Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Fetching contributors…

Cannot retrieve contributors at this time

726 lines (651 sloc) 29.698 kb
<?php
/**
* This class provides a simple interface for OpenID (1.1 and 2.0) authentication.
* Supports Yadis discovery.
* The authentication process is stateless/dumb.
*
* Usage:
* Sign-on with OpenID is a two step process:
* Step one is authentication with the provider:
* <code>
* $openid = new LightOpenID;
* $openid->identity = 'ID supplied by user';
* header('Location: ' . $openid->authUrl());
* </code>
* The provider then sends various parameters via GET, one of them is openid_mode.
* Step two is verification:
* <code>
* if ($this->data['openid_mode']) {
* $openid = new LightOpenID;
* echo $openid->validate() ? 'Logged in.' : 'Failed';
* }
* </code>
*
* Optionally, you can set $returnUrl and $realm (or $trustRoot, which is an alias).
* The default values for those are:
* $openid->realm = (!empty($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
* $openid->returnUrl = $openid->realm . $_SERVER['REQUEST_URI']; # without the query part, if present
* If you don't know their meaning, refer to any openid tutorial, or specification. Or just guess.
*
* AX and SREG extensions are supported.
* To use them, specify $openid->required and/or $openid->optional before calling $openid->authUrl().
* These are arrays, with values being AX schema paths (the 'path' part of the URL).
* For example:
* $openid->required = array('namePerson/friendly', 'contact/email');
* $openid->optional = array('namePerson/first');
* If the server supports only SREG or OpenID 1.1, these are automaticaly
* mapped to SREG names, so that user doesn't have to know anything about the server.
*
* To get the values, use $openid->getAttributes().
*
*
* The library requires PHP >= 5.1.2 with curl or http/https stream wrappers enabled..
* @author Mewp
* @copyright Copyright (c) 2010, Mewp
* @license http://www.opensource.org/licenses/mit-license.php MIT
*/
class LightOpenID
{
public $returnUrl
, $required = array()
, $optional = array()
, $verify_perr = null
, $capath = null;
private $identity, $claimed_id;
protected $server, $version, $trustRoot, $aliases, $identifier_select = false
, $ax = false, $sreg = false, $data;
static protected $ax_to_sreg = array(
'namePerson/friendly' => 'nickname',
'contact/email' => 'email',
'namePerson' => 'fullname',
'birthDate' => 'dob',
'person/gender' => 'gender',
'contact/postalCode/home' => 'postcode',
'contact/country/home' => 'country',
'pref/language' => 'language',
'pref/timezone' => 'timezone',
);
function __construct()
{
$this->trustRoot = (!empty($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
$uri = $_SERVER['REQUEST_URI'];
$uri = strpos($uri, '?') ? substr($uri, 0, strpos($uri, '?')) : $uri;
$this->returnUrl = $this->trustRoot . $uri;
$this->data = $_POST + $_GET; # OPs may send data as POST or GET.
}
function __set($name, $value)
{
switch ($name) {
case 'identity':
if (strlen($value = trim((String) $value))) {
if (preg_match('#^xri:/*#i', $value, $m)) {
$value = substr($value, strlen($m[0]));
} elseif (!preg_match('/^(?:[=@+\$!\(]|https?:)/i', $value)) {
$value = "http://$value";
}
if (preg_match('#^https?://[^/]+$#i', $value, $m)) {
$value .= '/';
}
}
$this->$name = $this->claimed_id = $value;
break;
case 'trustRoot':
case 'realm':
$this->trustRoot = trim($value);
}
}
function __get($name)
{
switch ($name) {
case 'identity':
# We return claimed_id instead of identity,
# because the developer should see the claimed identifier,
# i.e. what he set as identity, not the op-local identifier (which is what we verify)
return $this->claimed_id;
case 'trustRoot':
case 'realm':
return $this->trustRoot;
}
}
/**
* Checks if the server specified in the url exists.
