update openid for snakebite
This commit is contained in:
friendica
parent
d3120264cb
commit
7fc292831c
49
library/openid/README
Normal file
49
library/openid/README
Normal file
@ -0,0 +1,49 @@
|
||||
This class provides a simple interface for OpenID (1.1 and 2.0) authentication.
|
||||
Supports Yadis discovery.
|
||||
|
||||
The authentication process is stateless/dumb.
|
||||
|
||||
Usage:
|
||||
Sign-on with OpenID is a two step process:
|
||||
Step one is authentication with the provider:
|
||||
<code>
|
||||
$openid = new LightOpenID('my-host.example.org');
|
||||
$openid->identity = 'ID supplied by user';
|
||||
header('Location: ' . $openid->authUrl());
|
||||
</code>
|
||||
|
||||
The provider then sends various parameters via GET, one of them is openid_mode.
|
||||
Step two is verification:
|
||||
<code>
|
||||
if ($this->data['openid_mode']) {
|
||||
$openid = new LightOpenID('my-host.example.org');
|
||||
echo $openid->validate() ? 'Logged in.' : 'Failed';
|
||||
}
|
||||
</code>
|
||||
*
|
||||
Change the 'my-host.example.org' to your domain name. Do NOT use $_SERVER['HTTP_HOST']
|
||||
for that, unless you know what you are doing.
|
||||
*
|
||||
Optionally, you can set $returnUrl and $realm (or $trustRoot, which is an alias).
|
||||
The default values for those are:
|
||||
$openid->realm = (!empty($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
|
||||
$openid->returnUrl = $openid->realm . $_SERVER['REQUEST_URI'];
|
||||
If you don't know their meaning, refer to any openid tutorial, or specification. Or just guess.
|
||||
*
|
||||
AX and SREG extensions are supported.
|
||||
To use them, specify $openid->required and/or $openid->optional before calling $openid->authUrl().
|
||||
These are arrays, with values being AX schema paths (the 'path' part of the URL).
|
||||
For example:
|
||||
$openid->required = array('namePerson/friendly', 'contact/email');
|
||||
$openid->optional = array('namePerson/first');
|
||||
If the server supports only SREG or OpenID 1.1, these are automaticaly
|
||||
mapped to SREG names, so that user doesn't have to know anything about the server.
|
||||
*
|
||||
To get the values, use $openid->getAttributes().
|
||||
*
|
||||
The library requires PHP >= 5.1.2 with curl or http/https stream wrappers enabled.
|
||||
@author Mewp
|
||||
@contributors Brice http://github.com/brice/
|
||||
@copyright Copyright (c) 2010, Mewp
|
||||
@copyright Copyright (c) 2010, Brice
|
||||
@license http://www.opensource.org/licenses/mit-license.php MIT
|
||||
24
library/openid/example-google.php
Normal file
24
library/openid/example-google.php
Normal file
@ -0,0 +1,24 @@
|
||||
<?php
|
||||
# Logging in with Google accounts requires setting special identity, so this example shows how to do it.
|
||||
require 'openid.php';
|
||||
try {
|
||||
# Change 'localhost' to your domain name.
|
||||
$openid = new LightOpenID('localhost');
|
||||
if(!$openid->mode) {
|
||||
if(isset($_GET['login'])) {
|
||||
$openid->identity = 'https://www.google.com/accounts/o8/id';
|
||||
header('Location: ' . $openid->authUrl());
|
||||
}
|
||||
?>
|
||||
<form action="?login" method="post">
|
||||
<button>Login with Google</button>
|
||||
</form>
|
||||
<?php
|
||||
} elseif($openid->mode == 'cancel') {
|
||||
echo 'User has canceled authentication!';
|
||||
} else {
|
||||
echo 'User ' . ($openid->validate() ? $openid->identity . ' has ' : 'has not ') . 'logged in.';
|
||||
}
|
||||
} catch(ErrorException $e) {
|
||||
echo $e->getMessage();
|
||||
}
|
||||
23
library/openid/example.php
Normal file
23
library/openid/example.php
Normal file
@ -0,0 +1,23 @@
|
||||
<?php
|
||||
require 'openid.php';
|
||||
try {
|
||||
# Change 'localhost' to your domain name.
|
||||
$openid = new LightOpenID('localhost');
|
||||
if(!$openid->mode) {
|
||||
if(isset($_POST['openid_identifier'])) {
|
||||
$openid->identity = $_POST['openid_identifier'];
|
||||
header('Location: ' . $openid->authUrl());
|
||||
}
|
||||
?>
|
||||
<form action="" method="post">
|
||||
OpenID: <input type="text" name="openid_identifier" /> <button>Submit</button>
|
||||
</form>
|
||||
<?php
|
||||
} elseif($openid->mode == 'cancel') {
|
||||
echo 'User has canceled authentication!';
|
||||
} else {
|
||||
echo 'User ' . ($openid->validate() ? $openid->identity . ' has ' : 'has not ') . 'logged in.';
|
||||
}
|
||||
} catch(ErrorException $e) {
|
||||
echo $e->getMessage();
|
||||
}
|
||||
@ -8,7 +8,7 @@
|
||||
* Sign-on with OpenID is a two step process:
|
||||
* Step one is authentication with the provider:
|
||||
* <code>
|
||||
* $openid = new LightOpenID;
|
||||
* $openid = new LightOpenID('my-host.example.org');
|
||||
* $openid->identity = 'ID supplied by user';
|
||||
* header('Location: ' . $openid->authUrl());
|
||||
* </code>
|
||||
@ -16,15 +16,18 @@
|
||||
* Step two is verification:
|
||||
* <code>
|
||||
* if ($this->data['openid_mode']) {
|
||||
* $openid = new LightOpenID;
|
||||
* $openid = new LightOpenID('my-host.example.org');
|
||||
* echo $openid->validate() ? 'Logged in.' : 'Failed';
|
||||
* }
|
||||
* </code>
|
||||
*
|
||||
* Change the 'my-host.example.org' to your domain name. Do NOT use $_SERVER['HTTP_HOST']
|
||||
* for that, unless you know what you are doing.
|
||||
*
|
||||
* Optionally, you can set $returnUrl and $realm (or $trustRoot, which is an alias).
|
||||
* The default values for those are:
|
||||
* $openid->realm = (!empty($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
|
||||
* $openid->returnUrl = $openid->realm . $_SERVER['REQUEST_URI']; # without the query part, if present
|
||||
* $openid->returnUrl = $openid->realm . $_SERVER['REQUEST_URI'];
|
||||
* If you don't know their meaning, refer to any openid tutorial, or specification. Or just guess.
|
||||
*
|
||||
* AX and SREG extensions are supported.
|
||||
@ -39,7 +42,7 @@
|
||||
* To get the values, use $openid->getAttributes().
|
||||
*
|
||||
*
|
||||
* The library requires PHP >= 5.1.2 with curl or http/https stream wrappers enabled..
|
||||
* The library requires PHP >= 5.1.2 with curl or http/https stream wrappers enabled.
|
||||
* @author Mewp
|
||||
* @copyright Copyright (c) 2010, Mewp
|
||||
* @license http://www.opensource.org/licenses/mit-license.php MIT
|
||||
@ -49,11 +52,13 @@ class LightOpenID
|
||||
public $returnUrl
|
||||
, $required = array()
|
||||
, $optional = array()
|
||||
, $verify_perr = null
|
||||
, $capath = null;
|
||||
, $verify_peer = null
|
||||
, $capath = null
|
||||
, $cainfo = null
|
||||
, $data;
|
||||
private $identity, $claimed_id;
|
||||
protected $server, $version, $trustRoot, $aliases, $identifier_select = false
|
||||
, $ax = false, $sreg = false, $data;
|
||||
, $ax = false, $sreg = false, $setup_url = null;
|
||||
static protected $ax_to_sreg = array(
|
||||
'namePerson/friendly' => 'nickname',
|
||||
'contact/email' => 'email',
|
||||
@ -66,14 +71,28 @@ class LightOpenID
|
||||
'pref/timezone' => 'timezone',
|
||||
);
|
||||
|
||||
function __construct()
|
||||
function __construct($host)
|
||||
{
|
||||
$this->trustRoot = (!empty($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
|
||||
$uri = $_SERVER['REQUEST_URI'];
|
||||
$uri = strpos($uri, '?') ? substr($uri, 0, strpos($uri, '?')) : $uri;
|
||||
$this->trustRoot = (strpos($host, '://') ? $host : 'http://' . $host);
|
||||
if ((!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off')
|
||||
|| (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])
|
||||
&& $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
|
||||
) {
|
||||
$this->trustRoot = (strpos($host, '://') ? $host : 'https://' . $host);
|
||||
}
|
||||
|
||||
if(($host_end = strpos($this->trustRoot, '/', 8)) !== false) {
|
||||
$this->trustRoot = substr($this->trustRoot, 0, $host_end);
|
||||
}
|
||||
|
||||
$uri = rtrim(preg_replace('#((?<=\?)|&)openid\.[^&]+#', '', $_SERVER['REQUEST_URI']), '?');
|
||||
$this->returnUrl = $this->trustRoot . $uri;
|
||||
|
||||
$this->data = $_POST + $_GET; # OPs may send data as POST or GET.
