTP/1.x 302 Moved Temporarily Date: Wed, 18 Feb 2009 06:05:47 GMT X-XRDS-Location: http://pip.verisignlabs.com/user/DIRECTED_IDENTITY_USER/yadisxrds Pragma: No-cache Cache-Control: no-cache,no-store,max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _session-id_v01_ilmuhacking=6cf8bd30ec8b2fef728d7f3f2b676878; Domain=pip.verisignlabs.com; Path=/; HttpOnly Location: https://pip.verisignlabs.com/dataExchange?target=render&identityName=masrizki Content-Type: text/html Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive
Terlihat username dan password disubmit ke URL: https://pip.verisignlabs.com/login_user.do dan submit POST tersebut diresponse dengan 302 Redirect ke URL: https://pip.verisignlabs.com/dataExchange?target=render&identityName=masrizki . URL tersebut adalah url yang berisi halaman otorisasi dan verifikasi trust relationship dengan wordpress yang menjadi consumer.
trust relationship verification
Setelah user menentukan trust relationship dan mengisi beberapa data, berikut adalah sniff komunikasi POST yang terjadi ketika user mensubmit datanya.
https://pip.verisignlabs.com/authExchAction.do POST /authExchAction.do HTTP/1.1 Host: pip.verisignlabs.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6 ImageShackToolbar/5.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: https://pip.verisignlabs.com/dataExchange?target=render&identityName=masrizki Cookie: __utma=182045240.1255127474965694500.1234512662.1234523895.1234936800.3; __utmz=182045240.1234512662.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); JSESSIONID=4F3B5E2D447C07B6D616CCFFF1DF3663.pip1; __utmb=182045240.11.10.1234936800; __utmc=182045240; JSESSIONID=4F3B5E2D447C07B6D616CCFFF1DF3663.pip1; _session-id_v01_ilmuhacking=6cf8bd30ec8b2fef728d7f3f2b676878 Content-Type: application/x-www-form-urlencoded Content-Length: 271 session_id_validation=3adb2f83&target=submit&identity=masrizki&fullname=Mas+Rizki&nickname=Rizki&email=rizki%40ilmuhacking.com&dobmonth=10&dobday=09&dobyear=1981&gender=M&postcode=12345&country=ID&language=ind&timezone=Asia%2FJakarta&month=02&day=17&year=2009&timing=once HTTP/1.x 302 Moved Temporarily Date: Wed, 18 Feb 2009 06:06:44 GMT X-XRDS-Location: http://pip.verisignlabs.com/user/DIRECTED_IDENTITY_USER/yadisxrds Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: Thu, 01 Jan 1970 00:00:00 GMT Location: http://localhost/wordpress/?openid=consumer&janrain_nonce=2009-02-18T06%3A07%3A10Z4ZW4Xj&openid.sreg.fullname=Mas+Rizki&openid.assoc_handle=5193a7f0-fd82-11dd-a512-79ad78e29b8b&openid.response_nonce=2009-02-18T06%3A06%3A44ZqYxKBQ%3D%3D&openid.sreg.email=rizki%40ilmuhacking.com&openid.sreg.nickname=Rizki&openid.pape.nist_auth_level=0&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.mode=id_res&openid.op_endpoint=http%3A%2F%2Fpip.verisignlabs.com%2Fserver&openid.pape.auth_policies=none&openid.claimed_id=http%3A%2F%2Fmasrizki.ilmuhacking.com%2F&openid.sig=2CdUovMZVV2DbHQzLt2W3SjR5mE%3D&openid.identity=http%3A%2F%2Fmasrizki.pip.verisignlabs.com%2F&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.auth_time=2009-02-18T06%3A05%3A47Z&openid.signed=assoc_handle%2Cidentity%2Cresponse_nonce%2Creturn_to%2Cclaimed_id%2Cop_endpoint%2Csreg.nickname%2Csreg.email%2Csreg.fullname%2Cns.pape%2Cpape.auth_policies%2Cpape.auth_time%2Cpape.nist_auth_level&openid.invalidate_handle=dec470c0-fd80-11dd-8f5a-d5350139866a&openid.ns.sreg=http%3A%2F%2Fopenid.net%2Fextensions%2Fsreg%2F1.1&openid.return_to=http%3A%2F%2Flocalhost%2Fwordpress%2F%3Fopenid%3Dconsumer%26janrain_nonce%3D2009-02-18T06%253A07%253A10Z4ZW4Xj Content-Type: text/html Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive
Terlihat setelah user mensubmit datanya dan trust relationshipnya, PIP akan me-redirect user ke wordpress seperti semula. Perhatikan juga bahwa URL yang akan dituju oleh Redirect mengandung beberapa parameter yang gunanya untuk menyampaikan status proses authentication. HTTP Redirect ini merupakan jawaban (response) dari request yang diajukan consumer ketika user pertama login di halaman wordpress.
