src/Module/Security/OpenID.php

   1 <?php
   2
   3 namespace Friendica\Module\Security;
   4
   5 use Friendica\App\Authentication;
   6 use Friendica\App\BaseURL;
   7 use Friendica\BaseModule;
   8 use Friendica\Core\Config\Configuration;
   9 use Friendica\Core\L10n\L10n;
  10 use Friendica\Core\Session\ISession;
  11 use Friendica\Database\Database;
  12 use Friendica\DI;
  13 use Friendica\Util\Strings;
  14 use LightOpenID;
  15 use Psr\Log\LoggerInterface;
  16
  17 /**
  18  * Performs an login with OpenID
  19  */
  20 class OpenID extends BaseModule
  21 {
  22         public static function content(array $parameters = [])
  23         {
  24                 if (DI::config()->get('system', 'no_openid')) {
  25                         DI::baseUrl()->redirect();
  26                 }
  27
  28                 DI::logger()->debug('mod_openid.', ['request' => $_REQUEST]);
  29
  30                 $session = DI::session();
  31
  32                 if (!empty($_GET['openid_mode']) && !empty($session->get('openid'))) {
  33
  34                         $openid = new LightOpenID(DI::baseUrl()->getHostname());
  35
  36                         $l10n = DI::l10n();
  37
  38                         if ($openid->validate()) {
  39                                 $authId = $openid->data['openid_identity'];
  40
  41                                 if (empty($authId)) {
  42                                         DI::logger()->info($l10n->t('OpenID protocol error. No ID returned'));
  43                                         DI::baseUrl()->redirect();
  44                                 }
  45
  46                                 // NOTE: we search both for normalised and non-normalised form of $authid
  47                                 //       because the normalization step was removed from setting
  48                                 //       mod/settings.php in 8367cad so it might have left mixed
  49                                 //       records in the user table
  50                                 //
  51                                 $condition = ['blocked' => false, 'account_expired' => false, 'account_removed' => false, 'verified' => true,
  52                                               'openid' => [$authId, Strings::normaliseOpenID($authId)]];
  53
  54                                 $dba = DI::dba();
  55
  56                                 $user  = $dba->selectFirst('user', [], $condition);
  57                                 if ($dba->isResult($user)) {
  58
  59                                         // successful OpenID login
  60                                         $session->remove('openid');
  61
  62                                         DI::auth()->setForUser(self::getApp(), $user, true, true);
  63
  64                                         // just in case there was no return url set
  65                                         // and we fell through
  66                                         DI::baseUrl()->redirect();
  67                                 }
  68
  69                                 // Successful OpenID login - but we can't match it to an existing account.
  70                                 $session->remove('register');
  71                                 $session->set('openid_attributes', $openid->getAttributes());
  72                                 $session->set('openid_identity', $authId);
  73
  74                                 // Detect the server URL
  75                                 $open_id_obj = new LightOpenID(DI::baseUrl()->getHostName());
  76                                 $open_id_obj->identity = $authId;
  77                                 $session->set('openid_server', $open_id_obj->discover($open_id_obj->identity));
  78
  79                                 if (intval(DI::config()->get('config', 'register_policy')) === \Friendica\Module\Register::CLOSED) {
  80                                         notice($l10n->t('Account not found. Please login to your existing account to add the OpenID to it.'));
  81                                 } else {
  82                                         notice($l10n->t('Account not found. Please register a new account or login to your existing account to add the OpenID to it.'));
  83                                 }
  84
  85                                 DI::baseUrl()->redirect('login');
  86                         }
  87                 }
  88         }
  89 }