|
||||
$this->data = ($_SERVER['REQUEST_METHOD'] === 'POST') ? $_POST : $_GET;
|
||||
|
||||
if(!function_exists('curl_init') && !in_array('https', stream_get_wrappers())) {
|
||||
throw new ErrorException('You must have either https wrappers or curl enabled.');
|
||||
}
|
||||
}
|
||||
|
||||
function __set($name, $value)
|
||||
@ -109,6 +128,8 @@ class LightOpenID
|
||||
case 'trustRoot':
|
||||
case 'realm':
|
||||
return $this->trustRoot;
|
||||
case 'mode':
|
||||
return empty($this->data['openid_mode']) ? null : $this->data['openid_mode'];
|
||||
}
|
||||
}
|
||||
|
||||
@ -143,11 +164,15 @@ class LightOpenID
|
||||
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
|
||||
curl_setopt($curl, CURLOPT_HTTPHEADER, array('Accept: application/xrds+xml, */*'));
|
||||
|
||||
if($this->verify_perr !== null) {
|
||||
if($this->verify_peer !== null) {
|
||||
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, $this->verify_peer);
|
||||
if($this->capath) {
|
||||
curl_setopt($curl, CURLOPT_CAPATH, $this->capath);
|
||||
}
|
||||
|
||||
if($this->cainfo) {
|
||||
curl_setopt($curl, CURLOPT_CAINFO, $this->cainfo);
|
||||
}
|
||||
}
|
||||
|
||||
if ($method == 'POST') {
|
||||
@ -188,7 +213,7 @@ class LightOpenID
|
||||
protected function request_streams($url, $method='GET', $params=array())
|
||||
{
|
||||
if(!$this->hostExists($url)) {
|
||||
throw new ErrorException('Invalid request.');
|
||||
throw new ErrorException("Could not connect to $url.", 404);
|
||||
}
|
||||
|
||||
$params = http_build_query($params, '', '&');
|
||||
@ -199,7 +224,9 @@ class LightOpenID
|
||||
'method' => 'GET',
|
||||
'header' => 'Accept: application/xrds+xml, */*',
|
||||
'ignore_errors' => true,
|
||||
)
|
||||
), 'ssl' => array(
|
||||
'CN_match' => parse_url($url, PHP_URL_HOST),
|
||||
),
|
||||
);
|
||||
$url = $url . ($params ? '?' . $params : '');
|
||||
break;
|
||||
@ -210,7 +237,9 @@ class LightOpenID
|
||||
'header' => 'Content-type: application/x-www-form-urlencoded',
|
||||
'content' => $params,
|
||||
'ignore_errors' => true,
|
||||
)
|
||||
), 'ssl' => array(
|
||||
'CN_match' => parse_url($url, PHP_URL_HOST),
|
||||
),
|
||||
);
|
||||
break;
|
||||
case 'HEAD':
|
||||
@ -219,11 +248,15 @@ class LightOpenID
|
||||
# we have to change the defaults.
|
||||
$default = stream_context_get_options(stream_context_get_default());
|
||||
stream_context_get_default(
|
||||
array('http' => array(
|
||||
'method' => 'HEAD',
|
||||
'header' => 'Accept: application/xrds+xml, */*',
|
||||
'ignore_errors' => true,
|
||||
))
|
||||
array(
|
||||
'http' => array(
|
||||
'method' => 'HEAD',
|
||||
'header' => 'Accept: application/xrds+xml, */*',
|
||||
'ignore_errors' => true,
|
||||
), 'ssl' => array(
|
||||
'CN_match' => parse_url($url, PHP_URL_HOST),
|
||||
),
|
||||
)
|
||||
);
|
||||
|
||||
$url = $url . ($params ? '?' . $params : '');
|
||||
@ -263,10 +296,11 @@ class LightOpenID
|
||||
}
|
||||
|
||||
if($this->verify_peer) {
|
||||
$opts += array('ssl' => array(
|
||||
$opts['ssl'] += array(
|
||||
'verify_peer' => true,
|
||||
'capath' => $this->capath,
|
||||
));
|
||||
'cafile' => $this->cainfo,
|
||||
);
|
||||
}
|
||||
|
||||
$context = stream_context_create ($opts);
|
||||
@ -276,7 +310,9 @@ class LightOpenID
|
||||
|
||||
protected function request($url, $method='GET', $params=array())
|
||||
{
|
||||
if(function_exists('curl_init') && !ini_get('safe_mode') && (! strlen(ini_get('open_basedir')))) {
|
||||
if (function_exists('curl_init')
|
||||
&& (!in_array('https', stream_get_wrappers()) || !ini_get('safe_mode') && !ini_get('open_basedir'))
|
||||
) {
|
||||
return $this->request_curl($url, $method, $params);
|
||||
}
|
||||
return $this->request_streams($url, $method, $params);
|
||||
@ -297,7 +333,7 @@ class LightOpenID
|
||||
. (empty($url['port'])?'':":{$url['port']}")
|
||||
. (empty($url['path'])?'':$url['path'])
|
||||
. (empty($url['query'])?'':"?{$url['query']}")
|
||||
. (empty($url['fragment'])?'':":{$url['fragment']}");
|
||||
. (empty($url['fragment'])?'':"#{$url['fragment']}");
|
||||
return $url;
|
||||
}
|
||||
|
||||
@ -342,84 +378,90 @@ class LightOpenID
|
||||
$headers = $this->request($url, 'HEAD');
|
||||
|
||||
$next = false;
|
||||
if (isset($headers['x-xrds-location'])) {
|
||||
$url = $this->build_url(parse_url($url), parse_url(trim($headers['x-xrds-location'])));
|
||||
$next = true;
|
||||
}
|
||||
if (isset($headers['x-xrds-location'])) {
|
||||
$url = $this->build_url(parse_url($url), parse_url(trim($headers['x-xrds-location'])));
|
||||
$next = true;
|
||||
}
|
||||
|
||||
if (isset($headers['content-type'])
|
||||
&& ((strpos($headers['content-type'], 'application/xrds+xml') !== false
|
||||
) || (strpos($headers['content-type'], 'text/xml') !== false))) {
|
||||
# Found an XRDS document, now let's find the server, and optionally delegate.
|
||||
$content = $this->request($url, 'GET');
|
||||
if (isset($headers['content-type'])
|
||||
&& (strpos($headers['content-type'], 'application/xrds+xml') !== false
|
||||
|| strpos($headers['content-type'], 'text/xml') !== false)
|
||||
) {
|
||||
# Apparently, some providers return XRDS documents as text/html.
|
||||
# While it is against the spec, allowing this here shouldn't break
|
||||
# compatibility with anything.
|
||||
# ---
|
||||
# Found an XRDS document, now let's find the server, and optionally delegate.
|
||||
$content = $this->request($url, 'GET');
|
||||
|
||||
preg_match_all('#<Service.*?>(.*?)</Service>#s', $content, $m);
|
||||
foreach($m[1] as $content) {
|
||||
$content = ' ' . $content; # The space is added, so that strpos doesn't return 0.
|
||||
preg_match_all('#<Service.*?>(.*?)</Service>#s', $content, $m);
|
||||
foreach($m[1] as $content) {
|
||||
$content = ' ' . $content; # The space is added, so that strpos doesn't return 0.
