forked from GNUsocial/gnu-social
		
	To enable the admin panel:
    $config['admin']['panels'][] = 'openid';
Or to set them manually:
    $config['openid']['trusted_provider'] = 'https://login.ubuntu.net/';
    $config['openid']['required_team'] = 'my-project-cabal';
    $config['site']['openidonly'] = true;
OpenID-only mode can still be set from addPlugin() parameters as well for backwards compatibility.
Note: if it's set there, that value will override the setting from the database or config.php.
Note that team restrictions are only really meaningful if a trusted provider is set; otherwise,
any OpenID server could report back that users are members of the given team.
Restrictions are checked only at OpenID authentication time and will not kick off people currently
with a session open; existing remembered logins may also survive these changes.
Using code for Launchpad team support provided by Canonical under AGPLv3, pulled from r27 of
WordPress teams integration plugin:
    https://code.edge.launchpad.net/~canonical-isd-hackers/wordpress-teams-integration/trunk
		
	
		
			
				
	
	
		
			176 lines
		
	
	
		
			4.8 KiB
		
	
	
	
		
			PHP
		
	
	
	
	
	
			
		
		
	
	
			176 lines
		
	
	
		
			4.8 KiB
		
	
	
	
		
			PHP
		
	
	
	
	
	
<?php
 | 
						|
/*
 | 
						|
 *  Wordpress Teams plugin
 | 
						|
 *  Copyright (C) 2009-2010 Canonical Ltd.
 | 
						|
 *
 | 
						|
 *  This program is free software: you can redistribute it and/or modify
 | 
						|
 *  it under the terms of the GNU Affero General Public License as published by
 | 
						|
 *  the Free Software Foundation, either version 3 of the License, or
 | 
						|
 *  (at your option) any later version.
 | 
						|
 *
 | 
						|
 *  This program is distributed in the hope that it will be useful,
 | 
						|
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 | 
						|
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 | 
						|
 *  GNU Affero General Public License for more details.
 | 
						|
 *
 | 
						|
 *  You should have received a copy of the GNU Affero General Public License
 | 
						|
 *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 | 
						|
 */
 | 
						|
 | 
						|
/**
 | 
						|
 * Provides an example OpenID extension to query user team/group membership
 | 
						|
 *
 | 
						|
 * This code is based on code supplied with the openid library for simple
 | 
						|
 * registration data.
 | 
						|
 */
 | 
						|
 | 
						|
/**
 | 
						|
 * Require the Message implementation.
 | 
						|
 */
 | 
						|
require_once 'Auth/OpenID/Message.php';
 | 
						|
require_once 'Auth/OpenID/Extension.php';
 | 
						|
 | 
						|
/**
 | 
						|
 * The team/group extension base class
 | 
						|
 */
 | 
						|
class Auth_OpenID_TeamsExtension extends Auth_OpenID_Extension {
 | 
						|
  var $ns_uri = 'http://ns.launchpad.net/2007/openid-teams';
 | 
						|
  var $ns_alias = 'lp';
 | 
						|
  var $request_field = 'query_membership';
 | 
						|
  var $response_field = 'is_member';
 | 
						|
  
 | 
						|
  /**
 | 
						|
   * Get the string arguments that should be added to an OpenID
 | 
						|
   * message for this extension.
 | 
						|
   */
 | 
						|
  function getExtensionArgs() {
 | 
						|
    $args = array();
 | 
						|
 | 
						|
    if ($this->_teams) {
 | 
						|
      $args[$this->request_field] = implode(',', $this->_teams);
 | 
						|
    }
 | 
						|
 | 
						|
    return $args;
 | 
						|
  }
 | 
						|
 | 
						|
  /**
 | 
						|
   * Add the arguments from this extension to the provided message.
 | 
						|
   *
 | 
						|
   * Returns the message with the extension arguments added.
 | 
						|
   */
 | 
						|
  function toMessage(&$message) {
 | 
						|
    if ($message->namespaces->addAlias($this->ns_uri, $this->ns_alias) === null) {
 | 
						|
      if ($message->namespaces->getAlias($this->ns_uri) != $this->ns_alias) {
 | 
						|
        return null;
 | 
						|
      }
 | 
						|
    }
 | 
						|
 | 
						|
    $message->updateArgs($this->ns_uri, $this->getExtensionArgs());
 | 
						|
    return $message;
 | 
						|
  }
 | 
						|
  
