2010-02-21 15:00:53 +01:00
|
|
|
##@file
|
|
|
|
# OpenID authentication backend file
|
|
|
|
|
|
|
|
##@class
|
2010-02-21 15:47:16 +01:00
|
|
|
# OpenID authentication backend class.
|
2010-09-02 12:38:28 +02:00
|
|
|
# The form must return a openid_identifier field
|
2010-02-21 15:00:53 +01:00
|
|
|
package Lemonldap::NG::Portal::AuthOpenID;
|
|
|
|
|
|
|
|
use strict;
|
|
|
|
use Lemonldap::NG::Portal::Simple;
|
2010-10-10 15:32:01 +02:00
|
|
|
use Lemonldap::NG::Common::Regexp;
|
2013-10-08 06:35:38 +02:00
|
|
|
use Lemonldap::NG::Portal::_Browser;
|
2010-10-10 15:32:01 +02:00
|
|
|
use Cache::FileCache;
|
2010-02-21 15:00:53 +01:00
|
|
|
|
2013-10-08 06:35:38 +02:00
|
|
|
our @ISA = (qw(Lemonldap::NG::Portal::_Browser));
|
2014-02-19 16:10:21 +01:00
|
|
|
our $VERSION = '1.4.0';
|
2010-09-23 17:09:27 +02:00
|
|
|
our $initDone;
|
2010-02-21 15:00:53 +01:00
|
|
|
|
2010-10-30 21:25:38 +02:00
|
|
|
BEGIN {
|
|
|
|
eval {
|
|
|
|
require threads::shared;
|
|
|
|
threads::shared::share($initDone);
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
2010-02-21 15:00:53 +01:00
|
|
|
## @apmethod int authInit()
|
|
|
|
# @return Lemonldap::NG::Portal constant
|
|
|
|
sub authInit {
|
|
|
|
my $self = shift;
|
2010-09-23 17:09:27 +02:00
|
|
|
$self->{openIdSecret} ||= $self->{cipher}->encrypt(0);
|
2010-10-10 15:32:01 +02:00
|
|
|
my $tmp = $self->{openIdIDPList};
|
|
|
|
$tmp =~ s/^(\d);//;
|
|
|
|
$self->{_openIdIDPListIsWhite} = $1 + 0;
|
|
|
|
$self->{_reopenIdIDPList} =
|
|
|
|
Lemonldap::NG::Common::Regexp::reDomainsToHost($tmp);
|
|
|
|
|
2010-09-23 17:09:27 +02:00
|
|
|
return PE_OK if ($initDone);
|
|
|
|
|
2010-09-01 11:16:02 +02:00
|
|
|
eval { require Net::OpenID::Consumer };
|
|
|
|
$self->abort( 'Unable to load Net::OpenID::Consumer', $@ ) if ($@);
|
2010-09-23 17:09:27 +02:00
|
|
|
|
|
|
|
$initDone = 1;
|
2010-02-21 15:00:53 +01:00
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
## @apmethod int extractFormInfo()
|
|
|
|
# Read username return by OpenID authentication system.
|
|
|
|
# @return Lemonldap::NG::Portal constant
|
|
|
|
sub extractFormInfo {
|
|
|
|
my $self = shift;
|
2010-02-27 15:10:23 +01:00
|
|
|
|
|
|
|
$self->{csr} = Net::OpenID::Consumer->new(
|
2013-10-08 06:35:38 +02:00
|
|
|
ua => $self->ua(),
|
2010-09-01 11:16:02 +02:00
|
|
|
cache => $self->{refLocalStorage} || Cache::FileCache->new,
|
2010-02-27 15:10:23 +01:00
|
|
|
args => $self,
|
|
|
|
consumer_secret => $self->{openIdSecret},
|
|
|
|
required_root => $self->{portal},
|
|
|
|
);
|
|
|
|
|
2010-02-21 15:00:53 +01:00
|
|
|
my ( $url, $openid );
|
|
|
|
|
|
|
|
# 1. If no openid element has been detected
|
2010-02-27 15:10:23 +01:00
|
|
|
$openid = $self->param('openid');
|
2010-02-21 15:00:53 +01:00
|
|
|
return PE_FIRSTACCESS
|
2010-09-02 12:38:28 +02:00
|
|
|
unless ( $url = $self->param('openid_identifier') or $openid );
|
2010-02-21 15:00:53 +01:00
|
|
|
|
|
|
|
# 2. Check OpenID responses
|
|
|
|
if ($openid) {
|
|
|
|
my $csr = $self->{csr};
|
|
|
|
|
|
|
|
# Remote error
|
|
|
|
unless ( $csr->is_server_response() ) {
|
2010-10-07 13:05:36 +02:00
|
|
|
$self->{_msg} = 'No OpenID valid message found' . $csr->err();
|
|
|
|
