1 package Catalyst::Authentication::Credential::OpenID;
3 use warnings; no warnings "uninitialized"; # 321
4 use parent "Class::Accessor::Fast";
7 __PACKAGE__->mk_accessors(qw/ _config realm debug secret /);
10 our $VERSION = "0.12";
12 use Net::OpenID::Consumer;
13 use Catalyst::Exception ();
16 my ( $class, $config, $c, $realm ) = @_;
17 my $self = { _config => { %{ $config },
23 # 2.0 spec says "SHOULD" be named "openid_identifier."
24 $self->_config->{openid_field} ||= "openid_identifier";
26 $self->debug( $self->_config->{debug} );
28 my $secret = $self->_config->{consumer_secret} ||= join("+",
31 sort keys %{ $c->config }
34 $secret = substr($secret,0,255) if length $secret > 255;
35 $self->secret($secret);
36 $self->_config->{ua_class} ||= "LWPx::ParanoidAgent";
38 my $agent_class = $self->_config->{ua_class};
39 eval "require $agent_class"
40 or Catalyst::Exception->throw("Could not 'require' user agent class " .
41 $self->_config->{ua_class});
43 $c->log->debug("Setting consumer secret: " . $secret) if $self->debug;
48 sub authenticate : method {
49 my ( $self, $c, $realm, $authinfo ) = @_;
51 $c->log->debug("authenticate() called from " . $c->request->uri) if $self->debug;
53 my $field = $self->{_config}->{openid_field};
55 my $claimed_uri = $authinfo->{ $field };
57 # Its security related so we want to be explicit about GET/POST param retrieval.
58 $claimed_uri ||= $c->req->method eq 'GET' ?
59 $c->req->query_params->{ $field } : $c->req->body_params->{ $field };
61 my $csr = Net::OpenID::Consumer->new(
62 ua => $self->_config->{ua_class}->new(%{$self->_config->{ua_args} || {}}),
63 args => $c->req->params,
64 consumer_secret => $self->secret,
69 my $current = $c->uri_for($c->req->uri->path); # clear query/fragment...
71 my $identity = $csr->claimed_identity($claimed_uri)
72 or Catalyst::Exception->throw($csr->err);
74 $identity->set_extension_args(@{$self->_config->{extension_args}})
75 if $self->_config->{extension_args};
77 my $check_url = $identity->check_url(
78 return_to => $current . '?openid-check=1',
79 trust_root => $current,
82 $c->res->redirect($check_url);
85 elsif ( $c->req->params->{'openid-check'} )
87 if ( my $setup_url = $csr->user_setup_url )
89 $c->res->redirect($setup_url);
92 elsif ( $csr->user_cancel )
96 elsif ( my $identity = $csr->verified_identity )
98 # This is where we ought to build an OpenID user and verify against the spec.
99 my $user = +{ map { $_ => scalar $identity->$_ }
100 qw( url display rss atom foaf declared_rss declared_atom declared_foaf foafmaker ) };
102 for(keys %{$self->{_config}->{extensions}}) {
103 $user->{extensions}->{$_} = $identity->signed_extension_fields($_);
106 my $user_obj = $realm->find_user($user, $c);
114 $c->log->debug("Verified OpenID identity failed to load with find_user; bad user_class? Try 'Null.'") if $c->debug;
120 Catalyst::Exception->throw("Error validating identity: " .
133 Catalyst::Authentication::Credential::OpenID - OpenID credential for Catalyst::Plugin::Authentication framework.
146 Session::Store::FastMmap
147 Session::State::Cookie
150 Somewhere in myapp.conf-
152 <Plugin::Authentication>
159 ua_class LWPx::ParanoidAgent
162 </Plugin::Authentication>
164 Or in your myapp.yml if you're using L<YAML> instead-
166 Plugin::Authentication:
167 default_realm: openid
172 ua_class: LWPx::ParanoidAgent
174 In a controller, perhaps C<Root::openid>-
179 if ( $c->authenticate() )
181 $c->flash(message => "You signed in with OpenID!");
182 $c->res->redirect( $c->uri_for('/') );
186 # Present OpenID form.