 | 
						|
  /**
 | 
						|
   * Extract the team/group namespace URI from the given OpenID message.
 | 
						|
   * Handles OpenID 1 and 2.
 | 
						|
   *
 | 
						|
   * $message: The OpenID message from which to parse team/group data.
 | 
						|
   * This may be a request or response message.
 | 
						|
   *
 | 
						|
   * Returns the sreg namespace URI for the supplied message.
 | 
						|
   *
 | 
						|
   * @access private
 | 
						|
   */
 | 
						|
  function _getExtensionNS(&$message) {
 | 
						|
    $alias = null;
 | 
						|
    $found_ns_uri = null;
 | 
						|
 | 
						|
    // See if there exists an alias for the namespace
 | 
						|
    $alias = $message->namespaces->getAlias($this->ns_uri);
 | 
						|
    
 | 
						|
    if ($alias !== null) {
 | 
						|
      $found_ns_uri = $this->ns_uri;
 | 
						|
    }
 | 
						|
 | 
						|
    if ($alias === null) {
 | 
						|
      // There is no alias for this extension, so try to add one.
 | 
						|
      $found_ns_uri = Auth_OpenID_TYPE_1_0;
 | 
						|
      
 | 
						|
      if ($message->namespaces->addAlias($this->ns_uri, $this->ns_alias) === null) {
 | 
						|
        // An alias for the string 'lp' already exists, but
 | 
						|
        // it's defined for something other than team/group membership
 | 
						|
        return null;
 | 
						|
      }
 | 
						|
    }
 | 
						|
    
 | 
						|
    return $found_ns_uri;
 | 
						|
  }
 | 
						|
}
 | 
						|
 | 
						|
/**
 | 
						|
 * The team/group extension request class
 | 
						|
 */
 | 
						|
class Auth_OpenID_TeamsRequest extends Auth_OpenID_TeamsExtension {
 | 
						|
  function __init($teams) {
 | 
						|
    if (!is_array($teams)) {
 | 
						|
      if (!empty($teams)) {
 | 
						|
        $teams = explode(',', $teams);
 | 
						|
      } else {
 | 
						|
        $teams = Array();
 | 
						|
      }
 | 
						|
    }
 | 
						|
    
 | 
						|
    $this->_teams = $teams;
 | 
						|
  }
 | 
						|
  
 | 
						|
  function Auth_OpenID_TeamsRequest($teams) {
 | 
						|
    $this->__init($teams);
 | 
						|
  }
 | 
						|
}
 | 
						|
 | 
						|
/**
 | 
						|
 * The team/group extension response class
 | 
						|
 */
 | 
						|
class Auth_OpenID_TeamsResponse extends Auth_OpenID_TeamsExtension {
 | 
						|
  var $_teams = array();
 | 
						|
  
 | 
						|
  function __init(&$resp, $signed_only=true) {
 | 
						|
    $this->ns_uri = $this->_getExtensionNS($resp->message);
 | 
						|
    
 | 
						|
    if ($signed_only) {
 | 
						|
      $args = $resp->getSignedNS($this->ns_uri);
 | 
						|
    } else {
 | 
						|
      $args = $resp->message->getArgs($this->ns_uri);
 | 
						|
    }
 | 
						|
    
 | 
						|
    if ($args === null) {
 | 
						|
      return null;
 | 
						|
    }
 | 
						|
    
 | 
						|
    // An OpenID 2.0 response will handle the namespaces
 | 
						|
    if (in_array($this->response_field, array_keys($args)) && !empty($args[$this->response_field])) {
 | 
						|
      $this->_teams = explode(',', $args[$this->response_field]);
 | 
						|
    }
 | 
						|
    
 | 
						|
    // Piggybacking on a 1.x request, however, won't so the field name will
 | 
						|
    // be different
 | 
						|
    elseif (in_array($this->ns_alias.'.'.$this->response_field, array_keys($args)) && !empty($args[$this->ns_alias.'.'.$this->response_field])) {
 | 
						|
      $this->_teams = explode(',', $args[$this->ns_alias.'.'.$this->response_field]);
 | 
						|
    }
 | 
						|
  }
 | 
						|
  
 | 
						|
  function Auth_OpenID_TeamsResponse(&$resp, $signed_only=true) {
 | 
						|
    $this->__init($resp, $signed_only);
 | 
						|
  }
 | 
						|
  
 | 
						|
  /**
 | 
						|
   * Get the array of teams the user is a member of
 | 
						|
   *
 | 
						|
   * @return array
 | 
						|
   */
 | 
						|
  function getTeams() {
 | 
						|
    return $this->_teams;
 | 
						|
  }
 | 
						|
}
 | 
						|
 | 
						|
?>
 |