3 * StatusNet, the distributed open-source microblogging tool
7 * LICENCE: This program is free software: you can redistribute it and/or modify
8 * it under the terms of the GNU Affero General Public License as published by
9 * the Free Software Foundation, either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU Affero General Public License for more details.
17 * You should have received a copy of the GNU Affero General Public License
18 * along with this program. If not, see <http://www.gnu.org/licenses/>.
22 * @author Evan Prodromou <evan@status.net>
23 * @copyright 2009-2010 StatusNet, Inc.
24 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
25 * @link http://status.net/
28 if (!defined('STATUSNET')) {
33 * Plugin for OpenID authentication and identity
35 * This class enables consumer support for OpenID, the distributed authentication
36 * and identity system.
40 * @author Evan Prodromou <evan@status.net>
41 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
42 * @link http://status.net/
43 * @link http://openid.net/
46 class OpenIDPlugin extends Plugin
48 // Plugin parameter: set true to disallow non-OpenID logins
49 // If set, overrides the setting in database or $config['site']['openidonly']
50 public $openidOnly = null;
55 if ($this->openidOnly !== null) {
57 $config['site']['openidonly'] = (bool)$this->openidOnly;
63 * Add OpenID-related paths to the router table
65 * Hook for RouterInitialized event.
67 * @param Net_URL_Mapper $m URL mapper
69 * @return boolean hook return
72 function onStartInitializeRouter($m)
74 $m->connect('main/openid', array('action' => 'openidlogin'));
75 $m->connect('main/openidtrust', array('action' => 'openidtrust'));
76 $m->connect('settings/openid', array('action' => 'openidsettings'));
77 $m->connect('index.php?action=finishopenidlogin',
78 array('action' => 'finishopenidlogin'));
79 $m->connect('index.php?action=finishaddopenid',
80 array('action' => 'finishaddopenid'));
81 $m->connect('main/openidserver', array('action' => 'openidserver'));
82 $m->connect('admin/openid', array('action' => 'openidadminpanel'));
88 * In OpenID-only mode, disable paths for password stuff
90 * @param string $path path to connect
91 * @param array $defaults path defaults
92 * @param array $rules path rules
93 * @param array $result unused
95 * @return boolean hook return
98 function onStartConnectPath(&$path, &$defaults, &$rules, &$result)
100 if (common_config('site', 'openidonly')) {
101 static $block = array('main/login',
103 'main/recoverpassword',
104 'settings/password');
106 if (in_array($path, $block)) {
115 * If we've been hit with password-login args, redirect
117 * @param array $args args (URL, Get, post)
119 * @return boolean hook return
122 function onArgsInitialize($args)
124 if (common_config('site', 'openidonly')) {
125 if (array_key_exists('action', $args)) {
126 $action = trim($args['action']);
127 if (in_array($action, array('login', 'register'))) {
128 common_redirect(common_local_url('openidlogin'));
130 } else if ($action == 'passwordsettings') {
131 common_redirect(common_local_url('openidsettings'));
133 } else if ($action == 'recoverpassword') {
134 throw new ClientException('Unavailable action');
142 * Public XRDS output hook
144 * Puts the bits of code needed by some OpenID providers to show
145 * we're good citizens.
147 * @param Action $action Action being executed
148 * @param XMLOutputter &$xrdsOutputter Output channel
150 * @return boolean hook return
153 function onEndPublicXRDS($action, &$xrdsOutputter)
155 $xrdsOutputter->elementStart('XRD', array('xmlns' => 'xri://$xrd*($v*2.0)',
156 'xmlns:simple' => 'http://xrds-simple.net/core/1.0',
157 'version' => '2.0'));
158 $xrdsOutputter->element('Type', null, 'xri://$xrds*simple');
160 foreach (array('finishopenidlogin', 'finishaddopenid') as $finish) {
161 $xrdsOutputter->showXrdsService(Auth_OpenID_RP_RETURN_TO_URL_TYPE,
162 common_local_url($finish));
165 $xrdsOutputter->showXrdsService('http://specs.openid.net/auth/2.0/server',
166 common_local_url('openidserver'),
169 'http://specs.openid.net/auth/2.0/identifier_select');
170 $xrdsOutputter->elementEnd('XRD');
174 * User XRDS output hook
176 * Puts the bits of code needed to discover OpenID endpoints.
