Gentics Portal.Node PHP API
 All Classes Namespaces Functions Variables Pages
Public Member Functions | Public Attributes | Protected Member Functions | Protected Attributes | Static Protected Attributes | List of all members
LightOpenID Class Reference

Public Member Functions

 __set ($name, $value)
 __get ($name)
 hostExists ($url)
 discover ($url)
 authUrl ($identifier_select=null)
 validate ()
 getAttributes ()

Public Attributes

 $returnUrl
 $required = array()
 $optional = array()
 $verify_peer = null
 $capath = null
 $cainfo = null
 $claimed_id
 $version
 $trustRoot
 $aliases
 $identifier_select = false
 $ax = false
 $sreg = false
 $data

Protected Member Functions

 request_curl ($url, $method='GET', $params=array())
 request_streams ($url, $method='GET', $params=array())
 request ($url, $method='GET', $params=array())
 build_url ($url, $parts)
 htmlTag ($content, $tag, $attrName, $attrValue, $valueName)
 sregParams ()
 axParams ()
 authUrl_v1 ()
 authUrl_v2 ($identifier_select)
 getAxAttributes ()
 getSregAttributes ()

Protected Attributes

 $server

Static Protected Attributes

static $ax_to_sreg

Detailed Description

This class provides a simple interface for OpenID (1.1 and 2.0) authentication. Supports Yadis discovery. The authentication process is stateless/dumb.

Usage: Sign-on with OpenID is a two step process: Step one is authentication with the provider: $openid = new LightOpenID; $openid->identity = 'ID supplied by user'; header('Location: ' . $openid->authUrl()); The provider then sends various parameters via GET, one of them is openid_mode. Step two is verification: if ($this->data['openid_mode']) { $openid = new LightOpenID; echo $openid->validate() ? 'Logged in.' : 'Failed'; }

Optionally, you can set $returnUrl and $realm (or $trustRoot, which is an alias). The default values for those are: $openid->realm = (!empty($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST']; $openid->returnUrl = $openid->realm . $_SERVER['REQUEST_URI']; If you don't know their meaning, refer to any openid tutorial, or specification. Or just guess.

AX and SREG extensions are supported. To use them, specify $openid->required and/or $openid->optional before calling $openid->authUrl(). These are arrays, with values being AX schema paths (the 'path' part of the URL). For example: $openid->required = array('namePerson/friendly', 'contact/email'); $openid->optional = array('namePerson/first'); If the server supports only SREG or OpenID 1.1, these are automaticaly mapped to SREG names, so that user doesn't have to know anything about the server.

To get the values, use $openid->getAttributes().

The library requires PHP >= 5.1.2 with curl or http/https stream wrappers enabled.

Author
Mewp

Definition at line 47 of file LightOpenID.php.

Member Function Documentation

LightOpenID::authUrl (   $identifier_select = null)

Returns authentication url. Usually, you want to redirect your user to it.

Returns
String The authentication url.
Parameters
String$select_identifierWhether to request OP to select identity for an user in OpenID 2. Does not affect OpenID 1.
Exceptions
ErrorException

Definition at line 588 of file LightOpenID.php.

References discover().

{
if (!$this->server) $this->discover($this->identity);
if ($this->version == 2) {
if ($identifier_select === null) {
return $this->authUrl_v2($this->identifier_select);
}
return $this->authUrl_v2($identifier_select);
}
return $this->authUrl_v1();
}
LightOpenID::discover (   $url)

Performs Yadis and HTML discovery. Normally not used.

Parameters
$urlIdentity URL.
Returns
String OP Endpoint (i.e. OpenID provider address).
Exceptions
ErrorException

Definition at line 330 of file LightOpenID.php.

References htmlTag().

Referenced by authUrl(), and validate().

