modules/openid.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2009 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22
  23 /* Definitions for the OpenId Specification
  24  * http://openid.net/specs/openid-authentication-2_0.html
  25  *
  26  * OP Endpoint URL:             https://www.polytechnique.org/openid
  27  * OP Identifier:               https://www.polytechnique.org/openid
  28  * User Identifier:             https://www.polytechnique.org/openid/{hruid}
  29  * OP-Local Identifier:         {hruid}
  30  */
  31
  32 /* This implementation supports two modes:
  33  *     - entering the OP Identifier, which can simply be 'polytechnique.org'
  34  *     - entering the User Identifier, or some URL that resolves there
  35  * In both cases, Yadis discovery is made possible through the X-XRDS-Location
  36  * header.
  37  *
  38  * In the former case, Yadis discovery is performed on /, or where it redirects;
  39  * see platal.php. It resolves to the XRDS for this OP, and User Identifier
  40  * selection is performed after forcing the user to log in. This only works for
  41  * version 2.0 of the OpenId protocol.
  42  *
  43  * In the latter cas, Yadis discovery is performed on /openid/{hruid}. It
  44  * resolves ta a user-specific XRDS. This page also features HTML-based
  45  * discovery. This works with any version of the protocol.
  46  */
  47
  48 /* Testing suite is here:
  49  * http://openidenabled.com/resources/openid-test/
  50  * It only supports User Indentifiers.
  51  *
  52  * To test OP Identifiers, download the JanRain PHP library and use the
  53  * consumer provided as an example (although it appears that a failure is
  54  * mistakenly reported: 'Server denied check_authentication').
  55  * Reading the source of the server can also help understanding the code below.
  56  */
  57
  58
  59 class OpenidModule extends PLModule
  60 {
  61     function handlers()
  62     {
  63         return array(
  64             'openid'            => $this->make_hook('openid', AUTH_PUBLIC),
  65             'openid/trust'      => $this->make_hook('trust', AUTH_COOKIE),
  66             'openid/trusted'    => $this->make_hook('trusted', AUTH_MDP),
  67             'admin/openid/trusted'  => $this->make_hook('admin_trusted', AUTH_MDP),
  68             'openid/idp_xrds'   => $this->make_hook('idp_xrds', AUTH_PUBLIC),
  69             'openid/user_xrds'  => $this->make_hook('user_xrds', AUTH_PUBLIC),
  70             'openid/melix'      => $this->make_hook('melix', AUTH_PUBLIC),
  71         );
  72     }
  73
  74     function handler_openid(&$page, $x = null)
  75     {
  76         $this->load('openid.inc.php');
  77
  78         // Spec §4.1.2: if "openid.mode" is absent, we SHOULD assume that
  79         // the request is not an OpenId message
  80         if (!array_key_exists('openid_mode', $_REQUEST)) {
  81             return $this->render_discovery_page($page, get_user($x));
  82         }
  83
  84         // Now, deal with the OpenId message
  85         $server = init_openid_server();
  86         $request = $server->decodeRequest();
  87
  88         // In modes 'checkid_immediate' and 'checkid_setup', the request
  89         // needs some logic and can not be automatically answered by the server
  90
  91         // Immediate mode
  92         if ($request->mode == 'checkid_immediate') {
  93
  94             // We deny immediate requests, unless:
  95             //   - the user identifier is known by the RP
  96             //   - the user is logged in
  97             //   - the user identifier matches the user logged in
  98             //   - the user has whitelisted the site
  99             $answer = !$request->idSelect()
