OpenID 分类中的最新日记

最新的，支持 check_authentication 验证

演示地址：http://www.freebapp.org/tools/openid/

参考：
上一次的版本
OpenID登陆！
Yahoo的OpenID登陆
Windows Live ID当作OpenID使用的方法
Google的OpenID的登陆

演示地址：http://www.freebapp.org/tools/openid/

参考：
OpenID登陆！
Yahoo的OpenID登陆
Windows Live ID当作OpenID使用的方法
Google的OpenID的登陆

这个就不用说太多了，是标准的！

		if(empty($_REQUEST['openid_mode'])){
			if(empty($_REQUEST['OpenID']))
				LocationHtml($LoginUrl, 'OpenID is null!');
			$openid_url = formUrl($_REQUEST['OpenID']);
			$openid_server_list = getOpenIDServer($openid_url);
			if(empty($openid_server_list))
				LocationHtml($LoginUrl, 'OpenID server is null!');

			if(!empty($openid_server_list[1]))
				$openid_server = $openid_server_list[1];
			if(!empty($openid_server_list[2]))
				$openid_server = $openid_server_list[2];
			$data['openid.ns'] = 'http://specs.openid.net/auth/2.0';
			$data['openid.mode'] = 'associate';
			$data['openid.assoc_type'] = 'HMAC-SHA1';
			$data['openid.session_type'] = 'no-encryption';
			$AssocHandle = getAssociationHandle($openid_server.'?'.http_build_query($data));
			setcookie('cookieAssocHandle', $AssocHandle);
			unset($data);

			$data['openid.assoc_handle'] = $AssocHandle;
			$data['openid.ax.mode'] = 'fetch_request';
			$data['openid.ax.required'] = 'attr1,attr2,attr3,attr4,attr5';
			$data['openid.ax.type.attr1'] = 'http://axschema.org/contact/email';
			$data['openid.ax.type.attr2'] = 'http://axschema.org/namePerson/first';
			$data['openid.ax.type.attr3'] = 'http://axschema.org/namePerson/last';
			$data['openid.ax.type.attr4'] = 'http://axschema.org/contact/country/home';
			$data['openid.ax.type.attr5'] = 'http://axschema.org/pref/language';
			$data['openid.claimed_id'] = $openid_url;
			$data['openid.identity'] = $openid_url;
			$data['openid.mode'] = 'checkid_setup';
			$data['openid.ns'] = 'http://specs.openid.net/auth/2.0';
			$data['openid.ns.ax'] = 'http://openid.net/srv/ax/1.0';
			$data['openid.ns.sreg'] = 'http://openid.net/extensions/sreg/1.1';
			$data['openid.realm'] = $RealmUrl;
			$data['openid.return_to'] = $AuthUrl;
			$data['openid.sreg.optional'] = 'nickname,email,fullname,dob,gender,postcode,country,language,timezone';
			$data['openid.sreg.policy_url'] = $PolicyUrl;
			$data['openid.sreg.required'] = 'email';
			$data['openid.trust_root'] = $RealmUrl;

			$LocationUrl  = $openid_server.'?'.http_build_query($data);
		}else{
			if('id_res' == $_REQUEST['openid_mode']
				&& $AssocHandle == $_REQUEST['openid_assoc_handle']){
				$openid = !empty($_REQUEST['openid_claimed_id']) ? formUrl($_REQUEST['openid_claimed_id']) : formUrl($_REQUEST['openid_identity']);
				$email = $_REQUEST['openid_sreg_email'];
				$fullname = $_REQUEST['openid_sreg_fullname'];
				$nickname = $_REQUEST['openid_sreg_nickname'];
				$timezone = $_REQUEST['openid_sreg_timezone'];
				echo('<pre>');
				echo("<a href=$LoginUrl>BACK</a>\n\n");
				print_r($_REQUEST);
				echo('</pre>');
			}
		}
		break;

部分函数请参考：
Yahoo的OpenID登陆
Windows Live ID当作OpenID使用的方法
Google的OpenID的登陆

前两次写了Windows Live ID当作OpenID使用的方法和Google的OpenID的登陆，这次写Yahoo的OpenID的实现方法。

先说一下Yahoo的OpenID仅有Plaxo等几个网站可以获取用户属性，所以暂时不要考虑这个东西吧。

而且Yahoo还会出现了下面这段警告：

Warning: This website has not confirmed its identity with Yahoo! and might be fraudulent. Do not share any personal information with this website unless you are certain it is legitimate.

