3 * StatusNet, the distributed open-source microblogging tool
7 * LICENCE: This program is free software: you can redistribute it and/or modify
8 * it under the terms of the GNU Affero General Public License as published by
9 * the Free Software Foundation, either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU Affero General Public License for more details.
17 * You should have received a copy of the GNU Affero General Public License
18 * along with this program. If not, see <http://www.gnu.org/licenses/>.
22 * @author Evan Prodromou <evan@status.net>
23 * @author Craig Andrews <candrews@integralblue.com>
24 * @copyright 2009-2010 StatusNet, Inc.
25 * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
26 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
27 * @link http://status.net/
30 if (!defined('STATUSNET')) {
35 * Plugin for OpenID authentication and identity
37 * This class enables consumer support for OpenID, the distributed authentication
38 * and identity system.
42 * @author Evan Prodromou <evan@status.net>
43 * @author Craig Andrews <candrews@integralblue.com>
44 * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
45 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
46 * @link http://status.net/
47 * @link http://openid.net/
49 class OpenIDPlugin extends Plugin
51 // Plugin parameter: set true to disallow non-OpenID logins
52 // If set, overrides the setting in database or $config['site']['openidonly']
53 public $openidOnly = null;
58 if ($this->openidOnly !== null) {
60 $config['site']['openidonly'] = (bool)$this->openidOnly;
65 * Add OpenID-related paths to the router table
67 * Hook for RouterInitialized event.
69 * @param Net_URL_Mapper $m URL mapper
71 * @return boolean hook return
73 function onStartInitializeRouter($m)
75 $m->connect('main/openid', array('action' => 'openidlogin'));
76 $m->connect('main/openidtrust', array('action' => 'openidtrust'));
77 $m->connect('settings/openid', array('action' => 'openidsettings'));
78 $m->connect('index.php?action=finishopenidlogin',
79 array('action' => 'finishopenidlogin'));
80 $m->connect('index.php?action=finishaddopenid',
81 array('action' => 'finishaddopenid'));
82 $m->connect('main/openidserver', array('action' => 'openidserver'));
83 $m->connect('admin/openid', array('action' => 'openidadminpanel'));
89 * In OpenID-only mode, disable paths for password stuff
91 * @param string $path path to connect
92 * @param array $defaults path defaults
93 * @param array $rules path rules
94 * @param array $result unused
96 * @return boolean hook return
98 function onStartConnectPath(&$path, &$defaults, &$rules, &$result)
100 if (common_config('site', 'openidonly')) {
101 // Note that we should not remove the login and register
102 // actions. Lots of auth-related things link to them,
103 // such as when visiting a private site without a session
104 // or revalidating a remembered login for admin work.
106 // We take those two over with redirects to ourselves
107 // over in onArgsInitialize().
108 static $block = array('main/recoverpassword',
109 'settings/password');
111 if (in_array($path, $block)) {
120 * If we've been hit with password-login args, redirect
122 * @param array $args args (URL, Get, post)
124 * @return boolean hook return
126 function onArgsInitialize($args)
128 if (common_config('site', 'openidonly')) {
129 if (array_key_exists('action', $args)) {
130 $action = trim($args['action']);
131 if (in_array($action, array('login', 'register'))) {
132 common_redirect(common_local_url('openidlogin'));
134 } else if ($action == 'passwordsettings') {
135 common_redirect(common_local_url('openidsettings'));
137 } else if ($action == 'recoverpassword') {
138 throw new ClientException('Unavailable action');
146 * Public XRDS output hook
148 * Puts the bits of code needed by some OpenID providers to show
149 * we're good citizens.
151 * @param Action $action Action being executed
152 * @param XMLOutputter &$xrdsOutputter Output channel
154 * @return boolean hook return
156 function onEndPublicXRDS($action, &$xrdsOutputter)
158 $xrdsOutputter->elementStart('XRD', array('xmlns' => 'xri://$xrd*($v*2.0)',
159 'xmlns:simple' => 'http://xrds-simple.net/core/1.0',
160 'version' => '2.0'));
161 $xrdsOutputter->element('Type', null, 'xri://$xrds*simple');
163 foreach (array('finishopenidlogin', 'finishaddopenid') as $finish) {
164 $xrdsOutputter->showXrdsService(Auth_OpenID_RP_RETURN_TO_URL_TYPE,
165 common_local_url($finish));
168 $xrdsOutputter->showXrdsService('http://specs.openid.net/auth/2.0/server',
169 common_local_url('openidserver'),
172 'http://specs.openid.net/auth/2.0/identifier_select');
173 $xrdsOutputter->elementEnd('XRD');
177 * User XRDS output hook
179 * Puts the bits of code needed to discover OpenID endpoints.