 100                       && S::logged()
 101                       && $request->identity == S::user()->login()
 102                       && is_trusted_site(S::user(), $request->trust_root);
 103             $response =& $request->answer($answer);
 104
 105         // Setup mode
 106         } else if ($request->mode == 'checkid_setup') {
 107
 108             // We redirect to a page where the user will authenticate
 109             // and confirm the use of his/her OpenId
 110             // The request is saved in session before redirecting
 111             S::set('openid_request', serialize($request));
 112             pl_redirect('openid/trust');
 113             return;
 114
 115         // Other requests can be automatically handled by the server
 116         } else {
 117             $response =& $server->handleRequest($request);
 118         }
 119
 120         $webresponse =& $server->encodeResponse($response);
 121         $this->render_openid_response($webresponse);
 122     }
 123
 124     function handler_trust(&$page, $x = null)
 125     {
 126         $this->load('openid.inc.php');
 127
 128         // Recover request in session
 129         $request = S::v('openid_request');
 130         if (is_null($request)) {
 131             // There is no authentication information, something went wrong
 132             pl_redirect('/');
 133             return;
 134         }
 135
 136         require_once 'Auth/OpenID/Server.php';
 137         $request = unserialize($request);
 138
 139         $server = init_openid_server();
 140         $user = S::user();
 141         $identity = null;
 142         $claimed_id = null;
 143
 144         // Set the identity to the user currently logged in
 145         // if an OP Identifier was initially used
 146         if ($request->identity == Auth_OpenID_IDENTIFIER_SELECT) {
 147             $identity = $user->hruid;
 148             $claimed_id = get_user_openid_url($user);
 149         // Check that the identity matches the user currently logged in
 150         // if an User Identifier was initially used
 151         } else if ($request->identity != $user->hruid) {
 152             $response =& $request->answer(false);
 153             $webresponse =& $server->encodeResponse($response);
 154             $this->render_openid_response($webresponse);
 155             return;
 156         }
 157
 158         // Prepare Simple Registration response fields
 159         require_once 'Auth/OpenID/SReg.php';
 160         $sreg_request = Auth_OpenID_SRegRequest::fromOpenIDRequest($request);
 161         $sreg_response = Auth_OpenID_SRegResponse::extractResponse($sreg_request, get_sreg_data($user));
 162
 163         $whitelisted = is_trusted_site($user, $request->trust_root);
 164
 165         // Ask the user for confirmation
 166         if (!$whitelisted && $_SERVER['REQUEST_METHOD'] != 'POST') {
 167             $page->changeTpl('openid/trust.tpl');
 168             $page->assign('relying_party', $request->trust_root);
 169             $page->assign_by_ref('sreg_data', $sreg_response->data);
 170             return;
 171         }
 172
 173         // At this point $_SERVER['REQUEST_METHOD'] == 'POST'
 174
 175         // Add 'always trusted' sites to whitelist
 176         if (isset($_POST['trust']) && @$_POST['always']) {
 177             add_trusted_site($user, $request->trust_root);
 178         }
 179
 180         // Answer to the Relying Party
 181         if ($whitelisted || isset($_POST['trust'])) {
 182             S::kill('openid_request');
 183             $response =& $request->answer(true, null, $identity, $claimed_id);
 184
 185             // Add the simple registration response values to the OpenID
 186             // response message.