*
* @param $url url to check
* @return true, if the server exists; false otherwise
*/
function hostExists($url)
{
if (strpos($url, '/') === false) {
$server = $url;
} else {
$server = @parse_url($url, PHP_URL_HOST);
}
if (!$server) {
return false;
}
return !!gethostbynamel($server);
}
protected function request_curl($url, $method='GET', $params=array())
{
$params = http_build_query($params, '', '&');
$curl = curl_init($url . ($method == 'GET' && $params ? '?' . $params : ''));
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_HEADER, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_HTTPHEADER, array('Accept: application/xrds+xml, */*'));
if($this->verify_perr !== null) {
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, $this->verify_peer);
if($this->capath) {
curl_setopt($curl, CURLOPT_CAPATH, $this->capath);
}
}
if ($method == 'POST') {
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, $params);
} elseif ($method == 'HEAD') {
curl_setopt($curl, CURLOPT_HEADER, true);
curl_setopt($curl, CURLOPT_NOBODY, true);
} else {
curl_setopt($curl, CURLOPT_HTTPGET, true);
}
$response = curl_exec($curl);
if($method == 'HEAD') {
$headers = array();
foreach(explode("\n", $response) as $header) {
$pos = strpos($header,':');
$name = strtolower(trim(substr($header, 0, $pos)));
$headers[$name] = trim(substr($header, $pos+1));
}
# Updating claimed_id in case of redirections.
$effective_url = curl_getinfo($curl, CURLINFO_EFFECTIVE_URL);
if($effective_url != $url) {
$this->identity = $this->claimed_id = $effective_url;
}
return $headers;
}
if (curl_errno($curl)) {
throw new ErrorException(curl_error($curl), curl_errno($curl));
}
return $response;
}
protected function request_streams($url, $method='GET', $params=array())
{
if(!$this->hostExists($url)) {
throw new ErrorException('Invalid request.');
}
$params = http_build_query($params, '', '&');
switch($method) {
case 'GET':
$opts = array(
'http' => array(
'method' => 'GET',
'header' => 'Accept: application/xrds+xml, */*',
'ignore_errors' => true,
)
);
$url = $url . ($params ? '?' . $params : '');
break;
case 'POST':
$opts = array(
'http' => array(
'method' => 'POST',
'header' => 'Content-type: application/x-www-form-urlencoded',
'content' => $params,
'ignore_errors' => true,
)
);
break;
case 'HEAD':
# We want to send a HEAD request,
# but since get_headers doesn't accept $context parameter,
# we have to change the defaults.
$default = stream_context_get_options(stream_context_get_default());
stream_context_get_default(
array('http' => array(
'method' => 'HEAD',
'header' => 'Accept: application/xrds+xml, */*',
'ignore_errors' => true,
))
);
$url = $url . ($params ? '?' . $params : '');
$headers_tmp = get_headers ($url);
if(!$headers_tmp) {
return array();
}
# Parsing headers.
$headers = array();
foreach($headers_tmp as $header) {
$pos = strpos($header,':');
$name = strtolower(trim(substr($header, 0, $pos)));
$headers[$name] = trim(substr($header, $pos+1));