181 * @param Action $action Action being executed
182 * @param XMLOutputter &$xrdsOutputter Output channel
184 * @return boolean hook return
186 function onEndUserXRDS($action, &$xrdsOutputter)
188 $xrdsOutputter->elementStart('XRD', array('xmlns' => 'xri://$xrd*($v*2.0)',
189 'xml:id' => 'openid',
190 'xmlns:simple' => 'http://xrds-simple.net/core/1.0',
191 'version' => '2.0'));
192 $xrdsOutputter->element('Type', null, 'xri://$xrds*simple');
195 $xrdsOutputter->showXrdsService('http://specs.openid.net/auth/2.0/return_to',
196 common_local_url('finishopenidlogin'));
199 $xrdsOutputter->showXrdsService('http://specs.openid.net/auth/2.0/signon',
200 common_local_url('openidserver'),
203 common_profile_url($action->user->nickname));
204 $xrdsOutputter->elementEnd('XRD');
208 * If we're in OpenID-only mode, hide all the main menu except OpenID login.
210 * @param Action $action Action being run
212 * @return boolean hook return
214 function onStartPrimaryNav($action)
216 if (common_config('site', 'openidonly') && !common_logged_in()) {
217 // TRANS: Tooltip for main menu option "Login"
218 $tooltip = _m('TOOLTIP', 'Login to the site');
219 $action->menuItem(common_local_url('openidlogin'),
220 // TRANS: Main menu option when not logged in to log in
225 // TRANS: Tooltip for main menu option "Help"
226 $tooltip = _m('TOOLTIP', 'Help me!');
227 $action->menuItem(common_local_url('doc', array('title' => 'help')),
228 // TRANS: Main menu option for help on the StatusNet site
233 if (!common_config('site', 'private')) {
234 // TRANS: Tooltip for main menu option "Search"
235 $tooltip = _m('TOOLTIP', 'Search for people or text');
236 $action->menuItem(common_local_url('peoplesearch'),
237 // TRANS: Main menu option when logged in or when the StatusNet instance is not private
238 _m('MENU', 'Search'), $tooltip, false, 'nav_search');
240 Event::handle('EndPrimaryNav', array($action));
249 * If we're in openidOnly mode, we disable the menu for all other login.
251 * @param Action &$action Action being executed
253 * @return boolean hook return
255 function onStartLoginGroupNav(&$action)
257 if (common_config('site', 'openidonly')) {
258 $this->showOpenIDLoginTab($action);
259 // Even though we replace this code, we
260 // DON'T run the End* hook, to keep others from
261 // adding tabs. Not nice, but.
269 * Menu item for login
271 * @param Action &$action Action being executed
273 * @return boolean hook return
275 function onEndLoginGroupNav(&$action)
277 $this->showOpenIDLoginTab($action);
283 * Show menu item for login
285 * @param Action $action Action being executed
289 function showOpenIDLoginTab($action)
291 $action_name = $action->trimmed('action');
293 $action->menuItem(common_local_url('openidlogin'),
294 // TRANS: OpenID plugin menu item on site logon page.
295 _m('MENU', 'OpenID'),
296 // TRANS: OpenID plugin tooltip for logon menu item.
297 _m('Login or register with OpenID'),
298 $action_name === 'openidlogin');
302 * Show menu item for password
304 * We hide it in openID-only mode
306 * @param Action $menu Widget for menu
307 * @param void &$unused Unused value
311 function onStartAccountSettingsPasswordMenuItem($menu, &$unused) {
312 if (common_config('site', 'openidonly')) {
319 * Menu item for OpenID settings
321 * @param Action &$action Action being executed
323 * @return boolean hook return
325 function onEndAccountSettingsNav(&$action)
327 $action_name = $action->trimmed('action');
329 $action->menuItem(common_local_url('openidsettings'),
330 // TRANS: OpenID plugin menu item on user settings page.
331 _m('MENU', 'OpenID'),
332 // TRANS: OpenID plugin tooltip for user settings menu item.
333 _m('Add or remove OpenIDs'),
334 $action_name === 'openidsettings');
342 * Loads our classes if they're requested.