$self->lmLog( $self->{_msg}, 'info' );
|
2010-02-21 15:00:53 +01:00
|
|
|
return PE_BADCREDENTIALS;
|
|
|
|
}
|
|
|
|
|
2010-02-21 15:47:16 +01:00
|
|
|
# If confirmation is needed
|
2010-02-21 15:00:53 +01:00
|
|
|
if ( my $setup_url = $csr->user_setup_url ) {
|
2013-10-13 14:15:01 +02:00
|
|
|
$self->_sub( 'userInfo', 'OpenID confirmation needed' );
|
2010-02-21 15:47:16 +01:00
|
|
|
print $self->redirect($setup_url);
|
|
|
|
$self->quit();
|
2010-02-21 15:00:53 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
# Check if user has refused to share his authentication
|
|
|
|
elsif ( $csr->user_cancel() ) {
|
2010-10-07 13:05:36 +02:00
|
|
|
$self->{_msg} = "OpenID request cancelled by user";
|
|
|
|
$self->lmLog( $self->{_msg}, 'info' );
|
2010-02-21 15:00:53 +01:00
|
|
|
return PE_FIRSTACCESS;
|
|
|
|
}
|
|
|
|
|
|
|
|
# TODO: check verified identity
|
2010-02-27 15:10:23 +01:00
|
|
|
elsif ( $self->{vident} = $csr->verified_identity ) {
|
|
|
|
$self->{user} = $self->{vident}->url();
|
|
|
|
$self->lmLog( "OpenID good authentication for $self->{user}",
|
|
|
|
'debug' );
|
|
|
|
$self->{mustRedirect} = 1;
|
2010-02-21 15:00:53 +01:00
|
|
|
return PE_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
# Other errors
|
|
|
|
else {
|
2010-10-07 13:05:36 +02:00
|
|
|
$self->{_msg} = 'OpenID error: ' . $csr->err;
|
|
|
|
$self->lmLog( $self->{_msg}, 'warn' );
|
2010-02-21 15:47:16 +01:00
|
|
|
return PE_ERROR;
|
2010-02-21 15:00:53 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
# 3. Check if an OpenID url has been submitted
|
|
|
|
else {
|
2010-10-10 15:32:01 +02:00
|
|
|
my $tmp = $url;
|
|
|
|
$tmp =~ m#^http//(.*?)/#;
|
|
|
|
if ( $tmp =~
|
|
|
|
$self->{_reopenIdIDPList} xor $self->{_openIdIDPListIsWhite} )
|
|
|
|
{
|
2013-10-13 14:15:01 +02:00
|
|
|
$self->_sub( 'userNotice',
|
|
|
|
"$url is forbidden for openID exchange" );
|
2010-10-10 15:32:01 +02:00
|
|
|
$self->{_msg} =
|
|
|
|
"OpenID error: $tmp is forbidden for OpenID echange";
|
2010-10-11 14:27:03 +02:00
|
|
|
return PE_BADPARTNER;
|
2010-10-10 15:32:01 +02:00
|
|
|
}
|
2010-02-21 15:00:53 +01:00
|
|
|
my $claimed_identity = $self->{csr}->claimed_identity($url);
|
|
|
|
|
|
|
|
# Check if url is valid
|
|
|
|
unless ($claimed_identity) {
|
2010-10-07 13:05:36 +02:00
|
|
|
$self->{_msg} = "OpenID error : " . $self->{csr}->err();
|
|
|
|
$self->lmLog( $self->{_msg}, 'warn' );
|
2010-02-21 15:00:53 +01:00
|
|
|
return PE_BADCREDENTIALS;
|
|
|
|
}
|
|
|
|
|
2010-09-03 15:34:35 +02:00
|
|
|
# Build the redirection
|
2010-02-21 15:00:53 +01:00
|
|
|
$self->lmLog( "OpenID redirection to $url", 'debug' );
|
|
|
|
my $check_url = $claimed_identity->check_url(
|
2010-09-03 15:34:35 +02:00
|
|
|
return_to => $self->{portal}
|
|
|
|
. '?openid=1'
|
2010-09-03 16:58:25 +02:00
|
|
|
. ( $self->{_url} ? "&url=$self->{_url}" : '' )
|
|
|
|
. (
|
|
|
|
$self->param( $self->{authChoiceParam} )
|
|
|
|
? "&"
|
|
|
|
. $self->{authChoiceParam} . "="
|
|
|
|
. $self->param( $self->{authChoiceParam} )
|
|
|
|
: ''
|
|
|
|
),
|
2010-06-14 08:19:34 +02:00
|
|
|
trust_root => $self->{portal},
|
|
|
|
delayed_return => 1,
|
2010-02-21 15:00:53 +01:00
|
|
|
);
|
2010-09-03 15:34:35 +02:00