|
||||
|
||||
# OpenID 2
|
||||
$ns = preg_quote('http://specs.openid.net/auth/2.0/');
|
||||
if(preg_match('#<Type>\s*'.$ns.'(server|signon)\s*</Type>#s', $content, $type)) {
|
||||
if ($type[1] == 'server') $this->identifier_select = true;
|
||||
# OpenID 2
|
||||
$ns = preg_quote('http://specs.openid.net/auth/2.0/');
|
||||
if(preg_match('#<Type>\s*'.$ns.'(server|signon)\s*</Type>#s', $content, $type)) {
|
||||
if ($type[1] == 'server') $this->identifier_select = true;
|
||||
|
||||
preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
|
||||
preg_match('#<(Local|Canonical)ID>(.*)</\1ID>#', $content, $delegate);
|
||||
if (empty($server)) {
|
||||
return false;
|
||||
}
|
||||
# Does the server advertise support for either AX or SREG?
|
||||
$this->ax = (bool) strpos($content, '<Type>http://openid.net/srv/ax/1.0</Type>');
|
||||
$this->sreg = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
|
||||
|| strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');
|
||||
|
||||
$server = $server[1];
|
||||
if (isset($delegate[2])) $this->identity = trim($delegate[2]);
|
||||
$this->version = 2;
|
||||
logger('Server: ' . $server);
|
||||
$this->server = $server;
|
||||
return $server;
|
||||
preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
|
||||
preg_match('#<(Local|Canonical)ID>(.*)</\1ID>#', $content, $delegate);
|
||||
if (empty($server)) {
|
||||
return false;
|
||||
}
|
||||
# Does the server advertise support for either AX or SREG?
|
||||
$this->ax = (bool) strpos($content, '<Type>http://openid.net/srv/ax/1.0</Type>');
|
||||
$this->sreg = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
|
||||
|| strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');
|
||||
|
||||
# OpenID 1.1
|
||||
$ns = preg_quote('http://openid.net/signon/1.1');
|
||||
if (preg_match('#<Type>\s*'.$ns.'\s*</Type>#s', $content)) {
|
||||
$server = $server[1];
|
||||
if (isset($delegate[2])) $this->identity = trim($delegate[2]);
|
||||
$this->version = 2;
|
||||
|
||||
preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
|
||||
preg_match('#<.*?Delegate>(.*)</.*?Delegate>#', $content, $delegate);
|
||||
if (empty($server)) {
|
||||
return false;
|
||||
}
|
||||
# AX can be used only with OpenID 2.0, so checking only SREG
|
||||
$this->sreg = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
|
||||
|| strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');
|
||||
|
||||
$server = $server[1];
|
||||
if (isset($delegate[1])) $this->identity = $delegate[1];
|
||||
$this->version = 1;
|
||||
|
||||
$this->server = $server;
|
||||
return $server;
|
||||
}
|
||||
$this->server = $server;
|
||||
return $server;
|
||||
}
|
||||
|
||||
$next = true;
|
||||
$yadis = false;
|
||||
$url = $originalUrl;
|
||||
$content = null;
|
||||
break;
|
||||
# OpenID 1.1
|
||||
$ns = preg_quote('http://openid.net/signon/1.1');
|
||||
if (preg_match('#<Type>\s*'.$ns.'\s*</Type>#s', $content)) {
|
||||
|
||||
preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
|
||||
preg_match('#<.*?Delegate>(.*)</.*?Delegate>#', $content, $delegate);
|
||||
if (empty($server)) {
|
||||
return false;
|
||||
}
|
||||
# AX can be used only with OpenID 2.0, so checking only SREG
|
||||
$this->sreg = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
|
||||
|| strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');
|
||||
|
||||
$server = $server[1];
|
||||
if (isset($delegate[1])) $this->identity = $delegate[1];
|
||||
$this->version = 1;
|
||||
|
||||
$this->server = $server;
|
||||
return $server;
|
||||
}
|
||||
}
|
||||
|
||||
$next = true;
|
||||
$yadis = false;
|
||||
$url = $originalUrl;
|
||||
$content = null;
|
||||
break;
|
||||
}
|
||||
if ($next) continue;
|
||||
|
||||
# There are no relevant information in headers, so we search the body.
|
||||
$content = $this->request($url, 'GET');
|
||||
if ($location = $this->htmlTag($content, 'meta', 'http-equiv', 'X-XRDS-Location', 'content')) {
|
||||
$location = $this->htmlTag($content, 'meta', 'http-equiv', 'X-XRDS-Location', 'content');
|
||||
if ($location) {
|
||||
$url = $this->build_url(parse_url($url), parse_url($location));
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
if (!$content) $content = $this->request($url, 'GET');
|
||||
logger('openid' . $content);
|
||||
|
||||
# At this point, the YADIS Discovery has failed, so we'll switch
|
||||
# to openid2 HTML discovery, then fallback to openid 1.1 discovery.
|
||||
$server = $this->htmlTag($content, 'link', 'rel', 'openid2.provider', 'href');
|
||||
@ -443,9 +485,9 @@ logger('openid' . $content);
|
||||
return $server;
|
||||
}
|
||||
|
||||
throw new ErrorException('No servers found!');
|
||||
throw new ErrorException("No OpenID Server found at $url", 404);
|
||||
}
|
||||
throw new ErrorException('Endless redirection!');
|
||||
throw new ErrorException('Endless redirection!', 500);
|
||||
}
|
||||
|
||||
protected function sregParams()
|
||||
@ -514,7 +556,7 @@ logger('openid' . $content);
|
||||
return $params;
|
||||
}
|
||||
|
||||
protected function authUrl_v1()
|
||||
protected function authUrl_v1($immediate)
|
||||
{
|
||||
$returnUrl = $this->returnUrl;
|
||||
# If we have an openid.delegate that is different from our claimed id,
|
||||
@ -526,7 +568,7 @@ logger('openid' . $content);
|
||||
|
||||
$params = array(
|
||||
'openid.return_to' => $returnUrl,
|
||||
'openid.mode' => 'checkid_setup',
|
||||
'openid.mode' => $immediate ? 'checkid_immediate' : 'checkid_setup',
|
||||
'openid.identity' => $this->identity,
|
||||
'openid.trust_root' => $this->trustRoot,
|
||||
) + $this->sregParams();
|
||||
@ -535,11 +577,11 @@ logger('openid' . $content);
|
||||
, array('query' => http_build_query($params, '', '&')));
|
||||
}
|
||||
|
||||
protected function authUrl_v2($identifier_select)
|
||||
protected function authUrl_v2($immediate)
|
||||
{
|
||||
$params = array(
|
||||
'openid.ns' => 'http://specs.openid.net/auth/2.0',
|
||||
'openid.mode' => 'checkid_setup',
|
||||
'openid.mode' => $immediate ? 'checkid_immediate' : 'checkid_setup',
|
||||
'openid.return_to' => $this->returnUrl,
|
||||
'openid.realm' => $this->trustRoot,
|
||||
);
|
||||
@ -555,7 +597,7 @@ logger('openid' . $content);
|
||||
$params += $this->axParams() + $this->sregParams();
|
||||
}
|
||||
|
||||
if ($identifier_select) {
|
||||
if ($this->identifier_select) {
|
||||
$params['openid.identity'] = $params['openid.claimed_id']
|
||||
= 'http://specs.openid.net/auth/2.0/identifier_select';
|
||||
} else {
|
||||
@ -573,17 +615,15 @@ logger('openid' . $content);
|
||||
* @param String $select_identifier Whether to request OP to select identity for an user in OpenID 2. Does not affect OpenID 1.
|
||||
* @throws ErrorException
|
||||
*/
|
||||
function authUrl($identifier_select = null)
|
||||
function authUrl($immediate = false)
|
||||
{
|
||||
if ($this->setup_url && !$immediate) return $this->setup_url;
|
||||
if (!$this->server) $this->discover($this->identity);
|
||||
|
||||
if ($this->version == 2) {
|
||||
if ($identifier_select === null) {
|
||||
return $this->authUrl_v2($this->identifier_select);
|
||||
}
|
||||
return $this->authUrl_v2($identifier_select);
|
||||
return $this->authUrl_v2($immediate);
|
||||
}
|
||||
return $this->authUrl_v1();
|
||||
return $this->authUrl_v1($immediate);
|
||||
}
|
||||
|
||||
/**
|
||||
@ -593,6 +633,18 @@ logger('openid' . $content);
|
||||
*/
|
||||
function validate()
|
||||
{
|
||||
# If the request was using immediate mode, a failure may be reported
|
||||
# by presenting user_setup_url (for 1.1) or reporting
|
||||
# mode 'setup_needed' (for 2.0). Also catching all modes other than
|
||||
# id_res, in order to avoid throwing errors.
|
||||
if(isset($this->data['openid_user_setup_url'])) {
|
||||
$this->setup_url = $this->data['openid_user_setup_url'];
|
||||
return false;
|
||||
}
|
||||
if($this->mode != 'id_res') {
|
||||
return false;
|
||||
}
|
||||
|
||||
$this->claimed_id = isset($this->data['openid_claimed_id'])?$this->data['openid_claimed_id']:$this->data['openid_identity'];
|
||||
$params = array(
|
||||
'openid.assoc_handle' => $this->data['openid_assoc_handle'],
|
||||
@ -605,7 +657,9 @@ logger('openid' . $content);
|
||||
# Even though we should know location of the endpoint,
|
||||
# we still need to verify it by discovery, so $server is not set here
|
||||
$params['openid.ns'] = 'http://specs.openid.net/auth/2.0';
|
||||
} elseif(isset($this->data['openid_claimed_id'])) {
|
||||
} elseif (isset($this->data['openid_claimed_id'])
|
||||
&& $this->data['openid_claimed_id'] != $this->data['openid_identity']
|
||||
) {
|
||||
# If it's an OpenID 1 provider, and we've got claimed_id,
|
||||
# we have to append it to the returnUrl, like authUrl_v1 does.
|
||||
$this->returnUrl .= (strpos($this->returnUrl, '?') ? '&' : '?')
