X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/54f600af14bf6dc067ffc30ec6f22d517001fe99..b91a74721d7a73c95baaeb81976ec9bd2a78098d:/IkiWiki/Plugin/openid.pm diff --git a/IkiWiki/Plugin/openid.pm b/IkiWiki/Plugin/openid.pm index 7b1a17831..eb21955e9 100644 --- a/IkiWiki/Plugin/openid.pm +++ b/IkiWiki/Plugin/openid.pm @@ -7,18 +7,18 @@ use strict; use IkiWiki 3.00; sub import { - hook(type => "getopt", id => "openid", call => \&getopt); hook(type => "getsetup", id => "openid", call => \&getsetup); hook(type => "auth", id => "openid", call => \&auth); hook(type => "formbuilder_setup", id => "openid", call => \&formbuilder_setup, last => 1); -} - -sub getopt () { - eval q{use Getopt::Long}; - error($@) if $@; - Getopt::Long::Configure('pass_through'); - GetOptions("openidsignup=s" => \$config{openidsignup}); + IkiWiki::loadplugin("emailauth"); + IkiWiki::loadplugin("loginselector"); + IkiWiki::Plugin::loginselector::register_login_plugin( + "openid", + \&openid_setup, + \&openid_check_input, + \&openid_auth, + ); } sub getsetup () { @@ -28,15 +28,50 @@ sub getsetup () { rebuild => 0, section => "auth", }, - openidsignup => { + openid_realm => { type => "string", - example => "http://myopenid.com/", - description => "an url where users can signup for an OpenID", - safe => 1, + description => "url pattern of openid realm (default is cgiurl)", + safe => 0, + rebuild => 0, + }, + openid_cgiurl => { + type => "string", + description => "url to ikiwiki cgi to use for openid authentication (default is cgiurl)", + safe => 0, rebuild => 0, }, } +sub openid_setup ($$) { + my $q=shift; + my $template=shift; + + if (load_openid_module()) { + my $openid_url=$q->param('openid_identifier'); + if (defined $openid_url) { + $template->param(openid_url => $openid_url); + } + return 1; + } + else { + return 0; + } +} + +sub openid_check_input ($) { + my $q=shift; + my $openid_url=$q->param('openid_identifier'); + defined $q->param("action") && $q->param("action") eq "verify" && defined $openid_url && length $openid_url; +} + +sub openid_auth ($$$$) { + my $q=shift; + my $session=shift; + my $errordisplayer=shift; + my $openid_url=$q->param('openid_identifier'); + validate($q, $session, $openid_url, $errordisplayer); +} + sub formbuilder_setup (@) { my %params=@_; @@ -44,53 +79,14 @@ sub formbuilder_setup (@) { my $session=$params{session}; my $cgi=$params{cgi}; - if ($form->title eq "signin") { - # Give up if module is unavailable to avoid - # needing to depend on it. - eval q{use Net::OpenID::Consumer}; - if ($@) { - debug("unable to load Net::OpenID::Consumer, not enabling OpenID login ($@)"); - return; - } - - # This avoids it displaying a redundant label for the - # OpenID fieldset. - $form->fieldsets("OpenID"); - - $form->field( - name => "openid_url", - label => gettext("Log in with")." ".htmllink("", "", "ikiwiki/OpenID", noimageinline => 1), - fieldset => "OpenID", - size => 30, - comment => ($config{openidsignup} ? " | ".gettext("Get an OpenID")."" : "") - ); - - # Handle submission of an OpenID as validation. - if ($form->submitted && $form->submitted eq "Login" && - defined $form->field("openid_url") && - length $form->field("openid_url")) { - $form->field( - name => "openid_url", - validate => sub { - validate($cgi, $session, shift, $form); - }, - ); - # Skip all other required fields in this case. - foreach my $field ($form->field) { - next if $field eq "openid_url"; - $form->field(name => $field, required => 0, - validate => '/.