src/Module/Security/OpenID.php

   1 <?php
   2
   3 namespace Friendica\Module\Security;
   4
   5 use Friendica\BaseModule;
   6 use Friendica\DI;
   7 use Friendica\Util\Strings;
   8 use LightOpenID;
   9
  10 /**
  11  * Performs an login with OpenID
  12  */
  13 class OpenID extends BaseModule
  14 {
  15         public static function content(array $parameters = [])
  16         {
  17                 if (DI::config()->get('system', 'no_openid')) {
  18                         DI::baseUrl()->redirect();
  19                 }
  20
  21                 DI::logger()->debug('mod_openid.', ['request' => $_REQUEST]);
  22
  23                 $session = DI::session();
  24
  25                 if (!empty($_GET['openid_mode']) && !empty($session->get('openid'))) {
  26
  27                         $openid = new LightOpenID(DI::baseUrl()->getHostname());
  28
  29                         $l10n = DI::l10n();
  30
  31                         if ($openid->validate()) {
  32                                 $authId = $openid->data['openid_identity'];
  33
  34                                 if (empty($authId)) {
  35                                         DI::logger()->info($l10n->t('OpenID protocol error. No ID returned'));
  36                                         DI::baseUrl()->redirect();
  37                                 }
  38
  39                                 // NOTE: we search both for normalised and non-normalised form of $authid
  40                                 //       because the normalization step was removed from setting
  41                                 //       mod/settings.php in 8367cad so it might have left mixed
  42                                 //       records in the user table
  43                                 //
  44                                 $condition = ['blocked' => false, 'account_expired' => false, 'account_removed' => false, 'verified' => true,
  45                                               'openid' => [$authId, Strings::normaliseOpenID($authId)]];
  46
  47                                 $dba = DI::dba();
  48
  49                                 $user  = $dba->selectFirst('user', [], $condition);
  50                                 if ($dba->isResult($user)) {
  51
  52                                         // successful OpenID login
  53                                         $session->remove('openid');
  54
  55                                         DI::auth()->setForUser(DI::app(), $user, true, true);
  56
  57                                         // just in case there was no return url set
  58                                         // and we fell through
  59                                         DI::baseUrl()->redirect();
  60                                 }
  61
  62                                 // Successful OpenID login - but we can't match it to an existing account.
  63                                 $session->remove('register');
  64                                 $session->set('openid_attributes', $openid->getAttributes());
  65                                 $session->set('openid_identity', $authId);
  66
  67                                 // Detect the server URL
  68                                 $open_id_obj = new LightOpenID(DI::baseUrl()->getHostName());
  69                                 $open_id_obj->identity = $authId;
  70                                 $session->set('openid_server', $open_id_obj->discover($open_id_obj->identity));
  71
  72                                 if (intval(DI::config()->get('config', 'register_policy')) === \Friendica\Module\Register::CLOSED) {
  73                                         notice($l10n->t('Account not found. Please login to your existing account to add the OpenID to it.'));
  74                                 } else {
  75                                         notice($l10n->t('Account not found. Please register a new account or login to your existing account to add the OpenID to it.'));
  76                                 }
  77
  78                                 DI::baseUrl()->redirect('login');
  79                         }
  80                 }
  81         }
  82 }