344 * @param string $cls Class requested
346 * @return boolean hook return
348 function onAutoload($cls)
352 case 'OpenidloginAction':
353 case 'FinishopenidloginAction':
354 case 'FinishaddopenidAction':
356 case 'PublicxrdsAction':
357 case 'OpenidsettingsAction':
358 case 'OpenidserverAction':
359 case 'OpenidtrustAction':
360 case 'OpenidadminpanelAction':
361 require_once dirname(__FILE__) . '/' . strtolower(mb_substr($cls, 0, -6)) . '.php';
364 require_once dirname(__FILE__) . '/User_openid.php';
366 case 'User_openid_trustroot':
367 require_once dirname(__FILE__) . '/User_openid_trustroot.php';
369 case 'Auth_OpenID_TeamsExtension':
370 case 'Auth_OpenID_TeamsRequest':
371 case 'Auth_OpenID_TeamsResponse':
372 require_once dirname(__FILE__) . '/extlib/teams-extension.php';
382 * These actions should use https when SSL support is 'sometimes'
384 * @param Action $action Action to form an URL for
385 * @param boolean &$ssl Whether to mark it for SSL
387 * @return boolean hook return
389 function onSensitiveAction($action, &$ssl)
393 case 'finishopenidlogin':
394 case 'finishaddopenid':
405 * These actions should be visible even when the site is marked private
407 * @param Action $action Action to show
408 * @param boolean &$login Whether it's a login action
410 * @return boolean hook return
412 function onLoginAction($action, &$login)
417 case 'finishopenidlogin':
427 * We include a <meta> element linking to the userxrds page, for OpenID
428 * client-side authentication.
430 * @param Action $action Action being shown
434 function onEndShowHeadElements($action)
436 if ($action instanceof ShowstreamAction) {
437 $action->element('link', array('rel' => 'openid2.provider',
438 'href' => common_local_url('openidserver')));
439 $action->element('link', array('rel' => 'openid2.local_id',
440 'href' => $action->profile->profileurl));
441 $action->element('link', array('rel' => 'openid.server',
442 'href' => common_local_url('openidserver')));
443 $action->element('link', array('rel' => 'openid.delegate',
444 'href' => $action->profile->profileurl));
450 * Redirect to OpenID login if they have an OpenID
452 * @param Action $action Action being executed
453 * @param User $user User doing the action
455 * @return boolean whether to continue
457 function onRedirectToLogin($action, $user)
459 if (common_config('site', 'openid_only') || (!empty($user) && User_openid::hasOpenID($user->id))) {
460 common_redirect(common_local_url('openidlogin'), 303);
467 * Show some extra instructions for using OpenID
469 * @param Action $action Action being executed
471 * @return boolean hook value
473 function onEndShowPageNotice($action)
475 $name = $action->trimmed('action');
480 if (common_logged_in()) {
481 $instr = '(Have an [OpenID](http://openid.net/)? ' .
482 '[Add an OpenID to your account](%%action.openidsettings%%)!';
484 $instr = '(Have an [OpenID](http://openid.net/)? ' .
485 'Try our [OpenID registration]'.
486 '(%%action.openidlogin%%)!)';
490 $instr = '(Have an [OpenID](http://openid.net/)? ' .
491 'Try our [OpenID login]'.
492 '(%%action.openidlogin%%)!)';
498 $output = common_markup_to_html($instr);
499 $action->raw($output);
504 * Load our document if requested
506 * @param string &$title Title to fetch
507 * @param string &$output HTML to output
509 * @return boolean hook value
511 function onStartLoadDoc(&$title, &$output)
513 if ($title == 'openid') {
514 $filename = INSTALLDIR.'/plugins/OpenID/doc-src/openid';
516 $c = file_get_contents($filename);
517 $output = common_markup_to_html($c);
518 return false; // success!
525 * Add our document to the global menu
527 * @param string $title Title being fetched
528 * @param string &$output HTML being output
530 * @return boolean hook value
532 function onEndLoadDoc($title, &$output)
534 if ($title == 'help') {
535 $menuitem = '* [OpenID](%%doc.openid%%) - what OpenID is and how to use it with this service';
537 $output .= common_markup_to_html($menuitem);
546 * Assure that our data objects are available in the DB
548 * @return boolean hook value
550 function onCheckSchema()
552 $schema = Schema::get();
553 $schema->ensureTable('user_openid',
554 array(new ColumnDef('canonical', 'varchar',
555 '255', false, 'PRI'),
556 new ColumnDef('display', 'varchar',
557 '255', false, 'UNI'),
558 new ColumnDef('user_id', 'integer',
560 new ColumnDef('created', 'datetime',
562 new ColumnDef('modified', 'timestamp')));
563 $schema->ensureTable('user_openid_trustroot',
564 array(new ColumnDef('trustroot', 'varchar',
565 '255', false, 'PRI'),
566 new ColumnDef('user_id', 'integer',
568 new ColumnDef('created', 'datetime',
570 new ColumnDef('modified', 'timestamp')));
575 * Add our tables to be deleted when a user is deleted
577 * @param User $user User being deleted
578 * @param array &$tables Array of table names
580 * @return boolean hook value
582 function onUserDeleteRelated($user, &$tables)
584 $tables[] = 'User_openid';
585 $tables[] = 'User_openid_trustroot';
590 * Add an OpenID tab to the admin panel
592 * @param Widget $nav Admin panel nav
594 * @return boolean hook value
596 function onEndAdminPanelNav($nav)
598 if (AdminPanelAction::canAdmin('openid')) {
600 $action_name = $nav->action->trimmed('action');
603 common_local_url('openidadminpanel'),
604 // TRANS: OpenID configuration menu item.
