examples/openid.php

   1 <?php
   2 /**
   3  * Single signon for phpMyAdmin using OpenID
   4  *
   5  * This is just example how to use single signon with phpMyAdmin, it is
   6  * not intended to be perfect code and look, only shows how you can
   7  * integrate this functionality in your application.
   8  *
   9  * It uses OpenID pear package, see https://pear.php.net/package/OpenID
  10  *
  11  * User first authenticates using OpenID and based on content of $AUTH_MAP
  12  * the login information is passed to phpMyAdmin in session data.
  13  */
  14 declare(strict_types=1);
  15
  16 if (false === @include_once 'OpenID/RelyingParty.php') {
  17     exit;
  18 }
  19
  20 /* Change this to true if using phpMyAdmin over https */
  21 $secure_cookie = false;
  22
  23 /**
  24  * Map of authenticated users to MySQL user/password pairs.
  25  */
  26 $AUTH_MAP = [
  27     'https://launchpad.net/~username' => [
  28         'user' => 'root',
  29         'password' => '',
  30     ],
  31 ];
  32
  33 // phpcs:disable PSR1.Files.SideEffects
  34
  35 /**
  36  * Simple function to show HTML page with given content.
  37  *
  38  * @param string $contents Content to include in page
  39  *
  40  * @return void
  41  */
  42 function Show_page($contents)
  43 {
  44     header('Content-Type: text/html; charset=utf-8');
  45     echo '<?xml version="1.0" encoding="utf-8"?>' , "\n";
  46     ?>
  47     <!DOCTYPE HTML>
  48     <html lang="en" dir="ltr">
  49     <head>
  50     <link rel="icon" href="../favicon.ico" type="image/x-icon">
  51     <link rel="shortcut icon" href="../favicon.ico" type="image/x-icon">
  52     <meta charset="utf-8">
  53     <title>phpMyAdmin OpenID signon example</title>
  54     </head>
  55     <body>
  56     <?php
  57     if (isset($_SESSION['PMA_single_signon_error_message'])) {
  58         echo '<p class="error">' , $_SESSION['PMA_single_signon_message'] , '</p>';
  59         unset($_SESSION['PMA_single_signon_message']);
  60     }
  61     echo $contents;
  62     ?>
  63     </body>
  64     </html>
  65     <?php
  66 }
  67
  68 /**
  69  * Display error and exit
  70  *
  71  * @param Exception $e Exception object
  72  *
  73  * @return void
  74  */
  75 function Die_error($e)
  76 {
  77     $contents = "<div class='relyingparty_results'>\n";
  78     $contents .= '<pre>' . htmlspecialchars($e->getMessage()) . "</pre>\n";
  79     $contents .= "</div class='relyingparty_results'>";
  80     Show_page($contents);
  81     exit;
  82 }
  83
  84 // phpcs:enable
  85
  86 /* Need to have cookie visible from parent directory */
  87 session_set_cookie_params(0, '/', '', $secure_cookie, true);
  88 /* Create signon session */
  89 $session_name = 'SignonSession';
  90 session_name($session_name);
  91 @session_start();
  92
  93 // Determine realm and return_to
  94 $base = 'http';
  95 if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') {
  96     $base .= 's';
  97 }
  98 $base .= '://' . $_SERVER['SERVER_NAME'] . ':' . $_SERVER['SERVER_PORT'];
  99
 100 $realm = $base . '/';
 101 $returnTo = $base . dirname($_SERVER['PHP_SELF']);
 102 if ($returnTo[strlen($returnTo) - 1] != '/') {
 103     $returnTo .= '/';
 104 }
 105 $returnTo .= 'openid.php';
 106
 107 /* Display form */
 108 if (! count($_GET) && ! count($_POST) || isset($_GET['phpMyAdmin'])) {
 109     /* Show simple form */
 110     $content = '<form action="openid.php" method="post">
 111 OpenID: <input type="text" name="identifier"><br>
 112 <input type="submit" name="start">
 113 </form>
 114 </body>
 115 </html>';
 116     Show_page($content);
 117     exit;
 118 }
 119
 120 /* Grab identifier */
 121 if (isset($_POST['identifier']) && is_string($_POST['identifier'])) {
 122     $identifier = $_POST['identifier'];
 123 } elseif (isset($_SESSION['identifier']) && is_string($_SESSION['identifier'])) {
 124     $identifier = $_SESSION['identifier'];
 125 } else {
 126     $identifier = null;
 127 }
 128
 129 /* Create OpenID object */
 130 try {
 131     $o = new OpenID_RelyingParty($returnTo, $realm, $identifier);
 132 } catch (Throwable $e) {
 133     Die_error($e);
 134 }
 135
 136 /* Redirect to OpenID provider */
 137 if (isset($_POST['start'])) {
 138     try {
 139         $authRequest = $o->prepare();
 140     } catch (Throwable $e) {
 141         Die_error($e);
 142     }
 143
 144     $url = $authRequest->getAuthorizeURL();
 145
 146     header('Location: ' . $url);
 147     exit;
 148 } else {
 149     /* Grab query string */
 150     if (! count($_POST)) {
 151         list(, $queryString) = explode('?', $_SERVER['REQUEST_URI']);
 152     } else {
 153         // I hate php sometimes
 154         $queryString = file_get_contents('php://input');
 155     }
 156
 157     /* Check reply */
 158     try {
 159         $message = new OpenID_Message($queryString, OpenID_Message::FORMAT_HTTP);
 160     } catch (Throwable $e) {
 161         Die_error($e);
 162     }
 163
 164     $id = $message->get('openid.claimed_id');
 165
 166     if (! empty($id) && isset($AUTH_MAP[$id])) {
 167         $_SESSION['PMA_single_signon_user'] = $AUTH_MAP[$id]['user'];
 168         $_SESSION['PMA_single_signon_password'] = $AUTH_MAP[$id]['password'];
 169         session_write_close();
 170         /* Redirect to phpMyAdmin (should use absolute URL here!) */
 171         header('Location: ../index.php');
 172     } else {
 173         Show_page('<p>User not allowed!</p>');
 174         exit;
 175     }
 176 }