3 * StatusNet, the distributed open-source microblogging tool
7 * LICENCE: This program is free software: you can redistribute it and/or modify
8 * it under the terms of the GNU Affero General Public License as published by
9 * the Free Software Foundation, either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU Affero General Public License for more details.
17 * You should have received a copy of the GNU Affero General Public License
18 * along with this program. If not, see <http://www.gnu.org/licenses/>.
22 * @author Evan Prodromou <evan@status.net>
23 * @author Craig Andrews <candrews@integralblue.com>
24 * @copyright 2009-2010 StatusNet, Inc.
25 * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
26 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
27 * @link http://status.net/
30 if (!defined('STATUSNET')) {
35 * Plugin for OpenID authentication and identity
37 * This class enables consumer support for OpenID, the distributed authentication
38 * and identity system.
42 * @author Evan Prodromou <evan@status.net>
43 * @author Craig Andrews <candrews@integralblue.com>
44 * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
45 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
46 * @link http://status.net/
47 * @link http://openid.net/
50 class OpenIDPlugin extends Plugin
52 // Plugin parameter: set true to disallow non-OpenID logins
53 // If set, overrides the setting in database or $config['site']['openidonly']
54 public $openidOnly = null;
59 if ($this->openidOnly !== null) {
61 $config['site']['openidonly'] = (bool)$this->openidOnly;
67 * Add OpenID-related paths to the router table
69 * Hook for RouterInitialized event.
71 * @param Net_URL_Mapper $m URL mapper
73 * @return boolean hook return
76 function onStartInitializeRouter($m)
78 $m->connect('main/openid', array('action' => 'openidlogin'));
79 $m->connect('main/openidtrust', array('action' => 'openidtrust'));
80 $m->connect('settings/openid', array('action' => 'openidsettings'));
81 $m->connect('index.php?action=finishopenidlogin',
82 array('action' => 'finishopenidlogin'));
83 $m->connect('index.php?action=finishaddopenid',
84 array('action' => 'finishaddopenid'));
85 $m->connect('main/openidserver', array('action' => 'openidserver'));
86 $m->connect('admin/openid', array('action' => 'openidadminpanel'));
92 * In OpenID-only mode, disable paths for password stuff
94 * @param string $path path to connect
95 * @param array $defaults path defaults
96 * @param array $rules path rules
97 * @param array $result unused
99 * @return boolean hook return
102 function onStartConnectPath(&$path, &$defaults, &$rules, &$result)
104 if (common_config('site', 'openidonly')) {
105 // Note that we should not remove the login and register
106 // actions. Lots of auth-related things link to them,
107 // such as when visiting a private site without a session
108 // or revalidating a remembered login for admin work.
110 // We take those two over with redirects to ourselves
111 // over in onArgsInitialize().
112 static $block = array('main/recoverpassword',
113 'settings/password');
115 if (in_array($path, $block)) {
124 * If we've been hit with password-login args, redirect
126 * @param array $args args (URL, Get, post)
128 * @return boolean hook return
131 function onArgsInitialize($args)
133 if (common_config('site', 'openidonly')) {
134 if (array_key_exists('action', $args)) {
135 $action = trim($args['action']);
136 if (in_array($action, array('login', 'register'))) {
137 common_redirect(common_local_url('openidlogin'));
139 } else if ($action == 'passwordsettings') {
140 common_redirect(common_local_url('openidsettings'));
142 } else if ($action == 'recoverpassword') {
143 throw new ClientException('Unavailable action');
151 * Public XRDS output hook
153 * Puts the bits of code needed by some OpenID providers to show
154 * we're good citizens.