*/'); - } - } - } - elsif ($form->title eq "preferences" && + if ($form->title eq "preferences" && IkiWiki::openiduser($session->param("name"))) { - $form->field(name => "openid_url", disabled => 1, + $form->field(name => "openid_identifier", disabled => 1, label => htmllink("", "", "ikiwiki/OpenID", noimageinline => 1), - value => $session->param("name"), - size => 50, force => 1, - fieldset => "login"); - $form->field(name => "email", type => "hidden"); + value => "", + size => 1, force => 1, + fieldset => "login", + comment => $session->param("name")); } } @@ -98,15 +94,16 @@ sub validate ($$$;$) { my $q=shift; my $session=shift; my $openid_url=shift; - my $form=shift; + my $errhandler=shift; my $csr=getobj($q, $session); my $claimed_identity = $csr->claimed_identity($openid_url); if (! $claimed_identity) { - if ($form) { - # Put the error in the form and fail validation. - $form->field(name => "openid_url", comment => $csr->err); + if ($errhandler) { + if (ref($errhandler) eq 'CODE') { + $errhandler->($csr->err); + } return 0; } else { @@ -136,9 +133,15 @@ sub validate ($$$;$) { ); } + my $cgiurl=$config{openid_cgiurl}; + $cgiurl=$q->url if ! defined $cgiurl; + + my $trust_root=$config{openid_realm}; + $trust_root=$cgiurl if ! defined $trust_root; + my $check_url = $claimed_identity->check_url( - return_to => IkiWiki::cgiurl(do => "postsignin"), - trust_root => $config{cgiurl}, + return_to => auto_upgrade_https($q, "$cgiurl?do=postsignin"), + trust_root => auto_upgrade_https($q, $trust_root), delayed_return => 1, ); # Redirect the user to the OpenID server, which will @@ -158,7 +161,7 @@ sub auth ($$) { IkiWiki::redirect($q, $setup_url); } elsif ($csr->user_cancel) { - IkiWiki::redirect($q, $config{url}); + IkiWiki::redirect($q, IkiWiki::baseurl(undef)); } elsif (my $vident = $csr->verified_identity) { $session->param(name => $vident->url); @@ -170,12 +173,17 @@ sub auth ($$) { $vident->signed_extension_fields('http://openid.net/srv/ax/1.0'), ); } + my $nickname; foreach my $ext (@extensions) { foreach my $field (qw{value.email email}) { if (exists $ext->{$field} && defined $ext->{$field} && length $ext->{$field}) { $session->param(email => $ext->{$field}); + if (! defined $nickname && + $ext->{$field}=~/(.+)@.+/) { + $nickname = $1; + } last; } } @@ -183,11 +191,15 @@ sub auth ($$) { if (exists $ext->{$field} && defined $ext->{$field} && length $ext->{$field}) { - $session->param(username => $ext->{$field}); + $nickname=$ext->{$field}; last; } } } + if (defined $nickname) { + $session->param(nickname => + Encode::decode_utf8($nickname)); + } } else { error("OpenID failure: ".$csr->err); @@ -195,7 +207,7 @@ sub auth ($$) { } elsif (defined $q->param('openid_identifier')) { # myopenid.com affiliate support - validate($q, $session, $q->param('openid_identifier')); + validate($q, $session, scalar $q->param('openid_identifier')); } } @@ -203,17 +215,14 @@ sub getobj ($$) { my $q=shift; my $session=shift; + eval q{use Net::INET6Glue::INET_is_INET6}; # may not be available eval q{use Net::OpenID::Consumer}; error($@) if $@; - my $ua; - eval q{use LWPx::ParanoidAgent}; - if (! $@) { - $ua=LWPx::ParanoidAgent->new; - } - else { - $ua=LWP::UserAgent->new; - } + # We pass the for_url parameter, even though it's undef, because + # that will make sure we crash if used with an older IkiWiki.pm + # that didn't automatically try to use LWPx::ParanoidAgent. + my $ua=useragent(for_url => undef); # Store the secret in the session. my $secret=$session->param("openid_secret"); @@ -221,13 +230,35 @@ sub getobj ($$) { $secret=rand; $session->param(openid_secret => $secret); } + + my $cgiurl=$config{openid_cgiurl}; + $cgiurl=$q->url if ! defined $cgiurl; return Net::OpenID::Consumer->new( ua => $ua, args => $q, consumer_secret => sub { return shift()+$secret }, - required_root => $config{cgiurl}, + required_root => auto_upgrade_https($q, $cgiurl), ); } +sub auto_upgrade_https { + my $q=shift; + my $url=shift; + if ($q->https()) { + $url=~s/^http:/https:/i; + } + return $url; +} + +sub load_openid_module { + # Give up if module is unavailable to avoid needing to depend on it. + eval q{use Net::OpenID::Consumer}; + if ($@) { + debug("unable to load Net::OpenID::Consumer, not enabling OpenID login ($@)"); + return; + } + return 1; +} + 1