|
||||
@ -665,8 +719,8 @@ logger('openid' . $content);
|
||||
}
|
||||
|
||||
$attributes = array();
|
||||
foreach ($this->data as $key => $value) {
|
||||
$keyMatch = 'openid_' . $alias . '_value_';
|
||||
foreach (explode(',', $this->data['openid_signed']) as $key) {
|
||||
$keyMatch = $alias . '.value.';
|
||||
if (substr($key, 0, strlen($keyMatch)) != $keyMatch) {
|
||||
continue;
|
||||
}
|
||||
@ -677,8 +731,10 @@ logger('openid' . $content);
|
||||
# to check, than cause an E_NOTICE.
|
||||
continue;
|
||||
}
|
||||
$value = $this->data['openid_' . $alias . '_value_' . $key];
|
||||
$key = substr($this->data['openid_' . $alias . '_type_' . $key],
|
||||
strlen('http://axschema.org/'));
|
||||
|
||||
$attributes[$key] = $value;
|
||||
}
|
||||
return $attributes;
|
||||
@ -688,8 +744,8 @@ logger('openid' . $content);
|
||||
{
|
||||
$attributes = array();
|
||||
$sreg_to_ax = array_flip(self::$ax_to_sreg);
|
||||
foreach ($this->data as $key => $value) {
|
||||
$keyMatch = 'openid_sreg_';
|
||||
foreach (explode(',', $this->data['openid_signed']) as $key) {
|
||||
$keyMatch = 'sreg.';
|
||||
if (substr($key, 0, strlen($keyMatch)) != $keyMatch) {
|
||||
continue;
|
||||
}
|
||||
@ -698,7 +754,7 @@ logger('openid' . $content);
|
||||
# The field name isn't part of the SREG spec, so we ignore it.
|
||||
continue;
|
||||
}
|
||||
$attributes[$sreg_to_ax[$key]] = $value;
|
||||
$attributes[$sreg_to_ax[$key]] = $this->data['openid_sreg_' . $key];
|
||||
}
|
||||
return $attributes;
|
||||
}
|
||||
194
library/openid/provider/example-mysql.php
Normal file
194
library/openid/provider/example-mysql.php
Normal file
@ -0,0 +1,194 @@
|
||||
<?php
|
||||
/**
|
||||
* This example shows several things:
|
||||
* - How a setup interface should look like.
|
||||
* - How to use a mysql table for authentication
|
||||
* - How to store associations in mysql table, instead of php sessions.
|
||||
* - How to store realm authorizations.
|
||||
* - How to send AX/SREG parameters.
|
||||
* For the example to work, you need to create the necessary tables:
|
||||
CREATE TABLE Users (
|
||||
id INT NOT NULL auto_increment PRIMARY KEY,
|
||||
login VARCHAR(32) NOT NULL,
|
||||
password CHAR(40) NOT NULL,
|
||||
firstName VARCHAR(32) NOT NULL,
|
||||
lastName VARCHAR(32) NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE AllowedSites (
|
||||
user INT NOT NULL,
|
||||
realm TEXT NOT NULL,
|
||||
attributes TEXT NOT NULL,
|
||||
INDEX(user)
|
||||
);
|
||||
|
||||
CREATE TABLE Associations (
|
||||
id INT NOT NULL PRIMARY KEY,
|
||||
data TEXT NOT NULL
|
||||
);
|
||||
*
|
||||
* This is only an example. Don't use it in your code as-is.
|
||||
* It has several security flaws, which you shouldn't copy (like storing plaintext login and password in forms).
|
||||
*
|
||||
* This setup could be very easily flooded with many associations,
|
||||
* since non-private ones aren't automatically deleted.
|
||||
* You could prevent this by storing a date of association and removing old ones,
|
||||
* or by setting $this->dh = false;
|
||||
* However, the latter one would disable stateful mode, unless connecting via HTTPS.
|
||||
*/
|
||||
require 'provider.php';
|
||||
|
||||
mysql_connect();
|
||||
mysql_select_db('test');
|
||||
|
||||
function getUserData($handle=null)
|
||||
{
|
||||
if(isset($_POST['login'],$_POST['password'])) {
|
||||
$login = mysql_real_escape_string($_POST['login']);
|
||||
$password = sha1($_POST['password']);
|
||||
$q = mysql_query("SELECT * FROM Users WHERE login = '$login' AND password = '$password'");
|
||||
if($data = mysql_fetch_assoc($q)) {
|
||||
return $data;
|
||||
}
|
||||
if($handle) {
|
||||
echo 'Wrong login/password.';
|
||||
}
|
||||
}
|
||||
if($handle) {
|
||||
?>
|
||||
<form action="" method="post">
|
||||
<input type="hidden" name="openid.assoc_handle" value="<?php echo $handle?>">
|
||||
Login: <input type="text" name="login"><br>
|
||||
Password: <input type="password" name="password"><br>
|
||||
<button>Submit</button>
|
||||
</form>
|
||||
<?php
|
||||
die();
|
||||
}
|
||||
}
|
||||
|
||||
class MysqlProvider extends LightOpenIDProvider
|
||||
{
|
||||
private $attrMap = array(
|
||||
'namePerson/first' => 'First name',
|
||||
'namePerson/last' => 'Last name',
|
||||
'namePerson/friendly' => 'Nickname (login)'
|
||||
);
|
||||
|
||||
private $attrFieldMap = array(
|
||||
'namePerson/first' => 'firstName',
|
||||
'namePerson/last' => 'lastName',
|
||||
'namePerson/friendly' => 'login'
|
||||
);
|
||||
|
||||
function setup($identity, $realm, $assoc_handle, $attributes)
|
||||
{
|
||||
$data = getUserData($assoc_handle);
|
||||
echo '<form action="" method="post">'
|
||||
. '<input type="hidden" name="openid.assoc_handle" value="' . $assoc_handle . '">'
|
||||
. '<input type="hidden" name="login" value="' . $_POST['login'] .'">'
|
||||
. '<input type="hidden" name="password" value="' . $_POST['password'] .'">'
|
||||
. "<b>$realm</b> wishes to authenticate you.";
|
||||
if($attributes['required'] || $attributes['optional']) {
|
||||
echo " It also requests following information (required fields marked with *):"
|
||||
. '<ul>';
|
||||
|
||||
foreach($attributes['required'] as $attr) {
|
||||
if(isset($this->attrMap[$attr])) {
|
||||
echo '<li>'
|
||||
. '<input type="checkbox" name="attributes[' . $attr . ']"> '
|
||||
. $this->attrMap[$attr] . '(*)</li>';
|
||||
}
|
||||
}
|
||||
|
||||
foreach($attributes['optional'] as $attr) {
|
||||
if(isset($this->attrMap[$attr])) {
|
||||
echo '<li>'
|
||||
. '<input type="checkbox" name="attributes[' . $attr . ']"> '
|
||||
. $this->attrMap[$attr] . '</li>';
|
||||
}
|
||||
}
|
||||
echo '</ul>';
|
||||
}
|
||||
echo '<br>'
|
||||
. '<button name="once">Allow once</button> '
|
||||
. '<button name="always">Always allow</button> '
|
||||
. '<button name="cancel">cancel</button> '
|
||||
. '</form>';
|
||||
}
|
||||
|
||||
function checkid($realm, &$attributes)
|
||||
{
|
||||
if(isset($_POST['cancel'])) {
|
||||
$this->cancel();
|
||||
}
|
||||
|
||||
$data = getUserData();
|
||||
if(!$data) {
|
||||
return false;
|
||||
}
|
||||
$realm = mysql_real_escape_string($realm);
|
||||
$q = mysql_query("SELECT attributes FROM AllowedSites WHERE user = '{$data['id']}' AND realm = '$realm'");
|
||||
|
||||
$attrs = array();
|
||||
if($attrs = mysql_fetch_row($q)) {
|
||||
$attrs = explode(',', $attributes[0]);
|
||||
} elseif(isset($_POST['attributes'])) {
|
||||
$attrs = array_keys($_POST['attributes']);
|
||||
} elseif(!isset($_POST['once']) && !isset($_POST['always'])) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$attributes = array();
|
||||
foreach($attrs as $attr) {
|
||||
if(isset($this->attrFieldMap[$attr])) {
|
||||
$attributes[$attr] = $data[$this->attrFieldMap[$attr]];
|
||||
}
|
||||
}
|
||||
|
||||
if(isset($_POST['always'])) {
|
||||
$attrs = mysql_real_escape_string(implode(',', array_keys($attributes)));
|
||||
mysql_query("REPLACE INTO AllowedSites VALUES('{$data['id']}', '$realm', '$attrs')");
|
||||
}
|
||||
|
||||
return $this->serverLocation . '?' . $data['login'];
|
||||
}
|
||||
|
||||
function assoc_handle()