# Following possible redirections. The point is just to have
# claimed_id change with them, because get_headers() will
# follow redirections automatically.
# We ignore redirections with relative paths.
# If any known provider uses them, file a bug report.
if($name == 'location') {
if(strpos($headers[$name], 'http') === 0) {
$this->identity = $this->claimed_id = $headers[$name];
} elseif($headers[$name][0] == '/') {
$parsed_url = parse_url($this->claimed_id);
$this->identity =
$this->claimed_id = $parsed_url['scheme'] . '://'
. $parsed_url['host']
. $headers[$name];
}
}
}
# And restore them.
stream_context_get_default($default);
return $headers;
}
if($this->verify_peer) {
$opts += array('ssl' => array(
'verify_peer' => true,
'capath' => $this->capath,
));
}
$context = stream_context_create ($opts);
return file_get_contents($url, false, $context);
}
protected function request($url, $method='GET', $params=array())
{
if(function_exists('curl_init') && !ini_get('safe_mode') && (! strlen(ini_get('open_basedir')))) {
return $this->request_curl($url, $method, $params);
}
return $this->request_streams($url, $method, $params);
}
protected function build_url($url, $parts)
{
if (isset($url['query'], $parts['query'])) {
$parts['query'] = $url['query'] . '&' . $parts['query'];
}
$url = $parts + $url;
$url = $url['scheme'] . '://'
. (empty($url['username'])?''
:(empty($url['password'])? "{$url['username']}@"
:"{$url['username']}:{$url['password']}@"))
. $url['host']
. (empty($url['port'])?'':":{$url['port']}")
. (empty($url['path'])?'':$url['path'])
. (empty($url['query'])?'':"?{$url['query']}")
. (empty($url['fragment'])?'':":{$url['fragment']}");
return $url;
}
/**
* Helper function used to scan for <meta>/<link> tags and extract information
* from them
*/
protected function htmlTag($content, $tag, $attrName, $attrValue, $valueName)
{
preg_match_all("#<{$tag}[^>]*$attrName=['\"].*?$attrValue.*?['\"][^>]*$valueName=['\"](.+?)['\"][^>]*/?>#i", $content, $matches1);
preg_match_all("#<{$tag}[^>]*$valueName=['\"](.+?)['\"][^>]*$attrName=['\"].*?$attrValue.*?['\"][^>]*/?>#i", $content, $matches2);
$result = array_merge($matches1[1], $matches2[1]);
return empty($result)?false:$result[0];
}
/**
* Performs Yadis and HTML discovery. Normally not used.
* @param $url Identity URL.
* @return String OP Endpoint (i.e. OpenID provider address).
* @throws ErrorException
*/
function discover($url)
{
if (!$url) throw new ErrorException('No identity supplied.');
# Use xri.net proxy to resolve i-name identities
if (!preg_match('#^https?:#', $url)) {
$url = "https://xri.net/$url";
}
# We save the original url in case of Yadis discovery failure.
# It can happen when we'll be lead to an XRDS document
# which does not have any OpenID2 services.
$originalUrl = $url;
# A flag to disable yadis discovery in case of failure in headers.
$yadis = true;
# We'll jump a maximum of 5 times, to avoid endless redirections.
for ($i = 0; $i < 5; $i ++) {
if ($yadis) {
$headers = $this->request($url, 'HEAD');
$next = false;
if (isset($headers['x-xrds-location'])) {
$url = $this->build_url(parse_url($url), parse_url(trim($headers['x-xrds-location'])));
$next = true;
}
if (isset($headers['content-type'])
&& ((strpos($headers['content-type'], 'application/xrds+xml') !== false
) || (strpos($headers['content-type'], 'text/xml') !== false))) {
# Found an XRDS document, now let's find the server, and optionally delegate.
$content = $this->request($url, 'GET');
preg_match_all('#<Service.*?>(.*?)</Service>#s', $content, $m);
foreach($m[1] as $content) {
$content = ' ' . $content; # The space is added, so that strpos doesn't return 0.
# OpenID 2
$ns = preg_quote('http://specs.openid.net/auth/2.0/');
if(preg_match('#<Type>\s*'.$ns.'(server|signon)\s*</Type>#s', $content, $type)) {
if ($type[1] == 'server') $this->identifier_select = true;
preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
preg_match('#<(Local|Canonical)ID>(.*)</\1ID>#', $content, $delegate);
if (empty($server)) {
return false;