156 * @param Action $action Action being executed
157 * @param XMLOutputter &$xrdsOutputter Output channel
159 * @return boolean hook return
162 function onEndPublicXRDS($action, &$xrdsOutputter)
164 $xrdsOutputter->elementStart('XRD', array('xmlns' => 'xri://$xrd*($v*2.0)',
165 'xmlns:simple' => 'http://xrds-simple.net/core/1.0',
166 'version' => '2.0'));
167 $xrdsOutputter->element('Type', null, 'xri://$xrds*simple');
169 foreach (array('finishopenidlogin', 'finishaddopenid') as $finish) {
170 $xrdsOutputter->showXrdsService(Auth_OpenID_RP_RETURN_TO_URL_TYPE,
171 common_local_url($finish));
174 $xrdsOutputter->showXrdsService('http://specs.openid.net/auth/2.0/server',
175 common_local_url('openidserver'),
178 'http://specs.openid.net/auth/2.0/identifier_select');
179 $xrdsOutputter->elementEnd('XRD');
183 * User XRDS output hook
185 * Puts the bits of code needed to discover OpenID endpoints.
187 * @param Action $action Action being executed
188 * @param XMLOutputter &$xrdsOutputter Output channel
190 * @return boolean hook return
193 function onEndUserXRDS($action, &$xrdsOutputter)
195 $xrdsOutputter->elementStart('XRD', array('xmlns' => 'xri://$xrd*($v*2.0)',
196 'xml:id' => 'openid',
197 'xmlns:simple' => 'http://xrds-simple.net/core/1.0',
198 'version' => '2.0'));
199 $xrdsOutputter->element('Type', null, 'xri://$xrds*simple');
202 $xrdsOutputter->showXrdsService('http://specs.openid.net/auth/2.0/return_to',
203 common_local_url('finishopenidlogin'));
206 $xrdsOutputter->showXrdsService('http://specs.openid.net/auth/2.0/signon',
207 common_local_url('openidserver'),
210 common_profile_url($action->user->nickname));
211 $xrdsOutputter->elementEnd('XRD');
215 * If we're in OpenID-only mode, hide all the main menu except OpenID login.
217 * @param Action $action Action being run
219 * @return boolean hook return
222 function onStartPrimaryNav($action)
224 if (common_config('site', 'openidonly') && !common_logged_in()) {
225 // TRANS: Tooltip for main menu option "Login"
226 $tooltip = _m('TOOLTIP', 'Login to the site');
227 $action->menuItem(common_local_url('openidlogin'),
228 // TRANS: Main menu option when not logged in to log in
233 // TRANS: Tooltip for main menu option "Help"
234 $tooltip = _m('TOOLTIP', 'Help me!');
235 $action->menuItem(common_local_url('doc', array('title' => 'help')),
236 // TRANS: Main menu option for help on the StatusNet site
241 if (!common_config('site', 'private')) {
242 // TRANS: Tooltip for main menu option "Search"
243 $tooltip = _m('TOOLTIP', 'Search for people or text');
244 $action->menuItem(common_local_url('peoplesearch'),
245 // TRANS: Main menu option when logged in or when the StatusNet instance is not private
246 _m('MENU', 'Search'), $tooltip, false, 'nav_search');
248 Event::handle('EndPrimaryNav', array($action));
257 * If we're in openidOnly mode, we disable the menu for all other login.
259 * @param Action &$action Action being executed
261 * @return boolean hook return
264 function onStartLoginGroupNav(&$action)
266 if (common_config('site', 'openidonly')) {
267 $this->showOpenIDLoginTab($action);
268 // Even though we replace this code, we
269 // DON'T run the End* hook, to keep others from
270 // adding tabs. Not nice, but.
278 * Menu item for login
280 * @param Action &$action Action being executed
282 * @return boolean hook return
285 function onEndLoginGroupNav(&$action)
287 $this->showOpenIDLoginTab($action);
293 * Show menu item for login
295 * @param Action $action Action being executed
300 function showOpenIDLoginTab($action)
302 $action_name = $action->trimmed('action');
304 $action->menuItem(common_local_url('openidlogin'),
305 // TRANS: OpenID plugin menu item on site logon page.