|
||||
{
|
||||
# We generate an integer assoc handle, because it's just faster to look up an integer later.
|
||||
$q = mysql_query("SELECT MAX(id) FROM Associations");
|
||||
$result = mysql_fetch_row($q);
|
||||
return $q[0]+1;
|
||||
}
|
||||
|
||||
function setAssoc($handle, $data)
|
||||
{
|
||||
$data = mysql_real_escape_string(serialize($data));
|
||||
mysql_query("REPLACE INTO Associations VALUES('$handle', '$data')");
|
||||
}
|
||||
|
||||
function getAssoc($handle)
|
||||
{
|
||||
if(!is_numeric($handle)) {
|
||||
return false;
|
||||
}
|
||||
$q = mysql_query("SELECT data FROM Associations WHERE id = '$handle'");
|
||||
$data = mysql_fetch_row($q);
|
||||
if(!$data) {
|
||||
return false;
|
||||
}
|
||||
return unserialize($data[0]);
|
||||
}
|
||||
|
||||
function delAssoc($handle)
|
||||
{
|
||||
if(!is_numeric($handle)) {
|
||||
return false;
|
||||
}
|
||||
mysql_query("DELETE FROM Associations WHERE id = '$handle'");
|
||||
}
|
||||
|
||||
}
|
||||
$op = new MysqlProvider;
|
||||
$op->server();
|
||||
53
library/openid/provider/example.php
Normal file
53
library/openid/provider/example.php
Normal file
@ -0,0 +1,53 @@
|
||||
<?php
|
||||
/**
|
||||
* This example shows how to create a basic provider usin HTTP Authentication.
|
||||
* This is only an example. You shouldn't use it as-is in your code.
|
||||
*/
|
||||
require 'provider.php';
|
||||
|
||||
class BasicProvider extends LightOpenIDProvider
|
||||
{
|
||||
public $select_id = true;
|
||||
public $login = '';
|
||||
public $password = '';
|
||||
|
||||
function __construct()
|
||||
{
|
||||
parent::__construct();
|
||||
|
||||
# If we use select_id, we must disable it for identity pages,
|
||||
# so that an RP can discover it and get proper data (i.e. without select_id)
|
||||
if(isset($_GET['id'])) {
|
||||
$this->select_id = false;
|
||||
}
|
||||
}
|
||||
|
||||
function setup($identity, $realm, $assoc_handle, $attributes)
|
||||
{
|
||||
header('WWW-Authenticate: Basic realm="' . $this->data['openid_realm'] . '"');
|
||||
header('HTTP/1.0 401 Unauthorized');
|
||||
}
|
||||
|
||||
function checkid($realm, &$attributes)
|
||||
{
|
||||
if(!isset($_SERVER['PHP_AUTH_USER'])) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if ($_SERVER['PHP_AUTH_USER'] == $this->login
|
||||
&& $_SERVER['PHP_AUTH_PW'] == $this->password
|
||||
) {
|
||||
# Returning identity
|
||||
# It can be any url that leads here, or to any other place that hosts
|
||||
# an XRDS document pointing here.
|
||||
return $this->serverLocation . '?id=' . $this->login;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
$op = new BasicProvider;
|
||||
$op->login = 'test';
|
||||
$op->password = 'test';
|
||||
$op->server();
|
||||
845
library/openid/provider/provider.php
Normal file
845
library/openid/provider/provider.php
Normal file
@ -0,0 +1,845 @@
|
||||
<?php
|
||||
/**
|
||||
* Using this class, you can easily set up an OpenID Provider.
|
||||
* It's independent of LightOpenID class.
|
||||
* It requires either GMP or BCMath for session encryption,
|
||||
* but will work without them (although either via SSL, or in stateless mode only).
|
||||
* Also, it requires PHP >= 5.1.2
|
||||
*
|
||||
* This is an alpha version, using it in production code is not recommended,
|
||||
* until you are *sure* that it works and is secure.
|
||||
*
|
||||
* Please send me messages about your testing results
|
||||
* (even if successful, so I know that it has been tested).
|
||||
* Also, if you think there's a way to make it easier to use, tell me -- it's an alpha for a reason.
|
||||
* Same thing applies to bugs in code, suggestions,
|
||||
* and everything else you'd like to say about the library.
|
||||
*
|
||||
* There's no usage documentation here, see the examples.
|
||||
*
|
||||
* @author Mewp
|
||||
* @copyright Copyright (c) 2010, Mewp
|
||||
* @license http://www.opensource.org/licenses/mit-license.php MIT
|
||||
*/
|
||||
ini_set('error_log','log');
|
||||
abstract class LightOpenIDProvider
|
||||
{
|
||||
# URL-s to XRDS and server location.
|
||||
public $xrdsLocation, $serverLocation;
|
||||
|
||||
# Should we operate in server, or signon mode?
|
||||
public $select_id = false;
|
||||
|
||||
# Lifetime of an association.
|
||||
protected $assoc_lifetime = 600;
|
||||
|
||||
# Variables below are either set automatically, or are constant.
|
||||
# -----
|
||||
# Can we support DH?
|
||||
protected $dh = true;
|
||||
protected $ns = 'http://specs.openid.net/auth/2.0';
|
||||
protected $data, $assoc;
|
||||
|
||||
# Default DH parameters as defined in the specification.
|
||||
protected $default_modulus;
|
||||
protected $default_gen = 'Ag==';
|
||||
|
||||
# AX <-> SREG transform
|
||||
protected $ax_to_sreg = array(
|
||||
'namePerson/friendly' => 'nickname',
|
||||
'contact/email' => 'email',
|
||||
'namePerson' => 'fullname',
|
||||
'birthDate' => 'dob',
|
||||
'person/gender' => 'gender',
|
||||
'contact/postalCode/home' => 'postcode',
|
||||
'contact/country/home' => 'country',
|
||||
'pref/language' => 'language',
|
||||
'pref/timezone' => 'timezone',
|
||||
);
|
||||
|
||||
# Math
|
||||
private $add, $mul, $pow, $mod, $div, $powmod;
|
||||
# -----
|
||||
|
||||
# ------------------------------------------------------------------------ #
|
||||
# Functions you probably want to implement when extending the class.
|
||||
|
||||
/**
|
||||
* Checks whether an user is authenticated.
|
||||
* The function should determine what fields it wants to send to the RP,
|
||||
* and put them in the $attributes array.
|
||||
* @param Array $attributes
|
||||
* @param String $realm Realm used for authentication.
|
||||
* @return String OP-local identifier of an authenticated user, or an empty value.
|
||||
*/
|
||||
abstract function checkid($realm, &$attributes);
|
||||
|
||||
/**
|
||||
* Displays an user interface for inputting user's login and password.
|
||||
* Attributes are always AX field namespaces, with stripped host part.
|
||||
* For example, the $attributes array may be:
|
||||
* array( 'required' => array('namePerson/friendly', 'contact/email'),
|
||||
* 'optional' => array('pref/timezone', 'pref/language')
|
||||
* @param String $identity Discovered identity string. May be used to extract login, unless using $this->select_id
|
||||
* @param String $realm Realm used for authentication.
|
||||
* @param String Association handle. must be sent as openid.assoc_handle in $_GET or $_POST in subsequent requests.
|
||||
* @param Array User attributes requested by the RP.
|
||||
*/
|
||||
abstract function setup($identity, $realm, $assoc_handle, $attributes);
|
||||
|
||||
/**
|
||||
* Stores an association.
|
||||
* If you want to use php sessions in your provider code, you have to replace it.
|
||||
* @param String $handle Association handle -- should be used as a key.
|
||||
* @param Array $assoc Association data.
|
||||
*/
|
||||
protected function setAssoc($handle, $assoc)
|
||||
{
|
||||
$oldSession = session_id();
|
||||
session_commit();
|
||||
session_id($assoc['handle']);
|
||||
session_start();
|
||||
$_SESSION['assoc'] = $assoc;
|
||||
session_commit();
|
||||
if($oldSession) {
|
||||
session_id($oldSession);
|
||||
session_start();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Retreives association data.
|
||||
* If you want to use php sessions in your provider code, you have to replace it.
|
||||
* @param String $handle Association handle.
|
||||
* @return Array Association data.
|
||||
*/
|
||||
protected function getAssoc($handle)
|
||||
{
|
||||
$oldSession = session_id();
|
||||
session_commit();
|
||||
session_id($handle);
|
||||
session_start();
|
||||
if(empty($_SESSION['assoc'])) {
|
||||
return null;
|
||||
}
|
||||
return $_SESSION['assoc'];
|
||||
session_commit();
|
||||
if($oldSession) {
|
||||
session_id($oldSession);
|
||||
session_start();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Deletes an association.
|
||||
* If you want to use php sessions in your provider code, you have to replace it.
