scripts/openid.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Single signon for phpMyAdmin using OpenID
   5  *
   6  * This is just example how to use single signon with phpMyAdmin, it is
   7  * not intended to be perfect code and look, only shows how you can
   8  * integrate this functionality in your application.
   9  *
  10  * It uses OpenID pear package, see http://pear.php.net/package/OpenID
  11  *
  12  * User first authenticates using OpenID and based on content of $AUTH_MAP
  13  * the login information is passed to phpMyAdmin in session data.
  14  *
  15  * @package phpMyAdmin
  16  * @subpackage Example
  17  */
  18
  19 require_once 'OpenID/RelyingParty.php';
  20
  21 /**
  22  * Map of authenticated users to MySQL user/password pairs.
  23  */
  24 $AUTH_MAP = array(
  25     'http://launchpad.net/~username' => array(
  26         'user' => 'root',
  27         'password' => '',
  28         ),
  29     );
  30
  31 /**
  32  * Simple function to show HTML page with given content.
  33  */
  34 function show_page($contents)
  35 {
  36     header('Content-Type: text/html; charset=utf-8');
  37     echo '<?xml version="1.0" encoding="utf-8"?>' . "\n";
  38     ?>
  39 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  40     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  41 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
  42 <head>
  43     <link rel="icon" href="../favicon.ico" type="image/x-icon" />
  44     <link rel="shortcut icon" href="../favicon.ico" type="image/x-icon" />
  45     <title>phpMyAdmin OpenID signon example</title>
  46 </head>
  47 <body>
  48 <?php
  49 if (isset($_SESSION) && isset($_SESSION['PMA_single_signon_error_message'])) {
  50     echo '<p class="error">' . $_SESSION['PMA_single_signon_message'] . '</p>';
  51     unset($_SESSION['PMA_single_signon_message']);
  52 }
  53 echo $contents;
  54 ?>
  55 </body>
  56 </html>
  57 <?php
  58 }
  59
  60 /* Need to have cookie visible from parent directory */
  61 session_set_cookie_params(0, '/', '', 0);
  62 /* Create signon session */
  63 $session_name = 'SignonSession';
  64 session_name($session_name);
  65 session_start();
  66
  67 // Determine realm and return_to
  68 $base = 'http';
  69 if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') {
  70     $base .= 's';
  71 }
  72 $base .= '://' . $_SERVER['SERVER_NAME'] . ':' . $_SERVER['SERVER_PORT'];
  73
  74 $realm = $base . '/';
  75 $returnTo = $base . dirname($_SERVER['PHP_SELF']);
  76 if ($returnTo[strlen($returnTo) - 1] != '/') {
  77     $returnTo .= '/';
  78 }
  79 $returnTo .= 'openid.php';
  80
  81 /* Display form */
  82 if (!count($_GET) && !count($_POST) || isset($_GET['phpMyAdmin'])) {
  83     /* Show simple form */
  84     $content = '<form action="openid.php" method="post">
  85 OpenID: <input type="text" name="identifier" /><br />
  86 <input type="submit" name="start" />
  87 </form>
  88 </body>
  89 </html>';
  90     show_page($content);
  91     exit;
  92 }
  93
  94 /* Grab identifier */
  95 if (isset($_POST['identifier'])) {
  96     $identifier = $_POST['identifier'];
  97 } else if (isset($_SESSION['identifier'])) {
  98     $identifier = $_SESSION['identifier'];
  99 } else {
 100     $identifier = null;
 101 }
 102
 103 /* Create OpenID object */
 104 try {
 105     $o = new OpenID_RelyingParty($returnTo, $realm, $identifier);
 106 } catch (OpenID_Exception $e) {
 107     $contents = "<div class='relyingparty_results'>\n";
 108     $contents .= "<pre>" . $e->getMessage() . "</pre>\n";
 109     $contents .= "</div class='relyingparty_results'>";
 110     show_page($contents);
 111     exit;
 112 }
 113
 114 /* Redirect to OpenID provider */
 115 if (isset($_POST['start'])) {
 116     try {
 117         $authRequest = $o->prepare();
 118     } catch (OpenID_Exception $e) {
 119         $contents = "<div class='relyingparty_results'>\n";
 120         $contents .= "<pre>" . $e->getMessage() . "</pre>\n";
 121         $contents .= "</div class='relyingparty_results'>";
 122         show_page($contents);
 123         exit;
 124     }
 125
 126     $url = $authRequest->getAuthorizeURL();
 127
 128     header("Location: $url");
 129     exit;
 130 } else {
 131     /* Grab query string */
 132     if (!count($_POST)) {
 133         list(, $queryString) = explode('?', $_SERVER['REQUEST_URI']);
 134     } else {
 135         // I hate php sometimes
 136         $queryString = file_get_contents('php://input');
 137     }
 138
 139     /* Check reply */
 140     $message = new OpenID_Message($queryString, OpenID_Message::FORMAT_HTTP);
 141
 142     $id = $message->get('openid.claimed_id');
 143
 144     if (!empty($id) && isset($AUTH_MAP[$id])) {
 145         $_SESSION['PMA_single_signon_user'] = $AUTH_MAP[$id]['user'];
 146         $_SESSION['PMA_single_signon_password'] = $AUTH_MAP[$id]['password'];
 147         session_write_close();
 148         /* Redirect to phpMyAdmin (should use absolute URL here!) */
 149         header('Location: ../index.php');
 150     } else {
 151         show_page('<p>User not allowed!</p>');
 152         exit;
 153     }
 154 }