190 And a L<Template> to match in C<openid.tt>-
192 <form action="[% c.uri_for('/openid') %]" method="GET" name="openid">
193 <input type="text" name="openid_identifier" class="openid" />
194 <input type="submit" value="Sign in with OpenID" />
199 This is the B<third> OpenID related authentication piece for
200 L<Catalyst>. The first E<mdash> L<Catalyst::Plugin::Authentication::OpenID>
201 by Benjamin Trott E<mdash> was deprecated by the second E<mdash>
202 L<Catalyst::Plugin::Authentication::Credential::OpenID> by Tatsuhiko
203 Miyagawa E<mdash> and this is an attempt to deprecate both by conforming to
204 the newish, at the time of this module's inception, realm-based
205 authentication in L<Catalyst::Plugin::Authentication>.
207 1. Catalyst::Plugin::Authentication::OpenID
208 2. Catalyst::Plugin::Authentication::Credential::OpenID
209 3. Catalyst::Authentication::Credential::OpenID
211 The benefit of this version is that you can use an arbitrary number of
212 authentication systems in your L<Catalyst> application and configure
213 and call all of them in the same way.
215 Note that both earlier versions of OpenID authentication use the method
216 C<authenticate_openid()>. This module uses C<authenticate()> and
217 relies on you to specify the realm. You can specify the realm as the
218 default in the configuration or inline with each
219 C<authenticate()> call; more below.
221 This module functions quite differently internally from the others.
222 See L<Catalyst::Plugin::Authentication::Internals> for more about this
229 =item $c->authenticate({},"your_openid_realm");
231 Call to authenticate the user via OpenID. Returns false if
232 authorization is unsuccessful. Sets the user into the session and
233 returns the user object if authentication succeeds.
235 You can see in the call above that the authentication hash is empty.
236 The implicit OpenID parameter is, as the 2.0 specification says it
237 SHOULD be, B<openid_identifier>. You can set it anything you like in
238 your realm configuration, though, under the key C<openid_field>. If
239 you call C<authenticate()> with the empty info hash and no configured
240 C<openid_field> then only C<openid_identifier> is checked.
242 It implicitly does this (sort of, it checks the request method too)-
244 my $claimed_uri = $c->req->params->{openid_identifier};
245 $c->authenticate({openid_identifier => $claimed_uri});
247 =item Catalyst::Authentication::Credential::OpenID->new()
249 You will never call this. Catalyst does it for you. The only important
250 thing you might like to know about it is that it merges its realm
251 configuration with its configuration proper. If this doesn't mean
252 anything to you, don't worry.
258 Currently the only supported user class is L<Catalyst::Plugin::Authentication::User::Hash>.
264 =item $c->user->display
272 =item $c->user->declared_rss
274 =item $c->user->declared_atom
276 =item $c->user->declared_foaf
278 =item $c->user->foafmaker
282 See L<Net::OpenID::VerifiedIdentity> for details.
286 Catalyst authentication is now configured entirely from your
287 application's configuration. Do not, for example, put
288 C<Credential::OpenID> into your C<use Catalyst ...> statement.
289 Instead, tell your application that in one of your authentication
290 realms you will use the credential.
292 In your application the following will give you two different
293 authentication realms. One called "members" which authenticates with
294 clear text passwords and one called "openid" which uses... uh, OpenID.
298 "Plugin::Authentication" => {
299 default_realm => "members",
304 password_field => "password",
305 password_type => "clear"
311 password => "l4s4v3n7ur45",
317 consumer_secret => "Don't bother setting",
318 ua_class => "LWPx::ParanoidAgent",
320 whitelisted_hosts => [qw/ 127.0.0.1 localhost /],
329 'http://openid.net/extensions/sreg/1.1',
332 optional => 'fullname,nickname,timezone',
340 This is the same configuration in the default L<Catalyst> configuration format from L<Config::General>.
343 <Plugin::Authentication>
344 default_realm members
351 password l4s4v3n7ur45
356 password_field password
363 whitelisted_hosts 127.0.0.1
364 whitelisted_hosts localhost
366 consumer_secret Don't bother setting
367 ua_class LWPx::ParanoidAgent
375 http://openid.net/extensions/sreg/1.1
377 optional fullname,nickname,timezone
381 </Plugin::Authentication>
383 And now, the same configuration in L<YAML>. B<NB>: L<YAML> is whitespace sensitive.
386 Plugin::Authentication:
387 default_realm: members
392 password_field: password
398 password: l4s4v3n7ur45
404 consumer_secret: Don't bother setting
405 ua_class: LWPx::ParanoidAgent
411 - http://openid.net/extensions/sreg/1.1
413 optional: fullname,nickname,timezone
415 B<NB>: There is no OpenID store yet.
417 =head2 EXTENSIONS TO OPENID
419 The L<Simple Registration|http://openid.net/extensions/sreg/1.1> (SREG) extension to OpenID is supported in the L<Net::OpenID> family now. Experimental support for it is included here as of v0.12. SREG is the only supported extension in OpenID 1.1. It's experimental in the sense it's a new interface and barely tested. Support for OpenID extensions is here to stay.