178 * @param Action $action Action being executed
179 * @param XMLOutputter &$xrdsOutputter Output channel
181 * @return boolean hook return
184 function onEndUserXRDS($action, &$xrdsOutputter)
186 $xrdsOutputter->elementStart('XRD', array('xmlns' => 'xri://$xrd*($v*2.0)',
187 'xml:id' => 'openid',
188 'xmlns:simple' => 'http://xrds-simple.net/core/1.0',
189 'version' => '2.0'));
190 $xrdsOutputter->element('Type', null, 'xri://$xrds*simple');
193 $xrdsOutputter->showXrdsService('http://specs.openid.net/auth/2.0/return_to',
194 common_local_url('finishopenidlogin'));
197 $xrdsOutputter->showXrdsService('http://specs.openid.net/auth/2.0/signon',
198 common_local_url('openidserver'),
201 common_profile_url($action->user->nickname));
202 $xrdsOutputter->elementEnd('XRD');
206 * If we're in OpenID-only mode, hide all the main menu except OpenID login.
208 * @param Action $action Action being run
210 * @return boolean hook return
213 function onStartPrimaryNav($action)
215 if (common_config('site', 'openidonly') && !common_logged_in()) {
216 // TRANS: Tooltip for main menu option "Login"
217 $tooltip = _m('TOOLTIP', 'Login to the site');
218 // TRANS: Main menu option when not logged in to log in
219 $action->menuItem(common_local_url('openidlogin'),
224 // TRANS: Tooltip for main menu option "Help"
225 $tooltip = _m('TOOLTIP', 'Help me!');
226 // TRANS: Main menu option for help on the StatusNet site
227 $action->menuItem(common_local_url('doc', array('title' => 'help')),
232 if (!common_config('site', 'private')) {
233 // TRANS: Tooltip for main menu option "Search"
234 $tooltip = _m('TOOLTIP', 'Search for people or text');
235 // TRANS: Main menu option when logged in or when the StatusNet instance is not private
236 $action->menuItem(common_local_url('peoplesearch'),
237 _m('MENU', 'Search'), $tooltip, false, 'nav_search');
239 Event::handle('EndPrimaryNav', array($action));
248 * If we're in openidOnly mode, we disable the menu for all other login.
250 * @param Action &$action Action being executed
252 * @return boolean hook return
255 function onStartLoginGroupNav(&$action)
257 if (common_config('site', 'openidonly')) {
258 $this->showOpenIDLoginTab($action);
259 // Even though we replace this code, we
260 // DON'T run the End* hook, to keep others from
261 // adding tabs. Not nice, but.
269 * Menu item for login
271 * @param Action &$action Action being executed
273 * @return boolean hook return
276 function onEndLoginGroupNav(&$action)
278 $this->showOpenIDLoginTab($action);
284 * Show menu item for login
286 * @param Action $action Action being executed
291 function showOpenIDLoginTab($action)
293 $action_name = $action->trimmed('action');
295 $action->menuItem(common_local_url('openidlogin'),
297 _m('Login or register with OpenID'),
298 $action_name === 'openidlogin');
302 * Show menu item for password
304 * We hide it in openID-only mode
306 * @param Action $menu Widget for menu
307 * @param void &$unused Unused value
312 function onStartAccountSettingsPasswordMenuItem($menu, &$unused) {
313 if (common_config('site', 'openidonly')) {
320 * Menu item for OpenID settings
322 * @param Action &$action Action being executed
324 * @return boolean hook return
327 function onEndAccountSettingsNav(&$action)
329 $action_name = $action->trimmed('action');
331 $action->menuItem(common_local_url('openidsettings'),
333 _m('Add or remove OpenIDs'),
334 $action_name === 'openidsettings');
342 * Loads our classes if they're requested.
344 * @param string $cls Class requested
346 * @return boolean hook return
349 function onAutoload($cls)
353 case 'OpenidloginAction':
354 case 'FinishopenidloginAction':
355 case 'FinishaddopenidAction':
357 case 'PublicxrdsAction':
358 case 'OpenidsettingsAction':
359 case 'OpenidserverAction':
360 case 'OpenidtrustAction':
361 case 'OpenidadminpanelAction':
362 require_once dirname(__FILE__) . '/' . strtolower(mb_substr($cls, 0, -6)) . '.php';
365 require_once dirname(__FILE__) . '/User_openid.php';
367 case 'User_openid_trustroot':
368 require_once dirname(__FILE__) . '/User_openid_trustroot.php';
370 case 'Auth_OpenID_TeamsExtension':
371 case 'Auth_OpenID_TeamsRequest':
372 case 'Auth_OpenID_TeamsResponse':
373 require_once dirname(__FILE__) . '/extlib/teams-extension.php';
383 * These actions should use https when SSL support is 'sometimes'
385 * @param Action $action Action to form an URL for
386 * @param boolean &$ssl Whether to mark it for SSL
388 * @return boolean hook return
391 function onSensitiveAction($action, &$ssl)
395 case 'finishopenidlogin':
396 case 'finishaddopenid':
407 * These actions should be visible even when the site is marked private
409 * @param Action $action Action to show
410 * @param boolean &$login Whether it's a login action
412 * @return boolean hook return
415 function onLoginAction($action, &$login)
420 case 'finishopenidlogin':
430 * We include a <meta> element linking to the userxrds page, for OpenID
431 * client-side authentication.
