git.oblomov.eu Git - ikiwiki/blob - IkiWiki/Plugin/openid.pm

   1 #!/usr/bin/perl
   2 # OpenID support.
   3 package IkiWiki::Plugin::openid;
   4
   5 use warnings;
   6 use strict;
   7 use IkiWiki 3.00;
   8
   9 sub import {
  10         hook(type => "getopt", id => "openid", call => \&getopt);
  11         hook(type => "getsetup", id => "openid", call => \&getsetup);
  12         hook(type => "auth", id => "openid", call => \&auth);
  13         hook(type => "formbuilder_setup", id => "openid",
  14                 call => \&formbuilder_setup, last => 1);
  15 }
  16
  17 sub getopt () {
  18         eval q{use Getopt::Long};
  19         error($@) if $@;
  20         Getopt::Long::Configure('pass_through');
  21         GetOptions("openidsignup=s" => \$config{openidsignup});
  22 }
  23
  24 sub getsetup () {
  25         return
  26                 plugin => {
  27                         safe => 1,
  28                         rebuild => 0,
  29                         section => "auth",
  30                 },
  31                 openidsignup => {
  32                         type => "string",
  33                         example => "http://myopenid.com/",
  34                         description => "an url where users can signup for an OpenID",
  35                         safe => 1,
  36                         rebuild => 0,
  37                 },
  38 }
  39
  40 sub formbuilder_setup (@) {
  41         my %params=@_;
  42
  43         my $form=$params{form};
  44         my $session=$params{session};
  45         my $cgi=$params{cgi};
  46
  47         if ($form->title eq "signin") {
  48                 # Give up if module is unavailable to avoid
  49                 # needing to depend on it.
  50                 eval q{use Net::OpenID::Consumer};
  51                 if ($@) {
  52                         debug("unable to load Net::OpenID::Consumer, not enabling OpenID login ($@)");
  53                         return;
  54                 }
  55
  56                 # This avoids it displaying a redundant label for the
  57                 # OpenID fieldset.
  58                 $form->fieldsets("OpenID");
  59
  60                 $form->field(
  61                         name => "openid_url",
  62                         label => gettext("Log in with")." ".htmllink("", "", "ikiwiki/OpenID", noimageinline => 1),
  63                         fieldset => "OpenID",
  64                         size => 30,
  65                         comment => ($config{openidsignup} ? " | <a href=\"$config{openidsignup}\">".gettext("Get an OpenID")."</a>" : "")
  66                 );
  67
  68                 # Handle submission of an OpenID as validation.
  69                 if ($form->submitted && $form->submitted eq "Login" &&
  70                     defined $form->field("openid_url") &&
  71                     length $form->field("openid_url")) {
  72                         $form->field(
  73                                 name => "openid_url",
  74                                 validate => sub {
  75                                         validate($cgi, $session, shift, $form);
  76                                 },
  77                         );
  78                         # Skip all other required fields in this case.
  79                         foreach my $field ($form->field) {
  80                                 next if $field eq "openid_url";
  81                                 $form->field(name => $field, required => 0,
  82                                         validate => '/.*/');
  83                         }
  84                 }
  85         }
  86         elsif ($form->title eq "preferences" &&
  87                IkiWiki::openiduser($session->param("name"))) {
  88                 $form->field(name => "openid_url", disabled => 1,
  89                         label => htmllink("", "", "ikiwiki/OpenID", noimageinline => 1),
  90                         value => $session->param("name"),
  91                         size => 50, force => 1,
  92                         fieldset => "login");
  93         }
  94 }
  95
  96 sub validate ($$$;$) {
  97         my $q=shift;
  98         my $session=shift;
  99         my $openid_url=shift;
 100         my $form=shift;
 101
 102         my $csr=getobj($q, $session);
 103
 104         my $claimed_identity = $csr->claimed_identity($openid_url);
 105         if (! $claimed_identity) {
 106                 if ($form) {
 107                         # Put the error in the form and fail validation.
 108                         $form->field(name => "openid_url", comment => $csr->err);
 109                         return 0;
 110                 }
 111                 else {
 112                         error($csr->err);
 113                 }
 114         }
 115
 116         my $check_url = $claimed_identity->check_url(
 117                 return_to => IkiWiki::cgiurl(do => "postsignin"),
 118                 trust_root => $config{cgiurl},
 119                 delayed_return => 1,
 120         );
 121         # Redirect the user to the OpenID server, which will
 122         # eventually bounce them back to auth()
 123         IkiWiki::redirect($q, $check_url);
 124         exit 0;
 125 }
 126
 127 sub auth ($$) {
 128         my $q=shift;
 129         my $session=shift;
 130
 131         if (defined $q->param('openid.mode')) {
 132                 my $csr=getobj($q, $session);
 133
 134                 if (my $setup_url = $csr->user_setup_url) {
 135                         IkiWiki::redirect($q, $setup_url);
 136                 }
 137                 elsif ($csr->user_cancel) {
 138                         IkiWiki::redirect($q, $config{url});
 139                 }
 140                 elsif (my $vident = $csr->verified_identity) {
 141                         $session->param(name => $vident->url);
 142                 }
 143                 else {
 144                         error("OpenID failure: ".$csr->err);
 145                 }
 146         }
 147         elsif (defined $q->param('openid_identifier')) {
 148                 # myopenid.com affiliate support
 149                 validate($q, $session, $q->param('openid_identifier'));
 150         }
 151 }
 152
 153 sub getobj ($$) {
 154         my $q=shift;
 155         my $session=shift;
 156
 157         eval q{use Net::OpenID::Consumer};
 158         error($@) if $@;
 159
 160         my $ua;
 161         eval q{use LWPx::ParanoidAgent};
 162         if (! $@) {
 163                 $ua=LWPx::ParanoidAgent->new;
 164         }
 165         else {
 166                 $ua=LWP::UserAgent->new;
 167         }
 168
 169         # Store the secret in the session.
 170         my $secret=$session->param("openid_secret");
 171         if (! defined $secret) {
 172                 $secret=rand;
 173                 $session->param(openid_secret => $secret);
 174         }
 175
 176         return Net::OpenID::Consumer->new(
 177                 ua => $ua,
 178                 args => $q,
 179                 consumer_secret => sub { return shift()+$secret },
 180                 required_root => $config{cgiurl},
 181         );
 182 }
 183
 184 1