|
|
|
|
|
|
|
# If UserDB uses OpenID, add "OpenID Simple Registration Extension"
|
|
|
|
# compatible fields
|
2010-10-01 16:21:46 +02:00
|
|
|
if ( $self->get_module('user') eq 'OpenID' ) {
|
2010-09-03 15:34:35 +02:00
|
|
|
my ( @r, @o );
|
2014-02-19 16:10:21 +01:00
|
|
|
my %vars =
|
|
|
|
( %{ $self->{exportedVars} }, %{ $self->{openIdExportedVars} } );
|
|
|
|
while ( my ( $v, $k ) = each %vars ) {
|
2013-10-03 06:18:16 +02:00
|
|
|
if ( $k =~ Lemonldap::NG::Common::Regexp::OPENIDSREGATTR() ) {
|
2010-09-24 16:21:19 +02:00
|
|
|
if ( $v =~ s/^!// ) { push @r, $k }
|
2010-09-29 08:42:48 +02:00
|
|
|
else { push @o, $k }
|
2010-09-03 15:34:35 +02:00
|
|
|
}
|
|
|
|
else {
|
|
|
|
$self->lmLog(
|
|
|
|
"Unknown \"OpenID Simple Registration Extension\" field name: $k",
|
2010-10-04 14:29:18 +02:00
|
|
|
'warn'
|
2010-09-03 15:34:35 +02:00
|
|
|
);
|
|
|
|
}
|
|
|
|
}
|
2010-09-24 16:21:19 +02:00
|
|
|
my @tmp;
|
|
|
|
push @tmp, 'openid.sreg.required' => join( ',', @r ) if (@r);
|
|
|
|
push @tmp, 'openid.sreg.optional' => join( ',', @o ) if (@o);
|
2010-09-03 15:34:35 +02:00
|
|
|
OpenID::util::push_url_arg( \$check_url, @tmp ) if (@tmp);
|
|
|
|
}
|
2010-02-21 15:47:16 +01:00
|
|
|
print $self->redirect($check_url);
|
|
|
|
$self->quit();
|
2010-02-21 15:00:53 +01:00
|
|
|
}
|
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
## @apmethod int setAuthSessionInfo()
|
2010-04-14 17:37:57 +02:00
|
|
|
# Set _user and authenticationLevel.
|
2010-02-21 15:00:53 +01:00
|
|
|
# @return Lemonldap::NG::Portal constant
|
|
|
|
sub setAuthSessionInfo {
|
|
|
|
my $self = shift;
|
|
|
|
|
2010-03-15 10:53:56 +01:00
|
|
|
$self->{sessionInfo}->{'_user'} = $self->{user};
|
2010-02-21 15:00:53 +01:00
|
|
|
|
2010-09-01 18:06:01 +02:00
|
|
|
$self->{sessionInfo}->{authenticationLevel} = $self->{openIdAuthnLevel};
|
2010-04-14 17:37:57 +02:00
|
|
|
|
2010-02-21 15:00:53 +01:00
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
## @apmethod int authenticate()
|
|
|
|
# Does nothing.
|
|
|
|
# @return Lemonldap::NG::Portal constant
|
|
|
|
sub authenticate {
|
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
2010-09-01 10:59:39 +02:00
|
|
|
## @apmethod int authFinish()
|
|
|
|
# Does nothing.
|
|
|
|
# @return Lemonldap::NG::Portal constant
|
|
|
|
sub authFinish {
|
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
## @apmethod int authLogout()
|
|
|
|
# Does nothing
|
|
|
|
# @return Lemonldap::NG::Portal constant
|
|
|
|
sub authLogout {
|
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
## @apmethod boolean authForce()
|
|
|
|
# Does nothing
|
|
|
|
# @return result
|
|
|
|
sub authForce {
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2012-03-24 15:47:47 +01:00
|
|
|
## @method string getDisplayType
|
|
|
|
# @return display type
|
|
|
|
sub getDisplayType {
|
|
|
|
return "openidform";
|
|
|
|
}
|
|
|
|
|
2010-02-21 15:00:53 +01:00
|
|
|
1;
|
|
|
|
__END__
|
|
|
|
|
|
|
|
=head1 NAME
|
|
|
|
|
|
|
|
=encoding utf8
|
|
|
|
|
2010-02-27 23:37:59 +01:00
|
|
|
Lemonldap::NG::Portal::AuthOpenID - Perl extension for building Lemonldap::NG
|
2010-02-21 15:00:53 +01:00
|
|
|
compatible portals with OpenID authentication.