433 * @param Action $action Action being shown
438 function onEndShowHeadElements($action)
440 if ($action instanceof ShowstreamAction) {
441 $action->element('link', array('rel' => 'openid2.provider',
442 'href' => common_local_url('openidserver')));
443 $action->element('link', array('rel' => 'openid2.local_id',
444 'href' => $action->profile->profileurl));
445 $action->element('link', array('rel' => 'openid.server',
446 'href' => common_local_url('openidserver')));
447 $action->element('link', array('rel' => 'openid.delegate',
448 'href' => $action->profile->profileurl));
454 * Redirect to OpenID login if they have an OpenID
456 * @param Action $action Action being executed
457 * @param User $user User doing the action
459 * @return boolean whether to continue
462 function onRedirectToLogin($action, $user)
464 if (common_config('site', 'openid_only') || (!empty($user) && User_openid::hasOpenID($user->id))) {
465 common_redirect(common_local_url('openidlogin'), 303);
472 * Show some extra instructions for using OpenID
474 * @param Action $action Action being executed
476 * @return boolean hook value
479 function onEndShowPageNotice($action)
481 $name = $action->trimmed('action');
486 if (common_logged_in()) {
487 $instr = '(Have an [OpenID](http://openid.net/)? ' .
488 '[Add an OpenID to your account](%%action.openidsettings%%)!';
490 $instr = '(Have an [OpenID](http://openid.net/)? ' .
491 'Try our [OpenID registration]'.
492 '(%%action.openidlogin%%)!)';
496 $instr = '(Have an [OpenID](http://openid.net/)? ' .
497 'Try our [OpenID login]'.
498 '(%%action.openidlogin%%)!)';
504 $output = common_markup_to_html($instr);
505 $action->raw($output);
510 * Load our document if requested
512 * @param string &$title Title to fetch
513 * @param string &$output HTML to output
515 * @return boolean hook value
518 function onStartLoadDoc(&$title, &$output)
520 if ($title == 'openid') {
521 $filename = INSTALLDIR.'/plugins/OpenID/doc-src/openid';
523 $c = file_get_contents($filename);
524 $output = common_markup_to_html($c);
525 return false; // success!
532 * Add our document to the global menu
534 * @param string $title Title being fetched
535 * @param string &$output HTML being output
537 * @return boolean hook value
540 function onEndLoadDoc($title, &$output)
542 if ($title == 'help') {
543 $menuitem = '* [OpenID](%%doc.openid%%) - what OpenID is and how to use it with this service';
545 $output .= common_markup_to_html($menuitem);
554 * Assure that our data objects are available in the DB
556 * @return boolean hook value
559 function onCheckSchema()
561 $schema = Schema::get();
562 $schema->ensureTable('user_openid',
563 array(new ColumnDef('canonical', 'varchar',
564 '255', false, 'PRI'),
565 new ColumnDef('display', 'varchar',
566 '255', false, 'UNI'),
567 new ColumnDef('user_id', 'integer',
569 new ColumnDef('created', 'datetime',
571 new ColumnDef('modified', 'timestamp')));
572 $schema->ensureTable('user_openid_trustroot',
573 array(new ColumnDef('trustroot', 'varchar',
574 '255', false, 'PRI'),
575 new ColumnDef('user_id', 'integer',
577 new ColumnDef('created', 'datetime',
579 new ColumnDef('modified', 'timestamp')));
584 * Add our tables to be deleted when a user is deleted
586 * @param User $user User being deleted
587 * @param array &$tables Array of table names
589 * @return boolean hook value
592 function onUserDeleteRelated($user, &$tables)
594 $tables[] = 'User_openid';
595 $tables[] = 'User_openid_trustroot';
600 * Add an OpenID tab to the admin panel
602 * @param Widget $nav Admin panel nav
604 * @return boolean hook value
607 function onEndAdminPanelNav($nav)
609 if (AdminPanelAction::canAdmin('openid')) {
611 $action_name = $nav->action->trimmed('action');
614 common_local_url('openidadminpanel'),
616 _m('OpenID configuration'),
617 $action_name == 'openidadminpanel',
618 'nav_openid_admin_panel'
626 * Add our version information to output
628 * @param array &$versions Array of version-data arrays
630 * @return boolean hook value
633 function onPluginVersion(&$versions)
635 $versions[] = array('name' => 'OpenID',
636 'version' => STATUSNET_VERSION,
637 'author' => 'Evan Prodromou, Craig Andrews',
638 'homepage' => 'http://status.net/wiki/Plugin:OpenID',
640 _m('Use <a href="http://openid.net/">OpenID</a> to login to the site.'));