}
# Does the server advertise support for either AX or SREG?
$this->ax = (bool) strpos($content, '<Type>http://openid.net/srv/ax/1.0</Type>');
$this->sreg = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
|| strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');
$server = $server[1];
if (isset($delegate[2])) $this->identity = trim($delegate[2]);
$this->version = 2;
logger('Server: ' . $server);
$this->server = $server;
return $server;
}
# OpenID 1.1
$ns = preg_quote('http://openid.net/signon/1.1');
if (preg_match('#<Type>\s*'.$ns.'\s*</Type>#s', $content)) {
preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
preg_match('#<.*?Delegate>(.*)</.*?Delegate>#', $content, $delegate);
if (empty($server)) {
return false;
}
# AX can be used only with OpenID 2.0, so checking only SREG
$this->sreg = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
|| strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');
$server = $server[1];
if (isset($delegate[1])) $this->identity = $delegate[1];
$this->version = 1;
$this->server = $server;
return $server;
}
}
$next = true;
$yadis = false;
$url = $originalUrl;
$content = null;
break;
}
if ($next) continue;
# There are no relevant information in headers, so we search the body.
$content = $this->request($url, 'GET');
if ($location = $this->htmlTag($content, 'meta', 'http-equiv', 'X-XRDS-Location', 'content')) {
$url = $this->build_url(parse_url($url), parse_url($location));
continue;
}
}
if (!$content) $content = $this->request($url, 'GET');
logger('openid' . $content);
# At this point, the YADIS Discovery has failed, so we'll switch
# to openid2 HTML discovery, then fallback to openid 1.1 discovery.
$server = $this->htmlTag($content, 'link', 'rel', 'openid2.provider', 'href');
$delegate = $this->htmlTag($content, 'link', 'rel', 'openid2.local_id', 'href');
$this->version = 2;
if (!$server) {
# The same with openid 1.1
$server = $this->htmlTag($content, 'link', 'rel', 'openid.server', 'href');
$delegate = $this->htmlTag($content, 'link', 'rel', 'openid.delegate', 'href');
$this->version = 1;
}
if ($server) {
# We found an OpenID2 OP Endpoint
if ($delegate) {
# We have also found an OP-Local ID.
$this->identity = $delegate;
}
$this->server = $server;
return $server;
}
throw new ErrorException('No servers found!');
}
throw new ErrorException('Endless redirection!');
}
protected function sregParams()
{
$params = array();
# We always use SREG 1.1, even if the server is advertising only support for 1.0.
# That's because it's fully backwards compatibile with 1.0, and some providers
# advertise 1.0 even if they accept only 1.1. One such provider is myopenid.com
$params['openid.ns.sreg'] = 'http://openid.net/extensions/sreg/1.1';
if ($this->required) {
$params['openid.sreg.required'] = array();
foreach ($this->required as $required) {
if (!isset(self::$ax_to_sreg[$required])) continue;
$params['openid.sreg.required'][] = self::$ax_to_sreg[$required];
}
$params['openid.sreg.required'] = implode(',', $params['openid.sreg.required']);
}
if ($this->optional) {
$params['openid.sreg.optional'] = array();
foreach ($this->optional as $optional) {
if (!isset(self::$ax_to_sreg[$optional])) continue;
$params['openid.sreg.optional'][] = self::$ax_to_sreg[$optional];
}
$params['openid.sreg.optional'] = implode(',', $params['openid.sreg.optional']);
}
return $params;
}
protected function axParams()
{
$params = array();
if ($this->required || $this->optional) {
$params['openid.ns.ax'] = 'http://openid.net/srv/ax/1.0';
$params['openid.ax.mode'] = 'fetch_request';
$this->aliases = array();
$counts = array();
$required = array();
$optional = array();
foreach (array('required','optional') as $type) {
foreach ($this->$type as $alias => $field) {
if (is_int($alias)) $alias = strtr($field, '/', '_');
$this->aliases[$alias] = 'http://axschema.org/' . $field;
if (empty($counts[$alias])) $counts[$alias] = 0;
$counts[$alias] += 1;
${$type}[] = $alias;
}
}
foreach ($this->aliases as $alias => $ns) {
$params['openid.ax.type.' . $alias] = $ns;
}
foreach ($counts as $alias => $count) {
if ($count == 1) continue;
$params['openid.ax.count.' . $alias] = $count;