306 _m('MENU', 'OpenID'),
307 // TRANS: OpenID plugin tooltip for logon menu item.
308 _m('Login or register with OpenID'),
309 $action_name === 'openidlogin');
313 * Show menu item for password
315 * We hide it in openID-only mode
317 * @param Action $menu Widget for menu
318 * @param void &$unused Unused value
323 function onStartAccountSettingsPasswordMenuItem($menu, &$unused) {
324 if (common_config('site', 'openidonly')) {
331 * Menu item for OpenID settings
333 * @param Action &$action Action being executed
335 * @return boolean hook return
338 function onEndAccountSettingsNav(&$action)
340 $action_name = $action->trimmed('action');
342 $action->menuItem(common_local_url('openidsettings'),
343 // TRANS: OpenID plugin menu item on user settings page.
344 _m('MENU', 'OpenID'),
345 // TRANS: OpenID plugin tooltip for user settings menu item.
346 _m('Add or remove OpenIDs'),
347 $action_name === 'openidsettings');
355 * Loads our classes if they're requested.
357 * @param string $cls Class requested
359 * @return boolean hook return
362 function onAutoload($cls)
366 case 'OpenidloginAction':
367 case 'FinishopenidloginAction':
368 case 'FinishaddopenidAction':
370 case 'PublicxrdsAction':
371 case 'OpenidsettingsAction':
372 case 'OpenidserverAction':
373 case 'OpenidtrustAction':
374 case 'OpenidadminpanelAction':
375 require_once dirname(__FILE__) . '/' . strtolower(mb_substr($cls, 0, -6)) . '.php';
378 require_once dirname(__FILE__) . '/User_openid.php';
380 case 'User_openid_trustroot':
381 require_once dirname(__FILE__) . '/User_openid_trustroot.php';
383 case 'Auth_OpenID_TeamsExtension':
384 case 'Auth_OpenID_TeamsRequest':
385 case 'Auth_OpenID_TeamsResponse':
386 require_once dirname(__FILE__) . '/extlib/teams-extension.php';
396 * These actions should use https when SSL support is 'sometimes'
398 * @param Action $action Action to form an URL for
399 * @param boolean &$ssl Whether to mark it for SSL
401 * @return boolean hook return
404 function onSensitiveAction($action, &$ssl)
408 case 'finishopenidlogin':
409 case 'finishaddopenid':
420 * These actions should be visible even when the site is marked private
422 * @param Action $action Action to show
423 * @param boolean &$login Whether it's a login action
425 * @return boolean hook return
428 function onLoginAction($action, &$login)
433 case 'finishopenidlogin':
443 * We include a <meta> element linking to the userxrds page, for OpenID
444 * client-side authentication.
446 * @param Action $action Action being shown
451 function onEndShowHeadElements($action)
453 if ($action instanceof ShowstreamAction) {
454 $action->element('link', array('rel' => 'openid2.provider',
455 'href' => common_local_url('openidserver')));
456 $action->element('link', array('rel' => 'openid2.local_id',
457 'href' => $action->profile->profileurl));
458 $action->element('link', array('rel' => 'openid.server',
459 'href' => common_local_url('openidserver')));
460 $action->element('link', array('rel' => 'openid.delegate',
461 'href' => $action->profile->profileurl));
467 * Redirect to OpenID login if they have an OpenID
469 * @param Action $action Action being executed
470 * @param User $user User doing the action
472 * @return boolean whether to continue
475 function onRedirectToLogin($action, $user)
477 if (common_config('site', 'openid_only') || (!empty($user) && User_openid::hasOpenID($user->id))) {
478 common_redirect(common_local_url('openidlogin'), 303);
485 * Show some extra instructions for using OpenID
487 * @param Action $action Action being executed
489 * @return boolean hook value
492 function onEndShowPageNotice($action)
494 $name = $action->trimmed('action');
499 if (common_logged_in()) {
500 $instr = '(Have an [OpenID](http://openid.net/)? ' .