Direct vs Indirect Communication
Komunikasi ini adalah komunikasi tidak langsung, berawal dari consumer melakukan request ke provider (melalui perantaraan user), kemudian setelah user berhasil terotentikasi di provider, provider memberikan response balik ke consumer (melalui perantaraan user). Mengirimkan request/response melalui perantaraan user bisa dilakukan dengan mengirimkan status 302 Redirect atau memberikan html berisi auto-submit form. Untuk lebih jelasnya perhatikan gambar di samping.
Cross Check Authentication to Provider
Kini tiba langkah terakhir yang akan dilakukan consumer, yaitu melakukan cross-check/verifikasi, apakah benar user ini telah terotentikasi dengan sukses di provider. Consumer melakukan komunikasi langsung dengan provider tanpa perantaraan user dengan mengirimkan request POST berikut ini:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 | POST /server HTTP/1.0 Host: pip.verisignlabs.com Content-type: application/x-www-form-urlencoded Content-length: 1231 janrain_nonce=2009-02-18T06%3A07%3A10Z4ZW4Xj&openid=consumer&openid.assoc_handle=5193a7f0-fd82-11dd-a512-79ad78e29b8b&openid.claimed_id=http%3A%2F%2Fmasrizki.ilmuhacking.com%2F&openid.identity=http%3A%2F%2Fmasrizki.pip.verisignlabs.com%2F&openid.invalidate_handle=dec470c0-fd80-11dd-8f5a-d5350139866a&openid.mode=check_authentication&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.ns.sreg=http%3A%2F%2Fopenid.net%2Fextensions%2Fsreg%2F1.1&openid.op_endpoint=http%3A%2F%2Fpip.verisignlabs.com%2Fserver&openid.pape.auth_policies=none&openid.pape.auth_time=2009-02-18T06%3A05%3A47Z&openid.pape.nist_auth_level=0&openid.response_nonce=2009-02-18T06%3A06%3A44ZqYxKBQ%3D%3D&openid.return_to=http%3A%2F%2Flocalhost%2Fwordpress%2F%3Fopenid%3Dconsumer%26janrain_nonce%3D2009-02-18T06%253A07%253A10Z4ZW4Xj&openid.sig=2CdUovMZVV2DbHQzLt2W3SjR5mE%3D&openid.signed=assoc_handle%2Cidentity%2Cresponse_nonce%2Creturn_to%2Cclaimed_id%2Cop_endpoint%2Csreg.nickname%2Csreg.email%2Csreg.fullname%2Cns.pape%2Cpape.auth_policies%2Cpape.auth_time%2Cpape.nist_auth_level&openid.sreg.email=rizki%40ilmuhacking.com&openid.sreg.fullname=Mas+Rizki&openid.sreg.nickname=Rizki HTTP/1.1 200 OK Date: Wed, 18 Feb 2009 06:06:46 GMT Content-Length: 50 Connection: close Content-Type: text/html is_valid:true ns:http://specs.openid.net/auth/2.0 |
Terlihat pada request tersebut consumer membawa serta semua parameter yang didapatkannya dari provider (melalui browser redirect pada paragraf sebelumnya). Parameter tersebut akan dicocokkan dengan data yang dimiliki provider, bila memang benar terotentikasi maka responsenya adalah seperti pada baris ke-13 pada sniffing di atas, yaitu: is_valid:true. Setelah mengetahui bahwa user telah terotentikasi dengan sukses, maka selanjutnya user diijinkan masuk ke wordpress dan selesailah proses authentication dengan openid ini. Setelah selesai proses authentication, tidak ada lagi hubungan dan keterkaitan antara consumer dan provider, masing-masing memiliki session yang terpisah.