}
# Don't send empty ax.requied and ax.if_available.
# Google and possibly other providers refuse to support ax when one of these is empty.
if($required) {
$params['openid.ax.required'] = implode(',', $required);
}
if($optional) {
$params['openid.ax.if_available'] = implode(',', $optional);
}
}
return $params;
}
protected function authUrl_v1()
{
$returnUrl = $this->returnUrl;
# If we have an openid.delegate that is different from our claimed id,
# we need to somehow preserve the claimed id between requests.
# The simplest way is to just send it along with the return_to url.
if($this->identity != $this->claimed_id) {
$returnUrl .= (strpos($returnUrl, '?') ? '&' : '?') . 'openid.claimed_id=' . $this->claimed_id;
}
$params = array(
'openid.return_to' => $returnUrl,
'openid.mode' => 'checkid_setup',
'openid.identity' => $this->identity,
'openid.trust_root' => $this->trustRoot,
) + $this->sregParams();
return $this->build_url(parse_url($this->server)
, array('query' => http_build_query($params, '', '&')));
}
protected function authUrl_v2($identifier_select)
{
$params = array(
'openid.ns' => 'http://specs.openid.net/auth/2.0',
'openid.mode' => 'checkid_setup',
'openid.return_to' => $this->returnUrl,
'openid.realm' => $this->trustRoot,
);
if ($this->ax) {
$params += $this->axParams();
}
if ($this->sreg) {
$params += $this->sregParams();
}
if (!$this->ax && !$this->sreg) {
# If OP doesn't advertise either SREG, nor AX, let's send them both
# in worst case we don't get anything in return.
$params += $this->axParams() + $this->sregParams();
}
if ($identifier_select) {
$params['openid.identity'] = $params['openid.claimed_id']
= 'http://specs.openid.net/auth/2.0/identifier_select';
} else {
$params['openid.identity'] = $this->identity;
$params['openid.claimed_id'] = $this->claimed_id;
}
return $this->build_url(parse_url($this->server)
, array('query' => http_build_query($params, '', '&')));
}
/**
* Returns authentication url. Usually, you want to redirect your user to it.
* @return String The authentication url.
* @param String $select_identifier Whether to request OP to select identity for an user in OpenID 2. Does not affect OpenID 1.
* @throws ErrorException
*/
function authUrl($identifier_select = null)
{
if (!$this->server) $this->discover($this->identity);
if ($this->version == 2) {
if ($identifier_select === null) {
return $this->authUrl_v2($this->identifier_select);
}
return $this->authUrl_v2($identifier_select);
}
return $this->authUrl_v1();
}
/**
* Performs OpenID verification with the OP.
* @return Bool Whether the verification was successful.
* @throws ErrorException
*/
function validate()
{
$this->claimed_id = isset($this->data['openid_claimed_id'])?$this->data['openid_claimed_id']:$this->data['openid_identity'];
$params = array(
'openid.assoc_handle' => $this->data['openid_assoc_handle'],
'openid.signed' => $this->data['openid_signed'],
'openid.sig' => $this->data['openid_sig'],
);
if (isset($this->data['openid_ns'])) {
# We're dealing with an OpenID 2.0 server, so let's set an ns
# Even though we should know location of the endpoint,
# we still need to verify it by discovery, so $server is not set here
$params['openid.ns'] = 'http://specs.openid.net/auth/2.0';
} elseif(isset($this->data['openid_claimed_id'])) {
# If it's an OpenID 1 provider, and we've got claimed_id,
# we have to append it to the returnUrl, like authUrl_v1 does.
$this->returnUrl .= (strpos($this->returnUrl, '?') ? '&' : '?')