 187             $sreg_response->toMessage($response->fields);
 188
 189         } else { // !$whitelisted && !isset($_POST['trust'])
 190             S::kill('openid_request');
 191             $response =& $request->answer(false);
 192         }
 193
 194         $webresponse =& $server->encodeResponse($response);
 195         $this->render_openid_response($webresponse);
 196     }
 197
 198     function handler_trusted(&$page, $action = 'list', $id = null)
 199     {
 200         $page->setTitle('Sites tiers de confiance');
 201         $page->assign('title', 'Mes sites tiers de confiance pour OpenId');
 202         $table_editor = new PLTableEditor('openid/trusted', 'openid_trusted', 'id');
 203         $table_editor->set_where_clause('user_id = ' . XDB::escape(S::user()->id()));
 204         $table_editor->vars['user_id']['display'] = false;
 205         $table_editor->describe('url', 'site tiers', true);
 206         $page->assign('deleteonly', true);
 207         $table_editor->apply($page, $action, $id);
 208     }
 209
 210     function handler_admin_trusted(&$page, $action = 'list', $id = null)
 211     {
 212         $page->setTitle('Sites tiers de confiance');
 213         $page->assign('title', 'Sites tiers de confiance globaux pour OpenId');
 214         $table_editor = new PLTableEditor('admin/openid/trusted', 'openid_trusted', 'id');
 215         $table_editor->set_where_clause('user_id IS NULL');
 216         $table_editor->vars['user_id']['display'] = false;
 217         $table_editor->describe('url', 'site tiers', true);
 218         $page->assign('readonly', true);
 219         $table_editor->apply($page, $action, $id);
 220     }
 221
 222     function handler_idp_xrds(&$page)
 223     {
 224         $this->load('openid.inc.php');
 225         header('Content-type: application/xrds+xml');
 226         $page->changeTpl('openid/idp_xrds.tpl', NO_SKIN);
 227         $page->assign('type2', Auth_OpenID_TYPE_2_0_IDP);
 228         $page->assign('sreg', Auth_OpenID_SREG_URI);
 229         $page->assign('provider', get_openid_url());
 230     }
 231
 232     function handler_user_xrds(&$page, $x = null)
 233     {
 234         $this->load('openid.inc.php');
 235
 236         $user = get_user($x);
 237         if (is_null($user)) {
 238             return PL_NOT_FOUND;
 239         }
 240
 241         header('Content-type: application/xrds+xml');
 242         $page->changeTpl('openid/user_xrds.tpl', NO_SKIN);
 243         $page->assign('type2', Auth_OpenID_TYPE_2_0);
 244         $page->assign('type1', Auth_OpenID_TYPE_1_1);
 245         $page->assign('sreg', Auth_OpenID_SREG_URI);
 246         $page->assign('provider', get_openid_url());
 247         $page->assign('local_id', $user->hruid);
 248     }
 249
 250     function handler_melix(&$page, $x = null)
 251     {
 252         $this->load('openid.inc.php');
 253         $user = get_user_by_alias($x);
 254
 255         // This will redirect to the canonic URL, which was not used
 256         // if this hook was triggered
 257         return $this->render_discovery_page(&$page, $user);
 258     }
 259
 260     //--------------------------------------------------------------------//
 261
 262     function render_discovery_page(&$page, $user)
 263     {
 264
 265         // Show the documentation if this is not the OpenId page of an user
 266         if (is_null($user)) {
 267             pl_redirect('Xorg/OpenId');
 268         }
 269
 270         // Redirect to the canonic URL if we are using an alias
 271         // There might be a risk of redirection loop here
 272         // if $_SERVER was not exactly what we expect
 273         $current_url = 'http' . (empty($_SERVER['HTTPS']) ? '' : 's') . '://'
 274                        . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
 275         $canonic_url = get_user_openid_url($user);
 276         if ($current_url != $canonic_url) {
 277             http_redirect($canonic_url);
 278         }
 279
 280         // Include X-XRDS-Location response-header for Yadis discovery
 281         header('X-XRDS-Location: ' . get_user_xrds_url($user));
 282
 283         $page->changeTpl('openid/openid.tpl');
 284         $page->setTitle($user->fullName());
 285         // Set the <link> tags for HTML-Based Discovery
 286         $page->addLink('openid.server openid2.provider', get_openid_url());
 287         $page->addLink('openid.delegate openid2.local_id', $user->hruid);
 288         $page->assign_by_ref('user', $user);
 289
 290         return;
 291     }
 292
 293     function render_openid_response($webresponse)
 294     {
 295         if ($webresponse->code != AUTH_OPENID_HTTP_OK) {
 296             header(sprintf("HTTP/1.1 %d ", $webresponse->code),
 297                    true, $webresponse->code);
 298         }
 299         foreach ($webresponse->headers as $k => $v) {
 300             header("$k: $v");
 301         }
 302         header('Connection: close');
 303         print $webresponse->body;
 304         exit;
 305     }
 306 }
 307
 308 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 309 ?>