This is really interesting, You're a very skilled blogger.
ReplyDeleteI have joined your feed and look forward to seeking more of your fantastic post.
Also, I have shared your website in my social networks!
my website: Saffron Diet
James says that Farrah acted professional and didn't bring her daughter,
ReplyDeleteSophia, to the shoot. Their life may revolve around their next fix, just like any other addict.
Los Angeles, CA, where Dorothy Stratten was killed.
Here is my web blog - russia
Pretty portion of content. I simply stumbled upon your website and in accession capital to
ReplyDeleteassert that I get actually enjoyed account your weblog posts.
Any way I will be subscribing to your feeds or even I fulfillment you get
admission to consistently fast.
my page :: allied insurance
Turn the heat off and allow the treats to cool thoroughly before
ReplyDeleteremoving. One could easily find these foods at Central Market.
Stir constantly to toast all sides and prevent burning.
Feel free to surf to my blog post: breakfast easy dinner recipes for busy families - ,
To add to that, these recipes are also designed to help your body fight what is known to
ReplyDeletebe the metabolic adaptation phenomenon. Mix
the ingredients in a small bowl until evenly combined
and set aside for grilling. "The Cheesecake Factory cheesecake recipe was fantastic.
my site crockpot recipes recipes for french onion
soup
Summer is the perfect time for cookouts and dinner events.
ReplyDeleteOne could easily find these foods at Central Market. Place a
frying pan or iron skillet over medium to high heat.
Feel free to visit my webpage :: deviled
egg recipes ()
Make good use of the internet, if possible, to aid you in your search.
ReplyDeleteYou could serve jail time, lose your license or be ordered by the court to do community service.
Ethiopia levels serious charges Aviation law and compensation
- Possible causes of ET409 crash - All ET409 victims recovered
- How black boxes survive crashes - ET409 pilot had premonition - Second
plane in ET409 crash - Mystery deepens in ET409 crash - ET409 black box recovered - Lebanon and Cameroon
crash similar - Black box eludes Beirut searchers - Ethiopian Airlines black boxes found -
Fast turn by Ethiopian 737 pilot - Boeing and NTSB probe 737
crash.
My web site - what is a sr22 form, ,
Even if you are innocent you can be forced to carry
ReplyDeleteSR-22 insurance, even if you are innocent you may have
to pay the $250. Thereby, you can convince the department issuing SR22 auto insurance that you will soon become a responsible
driver. One of the first complete necessities
found in society relies on cash.
Feel free to visit my site: free sr22 insurance ()
Have fun at Thanksgiving, because you might not see Christmas.
ReplyDeleteAdd chicken stock (liter) and bring to boil, add salt to taste, chicken seasoning, ground peppercorn,
vetsin, cabbage and noodles. Dependency builds brand-loyalty in buyers minds and this is an extremely powerful psychological lever companies exploit
to maximum effect to gain market share - hence
all those bait-sponsored anglers wearing branded caps,
T-shirts and hooded tops etc.
Also visit my blog - allrecipes community
In order for a motorist to find cheap SR22 insurance quotes, wide research and shopping around should
ReplyDeletebe done. If you do not have to purchase collision for your
car because of a loan, do not buy it. When shopping for insurance, keep in mind that an insurance agent does not necessarily know that
an SR-22 filing is required unless a client specifically asks for
one.
Feel free to visit my weblog :: sr22 non owner insurance quotes
Almost everything can be insured like people, buildings, vehicles and documents etc
ReplyDeletebut insurance companies set different criteria for different objects and hence, the documents needed for insurance of these items vary from one insurance provider to
the other. Afford-ability should not be the only consideration while purchasing an SR22 auto insurance policy.