|
|
|
|
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
|
|
|
|
use Lemonldap::NG::Portal::SharedConf;
|
|
|
|
my $portal = new Lemonldap::NG::Portal::Simple(
|
|
|
|
configStorage => {...}, # See Lemonldap::NG::Portal
|
|
|
|
authentication => 'OpenID',
|
|
|
|
);
|
|
|
|
|
|
|
|
if($portal->process()) {
|
|
|
|
# Write here the menu with CGI methods. This page is displayed ONLY IF
|
|
|
|
# the user was not redirected here.
|
2013-10-17 21:21:45 +02:00
|
|
|
print $portal->header('text/html; charset=utf-8'); # DON'T FORGET THIS (see CGI(3))
|
2010-02-21 15:00:53 +01:00
|
|
|
print "...";
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
# If the user enters here, IT MEANS THAT CAS REDIRECTION DOES NOT WORK
|
2013-10-17 21:21:45 +02:00
|
|
|
print $portal->header('text/html; charset=utf-8'); # DON'T FORGET THIS (see CGI(3))
|
2010-02-21 15:00:53 +01:00
|
|
|
print "<html><body><h1>Unable to work</h1>";
|
|
|
|
print "This server isn't well configured. Contact your administrator.";
|
|
|
|
print "</body></html>";
|
|
|
|
}
|
|
|
|
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
|
|
|
|
This library just overload few methods of Lemonldap::NG::Portal::Simple to use
|
|
|
|
OpenID authentication mechanism.
|
|
|
|
|
|
|
|
See L<Lemonldap::NG::Portal::Simple> for usage and other methods.
|
|
|
|
|
|
|
|
=head1 SEE ALSO
|
|
|
|
|
|
|
|
L<Lemonldap::NG::Portal>, L<Lemonldap::NG::Portal::Simple>,
|
2010-10-26 08:08:16 +02:00
|
|
|
L<http://lemonldap-ng.org/>
|
2010-02-21 15:00:53 +01:00
|
|
|
|
|
|
|
=head1 AUTHOR
|
|
|
|
|
2013-01-31 06:33:10 +01:00
|
|
|
=over
|
|
|
|
|
|
|
|
=item Clement Oudot, E<lt>clem.oudot@gmail.comE<gt>
|
|
|
|
|
|
|
|
=item Xavier Guimard, E<lt>x.guimard@free.frE<gt>
|
|
|
|
|
|
|
|
=back
|
2010-02-21 15:00:53 +01:00
|
|
|
|
|
|
|
=head1 BUG REPORT
|
|
|
|
|
|
|
|
Use OW2 system to report bug or ask for features:
|
2010-10-26 08:08:16 +02:00
|
|
|
L<http://jira.ow2.org>
|
2010-02-21 15:00:53 +01:00
|
|
|
|
|
|
|
=head1 DOWNLOAD
|
|
|
|
|
|
|
|
Lemonldap::NG is available at
|
|
|
|
L<http://forge.objectweb.org/project/showfiles.php?group_id=274>
|
|
|
|
|
|
|
|
=head1 COPYRIGHT AND LICENSE
|
|
|
|
|
2013-01-31 06:33:10 +01:00
|
|
|
=over
|
|
|
|
|
|
|
|
=item Copyright (C) 2010 by Xavier Guimard, E<lt>x.guimard@free.frE<gt>
|
|
|
|
|
2016-01-21 22:15:19 +01:00
|
|
|
=item Copyright (C) 2010-2012 by Clement Oudot, E<lt>clem.oudot@gmail.comE<gt>
|
2013-01-31 06:33:10 +01:00
|
|
|
|
|
|
|
=back
|
2010-02-21 15:00:53 +01:00
|
|
|
|
|
|
|
This library is free software; you can redistribute it and/or modify
|
2013-01-31 06:33:10 +01:00
|
|
|
it under the terms of the GNU General Public License as published by
|
|
|
|
the Free Software Foundation; either version 2, or (at your option)
|
|
|
|
any later version.
|
|
|
|
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
GNU General Public License for more details.
|
|
|
|
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
|
|
along with this program. If not, see L<http://www.gnu.org/licenses/>.
|
2010-02-21 15:00:53 +01:00
|
|
|
|
|
|
|
=cut
|
|
|
|
|
|
|
|
|