. 'openid.claimed_id=' . $this->claimed_id;
}
if ($this->data['openid_return_to'] != $this->returnUrl) {
# The return_to url must match the url of current request.
# I'm assuing that noone will set the returnUrl to something that doesn't make sense.
return false;
}
$server = $this->discover($this->claimed_id);
foreach (explode(',', $this->data['openid_signed']) as $item) {
# Checking whether magic_quotes_gpc is turned on, because
# the function may fail if it is. For example, when fetching
# AX namePerson, it might containg an apostrophe, which will be escaped.
# In such case, validation would fail, since we'd send different data than OP
# wants to verify. stripslashes() should solve that problem, but we can't
# use it when magic_quotes is off.
$value = $this->data['openid_' . str_replace('.','_',$item)];
$params['openid.' . $item] = get_magic_quotes_gpc() ? stripslashes($value) : $value;
}
$params['openid.mode'] = 'check_authentication';
$response = $this->request($server, 'POST', $params);
return preg_match('/is_valid\s*:\s*true/i', $response);
}
protected function getAxAttributes()
{
$alias = null;
if (isset($this->data['openid_ns_ax'])
&& $this->data['openid_ns_ax'] != 'http://openid.net/srv/ax/1.0'
) { # It's the most likely case, so we'll check it before
$alias = 'ax';
} else {
# 'ax' prefix is either undefined, or points to another extension,
# so we search for another prefix
foreach ($this->data as $key => $val) {
if (substr($key, 0, strlen('openid_ns_')) == 'openid_ns_'
&& $val == 'http://openid.net/srv/ax/1.0'
) {
$alias = substr($key, strlen('openid_ns_'));
break;
}
}
}
if (!$alias) {
# An alias for AX schema has not been found,
# so there is no AX data in the OP's response
return array();
}
$attributes = array();
foreach ($this->data as $key => $value) {
$keyMatch = 'openid_' . $alias . '_value_';
if (substr($key, 0, strlen($keyMatch)) != $keyMatch) {
continue;
}
$key = substr($key, strlen($keyMatch));
if (!isset($this->data['openid_' . $alias . '_type_' . $key])) {
# OP is breaking the spec by returning a field without
# associated ns. This shouldn't happen, but it's better
# to check, than cause an E_NOTICE.
continue;
}
$key = substr($this->data['openid_' . $alias . '_type_' . $key],
strlen('http://axschema.org/'));
$attributes[$key] = $value;
}
return $attributes;
}
protected function getSregAttributes()
{
$attributes = array();
$sreg_to_ax = array_flip(self::$ax_to_sreg);
foreach ($this->data as $key => $value) {
$keyMatch = 'openid_sreg_';
if (substr($key, 0, strlen($keyMatch)) != $keyMatch) {
continue;
}
$key = substr($key, strlen($keyMatch));
if (!isset($sreg_to_ax[$key])) {
# The field name isn't part of the SREG spec, so we ignore it.
continue;
}
$attributes[$sreg_to_ax[$key]] = $value;
}
return $attributes;
}
/**
* Gets AX/SREG attributes provided by OP. should be used only after successful validaton.
* Note that it does not guarantee that any of the required/optional parameters will be present,
* or that there will be no other attributes besides those specified.
* In other words. OP may provide whatever information it wants to.
* * SREG names will be mapped to AX names.
* * @return Array Array of attributes with keys being the AX schema names, e.g. 'contact/email'
* @see http://www.axschema.org/types/
*/
function getAttributes()
{
if (isset($this->data['openid_ns'])
&& $this->data['openid_ns'] == 'http://specs.openid.net/auth/2.0'
) { # OpenID 2.0
# We search for both AX and SREG attributes, with AX taking precedence.
return $this->getAxAttributes() + $this->getSregAttributes();
}
return $this->getSregAttributes();
}
}
Jump to Line
Something went wrong with that request. Please try again.