Ethiopia levels serious charges Aviation law and compensation - Possible causes of ET409 crash - All ET409
victims recovered - How black boxes survive crashes -
ET409 pilot had premonition - Second plane in ET409 crash
- Mystery deepens in ET409 crash - ET409 black box recovered
- Lebanon and Cameroon crash similar - Black box eludes Beirut searchers - Ethiopian Airlines black boxes found - Fast turn by Ethiopian 737 pilot - Boeing and NTSB
probe 737 crash.
My blog post: sr22 insurance non owner quotes - ,
Hello, I wish for to subscribe for this weblog to get most recent updates, thus where can i do it please help out.
ReplyDeleteMy web blog :: auto insurance
Some companies even offer SR-22 filings for non-owners.
ReplyDeletePrivate pilots are not restricted to light sport aircraft, banned from towered airports
and night flying, or limited to one passenger. If you do not have a vehicle
of your own, or car is not registered in your name, you can apply for a non-owner's SR-22 policy.
My homepage :: non owners sr22 insurance
Have fun at Thanksgiving, because you might
ReplyDeletenot see Christmas. To make your own baby shampoo at home, you'll need:
. Stir constantly to toast all sides and prevent burning.
Feel free to surf to my web blog ... best recipes vegetable soup made
with ground beef (http://www.scribd.com/elmerscarfe/info)
According to the Cirrus Owners and Pilots
ReplyDeleteAssociation (COPA), there have been 36 known CAPS activations as of July 24, 2012.
Companies offer extended warranty automobile insurance plans at various levels.
Ethiopia levels serious charges Aviation law and compensation - Possible causes of ET409 crash - All ET409 victims recovered
- How black boxes survive crashes - ET409 pilot had premonition - Second plane in ET409 crash - Mystery deepens in ET409 crash - ET409 black
box recovered - Lebanon and Cameroon crash similar - Black box eludes Beirut searchers -
Ethiopian Airlines black boxes found - Fast turn by Ethiopian 737 pilot - Boeing and
NTSB probe 737 crash.
My blog post: sr22 insurance companies
According to the Cirrus Owners and Pilots Association (COPA),
ReplyDeletethere have been 36 known CAPS activations
as of July 24, 2012. Afford-ability should not be the only consideration
while purchasing an SR22 auto insurance policy.
One of the first complete necessities found in society relies on cash.
Look into my web-site - how much is a sr22 in texas
Summer is the perfect time for cookouts and dinner events.
ReplyDeleteTo make your own baby shampoo at home, you'll need:.
"The Cheesecake Factory cheesecake recipe was fantastic.
my homepage ... butter chicken recipes indian - video.theoutdoorline.com -
It could turn out to be your only option if your problems are big enough.
ReplyDeleteBy law, an insurer is required to cancel
the SR22 using state incase the insurance
plan expires, canceled or is not really renewed
by the insured for any particular reason. An SR22 is required by the Department of Motor Vehicles in order for a particular individual to be allowed driving privileges.
my web site; cheap sr22 non owner Insurance
Hi there to every body, it's my first go to see of this weblog;
ReplyDeletethis weblog includes remarkable and in fact excellent stuff in support of visitors.
Take a look at my webpage low cost auto insurance
What you wrote made a bunch of sense. However, think about this, suppose you wrote a catchier title?
ReplyDeleteI am not suggesting your information is not good., however what if you added
something to maybe grab folk's attention? I mean "Lebih Dalam tentang OpenID" is a little plain.
You could peek at Yahoo's home page and note how they create post titles to get
people interested. You might add a video or a related
picture or two to get readers interested about what you've got
to say. In my opinion, it would make your posts a little bit more interesting.
my blog auto insurance america; ,
Many of my free baits were well over 25 millimetres in
ReplyDeletesize and none were made to be round but rather
all were odd shaped and were in fact not prepared by rolling at
all. Season the beef roast with salt and pepper as desired.
) In this regard you might think that nutritional
de-hulled hemp seed bars or hemp oil would be a good thing for everyone - but this is far from being the truth.