606 // TRANS: Tooltip for OpenID configuration menu item.
607 _m('OpenID configuration'),
608 $action_name == 'openidadminpanel',
609 'nav_openid_admin_panel'
617 * Add OpenID information to the Account Management Control Document
618 * Event supplied by the Account Manager plugin
620 * @param array &$amcd Array that expresses the AMCD
622 * @return boolean hook value
625 function onEndAccountManagementControlDocument(&$amcd)
627 $amcd['auth-methods']['openid'] = array(
630 'path' => common_local_url('openidlogin'),
632 'identity' => 'openid_url'
639 * Add our version information to output
641 * @param array &$versions Array of version-data arrays
643 * @return boolean hook value
645 function onPluginVersion(&$versions)
647 $versions[] = array('name' => 'OpenID',
648 'version' => STATUSNET_VERSION,
649 'author' => 'Evan Prodromou, Craig Andrews',
650 'homepage' => 'http://status.net/wiki/Plugin:OpenID',
652 // TRANS: OpenID plugin description.
653 _m('Use <a href="http://openid.net/">OpenID</a> to login to the site.'));
657 function onStartOAuthLoginForm($action, &$button)
659 if (common_config('site', 'openidonly')) {
660 // Cancel the regular password login form, we won't need it.
661 $this->showOAuthLoginForm($action);
662 // TRANS: button label for OAuth authorization page when needing OpenID authentication first.
663 $button = _m('BUTTON', 'Continue');
666 // Leave the regular password login form in place.
667 // We'll add an OpenID link at bottom...?
673 * @fixme merge with common code for main OpenID login form
674 * @param HTMLOutputter $action
676 protected function showOAuthLoginForm($action)
678 $action->elementStart('fieldset');
679 // TRANS: OpenID plugin logon form legend.
680 $action->element('legend', null, _m('OpenID login'));
682 $action->elementStart('ul', 'form_data');
683 $action->elementStart('li');
684 $provider = common_config('openid', 'trusted_provider');
685 $appendUsername = common_config('openid', 'append_username');
687 // TRANS: Field label.
688 $action->element('label', array(), _m('OpenID provider'));
689 $action->element('span', array(), $provider);
690 if ($appendUsername) {
691 $action->element('input', array('id' => 'openid_username',
692 'name' => 'openid_username',
693 'style' => 'float: none'));
695 $action->element('p', 'form_guide',
696 // TRANS: Form guide.
697 ($appendUsername ? _m('Enter your username.') . ' ' : '') .
698 // TRANS: Form guide.
699 _m('You will be sent to the provider\'s site for authentication.'));
700 $action->hidden('openid_url', $provider);
702 // TRANS: OpenID plugin logon form field label.
703 $action->input('openid_url', _m('OpenID URL'),
705 // TRANS: OpenID plugin logon form field instructions.
706 _m('Your OpenID URL'));
708 $action->elementEnd('li');
709 $action->elementEnd('ul');
711 $action->elementEnd('fieldset');
715 * Handle a POST user credential check in apioauthauthorization.
716 * If given an OpenID URL, we'll pass us over to the regular things
717 * and then redirect back here on completion.
719 * @fixme merge with common code for main OpenID login form
720 * @param HTMLOutputter $action
722 function onStartOAuthLoginCheck($action, &$user)
724 $provider = common_config('openid', 'trusted_provider');
726 $openid_url = $provider;
727 if (common_config('openid', 'append_username')) {
728 $openid_url .= $action->trimmed('openid_username');
731 $openid_url = $action->trimmed('openid_url');
735 require_once dirname(__FILE__) . '/openid.php';
736 oid_assert_allowed($openid_url);
738 $returnto = common_local_url(
742 'oauth_token' => $action->arg('oauth_token'),
743 'mode' => $action->arg('mode')
746 common_set_returnto($returnto);
748 // This will redirect if functional...
749 $result = oid_authenticate($openid_url,
750 'finishopenidlogin');
751 if (is_string($result)) { # error message
752 throw new ServerException($result);
762 * Add link in user's XRD file to allow OpenID login.
764 * This link in the XRD should let users log in with their
765 * Webfinger identity to services that support it. See
766 * http://webfinger.org/login for an example.
768 * @param XRD &$xrd Currently-displaying XRD object
769 * @param User $user The user that it's for
771 * @return boolean hook value (always true)
774 function onEndXrdActionLinks(&$xrd, $user)
776 $profile = $user->getProfile();
778 if (!empty($profile)) {
779 $xrd->links[] = array('rel' => 'http://specs.openid.net/auth/2.0/provider',
780 'href' => $profile->profileurl);