X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/blobdiff_plain/b07bba87bf48a5a17ce70ca3552501e8677842bf..1e75389a856c8ab8e233b81fd3310169cbe8d57e:/IkiWiki/Plugin/openid.pm diff --git a/IkiWiki/Plugin/openid.pm b/IkiWiki/Plugin/openid.pm index fcd53ee71..7e4d0844a 100644 --- a/IkiWiki/Plugin/openid.pm +++ b/IkiWiki/Plugin/openid.pm @@ -4,83 +4,127 @@ package IkiWiki::Plugin::openid; use warnings; use strict; -use IkiWiki 2.00; +use IkiWiki 3.00; -sub import { #{{{ +sub import { + add_underlay("openid-selector"); + hook(type => "checkconfig", id => "openid", call => \&checkconfig); hook(type => "getopt", id => "openid", call => \&getopt); + hook(type => "getsetup", id => "openid", call => \&getsetup); hook(type => "auth", id => "openid", call => \&auth); hook(type => "formbuilder_setup", id => "openid", call => \&formbuilder_setup, last => 1); -} # }}} +} + +sub checkconfig () { + if ($config{cgi}) { + # Intercept normal signin form, so the openid selector + # can be displayed. + # + # When other auth hooks are registered, give the selector + # a reference to the normal signin form. + require IkiWiki::CGI; + my $real_cgi_signin; + if (keys %{$IkiWiki::hooks{auth}} > 1) { + $real_cgi_signin=\&IkiWiki::cgi_signin; + } + inject(name => "IkiWiki::cgi_signin", call => sub ($$) { + openid_selector($real_cgi_signin, @_); + }); + } +} -sub getopt () { #{{{ +sub getopt () { eval q{use Getopt::Long}; error($@) if $@; Getopt::Long::Configure('pass_through'); GetOptions("openidsignup=s" => \$config{openidsignup}); -} #}}} +} -sub formbuilder_setup (@) { #{{{ - my %params=@_; +sub getsetup () { + return + plugin => { + safe => 1, + rebuild => 0, + section => "auth", + }, + openidsignup => { + type => "string", + example => "http://myopenid.com/", + description => "an url where users can signup for an OpenID", + safe => 1, + rebuild => 0, + }, +} - my $form=$params{form}; - my $session=$params{session}; - my $cgi=$params{cgi}; +sub openid_selector { + my $real_cgi_signin=shift; + my $q=shift; + my $session=shift; - if ($form->title eq "signin") { - # This avoids it displaying a redundant label for the - # OpenID fieldset. - $form->fieldsets("OpenID"); - - $form->field( - name => "openid_url", - label => gettext("Log in with")." ".htmllink("", "", "OpenID", noimageinline => 1), - fieldset => "OpenID", - size => 30, - comment => ($config{openidsignup} ? " | ".gettext("Get an OpenID")."" : "") - ); + my $openid_url=$q->param('openid_identifier'); + my $openid_error; - # Handle submission of an OpenID as validation. - if ($form->submitted && $form->submitted eq "Login" && - defined $form->field("openid_url") && - length $form->field("openid_url")) { - $form->field( - name => "openid_url", - validate => sub { - validate($cgi, $session, shift, $form); - }, - ); - # Skip all other required fields in this case. - foreach my $field ($form->field) { - next if $field eq "openid_url"; - $form->field(name => $field, required => 0, - validate => '/.*/'); - } + if (! load_openid_module()) { + if ($real_cgi_signin) { + $real_cgi_signin->($q, $session); + exit; } + error(sprintf(gettext("failed to load openid module: "), @_)); } - elsif ($form->title eq "preferences") { - if (! defined $form->field(name => "name")) { - $form->field(name => "OpenID", disabled => 1, - value => $session->param("name"), - size => 50, force => 1, - fieldset => "login"); - } + elsif (defined $q->param("action") && $q->param("action") eq "verify") { + validate($q, $session, $openid_url, sub { + $openid_error=shift; + }); + } + elsif ($q->param("do") eq "signin" && $real_cgi_signin) { + $real_cgi_signin->($q, $session); + exit; + } + + my $template=IkiWiki::template("openid-selector.tmpl"); + $template->param( + cgiurl => $config{cgiurl}, + (defined $openid_error ? (openid_error => $openid_error) : ()), + (defined $openid_url ? (openid_url => $openid_url) : ()), + ($real_cgi_signin ? (nonopenidurl => IkiWiki::cgiurl(do => "signin")) : ()), + ); + + IkiWiki::printheader($session); + print IkiWiki::misctemplate("signin", $template->output); + exit; +} + +sub formbuilder_setup (@) { + my %params=@_; + + my $form=$params{form}; + my $session=$params{session}; + my $cgi=$params{cgi}; + + if ($form->title eq "preferences" && + IkiWiki::openiduser($session->param("name"))) { + $form->field(name => "openid_identifier", disabled => 1, + label => htmllink("", "", "ikiwiki/OpenID", noimageinline => 1), + value => $session->param("name"), + size => 50, force => 1, + fieldset => "login"); + $form->field(name => "email", type => "hidden"); } } -sub validate ($$$;$) { #{{{ +sub validate ($$$;$) { my $q=shift; my $session=shift; my $openid_url=shift; - my $form=shift; + my $errhandler=shift; my $csr=getobj($q, $session); my $claimed_identity = $csr->claimed_identity($openid_url); if (! $claimed_identity) { - if ($form) { - # Put the error in the form and fail validation. - $form->field(name => "openid_url", comment => $csr->err); + if ($errhandler) { + $errhandler->($csr->err); return 0; } else { @@ -88,6 +132,28 @@ sub validate ($$$;$) { #{{{ } } + # Ask for client to provide a name and email, if possible. + # Try sreg and ax + if ($claimed_identity->can("set_extension_args")) { + $claimed_identity->set_extension_args( + 'http://openid.net/extensions/sreg/1.1', + { + optional => 'email,fullname,nickname', + }, + ); + $claimed_identity->set_extension_args( + 'http://openid.net/srv/ax/1.0', + { + mode => 'fetch_request', + 'required' => 'email,fullname,nickname,firstname', + 'type.email' => "http://schema.openid.net/contact/email", + 'type.fullname' => "http://axschema.org/namePerson", + 'type.nickname' => "http://axschema.org/namePerson/friendly", + 'type.firstname' => "http://axschema.org/namePerson/first", + }, + ); + } + my $check_url = $claimed_identity->check_url( return_to => IkiWiki::cgiurl(do => "postsignin"), trust_root => $config{cgiurl}, @@ -97,9 +163,9 @@ sub validate ($$$;$) { #{{{ # eventually bounce them back to auth() IkiWiki::redirect($q, $check_url); exit 0; -} #}}} +} -sub auth ($$) { #{{{ +sub auth ($$) { my $q=shift; my $session=shift; @@ -114,6 +180,32 @@ sub auth ($$) { #{{{ } elsif (my $vident = $csr->verified_identity) { $session->param(name => $vident->url); + + my @extensions; + if ($vident->can("signed_extension_fields")) { + @extensions=grep { defined } ( + $vident->signed_extension_fields('http://openid.net/extensions/sreg/1.1'), + $vident->signed_extension_fields('http://openid.net/srv/ax/1.0'), + ); + } + foreach my $ext (@extensions) { + foreach my $field (qw{value.email email}) { + if (exists $ext->{$field} && + defined $ext->{$field} && + length $ext->{$field}) { + $session->param(email => $ext->{$field}); + last; + } + } + foreach my $field (qw{value.nickname nickname value.fullname fullname value.firstname}) { + if (exists $ext->{$field} && + defined $ext->{$field} && + length $ext->{$field}) { + $session->param(username => $ext->{$field}); + last; + } + } + } } else { error("OpenID failure: ".$csr->err); @@ -123,9 +215,9 @@ sub auth ($$) { #{{{ # myopenid.com affiliate support validate($q, $session, $q->param('openid_identifier')); } -} #}}} +} -sub getobj ($$) { #{{{ +sub getobj ($$) { my $q=shift; my $session=shift; @@ -154,6 +246,16 @@ sub getobj ($$) { #{{{ consumer_secret => sub { return shift()+$secret }, required_root => $config{cgiurl}, ); -} #}}} +} + +sub load_openid_module { + # Give up if module is unavailable to avoid needing to depend on it. + eval q{use Net::OpenID::Consumer}; + if ($@) { + debug("unable to load Net::OpenID::Consumer, not enabling OpenID login ($@)"); + return; + } + return 1; +} 1