Also visit my homepage pork chop recipes crock pot apples
These might even be honey, smooth peanut butter, jam or marmalade,
ReplyDeletecurry source, crab paste, tomato puree, liquidised fruits or liquidised liver; look into why
you are doing this and why you are choosing these substances (see my ebooks.
One could easily find these foods at Central Market.
Dependency builds brand-loyalty in buyers minds and this is an extremely powerful psychological lever companies
exploit to maximum effect to gain market share - hence
all those bait-sponsored anglers wearing branded
caps, T-shirts and hooded tops etc.
Also visit my web blog :: Healthy breakfast recipes indian
It's like an insurance card that the court orders you to carry to verify that when a high-risk driver is
ReplyDeletebehind the wheel, they're insured to be behind the wheel.
By law, an insurer is required to cancel the SR22 using state incase the insurance
plan expires, canceled or is not really renewed by the insured for any particular reason.
For these people, auto insurance sr22 filings are
required so that they can legally drive in the state
that they reside in.
my web-site: sr22 requirements
To add to that, these recipes are also designed to help your body fight
ReplyDeletewhat is known to be the metabolic adaptation phenomenon.
com, the first and only interactive cooking portal that
highlights Filipino regional food recipes. Impress Your Family and Friends With Exact Replicas of The Following Recipes:.
Feel free to surf to my web site ... curry recipes
Anyone anywhere in the world who loves to cook and
ReplyDeletewho is interested in learning how to cook Filipino food recipes only needs a working
internet connection in order to be able to access and download famous Filipino food
or. Add chicken stock (liter) and bring to boil,
add salt to taste, chicken seasoning, ground peppercorn, vetsin, cabbage and noodles.
This article has Pizza Hut’s copycat recipe and
the history of the pizza.
Also visit my webpage - chili pie crust recipes with lard
()
Almost everything can be insured like people,
ReplyDeletebuildings, vehicles and documents etc but insurance companies
set different criteria for different objects and hence,
the documents needed for insurance of these items vary from one insurance provider to the other.
If you are looking for extended warranty automobile insurance package that provides coverage for air conditioning,
front and rear suspension, wiring, brakes, steering, transmission,
and engine, you can consider the gold plan. If you do not have a vehicle of your own, or car is not registered in your name,
you can apply for a non-owner's SR-22 policy.
my web blog; sr22 insurance requirements
We can help you search for the best rate available.
ReplyDeleteThe fact that the operator has a non-owner coverage will not excuse the
operator for not having coverage on the vehicle. Even the companies
in Los Angeles, who do insure high danger drivers, use diverse formulas to calculate DUI insurance rates.
Here is my homepage ... non owners Sr22 (ryan1852pfs6.livejournal.com)
My brother suggested I might like this web site.
ReplyDeleteHe was once totally right. This publish actually made
my day. You cann't consider just how much time I had spent for this info!
Thank you!
Feel free to surf to my web site ... best car insurance companies; ,
(Many of the best flavours work well beyond simple potentiation of
ReplyDeletenerve cells. To make your own baby shampoo at home, you'll
need:. Stir constantly to toast all sides and prevent burning.
Check out my homepage :: recipes in hindi by sanjeev kapoor ()
To add to that, these recipes are also designed to help your
ReplyDeletebody fight what is known to be the metabolic adaptation phenomenon.
) It is just the same as the difference between playing the guitar hero game
and dreaming of being a rock God - and being a dreamer all your life.
"The Cheesecake Factory cheesecake recipe was fantastic.
My web site all recipes uk
naturally like your website but you have to test the
ReplyDeletespelling on quite a few of your posts. Several of them are rife with spelling
problems and I in finding it very troublesome to inform the truth
on the other hand I will definitely come back again.
Review my webpage - auto insurance ()
Many of my free baits were well over 25 millimetres in size and
ReplyDeletenone were made to be round but rather all were odd shaped and were in fact not prepared by rolling at all.
Season the beef roast with salt and pepper as desired. ) In
this regard you might think that nutritional de-hulled hemp seed bars or hemp oil would be a good
thing for everyone - but this is far from being the truth.