501 '[Add an OpenID to your account](%%action.openidsettings%%)!';
503 $instr = '(Have an [OpenID](http://openid.net/)? ' .
504 'Try our [OpenID registration]'.
505 '(%%action.openidlogin%%)!)';
509 $instr = '(Have an [OpenID](http://openid.net/)? ' .
510 'Try our [OpenID login]'.
511 '(%%action.openidlogin%%)!)';
517 $output = common_markup_to_html($instr);
518 $action->raw($output);
523 * Load our document if requested
525 * @param string &$title Title to fetch
526 * @param string &$output HTML to output
528 * @return boolean hook value
531 function onStartLoadDoc(&$title, &$output)
533 if ($title == 'openid') {
534 $filename = INSTALLDIR.'/plugins/OpenID/doc-src/openid';
536 $c = file_get_contents($filename);
537 $output = common_markup_to_html($c);
538 return false; // success!
545 * Add our document to the global menu
547 * @param string $title Title being fetched
548 * @param string &$output HTML being output
550 * @return boolean hook value
553 function onEndLoadDoc($title, &$output)
555 if ($title == 'help') {
556 $menuitem = '* [OpenID](%%doc.openid%%) - what OpenID is and how to use it with this service';
558 $output .= common_markup_to_html($menuitem);
567 * Assure that our data objects are available in the DB
569 * @return boolean hook value
572 function onCheckSchema()
574 $schema = Schema::get();
575 $schema->ensureTable('user_openid',
576 array(new ColumnDef('canonical', 'varchar',
577 '255', false, 'PRI'),
578 new ColumnDef('display', 'varchar',
579 '255', false, 'UNI'),
580 new ColumnDef('user_id', 'integer',
582 new ColumnDef('created', 'datetime',
584 new ColumnDef('modified', 'timestamp')));
585 $schema->ensureTable('user_openid_trustroot',
586 array(new ColumnDef('trustroot', 'varchar',
587 '255', false, 'PRI'),
588 new ColumnDef('user_id', 'integer',
590 new ColumnDef('created', 'datetime',
592 new ColumnDef('modified', 'timestamp')));
597 * Add our tables to be deleted when a user is deleted
599 * @param User $user User being deleted
600 * @param array &$tables Array of table names
602 * @return boolean hook value
605 function onUserDeleteRelated($user, &$tables)
607 $tables[] = 'User_openid';
608 $tables[] = 'User_openid_trustroot';
613 * Add an OpenID tab to the admin panel
615 * @param Widget $nav Admin panel nav
617 * @return boolean hook value
620 function onEndAdminPanelNav($nav)
622 if (AdminPanelAction::canAdmin('openid')) {
624 $action_name = $nav->action->trimmed('action');
627 common_local_url('openidadminpanel'),
629 _m('OpenID configuration'),
630 $action_name == 'openidadminpanel',
631 'nav_openid_admin_panel'
639 * Add OpenID information to the Account Management Control Document
640 * Event supplied by the Account Manager plugin
642 * @param array &$amcd Array that expresses the AMCD
644 * @return boolean hook value
647 function onEndAccountManagementControlDocument(&$amcd)
649 $amcd['auth-methods']['openid'] = array(
652 'path' => common_local_url('openidlogin'),
654 'identity' => 'openid_url'
661 * Add our version information to output
663 * @param array &$versions Array of version-data arrays
665 * @return boolean hook value
668 function onPluginVersion(&$versions)
670 $versions[] = array('name' => 'OpenID',
671 'version' => STATUSNET_VERSION,
672 'author' => 'Evan Prodromou, Craig Andrews',
673 'homepage' => 'http://status.net/wiki/Plugin:OpenID',
675 // TRANS: OpenID plugin description.
676 _m('Use <a href="http://openid.net/">OpenID</a> to login to the site.'));