|
||||
* @param String $handle Association handle.
|
||||
*/
|
||||
protected function delAssoc($handle)
|
||||
{
|
||||
$oldSession = session_id();
|
||||
session_commit();
|
||||
session_id($handle);
|
||||
session_start();
|
||||
session_destroy();
|
||||
if($oldSession) {
|
||||
session_id($oldSession);
|
||||
session_start();
|
||||
}
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------------ #
|
||||
# Functions that you might want to implement.
|
||||
|
||||
/**
|
||||
* Redirects the user to an url.
|
||||
* @param String $location The url that the user will be redirected to.
|
||||
*/
|
||||
protected function redirect($location)
|
||||
{
|
||||
header('Location: ' . $location);
|
||||
die();
|
||||
}
|
||||
|
||||
/**
|
||||
* Generates a new association handle.
|
||||
* @return string
|
||||
*/
|
||||
protected function assoc_handle()
|
||||
{
|
||||
return sha1(microtime());
|
||||
}
|
||||
|
||||
/**
|
||||
* Generates a random shared secret.
|
||||
* @return string
|
||||
*/
|
||||
protected function shared_secret($hash)
|
||||
{
|
||||
$length = 20;
|
||||
if($hash == 'sha256') {
|
||||
$length = 256;
|
||||
}
|
||||
|
||||
$secret = '';
|
||||
for($i = 0; $i < $length; $i++) {
|
||||
$secret .= mt_rand(0,255);
|
||||
}
|
||||
|
||||
return $secret;
|
||||
}
|
||||
|
||||
/**
|
||||
* Generates a private key.
|
||||
* @param int $length Length of the key.
|
||||
*/
|
||||
protected function keygen($length)
|
||||
{
|
||||
$key = '';
|
||||
for($i = 1; $i < $length; $i++) {
|
||||
$key .= mt_rand(0,9);
|
||||
}
|
||||
$key .= mt_rand(1,9);
|
||||
|
||||
return $key;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------------ #
|
||||
# Functions that you probably shouldn't touch.
|
||||
|
||||
function __construct()
|
||||
{
|
||||
$this->default_modulus =
|
||||
'ANz5OguIOXLsDhmYmsWizjEOHTdxfo2Vcbt2I3MYZuYe91ouJ4mLBX+YkcLiemOcPy'
|
||||
. 'm2CBRYHNOyyjmG0mg3BVd9RcLn5S3IHHoXGHblzqdLFEi/368Ygo79JRnxTkXjgmY0'
|
||||
. 'rxlJ5bU1zIKaSDuKdiI+XUkKJX8Fvf8W8vsixYOr';
|
||||
|
||||
$location = (!empty($_SERVER['HTTPS']) ? 'https' : 'http') . '://'
|
||||
. $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
|
||||
$location = preg_replace('/\?.*/','',$location);
|
||||
$this->serverLocation = $location;
|
||||
$location .= (strpos($location, '?') ? '&' : '?') . 'xrds';
|
||||
$this->xrdsLocation = $location;
|
||||
|
||||
$this->data = $_GET + $_POST;
|
||||
|
||||
# We choose GMP if avaiable, and bcmath otherwise
|
||||
if(function_exists('gmp_add')) {
|
||||
$this->add = 'gmp_add';
|
||||
$this->mul = 'gmp_mul';
|
||||
$this->pow = 'gmp_pow';
|
||||
$this->mod = 'gmp_mod';
|
||||
$this->div = 'gmp_div';
|
||||
$this->powmod = 'gmp_powm';
|
||||
} elseif(function_exists('bcadd')) {
|
||||
$this->add = 'bcadd';
|
||||
$this->mul = 'bcmul';
|
||||
$this->pow = 'bcpow';
|
||||
$this->mod = 'bcmod';
|
||||
$this->div = 'bcdiv';
|
||||
$this->powmod = 'bcpowmod';
|
||||
} else {
|
||||
# If neither are avaiable, we can't use DH
|
||||
$this->dh = false;
|
||||
}
|
||||
|
||||
# However, we do require the hash functions.
|
||||
# They should be built-in anyway.
|
||||
if(!function_exists('hash_algos')) {
|
||||
$this->dh = false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Displays an XRDS document, or redirects to it.
|
||||
* By default, it detects whether it should display or redirect automatically.
|
||||
* @param bool|null $force When true, always display the document, when false always redirect.
|
||||
*/
|
||||
function xrds($force=null)
|
||||
{
|
||||
if($force) {
|
||||
echo $this->xrdsContent();
|
||||
die();
|
||||
} elseif($force === false) {
|
||||
header('X-XRDS-Location: '. $this->xrdsLocation);
|
||||
return;
|
||||
}
|
||||
|
||||
if (isset($_GET['xrds'])
|
||||
|| (isset($_SERVER['HTTP_ACCEPT']) && strpos($_SERVER['HTTP_ACCEPT'], 'application/xrds+xml') !== false)
|
||||
) {
|
||||
header('Content-Type: application/xrds+xml');
|
||||
echo $this->xrdsContent();
|
||||
die();
|
||||
}
|
||||
|
||||
header('X-XRDS-Location: ' . $this->xrdsLocation);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the content of the XRDS document
|
||||
* @return String The XRDS document.
|
||||
*/
|
||||
protected function xrdsContent()
|
||||
{
|
||||
$lines = array(
|
||||
'<?xml version="1.0" encoding="UTF-8"?>',
|
||||
'<xrds:XRDS xmlns:xrds="xri://$xrds" xmlns="xri://$xrd*($v*2.0)">',
|
||||
'<XRD>',
|
||||
' <Service>',
|
||||
' <Type>' . $this->ns . '/' . ($this->select_id ? 'server' : 'signon') .'</Type>',
|
||||
' <URI>' . $this->serverLocation . '</URI>',
|
||||
' </Service>',
|
||||
'</XRD>',
|
||||
'</xrds:XRDS>'
|
||||
);
|
||||
return implode("\n", $lines);
|
||||
}
|
||||
|
||||
/**
|
||||
* Does everything that a provider has to -- in one function.
|
||||
*/
|
||||
function server()
|
||||
{
|
||||
if(isset($this->data['openid_assoc_handle'])) {
|
||||
$this->assoc = $this->getAssoc($this->data['openid_assoc_handle']);
|
||||
if(isset($this->assoc['data'])) {
|
||||
# We have additional data stored for setup.
|
||||
$this->data += $this->assoc['data'];
|
||||
unset($this->assoc['data']);
|
||||
}
|
||||
}
|
||||
|
||||
if (isset($this->data['openid_ns'])
|
||||
&& $this->data['openid_ns'] == $this->ns
|
||||
) {
|
||||
if(!isset($this->data['openid_mode'])) $this->errorResponse();
|
||||
|
||||
switch($this->data['openid_mode'])
|
||||
{
|
||||
case 'checkid_immediate':
|
||||
case 'checkid_setup':
|
||||
$this->checkRealm();
|
||||
# We support AX xor SREG.
|
||||
$attributes = $this->ax();
|
||||
if(!$attributes) {
|
||||
$attributes = $this->sreg();
|
||||
}
|
||||
|
||||
# Even if some user is authenticated, we need to know if it's
|
||||
# the same one that want's to authenticate.
|
||||
# Of course, if we use select_id, we accept any user.
|
||||
if (($identity = $this->checkid($this->data['openid_realm'], $attrValues))
|
||||
&& ($this->select_id || $identity == $this->data['openid_identity'])
|
||||
) {
|
||||
$this->positiveResponse($identity, $attrValues);
|
||||
} elseif($this->data['openid_mode'] == 'checkid_immediate') {
|
||||
$this->redirect($this->response(array('openid.mode' => 'setup_needed')));
|
||||
} else {
|
||||
if(!$this->assoc) {
|
||||
$this->generateAssociation();
|
||||
$this->assoc['private'] = true;
|
||||
}
|
||||
$this->assoc['data'] = $this->data;
|
||||
$this->setAssoc($this->assoc['handle'], $this->assoc);
|
||||
$this->setup($this->data['openid_identity'],
|
||||
$this->data['openid_realm'],
|
||||
$this->assoc['handle'],
|
||||
$attributes);
|
||||
}
|
||||
break;
|
||||
case 'associate':
|
||||
$this->associate();
|
||||
break;
|
||||
case 'check_authentication':
|
||||
$this->checkRealm();
|
||||
if($this->verify()) {
|
||||
echo "ns:$this->ns\nis_valid:true";
|
||||
if(strpos($this->data['openid_signed'],'invalidate_handle') !== false) {
|
||||
echo "\ninvalidate_handle:" . $this->data['openid_invalidate_handle'];
|
||||
}
|
||||
} else {
|
||||
echo "ns:$this->ns\nis_valid:false";
|
||||
}
|
||||
die();
|
||||
break;
|
||||
default:
|
||||
$this->errorResponse();
|
||||
}
|
||||
} else {
|
||||
$this->xrds();
|
||||
}
|
||||
}
|
||||
|
||||
protected function checkRealm()
|
||||
{
|
||||
if (!isset($this->data['openid_return_to'], $this->data['openid_realm'])) {
|
||||
$this->errorResponse();
|
||||
}
|
||||
|
||||
$realm = str_replace('\*', '[^/]', preg_quote($this->data['openid_realm']));
|
||||
if(!preg_match("#^$realm#", $this->data['openid_return_to'])) {
|
||||
$this->errorResponse();
|
||||
}
|
||||
}
|
||||
|
||||
protected function ax()