{
if (!$url) throw new ErrorException('No identity supplied.');
# Use xri.net proxy to resolve i-name identities
if (!preg_match('#^https?:#', $url)) {
$url = "https://xri.net/$url";
}
# We save the original url in case of Yadis discovery failure.
# It can happen when we'll be lead to an XRDS document
# which does not have any OpenID2 services.
$originalUrl = $url;
# A flag to disable yadis discovery in case of failure in headers.
$yadis = true;
# We'll jump a maximum of 5 times, to avoid endless redirections.
for ($i = 0; $i < 5; $i ++) {
if ($yadis) {
$headers = $this->request($url, 'HEAD');
$next = false;
if (isset($headers['x-xrds-location'])) {
$url = $this->build_url(parse_url($url), parse_url(trim($headers['x-xrds-location'])));
$next = true;
}
if (isset($headers['content-type'])
&& (strpos($headers['content-type'], 'application/xrds+xml') !== false
|| strpos($headers['content-type'], 'text/xml') !== false)
) {
# Apparently, some providers return XRDS documents as text/html.
# While it is against the spec, allowing this here shouldn't break
# compatibility with anything.
# ---
# Found an XRDS document, now let's find the server, and optionally delegate.
$content = $this->request($url, 'GET');
preg_match_all('#<Service.*?>(.*?)</Service>#s', $content, $m);
foreach($m[1] as $content) {
$content = ' ' . $content; # The space is added, so that strpos doesn't return 0.
# OpenID 2
$ns = preg_quote('http://specs.openid.net/auth/2.0/');
if(preg_match('#<Type>\s*'.$ns.'(server|signon)\s*</Type>#s', $content, $type)) {
if ($type[1] == 'server') $this->identifier_select = true;
preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
preg_match('#<(Local|Canonical)ID>(.*)</\1ID>#', $content, $delegate);
if (empty($server)) {
return false;
}
# Does the server advertise support for either AX or SREG?
$this->ax = (bool) strpos($content, '<Type>http://openid.net/srv/ax/1.0</Type>');
$this->sreg = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
|| strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');
$server = $server[1];
if (isset($delegate[2])) $this->identity = trim($delegate[2]);
$this->version = 2;
$this->server = $server;
return $server;
}
# OpenID 1.1
$ns = preg_quote('http://openid.net/signon/1.1');
if (preg_match('#<Type>\s*'.$ns.'\s*</Type>#s', $content)) {
preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
preg_match('#<.*?Delegate>(.*)</.*?Delegate>#', $content, $delegate);
if (empty($server)) {
return false;
}
# AX can be used only with OpenID 2.0, so checking only SREG
$this->sreg = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
|| strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');
$server = $server[1];
if (isset($delegate[1])) $this->identity = $delegate[1];
$this->version = 1;
$this->server = $server;
return $server;
}
}
$next = true;
$yadis = false;
$url = $originalUrl;
$content = null;
break;
}
if ($next) continue;
# There are no relevant information in headers, so we search the body.
$content = $this->request($url, 'GET');
$location = $this->htmlTag($content, 'meta', 'http-equiv', 'X-XRDS-Location', 'content');
if ($location) {
$url = $this->build_url(parse_url($url), parse_url($location));
continue;
}
}
if (!$content) $content = $this->request($url, 'GET');
# At this point, the YADIS Discovery has failed, so we'll switch
# to openid2 HTML discovery, then fallback to openid 1.1 discovery.
$server = $this->htmlTag($content, 'link', 'rel', 'openid2.provider', 'href');
$delegate = $this->htmlTag($content, 'link', 'rel', 'openid2.local_id', 'href');
$this->version = 2;
if (!$server) {
# The same with openid 1.1
$server = $this->htmlTag($content, 'link', 'rel', 'openid.server', 'href');
$delegate = $this->htmlTag($content, 'link', 'rel', 'openid.delegate', 'href');
$this->version = 1;
}
if ($server) {
# We found an OpenID2 OP Endpoint
if ($delegate) {
# We have also found an OP-Local ID.
$this->identity = $delegate;
}
$this->server = $server;
return $server;
}
throw new ErrorException('No servers found!');
}
throw new ErrorException('Endless redirection!');
}
LightOpenID::getAttributes ( )

Gets AX/SREG attributes provided by OP. should be used only after successful validaton. Note that it does not guarantee that any of the required/optional parameters will be present, or that there will be no other attributes besides those specified. In other words. OP may provide whatever information it wants to.

  • SREG names will be mapped to AX names.
  • Returns
    Array Array of attributes with keys being the AX schema names, e.g. 'contact/email'
    See Also
    http://www.axschema.org/types/

Definition at line 729 of file LightOpenID.php.

