<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">#!/usr/bin/perl
# OpenID support.
package IkiWiki::Plugin::openid;

use warnings;
use strict;
use IkiWiki 3.00;

sub import {
	add_underlay("openid-selector");
	add_underlay("jquery");
	hook(type =&gt; "checkconfig", id =&gt; "openid", call =&gt; \&amp;checkconfig);
	hook(type =&gt; "getsetup", id =&gt; "openid", call =&gt; \&amp;getsetup);
	hook(type =&gt; "auth", id =&gt; "openid", call =&gt; \&amp;auth);
	hook(type =&gt; "formbuilder_setup", id =&gt; "openid",
		call =&gt; \&amp;formbuilder_setup, last =&gt; 1);
}

sub checkconfig () {
	if ($config{cgi}) {
		# Intercept normal signin form, so the openid selector
		# can be displayed.
		# 
		# When other auth hooks are registered, give the selector
		# a reference to the normal signin form.
		require IkiWiki::CGI;
		my $real_cgi_signin;
		if (keys %{$IkiWiki::hooks{auth}} &gt; 1) {
			$real_cgi_signin=\&amp;IkiWiki::cgi_signin;
		}
		inject(name =&gt; "IkiWiki::cgi_signin", call =&gt; sub ($$) {
			openid_selector($real_cgi_signin, @_);
		});
	}
}

sub getsetup () {
	return
		plugin =&gt; {
			safe =&gt; 1,
			rebuild =&gt; 0,
			section =&gt; "auth",
		},
		openid_realm =&gt; {
			type =&gt; "string",
			description =&gt; "url pattern of openid realm (default is cgiurl)",
			safe =&gt; 0,
			rebuild =&gt; 0,
		},
		openid_cgiurl =&gt; {
			type =&gt; "string",
			description =&gt; "url to ikiwiki cgi to use for openid authentication (default is cgiurl)",
			safe =&gt; 0,
			rebuild =&gt; 0,
		},
}

sub openid_selector {
	my $real_cgi_signin=shift;
        my $q=shift;
        my $session=shift;

	my $openid_url=$q-&gt;param('openid_identifier');
	my $openid_error;

	if (! load_openid_module()) {
		if ($real_cgi_signin) {
			$real_cgi_signin-&gt;($q, $session);
			exit;
		}
		error(sprintf(gettext("failed to load openid module: "), @_));
	}
	elsif (defined $q-&gt;param("action") &amp;&amp; $q-&gt;param("action") eq "verify") {
		validate($q, $session, $openid_url, sub {
			$openid_error=shift;
		});
	}

	my $template=IkiWiki::template("openid-selector.tmpl");
	$template-&gt;param(
		cgiurl =&gt; IkiWiki::cgiurl(),
		(defined $openid_error ? (openid_error =&gt; $openid_error) : ()),
		(defined $openid_url ? (openid_url =&gt; $openid_url) : ()),
		($real_cgi_signin ? (nonopenidform =&gt; $real_cgi_signin-&gt;($q, $session, 1)) : ()),
	);

	IkiWiki::printheader($session);
	print IkiWiki::cgitemplate($q, "signin", $template-&gt;output);
	exit;
}

sub formbuilder_setup (@) {
	my %params=@_;

	my $form=$params{form};
	my $session=$params{session};
	my $cgi=$params{cgi};
	
	if ($form-&gt;title eq "preferences" &amp;&amp;
	       IkiWiki::openiduser($session-&gt;param("name"))) {
		$form-&gt;field(name =&gt; "openid_identifier", disabled =&gt; 1,
			label =&gt; htmllink("", "", "ikiwiki/OpenID", noimageinline =&gt; 1),
			value =&gt; "", 
			size =&gt; 1, force =&gt; 1,
			fieldset =&gt; "login",
			comment =&gt; $session-&gt;param("name"));
		$form-&gt;field(name =&gt; "email", type =&gt; "hidden");
	}
}

sub validate ($$$;$) {
	my $q=shift;
	my $session=shift;
	my $openid_url=shift;
	my $errhandler=shift;

	my $csr=getobj($q, $session);

	my $claimed_identity = $csr-&gt;claimed_identity($openid_url);
	if (! $claimed_identity) {
		if ($errhandler) {
			$errhandler-&gt;($csr-&gt;err);
			return 0;
		}
		else {
			error($csr-&gt;err);
		}
	}