My homepage ... 50 recipes 75 things every man should know
Hi I am so delighted I found your weblog, I really found you by accident, while I was looking on Digg for something else, Nonetheless I am here now and
ReplyDeletewould just like to say thanks a lot for a remarkable
post and a all round exciting blog (I also love the theme/design), I don't have time to browse it all at the minute but
I have bookmarked it and also included your RSS
feeds, so when I have time I will be back to read
a great deal more, Please do keep up the superb job.
Here is my blog :: general auto insurance
Turn the heat off and allow the treats to cool thoroughly before removing.
ReplyDeleteAdd chicken stock (liter) and bring to boil, add salt to taste,
chicken seasoning, ground peppercorn, vetsin, cabbage
and noodles. Impress Your Family and Friends With Exact Replicas of The Following Recipes:
.
my web blog ... dutch oven recipes
Go through this short article for a few of individuals recipes.
ReplyDeleteIf you would like to own pasta, you can add veggies as side dishes or make a salad utilizing pasta.
Place a frying pan or iron skillet over medium to
high heat.
my web-site :: all recipes apple pie slices - -
Some companies even offer SR-22 filings for non-owners. Companies offer extended warranty automobile insurance plans at various levels.
ReplyDeleteEven the companies in Los Angeles, who do insure high
danger drivers, use diverse formulas to calculate DUI insurance rates.
Here is my web blog ... what is a sr22 in texas
Go through this short article for a few of individuals recipes.
ReplyDelete) It is just the same as the difference between playing the guitar hero game and dreaming of being a rock God - and being a dreamer all your life.
Stir constantly to toast all sides and prevent burning.
My homepage - quick and easy best recipes for church dinners ()
Make good use of the internet, if possible, to aid you in your search.
ReplyDeleteIf you do not have to purchase collision for your car because of a loan, do
not buy it. Ethiopia levels serious charges Aviation law and compensation - Possible causes of ET409 crash - All ET409
victims recovered - How black boxes survive crashes - ET409 pilot had premonition - Second plane in ET409 crash
- Mystery deepens in ET409 crash - ET409 black box recovered
- Lebanon and Cameroon crash similar - Black box eludes Beirut searchers
- Ethiopian Airlines black boxes found - Fast turn by Ethiopian 737 pilot
- Boeing and NTSB probe 737 crash.
My blog: sr22 quote
Almost everything can be insured like people, buildings, vehicles and documents etc but insurance companies set different
ReplyDeletecriteria for different objects and hence, the
documents needed for insurance of these items vary from one insurance provider to the other.
Private pilots are not restricted to light sport aircraft,
banned from towered airports and night flying, or limited to one passenger.
Even the companies in Los Angeles, who do insure high danger drivers, use diverse formulas
to calculate DUI insurance rates.
My web page: allstate sr22
Hey I know this is off topic but I was wondering if you knew of any widgets I
ReplyDeletecould add to my blog that automatically tweet my newest twitter updates.
I've been looking for a plug-in like this for
quite some time and was hoping maybe you would have some experience with something like this.
Please let me know if you run into anything. I truly enjoy reading your blog and I look
forward to your new updates.
Feel free to visit my web page - Cheapest Car insurance
Very quickly this web page will be famous amid all blogging visitors, due to it's fastidious articles or reviews
ReplyDeleteFeel free to visit my page - best insurance; jackson9862uka9.livejournal.com,
According to the Cirrus Owners and Pilots Association (COPA), there
ReplyDeletehave been 36 known CAPS activations as of July 24, 2012. You could serve jail
time, lose your license or be ordered by the court to do community service.
When shopping for insurance, keep in mind that an insurance agent does not necessarily know
that an SR-22 filing is required unless a client
specifically asks for one.
Check out my homepage - cheap insurance sr22
It's like an insurance card that the court orders you to carry to verify that when a high-risk
ReplyDeletedriver is behind the wheel, they're insured to be behind the wheel.
You could serve jail time, lose your license or be ordered by the court to do community
service. The SR22 insurance derives its name from the form of the policy.