{
if (isset($this->data['openid_ns'])
&& $this->data['openid_ns'] == 'http://specs.openid.net/auth/2.0'
) { # OpenID 2.0
# We search for both AX and SREG attributes, with AX taking precedence.
return $this->getAxAttributes() + $this->getSregAttributes();
}
return $this->getSregAttributes();
}
LightOpenID::hostExists (   $url)

Checks if the server specified in the url exists.

Parameters
$urlurl to check
Returns
true, if the server exists; false otherwise

Definition at line 123 of file LightOpenID.php.

{
if (strpos($url, '/') === false) {
$server = $url;
} else {
$server = @parse_url($url, PHP_URL_HOST);
}
if (!$server) {
return false;
}
return !!gethostbynamel($server);
}
LightOpenID::htmlTag (   $content,
  $tag,
  $attrName,
  $attrValue,
  $valueName 
)
protected

Helper function used to scan for <meta>/<link> tags and extract information from them

Definition at line 315 of file LightOpenID.php.

Referenced by discover().

{
preg_match_all("#<{$tag}[^>]*$attrName=['\"].*?$attrValue.*?['\"][^>]*$valueName=['\"](.+?)['\"][^>]*/?>#i", $content, $matches1);
preg_match_all("#<{$tag}[^>]*$valueName=['\"](.+?)['\"][^>]*$attrName=['\"].*?$attrValue.*?['\"][^>]*/?>#i", $content, $matches2);
$result = array_merge($matches1[1], $matches2[1]);
return empty($result)?false:$result[0];
}
LightOpenID::validate ( )

Performs OpenID verification with the OP.

Returns
Bool Whether the verification was successful.
Exceptions
ErrorException

Definition at line 606 of file LightOpenID.php.

References discover().

{
$this->claimed_id = isset($this->data['openid_claimed_id'])?$this->data['openid_claimed_id']:$this->data['openid_identity'];
$params = array(
'openid.assoc_handle' => $this->data['openid_assoc_handle'],
'openid.signed' => $this->data['openid_signed'],
'openid.sig' => $this->data['openid_sig'],
);
if (isset($this->data['openid_ns'])) {
# We're dealing with an OpenID 2.0 server, so let's set an ns
# Even though we should know location of the endpoint,
# we still need to verify it by discovery, so $server is not set here
$params['openid.ns'] = 'http://specs.openid.net/auth/2.0';
} elseif (isset($this->data['openid_claimed_id'])
&& $this->data['openid_claimed_id'] != $this->data['openid_identity']
) {
# If it's an OpenID 1 provider, and we've got claimed_id,
# we have to append it to the returnUrl, like authUrl_v1 does.
$this->returnUrl .= (strpos($this->returnUrl, '?') ? '&' : '?')
. 'openid.claimed_id=' . $this->claimed_id;
}
if ($this->data['openid_return_to'] != $this->returnUrl) {
# The return_to url must match the url of current request.
# I'm assuing that noone will set the returnUrl to something that doesn't make sense.
return false;
}
$server = $this->discover($this->claimed_id);
foreach (explode(',', $this->data['openid_signed']) as $item) {
# Checking whether magic_quotes_gpc is turned on, because
# the function may fail if it is. For example, when fetching
# AX namePerson, it might containg an apostrophe, which will be escaped.
# In such case, validation would fail, since we'd send different data than OP
# wants to verify. stripslashes() should solve that problem, but we can't
# use it when magic_quotes is off.
$value = $this->data['openid_' . str_replace('.','_',$item)];
$params['openid.' . $item] = get_magic_quotes_gpc() ? stripslashes($value) : $value;
}
$params['openid.mode'] = 'check_authentication';
$response = $this->request($server, 'POST', $params);
return preg_match('/is_valid\s*:\s*true/i', $response);
}

Member Data Documentation

LightOpenID::$ax_to_sreg
staticprotected
Initial value:
array(
'namePerson/friendly' => 'nickname',
'contact/email' => 'email',
'namePerson' => 'fullname',
'birthDate' => 'dob',
'person/gender' => 'gender',
'contact/postalCode/home' => 'postcode',
'contact/country/home' => 'country',
'pref/language' => 'language',
'pref/timezone' => 'timezone',
)

Definition at line 58 of file LightOpenID.php.


The documentation for this class was generated from the following file: