X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fopenid.php;h=7d1e875f3655af82549e054418fe152b5057998c;hb=2c411733fbb7d90831e144595bb5c09e71b794a6;hp=cb7b2e67f1e6e753004d3cd184c681576a39e379;hpb=7eaf07e95c64fa64f85096b689329f5074665fdc;p=platal.git
diff --git a/modules/openid.php b/modules/openid.php
index cb7b2e6..7d1e875 100644
--- a/modules/openid.php
+++ b/modules/openid.php
@@ -1,6 +1,6 @@
$this->make_hook('openid', AUTH_PUBLIC),
'openid/trust' => $this->make_hook('trust', AUTH_COOKIE),
+ 'openid/trusted' => $this->make_hook('trusted', AUTH_MDP),
+ 'admin/openid/trusted' => $this->make_hook('admin_trusted', AUTH_MDP),
'openid/idp_xrds' => $this->make_hook('idp_xrds', AUTH_PUBLIC),
'openid/user_xrds' => $this->make_hook('user_xrds', AUTH_PUBLIC),
'openid/melix' => $this->make_hook('melix', AUTH_PUBLIC),
@@ -80,68 +75,48 @@ class OpenidModule extends PLModule
{
$this->load('openid.inc.php');
- // Spec §4.1.2: if "openid.mode" is absent, whe SHOULD assume that
+ // Spec §4.1.2: if "openid.mode" is absent, we SHOULD assume that
// the request is not an OpenId message
- // Thus, we try to render the discovery page
if (!array_key_exists('openid_mode', $_REQUEST)) {
return $this->render_discovery_page($page, get_user($x));
}
// Now, deal with the OpenId message
- // Create a server and decode the request
$server = init_openid_server();
$request = $server->decodeRequest();
- // With these modes, the request needs some logic
- // and can not be automatically answered by the server
- if (in_array($request->mode,
- array('checkid_immediate', 'checkid_setup'))) {
-
- // User identifier selection
- // if the user identifier is not known by the RP yet
- if ($request->idSelect()) {
- if ($request->mode == 'checkid_immediate') {
- // Deny authentication if we can't interact with the user
- $response =& $request->answer(false);
- } else {
- // Otherwise save request in session and redirect
- // to a page that requires authentication
- // Then the user will be known
- S::set('openid_request', serialize($request));
- pl_redirect('openid/trust');
- return;
- }
-
- // If don't use identifier selection and don't have an identifier,
- // give up
- } else if (!$request->identity) {
- $this->render_no_identifier_page($page, $request);
- return;
-
- // From now on we have an identifier
-
- // We deny immediate requests, unless the user is logged in
- // and has whitelisted the site
- } else if ($request->immediate) {
- $answer = S::logged() && is_trusted_site(S::user(),
- $request->trust_root);
- $response =& $request->answer($answer);
-
- // For setup requests, we redirect to a page where the user
- // will authenticate and confirm the use of his/her OpenId
- } else {
- // Save request in session before jumping to confirmation page
- S::set('openid_request', serialize($request));
- pl_redirect('openid/trust');
- return;
- }
+ // In modes 'checkid_immediate' and 'checkid_setup', the request
+ // needs some logic and can not be automatically answered by the server
+
+ // Immediate mode
+ if ($request->mode == 'checkid_immediate') {
+
+ // We deny immediate requests, unless:
+ // - the user identifier is known by the RP
+ // - the user is logged in
+ // - the user identifier matches the user logged in
+ // - the user has whitelisted the site
+ $answer = !$request->idSelect()
+ && S::logged()
+ && $request->identity == S::user()->login()
+ && is_trusted_site(S::user(), $request->trust_root);
+ $response =& $request->answer($answer);
+
+ // Setup mode
+ } else if ($request->mode == 'checkid_setup') {
+
+ // We redirect to a page where the user will authenticate
+ // and confirm the use of his/her OpenId
+ // The request is saved in session before redirecting
+ S::set('openid_request', serialize($request));
+ pl_redirect('openid/trust');
+ return;
// Other requests can be automatically handled by the server
} else {
$response =& $server->handleRequest($request);
}
- // Render response
$webresponse =& $server->encodeResponse($response);
$this->render_openid_response($webresponse);
}
@@ -158,7 +133,6 @@ class OpenidModule extends PLModule
return;
}
- // Unserialize the request
require_once 'Auth/OpenID/Server.php';
$request = unserialize($request);
@@ -186,7 +160,6 @@ class OpenidModule extends PLModule
$sreg_request = Auth_OpenID_SRegRequest::fromOpenIDRequest($request);
$sreg_response = Auth_OpenID_SRegResponse::extractResponse($sreg_request, get_sreg_data($user));
- // Check the whitelist
$whitelisted = is_trusted_site($user, $request->trust_root);
// Ask the user for confirmation
@@ -198,6 +171,12 @@ class OpenidModule extends PLModule
}
// At this point $_SERVER['REQUEST_METHOD'] == 'POST'
+
+ // Add 'always trusted' sites to whitelist
+ if (isset($_POST['trust']) && @$_POST['always']) {
+ add_trusted_site($user, $request->trust_root);
+ }
+
// Answer to the Relying Party
if ($whitelisted || isset($_POST['trust'])) {
S::kill('openid_request');
@@ -212,20 +191,39 @@ class OpenidModule extends PLModule
$response =& $request->answer(false);
}
- // Generate a response to send to the user agent.
$webresponse =& $server->encodeResponse($response);
$this->render_openid_response($webresponse);
}
+ function handler_trusted(&$page, $action = 'list', $id = null)
+ {
+ $page->setTitle('Sites tiers de confiance');
+ $page->assign('title', 'Mes sites tiers de confiance pour OpenId');
+ $table_editor = new PLTableEditor('openid/trusted', 'openid_trusted', 'id');
+ $table_editor->set_where_clause('user_id = ' . XDB::escape(S::user()->id()));
+ $table_editor->vars['user_id']['display'] = false;
+ $table_editor->describe('url', 'site tiers', true);
+ $page->assign('deleteonly', true);
+ $table_editor->apply($page, $action, $id);
+ }
+
+ function handler_admin_trusted(&$page, $action = 'list', $id = null)
+ {
+ $page->setTitle('Sites tiers de confiance');
+ $page->assign('title', 'Sites tiers de confiance globaux pour OpenId');
+ $table_editor = new PLTableEditor('admin/openid/trusted', 'openid_trusted', 'id');
+ $table_editor->set_where_clause('user_id IS NULL');
+ $table_editor->vars['user_id']['display'] = false;
+ $table_editor->describe('url', 'site tiers', true);
+ $page->assign('readonly', true);
+ $table_editor->apply($page, $action, $id);
+ }
+
function handler_idp_xrds(&$page)
{
$this->load('openid.inc.php');
-
- // Set XRDS content-type and template
header('Content-type: application/xrds+xml');
$page->changeTpl('openid/idp_xrds.tpl', NO_SKIN);
-
- // Set variables
$page->assign('type2', Auth_OpenID_TYPE_2_0_IDP);
$page->assign('sreg', Auth_OpenID_SREG_URI);
$page->assign('provider', get_openid_url());
@@ -235,17 +233,13 @@ class OpenidModule extends PLModule
{
$this->load('openid.inc.php');
- // Make sure the user exists
$user = get_user($x);
if (is_null($user)) {
return PL_NOT_FOUND;
}
- // Set XRDS content-type and template
header('Content-type: application/xrds+xml');
$page->changeTpl('openid/user_xrds.tpl', NO_SKIN);
-
- // Set variables
$page->assign('type2', Auth_OpenID_TYPE_2_0);
$page->assign('type1', Auth_OpenID_TYPE_1_1);
$page->assign('sreg', Auth_OpenID_SREG_URI);
@@ -286,43 +280,26 @@ class OpenidModule extends PLModule
// Include X-XRDS-Location response-header for Yadis discovery
header('X-XRDS-Location: ' . get_user_xrds_url($user));
- // Select template
$page->changeTpl('openid/openid.tpl');
-
- // Sets the title of the html page.
$page->setTitle($user->fullName());
-
- // Sets the tags for HTML-Based Discovery
+ // Set the tags for HTML-Based Discovery
$page->addLink('openid.server openid2.provider', get_openid_url());
$page->addLink('openid.delegate openid2.local_id', $user->hruid);
-
- // Adds the global user property array to the display.
$page->assign_by_ref('user', $user);
return;
}
- function render_no_identifier_page($page, $request)
- {
- // Select template
- $page->changeTpl('openid/no_identifier.tpl');
- }
-
function render_openid_response($webresponse)
{
- // Send HTTP response code
if ($webresponse->code != AUTH_OPENID_HTTP_OK) {
header(sprintf("HTTP/1.1 %d ", $webresponse->code),
true, $webresponse->code);
}
-
- // Send headers
foreach ($webresponse->headers as $k => $v) {
header("$k: $v");
}
header('Connection: close');
-
- // Send body
print $webresponse->body;
exit;
}