Have a look at my blog post; sr22 ins
It's like an insurance card that the court orders you to carry to verify that when a high-risk driver is behind the wheel,
ReplyDeletethey're insured to be behind the wheel. Thereby, you can convince the department issuing SR22 auto insurance that you
will soon become a responsible driver. Even the companies
in Los Angeles, who do insure high danger drivers, use diverse formulas to calculate DUI
insurance rates.
My blog; cheap Sr22 Insurance quotes
Have fun at Thanksgiving, because you might not see Christmas.
ReplyDeleteIf you would like to own pasta, you can add veggies as side dishes or make a salad utilizing pasta.
Place a frying pan or iron skillet over medium to high
heat.
Here is my weblog - chicken recipes barefoot contessa ()
Go through this short article for a few of individuals recipes.
ReplyDeleteSeason the beef roast with salt and pepper as desired. You will need to
obtain the following ingredients to make one gallon of liquid goat's milk soap:.
Look at my web-site - recipes free kindle books ()
Go through this short article for a few of individuals recipes.
ReplyDeletecom, the first and only interactive cooking portal that highlights Filipino
regional food recipes. You'll be able to cook a lot of meals not having adding heat for your definitely scorching apartment or house.
My website: chicken slow cooker recipes indian
Even if you are innocent you can be forced to carry SR-22
ReplyDeleteinsurance, even if you are innocent you may have to pay the $250.
You could serve jail time, lose your license or be ordered
by the court to do community service. Even the companies in Los Angeles,
who do insure high danger drivers, use diverse
formulas to calculate DUI insurance rates.
Also visit my web-site non owners sr22 insurance quotes ()
Turn the heat off and allow the treats to cool thoroughly
ReplyDeletebefore removing. Season the beef roast with salt and pepper as desired.
Stir constantly to toast all sides and prevent burning.
Here is my blog :: food network recipes cabbage rolls ()
Hello to all, how is everything, I think every one is getting more from this web page, and your views are fastidious in support of
ReplyDeletenew viewers.
Feel free to surf to my blog post: average car insurance rates
The fact on the matter is that idea not enough to have specifics of auto insurance, you also should
ReplyDeletecollect info about other pursuits. By law, an
insurer is required to cancel the SR22 using state incase the insurance plan expires, canceled or is not really renewed by the insured for any particular reason.
Ethiopia levels serious charges Aviation law
and compensation - Possible causes of ET409 crash - All ET409 victims recovered
- How black boxes survive crashes - ET409 pilot
had premonition - Second plane in ET409 crash - Mystery
deepens in ET409 crash - ET409 black box recovered - Lebanon and Cameroon crash similar - Black box eludes Beirut searchers - Ethiopian Airlines black boxes found - Fast turn
by Ethiopian 737 pilot - Boeing and NTSB probe 737
crash.
My blog; sr22 insurance requirements ()
Hi there great website! Does running a blog like this take a lot of work?
ReplyDeleteI have virtually no knowledge of computer programming but I had been hoping to start my own blog soon.
Anyhow, if you have any recommendations or tips for new blog owners please share.
I understand this is off topic nevertheless I just wanted to ask.
Thanks!
Here is my site :: cheapest insurance ()
Some companies even offer SR-22 filings for non-owners.
ReplyDeleteYou could serve jail time, lose your license or be ordered by the court
to do community service. For these people, auto insurance
sr22 filings are required so that they can legally drive in the state that they reside in.
Also visit my web-site; average cost of sr22 insurance
To add to that, these recipes are also designed to help your body fight what is known to be the metabolic adaptation phenomenon.
ReplyDeleteOne could easily find these foods at Central Market. This article has Pizza
Hut’s copycat recipe and the history of the pizza.
Visit my web site :: best recipes for chicken drumsticks []
The fact on the matter is that idea not enough to have specifics of auto insurance, you also should collect info
ReplyDeleteabout other pursuits. You could serve jail time, lose your license or be ordered by
the court to do community service. One of the first complete necessities found in society relies on cash.
Feel free to visit my web site ... sr22 insurance non owner quotes
Pretty element of content. I just stumbled upon your website
ReplyDeleteand in accession capital to claim that I acquire actually loved
account your weblog posts. Anyway I'll be subscribing for your feeds or even
I achievement you access constantly fast.
Feel free to visit my web page :: cheapest car insurance
I'm not sure where you are getting your info, but good
ReplyDeletetopic. I needs to spend some time learning much more or understanding more.
Thanks for wonderful information I was looking for this information for my mission.
my blog post; free insurance quotes
Turn the heat off and allow the treats to cool thoroughly before
ReplyDeleteremoving. One could easily find these foods at Central Market.
You'll be able to cook a lot of meals not having adding
heat for your definitely scorching apartment or house.
Here is my blog :: sweet potato recipes the ultimate farmville 2 recipe
According to the Cirrus Owners and Pilots Association (COPA), there have been 36 known CAPS activations as of July 24, 2012.
ReplyDeleteThereby, you can convince the department issuing SR22 auto insurance that you will soon become a responsible driver.
For these people, auto insurance sr22 filings are required so that they can legally drive in the state that they reside in.
Feel free to surf to my website :: how do i get an sr22
form ()
Excellent blog here! Also your site loads up very fast!
ReplyDeleteWhat host are you using? Can I get your affiliate link to your host?
I wish my web site loaded up as quickly as yours lol
Here is my page; free insurance quotes []
Many of my free baits were well over 25 millimetres in size and none were made to be round
ReplyDeletebut rather all were odd shaped and were in fact not prepared
by rolling at all. com, the first and only interactive cooking
portal that highlights Filipino regional food recipes. This article has Pizza Hut’s copycat
recipe and the history of the pizza.
my web site crock pot recipes for brisket
Almost everything can be insured like people, buildings, vehicles and documents etc but insurance companies set different criteria for different objects and hence, the documents needed for insurance of these items vary from one insurance provider to the other.
ReplyDeleteA standard first offense DUI offender should expect to pay between 3 and 5 times as much per month for their SR22
insurance as they were paying on their regular auto insurance rates.
For these people, auto insurance sr22 filings are required so that they can legally
drive in the state that they reside in.
Here is my web-site; free sr22 insurance
This text is invaluable. How can I find out more?
ReplyDeleteFeel free to surf to my homepage :: non owner car insurance
Summer is the perfect time for cookouts and dinner
ReplyDeleteevents. One could easily find these foods at Central Market.
You'll be able to cook a lot of meals not having adding heat for your definitely scorching apartment or
house.
Feel free to visit my web page ... Free Recipes For Baked Chicken Legs
Make good use of the internet, if possible, to aid you in your
ReplyDeletesearch. Thereby, you can convince the department issuing SR22 auto insurance that
you will soon become a responsible driver. When shopping for insurance, keep in mind
that an insurance agent does not necessarily know that an SR-22 filing
is required unless a client specifically asks for one.
Here is my weblog ... non owner sr22 insurance cost
It's like an insurance card that the court orders you to carry
ReplyDeleteto verify that when a high-risk driver is behind the wheel, they're insured to be behind the wheel.
Companies offer extended warranty automobile insurance
plans at various levels. If you do not have a vehicle of your own,
or car is not registered in your name, you can apply for a non-owner's SR-22 policy.
Here is my weblog; sr22 california insurance
These might even be honey, smooth peanut butter, jam or marmalade,
ReplyDeletecurry source, crab paste, tomato puree, liquidised fruits or liquidised liver;
look into why you are doing this and why you are choosing these substances (see my ebooks.
Season the beef roast with salt and pepper as desired.
Impress Your Family and Friends With Exact Replicas of The Following Recipes:
.
Also visit my web blog ... best beef crock pot recipes ()
We can help you search for the best rate available. Thereby, you
ReplyDeletecan convince the department issuing SR22 auto insurance that you will
soon become a responsible driver. At the moment the big boy companies go through brokers to sell their product and if they went online it could kill the retail broker industry.
Also visit my web blog non vehicle owner sr22 ()