	# Ask for client to provide a name and email, if possible.
	# Try sreg and ax
	if ($claimed_identity-&gt;can("set_extension_args")) {
		$claimed_identity-&gt;set_extension_args(
			'http://openid.net/extensions/sreg/1.1',
			{
				optional =&gt; 'email,fullname,nickname',
			},
		);
		$claimed_identity-&gt;set_extension_args(
			'http://openid.net/srv/ax/1.0',
			{
				mode =&gt; 'fetch_request',
				'required' =&gt; 'email,fullname,nickname,firstname',
				'type.email' =&gt; "http://schema.openid.net/contact/email",
				'type.fullname' =&gt; "http://axschema.org/namePerson",
				'type.nickname' =&gt; "http://axschema.org/namePerson/friendly",
				'type.firstname' =&gt; "http://axschema.org/namePerson/first",
			},
		);
	}

	my $cgiurl=$config{openid_cgiurl};
	$cgiurl=$q-&gt;url if ! defined $cgiurl;

	my $trust_root=$config{openid_realm};
	$trust_root=$cgiurl if ! defined $trust_root;

	my $check_url = $claimed_identity-&gt;check_url(
		return_to =&gt; "$cgiurl?do=postsignin",
		trust_root =&gt; $trust_root,
		delayed_return =&gt; 1,
	);
	# Redirect the user to the OpenID server, which will
	# eventually bounce them back to auth()
	IkiWiki::redirect($q, $check_url);
	exit 0;
}

sub auth ($$) {
	my $q=shift;
	my $session=shift;

	if (defined $q-&gt;param('openid.mode')) {
		my $csr=getobj($q, $session);

		if (my $setup_url = $csr-&gt;user_setup_url) {
			IkiWiki::redirect($q, $setup_url);
		}
		elsif ($csr-&gt;user_cancel) {
			IkiWiki::redirect($q, IkiWiki::baseurl(undef));
		}
		elsif (my $vident = $csr-&gt;verified_identity) {
			$session-&gt;param(name =&gt; $vident-&gt;url);

			my @extensions;
			if ($vident-&gt;can("signed_extension_fields")) {
				@extensions=grep { defined } (
					$vident-&gt;signed_extension_fields('http://openid.net/extensions/sreg/1.1'),
					$vident-&gt;signed_extension_fields('http://openid.net/srv/ax/1.0'),
				);
			}
			my $nickname;
			foreach my $ext (@extensions) {
				foreach my $field (qw{value.email email}) {
					if (exists $ext-&gt;{$field} &amp;&amp;
					    defined $ext-&gt;{$field} &amp;&amp;
					    length $ext-&gt;{$field}) {
						$session-&gt;param(email =&gt; $ext-&gt;{$field});
						if (! defined $nickname &amp;&amp;
						    $ext-&gt;{$field}=~/(.+)@.+/) {
							$nickname = $1;
						}
						last;
					}
				}
				foreach my $field (qw{value.nickname nickname value.fullname fullname value.firstname}) {
					if (exists $ext-&gt;{$field} &amp;&amp;
					    defined $ext-&gt;{$field} &amp;&amp;
					    length $ext-&gt;{$field}) {
						$nickname=$ext-&gt;{$field};
						last;
					}
				}
			}
			if (defined $nickname) {
				$session-&gt;param(nickname =&gt;
					Encode::decode_utf8($nickname));
			}
		}
		else {
			error("OpenID failure: ".$csr-&gt;err);
		}
	}
	elsif (defined $q-&gt;param('openid_identifier')) {
		# myopenid.com affiliate support
		validate($q, $session, $q-&gt;param('openid_identifier'));
	}
}

sub getobj ($$) {
	my $q=shift;
	my $session=shift;

	eval q{use Net::INET6Glue::INET_is_INET6}; # may not be available
	eval q{use Net::OpenID::Consumer};
	error($@) if $@;

	my $ua;
	eval q{use LWPx::ParanoidAgent};
	if (! $@) {
		$ua=LWPx::ParanoidAgent-&gt;new;
	}
	else {
	        $ua=LWP::UserAgent-&gt;new;
	}

	# Store the secret in the session.
	my $secret=$session-&gt;param("openid_secret");
	if (! defined $secret) {
		$secret=rand;
		$session-&gt;param(openid_secret =&gt; $secret);
	}
	
	my $cgiurl=$config{openid_cgiurl};
	$cgiurl=$q-&gt;url if ! defined $cgiurl;

	return Net::OpenID::Consumer-&gt;new(
		ua =&gt; $ua,
		args =&gt; $q,
		consumer_secret =&gt; sub { return shift()+$secret },
		required_root =&gt; $cgiurl,
	);
}

sub load_openid_module {
	# Give up if module is unavailable to avoid needing to depend on it.
	eval q{use Net::OpenID::Consumer};
	if ($@) {
		debug("unable to load Net::OpenID::Consumer, not enabling OpenID login ($@)");
		return;
	}
	return 1;
}

1
</pre></body></html>