|
||||
{
|
||||
# Namespace prefix that the fields must have.
|
||||
$ns = 'http://axschema.org/';
|
||||
|
||||
# First, we must find out what alias is used for AX.
|
||||
# Let's check the most likely one
|
||||
$alias = null;
|
||||
if (isset($this->data['openid_ns_ax'])
|
||||
&& $this->data['openid_ns_ax'] == 'http://openid.net/srv/ax/1.0'
|
||||
) {
|
||||
$alias = 'ax';
|
||||
} else {
|
||||
foreach($this->data as $name => $value) {
|
||||
if ($value == 'http://openid.net/srv/ax/1.0'
|
||||
&& preg_match('/openid_ns_(.+)/', $name, $m)
|
||||
) {
|
||||
$alias = $m[1];
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if(!$alias) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$fields = array();
|
||||
# Now, we must search again, this time for field aliases
|
||||
foreach($this->data as $name => $value) {
|
||||
if (strpos($name, 'openid_' . $alias . '_type') === false
|
||||
|| strpos($value, $ns) === false) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$name = substr($name, strlen('openid_' . $alias . '_type_'));
|
||||
$value = substr($value, strlen($ns));
|
||||
|
||||
$fields[$name] = $value;
|
||||
}
|
||||
|
||||
# Then, we find out what fields are required and optional
|
||||
$required = array();
|
||||
$if_available = array();
|
||||
foreach(array('required','if_available') as $type) {
|
||||
if(empty($this->data["openid_{$alias}_{$type}"])) {
|
||||
continue;
|
||||
}
|
||||
$attributes = explode(',', $this->data["openid_{$alias}_{$type}"]);
|
||||
foreach($attributes as $attr) {
|
||||
if(empty($fields[$attr])) {
|
||||
# There is an undefined field here, so we ignore it.
|
||||
continue;
|
||||
}
|
||||
|
||||
${$type}[] = $fields[$attr];
|
||||
}
|
||||
}
|
||||
|
||||
$this->data['ax'] = true;
|
||||
return array('required' => $required, 'optional' => $if_available);
|
||||
}
|
||||
|
||||
protected function sreg()
|
||||
{
|
||||
$sreg_to_ax = array_flip($this->ax_to_sreg);
|
||||
|
||||
$attributes = array('required' => array(), 'optional' => array());
|
||||
|
||||
if (empty($this->data['openid_sreg_required'])
|
||||
&& empty($this->data['openid_sreg_optional'])
|
||||
) {
|
||||
return $attributes;
|
||||
}
|
||||
|
||||
foreach(array('required', 'optional') as $type) {
|
||||
foreach(explode(',',$this->data['openid_sreg_' . $type]) as $attr) {
|
||||
if(empty($sreg_to_ax[$attr])) {
|
||||
# Undefined attribute in SREG request.
|
||||
# Shouldn't happen, but we check anyway.
|
||||
continue;
|
||||
}
|
||||
|
||||
$attributes[$type][] = $sreg_to_ax[$attr];
|
||||
}
|
||||
}
|
||||
|
||||
return $attributes;
|
||||
}
|
||||
|
||||
/**
|
||||
* Aids an RP in assertion verification.
|
||||
* @return bool Information whether the verification suceeded.
|
||||
*/
|
||||
protected function verify()
|
||||
{
|
||||
# Firstly, we need to make sure that there's an association.
|
||||
# Otherwise the verification will fail,
|
||||
# because we've signed assoc_handle in the assertion
|
||||
if(empty($this->assoc)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
# Next, we check that it's a private association,
|
||||
# i.e. one made without RP input.
|
||||
# Otherwise, the RP shouldn't ask us to verify.
|
||||
if(empty($this->assoc['private'])) {
|
||||
return false;
|
||||
}
|
||||
|
||||
# Now we have to check if the nonce is correct, to prevent replay attacks.
|
||||
if($this->data['openid_response_nonce'] != $this->assoc['nonce']) {
|
||||
return false;
|
||||
}
|
||||
|
||||
# Getting the signed fields for signature.
|
||||
$sig = array();
|
||||
$signed = explode(',', $this->data['openid_signed']);
|
||||
foreach($signed as $field) {
|
||||
$name = strtr($field, '.', '_');
|
||||
if(!isset($this->data['openid_' . $name])) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$sig[$field] = $this->data['openid_' . $name];
|
||||
}
|
||||
|
||||
# Computing the signature and checking if it matches.
|
||||
$sig = $this->keyValueForm($sig);
|
||||
if ($this->data['openid_sig'] !=
|
||||
base64_encode(hash_hmac($this->assoc['hash'], $sig, $this->assoc['mac'], true))
|
||||
) {
|
||||
return false;
|
||||
}
|
||||
|
||||
# Clearing the nonce, so that it won't be used again.
|
||||
$this->assoc['nonce'] = null;
|
||||
|
||||
if(empty($this->assoc['private'])) {
|
||||
# Commiting changes to the association.
|
||||
$this->setAssoc($this->assoc['handle'], $this->assoc);
|
||||
} else {
|
||||
# Private associations shouldn't be used again, se we can as well delete them.
|
||||
$this->delAssoc($this->assoc['handle']);
|
||||
}
|
||||
|
||||
# Nothing has failed, so the verification was a success.
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Performs association with an RP.
|
||||
*/
|
||||
protected function associate()
|
||||
{
|
||||
# Rejecting no-encryption without TLS.
|
||||
if(empty($_SERVER['HTTPS']) && $this->data['openid_session_type'] == 'no-encryption') {
|
||||
$this->directErrorResponse();
|
||||
}
|
||||
|
||||
# Checking whether we support DH at all.
|
||||
if (!$this->dh && substr($this->data['openid_session_type'], 0, 2) == 'DH') {
|
||||
$this->redirect($this->response(array(
|
||||
'openid.error' => 'DH not supported',
|
||||
'openid.error_code' => 'unsupported-type',
|
||||
'openid.session_type' => 'no-encryption'
|
||||
)));
|
||||
}
|
||||
|
||||
# Creating the association
|
||||
$this->assoc = array();
|
||||
$this->assoc['hash'] = $this->data['openid_assoc_type'] == 'HMAC-SHA256' ? 'sha256' : 'sha1';
|
||||
$this->assoc['handle'] = $this->assoc_handle();
|
||||
|
||||
# Getting the shared secret
|
||||
if($this->data['openid_session_type'] == 'no-encryption') {
|
||||
$this->assoc['mac'] = base64_encode($this->shared_secret($this->assoc['hash']));
|
||||
} else {
|
||||
$this->dh();
|
||||
}
|
||||
|
||||
# Preparing the direct response...
|
||||
$response = array(
|
||||
'ns' => $this->ns,
|
||||
'assoc_handle' => $this->assoc['handle'],
|
||||
'assoc_type' => $this->data['openid_assoc_type'],
|
||||
'session_type' => $this->data['openid_session_type'],
|
||||
'expires_in' => $this->assoc_lifetime
|
||||
);
|
||||
|
||||
if(isset($this->assoc['dh_server_public'])) {
|
||||
$response['dh_server_public'] = $this->assoc['dh_server_public'];
|
||||
$response['enc_mac_key'] = $this->assoc['mac'];
|
||||
} else {
|
||||
$response['mac_key'] = $this->assoc['mac'];
|
||||
}
|
||||
|
||||
# ...and sending it.
|
||||
echo $this->keyValueForm($response);
|
||||
die();
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a private association.
|
||||
*/
|
||||
protected function generateAssociation()
|
||||
{
|
||||
$this->assoc = array();
|
||||
# We use sha1 by default.
|
||||
$this->assoc['hash'] = 'sha1';
|
||||
$this->assoc['mac'] = $this->shared_secret('sha1');
|
||||
$this->assoc['handle'] = $this->assoc_handle();
|
||||
}
|
||||
|
||||
/**
|
||||
* Encrypts the MAC key using DH key exchange.