421 =head2 MORE ON CONFIGURATION
423 These are set in your realm. See above.
427 =item ua_args and ua_class
429 L<LWPx::ParanoidAgent> is the default agent E<mdash> C<ua_class>. You don't
430 have to set it. I recommend that you do B<not> override it. You can
431 with any well behaved L<LWP::UserAgent>. You probably should not.
432 L<LWPx::ParanoidAgent> buys you many defenses and extra security
433 checks. When you allow your application users freedom to initiate
434 external requests, you open a big avenue for DoS (denial of service)
435 attacks. L<LWPx::ParanoidAgent> defends against this.
436 L<LWP::UserAgent> and any regular subclass of it will not.
438 =item consumer_secret
440 The underlying L<Net::OpenID::Consumer> object is seeded with a
441 secret. If it's important to you to set your own, you can. The default
442 uses this package name + its version + the sorted configuration keys
443 of your Catalyst application (chopped at 255 characters if it's
444 longer). This should generally be superior to any fixed string.
450 Support more of the new methods in the L<Net::OpenID> kit.
452 There are some interesting implications with this sort of setup. Does
453 a user aggregate realms or can a user be signed in under more than one
454 realm? The documents could contain a recipe of the self-answering
455 OpenID end-point that is in the tests.
457 Debug statements need to be both expanded and limited via realm
460 Better diagnostics in errors. Debug info at all consumer calls.
462 Roles from provider domains? Mapped? Direct? A generic "openid" auto_role?
466 To Benjamin Trott (L<Catalyst::Plugin::Authentication::OpenID>), Tatsuhiko Miyagawa (L<Catalyst::Plugin::Authentication::Credential::OpenID>), Brad Fitzpatrick for the great OpenID stuff, Martin Atkins for picking up the code to handle OpenID 2.0, and Jay Kuri and everyone else who has made Catalyst such a wonderful framework.
468 L<Meno Blom|http://search.cpan.org/~blom/> provided a bug fix and the hook to use OpenID extensions.
470 =head1 LICENSE AND COPYRIGHT
472 Copyright (c) 2008, Ashley Pond V C<< <ashley@cpan.org> >>. Some of Tatsuhiko Miyagawa's work is reused here.
474 This module is free software; you can redistribute it and modify it under the same terms as Perl itself. See L<perlartistic>.
476 =head1 DISCLAIMER OF WARRANTY
478 Because this software is licensed free of charge, there is no warranty
479 for the software, to the extent permitted by applicable law. Except when
480 otherwise stated in writing the copyright holders and other parties
481 provide the software "as is" without warranty of any kind, either
482 expressed or implied, including, but not limited to, the implied
483 warranties of merchantability and fitness for a particular purpose. The
484 entire risk as to the quality and performance of the software is with
485 you. Should the software prove defective, you assume the cost of all
486 necessary servicing, repair, or correction.
488 In no event unless required by applicable law or agreed to in writing
489 will any copyright holder, or any other party who may modify or
490 redistribute the software as permitted by the above license, be
491 liable to you for damages, including any general, special, incidental,
492 or consequential damages arising out of the use or inability to use
493 the software (including but not limited to loss of data or data being
494 rendered inaccurate or losses sustained by you or third parties or a
495 failure of the software to operate with any other software), even if
496 such holder or other party has been advised of the possibility of
505 L<Net::OpenID::Server>, L<Net::OpenID::VerifiedIdentity>, L<Net::OpenID::Consumer>, L<http://openid.net/>, L<http://openid.net/developers/specs/>, and L<http://openid.net/extensions/sreg/1.1>.
507 =item Catalyst Authentication
509 L<Catalyst>, L<Catalyst::Plugin::Authentication>, L<Catalyst::Manual::Tutorial::Authorization>, and L<Catalyst::Manual::Tutorial::Authentication>.
511 =item Catalyst Configuration
513 L<Catalyst::Plugin::ConfigLoader>, L<Config::General>, and L<YAML>.
517 L<Catalyst::Manual::Tutorial>, L<Template>, L<LWPx::ParanoidAgent>.