Skip to content

Commit 4009afb

Browse files
olavmo-siktolavmo-sikt
committed
openid: Support for attribute exchange + other improvements.
Also adds openid.server and openid.claimed_id based on where receive the response from. Thanks to Brook Schofield for creating this patch. git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2622 44740490-163a-0410-bde0-09ae8108e29a
1 parent 371d091 commit 4009afb

2 files changed

Lines changed: 68 additions & 23 deletions

File tree

‎config-templates/authsources.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,9 @@
8686
'openid:OpenIDConsumer',
8787
'attributes.required' => array('nickname'),
8888
'attributes.optional' => array('fullname', 'email',),
89+
// 'sreg.validate' => FALSE,
90+
'attributes.ax_required' => array('http://axschema.org/namePerson/friendly'),
91+
'attributes.ax_optional' => array('http://axschema.org/namePerson','http://axschema.org/contact/email'),
8992
),
9093
*/
9194

‎modules/openid/lib/Auth/Source/OpenIDConsumer.php‎

Lines changed: 65 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
/* Add the OpenID library search path. */
1010
set_include_path(get_include_path() . PATH_SEPARATOR . dirname(dirname(dirname(dirname(dirname(dirname(__FILE__)))))) . '/lib');
1111

12+
require_once('Auth/OpenID/AX.php');
1213
require_once('Auth/OpenID/SReg.php');
1314
require_once('Auth/OpenID/Server.php');
1415
require_once('Auth/OpenID/ServerRequest.php');
@@ -27,13 +28,19 @@ class sspmod_openid_Auth_Source_OpenIDConsumer extends SimpleSAML_Auth_Source {
2728
* List of optional attributes.
2829
*/
2930
private $optionalAttributes;
31+
private $optionalAXAttributes;
3032

3133

3234
/**
3335
* List of required attributes.
3436
*/
3537
private $requiredAttributes;
38+
private $requiredAXAttributes;
3639

40+
/**
41+
* Validate SReg responses.
42+
*/
43+
private $validateSReg;
3744

3845
/**
3946
* Constructor for this authentication source.
@@ -51,6 +58,11 @@ public function __construct($info, $config) {
5158

5259
$this->optionalAttributes = $cfgParse->getArray('attributes.optional', array());
5360
$this->requiredAttributes = $cfgParse->getArray('attributes.required', array());
61+
62+
$this->optionalAXAttributes = $cfgParse->getArray('attributes.ax_optional', array());
63+
$this->requiredAXAttributes = $cfgParse->getArray('attributes.ax_required', array());
64+
65+
$this->validateSReg = $cfgParse->getBoolean('sreg.validate',TRUE);
5466
}
5567

5668

@@ -71,26 +83,6 @@ public function authenticate(&$state) {
7183
}
7284

7385

74-
/**
75-
* Retrieve required attributes.
76-
*
77-
* @return array Required attributes.
78-
*/
79-
private function getRequiredAttributes() {
80-
return $this->requiredAttributes;
81-
}
82-
83-
84-
/**
85-
* Retrieve optional attributes.
86-
*
87-
* @return array Optional attributes.
88-
*/
89-
private function getOptionalAttributes() {
90-
return $this->optionalAttributes;
91-
}
92-
93-
9486
/**
9587
* Retrieve the Auth_OpenID_Consumer instance.
9688
*
@@ -151,14 +143,40 @@ public function doAuth(array &$state, $openid) {
151143
}
152144

153145
$sreg_request = Auth_OpenID_SRegRequest::build(
154-
$this->getRequiredAttributes(),
155-
$this->getOptionalAttributes()
146+
$this->requiredAttributes,
147+
$this->optionalAttributes
156148
);
157149

158150
if ($sreg_request) {
159151
$auth_request->addExtension($sreg_request);
160152
}
161153

154+
// Create attribute request object
155+
$ax_attribute = array();
156+
157+
foreach($this->requiredAXAttributes as $attr) {
158+
$ax_attribute[] = Auth_OpenID_AX_AttrInfo::make($attr,1,true);
159+
}
160+
161+
foreach($this->optionalAXAttributes as $attr) {
162+
$ax_attribute[] = Auth_OpenID_AX_AttrInfo::make($attr,1,false);
163+
}
164+
165+
if (count($ax_attribute) > 0) {
166+
167+
// Create AX fetch request
168+
$ax_request = new Auth_OpenID_AX_FetchRequest;
169+
170+
// Add attributes to AX fetch request
171+
foreach($ax_attribute as $attr){
172+
$ax_request->add($attr);
173+
}
174+
175+
// Add AX fetch request to authentication request
176+
$auth_request->addExtension($ax_request);
177+
178+
}
179+
162180
// Redirect the user to the OpenID server for authentication.
163181
// Store the token for this authentication so we can verify the
164182
// response.
@@ -223,12 +241,17 @@ public function postAuth(array &$state) {
223241
$openid = $response->identity_url;
224242

225243
$attributes = array('openid' => array($openid));
244+
$attributes['openid.server_url'] = array($response->endpoint->server_url);
226245

227246
if ($response->endpoint->canonicalID) {
228247
$attributes['openid.canonicalID'] = array($response->endpoint->canonicalID);
229248
}
230249

231-
$sreg_resp = Auth_OpenID_SRegResponse::fromSuccessResponse($response);
250+
if ($response->endpoint->claimed_id) {
251+
$attributes['openid.claimed_id'] = array($response->endpoint->claimed_id);
252+
}
253+
254+
$sreg_resp = Auth_OpenID_SRegResponse::fromSuccessResponse($response, $this->validateSReg);
232255
$sregresponse = $sreg_resp->contents();
233256

234257
if (is_array($sregresponse) && count($sregresponse) > 0) {
@@ -238,6 +261,25 @@ public function postAuth(array &$state) {
238261
}
239262
}
240263

264+
// Get AX response information
265+
$ax = new Auth_OpenID_AX_FetchResponse();
266+
$ax_resp = $ax->fromSuccessResponse($response);
267+
268+
if (($ax_resp instanceof Auth_OpenID_AX_FetchResponse) && (!empty($ax_resp->data))) {
269+
$axresponse = $ax_resp->data;
270+
271+
$attributes['openid.axkeys'] = array_keys($axresponse);
272+
foreach ($axresponse AS $axkey => $axvalue) {
273+
if (preg_match("/^\w+:/",$axkey)) {
274+
$attributes[$axkey] = (is_array($axvalue)) ? $axvalue : array($axvalue);
275+
} else {
276+
SimpleSAML_Logger::warning('Invalid attribute name in AX response: ' . var_export($axkey, TRUE));
277+
}
278+
}
279+
}
280+
281+
SimpleSAML_Logger::debug('OpenID Returned Attributes: '. implode(", ",array_keys($attributes)));
282+
241283
$state['Attributes'] = $attributes;
242284
SimpleSAML_Auth_Source::completeAuth($state);
243285
}

0 commit comments

Comments
 (0)