examples/openid.php

   1 <?php
   2 /**
   3  * Single signon for phpMyAdmin using OpenID
   4  *
   5  * This is just example how to use single signon with phpMyAdmin, it is
   6  * not intended to be perfect code and look, only shows how you can
   7  * integrate this functionality in your application.
   8  *
   9  * It uses OpenID pear package, see https://pear.php.net/package/OpenID
  10  *
  11  * User first authenticates using OpenID and based on content of $AUTH_MAP
  12  * the login information is passed to phpMyAdmin in session data.
  13  */
  14
  15 declare(strict_types=1);
  16
  17 if (false === @include_once 'OpenID/RelyingParty.php') {
  18     exit;
  19 }
  20
  21 /* Change this to true if using phpMyAdmin over https */
  22 $secure_cookie = false;
  23
  24 /**
  25  * Map of authenticated users to MySQL user/password pairs.
  26  */
  27 $AUTH_MAP = [
  28     'https://launchpad.net/~username' => [
  29         'user' => 'root',
  30         'password' => '',
  31     ],
  32 ];
  33
  34 // phpcs:disable PSR1.Files.SideEffects,Squiz.Functions.GlobalFunction
  35
  36 /**
  37  * Simple function to show HTML page with given content.
  38  *
  39  * @param string $contents Content to include in page
  40  *
  41  * @return void
  42  */
  43 function Show_page($contents)
  44 {
  45     header('Content-Type: text/html; charset=utf-8');
  46
  47     echo '<?xml version="1.0" encoding="utf-8"?>' . "\n";
  48     echo '<!DOCTYPE HTML>
  49 <html lang="en" dir="ltr">
  50 <head>
  51 <link rel="icon" href="../favicon.ico" type="image/x-icon">
  52 <link rel="shortcut icon" href="../favicon.ico" type="image/x-icon">
  53 <meta charset="utf-8">
  54 <title>phpMyAdmin OpenID signon example</title>
  55 </head>
  56 <body>';
  57
  58     if (isset($_SESSION['PMA_single_signon_error_message'])) {
  59         echo '<p class="error">' . $_SESSION['PMA_single_signon_message'] . '</p>';
  60         unset($_SESSION['PMA_single_signon_message']);
  61     }
  62
  63     echo $contents;
  64     echo '</body></html>';
  65 }
  66
  67 /**
  68  * Display error and exit
  69  *
  70  * @param Exception $e Exception object
  71  *
  72  * @return void
  73  */
  74 function Die_error($e)
  75 {
  76     $contents = "<div class='relyingparty_results'>\n";
  77     $contents .= '<pre>' . htmlspecialchars($e->getMessage()) . "</pre>\n";
  78     $contents .= "</div class='relyingparty_results'>";
  79     Show_page($contents);
  80     exit;
  81 }
  82
  83 // phpcs:enable
  84
  85 /* Need to have cookie visible from parent directory */
  86 session_set_cookie_params(0, '/', '', $secure_cookie, true);
  87 /* Create signon session */
  88 $session_name = 'SignonSession';
  89 session_name($session_name);
  90 @session_start();
  91
  92 // Determine realm and return_to
  93 $base = 'http';
  94 if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
  95     $base .= 's';
  96 }
  97 $base .= '://' . $_SERVER['SERVER_NAME'] . ':' . $_SERVER['SERVER_PORT'];
  98
  99 $realm = $base . '/';
 100 $returnTo = $base . dirname($_SERVER['PHP_SELF']);
 101 if ($returnTo[strlen($returnTo) - 1] !== '/') {
 102     $returnTo .= '/';
 103 }
 104 $returnTo .= 'openid.php';
 105
 106 /* Display form */
 107 if ((! count($_GET) && ! count($_POST)) || isset($_GET['phpMyAdmin'])) {
 108     /* Show simple form */
 109     $content = '<form action="openid.php" method="post">
 110 OpenID: <input type="text" name="identifier"><br>
 111 <input type="submit" name="start">
 112 </form>';
 113     Show_page($content);
 114     exit;
 115 }
 116
 117 /* Grab identifier */
 118 if (isset($_POST['identifier']) && is_string($_POST['identifier'])) {
 119     $identifier = $_POST['identifier'];
 120 } elseif (isset($_SESSION['identifier']) && is_string($_SESSION['identifier'])) {
 121     $identifier = $_SESSION['identifier'];
 122 } else {
 123     $identifier = null;
 124 }
 125
 126 /* Create OpenID object */
 127 try {
 128     $o = new OpenID_RelyingParty($returnTo, $realm, $identifier);
 129 } catch (Throwable $e) {
 130     Die_error($e);
 131 }
 132
 133 /* Redirect to OpenID provider */
 134 if (isset($_POST['start'])) {
 135     try {
 136         $authRequest = $o->prepare();
 137     } catch (Throwable $e) {
 138         Die_error($e);
 139     }
 140
 141     $url = $authRequest->getAuthorizeURL();
 142
 143     header('Location: ' . $url);
 144     exit;
 145 }
 146
 147 /* Grab query string */
 148 if (! count($_POST)) {
 149     [, $queryString] = explode('?', $_SERVER['REQUEST_URI']);
 150 } else {
 151     // I hate php sometimes
 152     $queryString = file_get_contents('php://input');
 153 }
 154
 155 /* Check reply */
 156 try {
 157     $message = new OpenID_Message($queryString, OpenID_Message::FORMAT_HTTP);
 158 } catch (Throwable $e) {
 159     Die_error($e);
 160 }
 161
 162 $id = $message->get('openid.claimed_id');
 163
 164 if (empty($id) || ! isset($AUTH_MAP[$id])) {
 165     Show_page('<p>User not allowed!</p>');
 166     exit;
 167 }
 168
 169 $_SESSION['PMA_single_signon_user'] = $AUTH_MAP[$id]['user'];
 170 $_SESSION['PMA_single_signon_password'] = $AUTH_MAP[$id]['password'];
 171 $_SESSION['PMA_single_signon_HMAC_secret'] = hash('sha1', uniqid(strval(rand()), true));
 172 session_write_close();
 173 /* Redirect to phpMyAdmin (should use absolute URL here!) */
 174 header('Location: ../index.php');