|
||||
*/
|
||||
protected function dh()
|
||||
{
|
||||
if(empty($this->data['openid_dh_modulus'])) {
|
||||
$this->data['openid_dh_modulus'] = $this->default_modulus;
|
||||
}
|
||||
|
||||
if(empty($this->data['openid_dh_gen'])) {
|
||||
$this->data['openid_dh_gen'] = $this->default_gen;
|
||||
}
|
||||
|
||||
if(empty($this->data['openid_dh_consumer_public'])) {
|
||||
$this->directErrorResponse();
|
||||
}
|
||||
|
||||
$modulus = $this->b64dec($this->data['openid_dh_modulus']);
|
||||
$gen = $this->b64dec($this->data['openid_dh_gen']);
|
||||
$consumerKey = $this->b64dec($this->data['openid_dh_consumer_public']);
|
||||
|
||||
$privateKey = $this->keygen(strlen($modulus));
|
||||
$publicKey = $this->powmod($gen, $privateKey, $modulus);
|
||||
$ss = $this->powmod($consumerKey, $privateKey, $modulus);
|
||||
|
||||
$mac = $this->x_or(hash($this->assoc['hash'], $ss, true), $this->shared_secret($this->assoc['hash']));
|
||||
$this->assoc['dh_server_public'] = $this->decb64($publicKey);
|
||||
$this->assoc['mac'] = base64_encode($mac);
|
||||
}
|
||||
|
||||
/**
|
||||
* XORs two strings.
|
||||
* @param String $a
|
||||
* @param String $b
|
||||
* @return String $a ^ $b
|
||||
*/
|
||||
protected function x_or($a, $b)
|
||||
{
|
||||
$length = strlen($a);
|
||||
for($i = 0; $i < $length; $i++) {
|
||||
$a[$i] = $a[$i] ^ $b[$i];
|
||||
}
|
||||
|
||||
return $a;
|
||||
}
|
||||
|
||||
/**
|
||||
* Prepares an indirect response url.
|
||||
* @param array $params Parameters to be sent.
|
||||
*/
|
||||
protected function response($params)
|
||||
{
|
||||
$params += array('openid.ns' => $this->ns);
|
||||
return $this->data['openid_return_to']
|
||||
. (strpos($this->data['openid_return_to'],'?') ? '&' : '?')
|
||||
. http_build_query($params, '', '&');
|
||||
}
|
||||
|
||||
/**
|
||||
* Outputs a direct error.
|
||||
*/
|
||||
protected function errorResponse()
|
||||
{
|
||||
if(!empty($this->data['openid_return_to'])) {
|
||||
$response = array(
|
||||
'openid.mode' => 'error',
|
||||
'openid.error' => 'Invalid request'
|
||||
);
|
||||
$this->redirect($this->response($response));
|
||||
} else {
|
||||
header('HTTP/1.1 400 Bad Request');
|
||||
$response = array(
|
||||
'ns' => $this->ns,
|
||||
'error' => 'Invalid request'
|
||||
);
|
||||
echo $this->keyValueForm($response);
|
||||
}
|
||||
die();
|
||||
}
|
||||
|
||||
/**
|
||||
* Sends an positive assertion.
|
||||
* @param String $identity the OP-Local Identifier that is being authenticated.
|
||||
* @param Array $attributes User attributes to be sent.
|
||||
*/
|
||||
protected function positiveResponse($identity, $attributes)
|
||||
{
|
||||
# We generate a private association if there is none established.
|
||||
if(!$this->assoc) {
|
||||
$this->generateAssociation();
|
||||
$this->assoc['private'] = true;
|
||||
}
|
||||
|
||||
# We set openid.identity (and openid.claimed_id if necessary) to our $identity
|
||||
if($this->data['openid_identity'] == $this->data['openid_claimed_id'] || $this->select_id) {
|
||||
$this->data['openid_claimed_id'] = $identity;
|
||||
}
|
||||
$this->data['openid_identity'] = $identity;
|
||||
|
||||
# Preparing fields to be signed
|
||||
$params = array(
|
||||
'op_endpoint' => $this->serverLocation,
|
||||
'claimed_id' => $this->data['openid_claimed_id'],
|
||||
'identity' => $this->data['openid_identity'],
|
||||
'return_to' => $this->data['openid_return_to'],
|
||||
'realm' => $this->data['openid_realm'],
|
||||
'response_nonce' => gmdate("Y-m-d\TH:i:s\Z"),
|
||||
'assoc_handle' => $this->assoc['handle'],
|
||||
);
|
||||
|
||||
$params += $this->responseAttributes($attributes);
|
||||
|
||||
# Has the RP used an invalid association handle?
|
||||
if (isset($this->data['openid_assoc_handle'])
|
||||
&& $this->data['openid_assoc_handle'] != $this->assoc['handle']
|
||||
) {
|
||||
$params['invalidate_handle'] = $this->data['openid_assoc_handle'];
|
||||
}
|
||||
|
||||
# Signing the $params
|
||||
$sig = hash_hmac($this->assoc['hash'], $this->keyValueForm($params), $this->assoc['mac'], true);
|
||||
$req = array(
|
||||
'openid.mode' => 'id_res',
|
||||
'openid.signed' => implode(',', array_keys($params)),
|
||||
'openid.sig' => base64_encode($sig),
|
||||
);
|
||||
|
||||
# Saving the nonce and commiting the association.
|
||||
$this->assoc['nonce'] = $params['response_nonce'];
|
||||
$this->setAssoc($this->assoc['handle'], $this->assoc);
|
||||
|
||||
# Preparing and sending the response itself
|
||||
foreach($params as $name => $value) {
|
||||
$req['openid.' . $name] = $value;
|
||||
}
|
||||
|
||||
$this->redirect($this->response($req));
|
||||
}
|
||||
|
||||
/**
|
||||
* Prepares an array of attributes to send
|
||||
*/
|
||||
protected function responseAttributes($attributes)
|
||||
{
|
||||
if(!$attributes) return array();
|
||||
|
||||
$ns = 'http://axschema.org/';
|
||||
|
||||
$response = array();
|
||||
if(isset($this->data['ax'])) {
|
||||
$response['ns.ax'] = 'http://openid.net/srv/ax/1.0';
|
||||
foreach($attributes as $name => $value) {
|
||||
$alias = strtr($name, '/', '_');
|
||||
$response['ax.type.' . $alias] = $ns . $name;
|
||||
$response['ax.value.' . $alias] = $value;
|
||||
}
|
||||
return $response;
|
||||
}
|
||||
|
||||
foreach($attributes as $name => $value) {
|
||||
if(!isset($this->ax_to_sreg[$name])) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$response['sreg.' . $this->ax_to_sreg[$name]] = $value;
|
||||
}
|
||||
return $response;
|
||||
}
|
||||
|
||||
/**
|
||||
* Encodes fields in key-value form.
|
||||
* @param Array $params Fields to be encoded.
|
||||
* @return String $params in key-value form.
|
||||
*/
|
||||
protected function keyValueForm($params)
|
||||
{
|
||||
$str = '';
|
||||
foreach($params as $name => $value) {
|
||||
$str .= "$name:$value\n";
|
||||
}
|
||||
|
||||
return $str;
|
||||
}
|
||||
|
||||
/**
|
||||
* Responds with an information that the user has canceled authentication.
|
||||
*/
|
||||
protected function cancel()
|
||||
{
|
||||
$this->redirect($this->response(array('openid.mode' => 'cancel')));
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts base64 encoded number to it's decimal representation.
|
||||
* @param String $str base64 encoded number.
|
||||
* @return String Decimal representation of that number.
|
||||
*/
|
||||
protected function b64dec($str)
|
||||
{
|
||||
$bytes = unpack('C*', base64_decode($str));
|
||||
$n = 0;
|
||||
foreach($bytes as $byte) {
|
||||
$n = $this->add($this->mul($n, 256), $byte);
|
||||
}
|
||||
|
||||
return $n;
|
||||
}
|
||||
|
||||
/**
|
||||
* Complements b64dec.
|
||||
*/
|
||||
protected function decb64($num)
|
||||
{
|
||||
$bytes = array();
|
||||
while($num) {
|
||||
array_unshift($bytes, $this->mod($num, 256));
|
||||
$num = $this->div($num, 256);
|
||||
}
|
||||
|
||||
if($bytes && $bytes[0] > 127) {
|
||||
array_unshift($bytes,0);
|
||||
}
|
||||
|
||||
array_unshift($bytes, 'C*');
|
||||
|
||||
return base64_encode(call_user_func_array('pack', $bytes));
|
||||
}
|
||||
|
||||
function __call($name, $args)
|
||||
{
|
||||
switch($name) {
|
||||
case 'add':
|
||||
case 'mul':
|
||||
case 'pow':
|
||||
case 'mod':
|
||||
case 'div':
|
||||
case 'powmod':
|
||||
if(function_exists('gmp_strval')) {
|
||||
return gmp_strval(call_user_func_array($this->$name, $args));
|
||||
}
|
||||
return call_user_func_array($this->$name, $args);
|
||||
default:
|
||||
throw new BadMethodCallException();
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user