你是不是很郁闷呢？其实解决方法很简单，请参考：http://tihualong.javaeye.com/blog/309246

...

因为其他的OpenID提供者同时支持OpenID1.1与OpenID2.0协议，但是Yahoo的程序员像我们一样不喜欢考虑兼容性的问题。只支持OpenID2.0协议标准。

那么OpenID2.0协议标准有什么特殊的地方呢？

OpenID2.0中提出了一个新的东西叫做OpenID Relying Party discovery的，我们的问题就出在这个OpenID Relying Party discovery上。

先解释一下这个OpenID Relying Party discovery是什么东西。

当你重定向到OpenID提供者站点去请求认证的时候，OpenID提供者会使用这个叫做OpenID Relying Party discovery的机制自动验证return_to的URL处于指定的范围内，并且与OP通过realm参数获取到的XRDS文档中获取到的return_to的URL相同。

我是这么理解的：我的Consumer程序告诉了OP我的return_to地址是什么，但是OP不信任我，要通过我的realm参数(注意：这个地方是OP向RP发出的请求，所以要求你realm参数的url必须是外网的ip地址或者能通过外部的DNS查找到的域名)查找一个基于yadis协议的XRDS文档中的return_to地址，两个return_to地址相比较，如果相同，好，我相信你了，放行。(不知道这样理解有没有问题，我觉得应该没问题吧)

好，原理理解了。下面我们要做的就是：

1、 编写一个XRDS文档保存到你的网站上，存放成什么扩展名的没什么关系，但是你要保证Yahoo或者其他OP获取到这个文档的Content-Type是" application/xrds+xml"，不然他们会认为这个文档不是他们要找的文档。

2、 将你第一步编写的XRDS文档的地址公布在你网站的首页，或者你的openid.realm参数指定的页面上(建议)

我们先来编写XRDS文档：(起名xrds.php)

<?php
header('Content-type: application/xrds+xml');
?>
<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS
xmlns:xrds="xri://$xrds"
xmlns:openid="http://openid.net/xmlns/1.0"
xmlns="xri://$xrd*($v*2.0)">
<XRD>
<Service priority="1">
<Type>http://specs.openid.net/auth/2.0/return_to</Type>
<URI>改成你的return_url地址</URI>
</Service>
</XRD>
</xrds:XRDS>

将你编写的XRDS文档的地址公布在openid.realm指定的页面，建议单独写一个页面维护，然后设置openid.realm参数为你创建的这个页面

<?php
header('X-XRDS-Location: 改成你的xrds.php地址');
?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta http-equiv="X-XRDS-Location" content="改成你的xrds.php地址"/>
</head>
<body>
网页内容
</body>
</html>

if(empty($_REQUEST['openid_mode'])){
$openid_server = 'https://open.login.yahooapis.com/openid/op/auth';
$data['openid.ns'] = 'http://specs.openid.net/auth/2.0';
$data['openid.mode'] = 'associate';
$data['openid.assoc_type'] = 'HMAC-SHA1';
$data['openid.session_type'] = 'no-encryption';
$AssocHandle = getAssociationHandle($openid_server.'?'.http_build_query($data));
setcookie('cookieAssocHandle', $AssocHandle);
unset($data);

$data['openid.assoc_handle'] = $AssocHandle;
$data['openid.ax.mode'] = 'fetch_request';
$data['openid.ax.required'] = 'attr1,attr2,attr3,attr4,attr5';
$data['openid.ax.type.attr1'] = 'http://axschema.org/contact/email';
$data['openid.ax.type.attr2'] = 'http://axschema.org/namePerson/first';
$data['openid.ax.type.attr3'] = 'http://axschema.org/namePerson/last';
$data['openid.ax.type.attr4'] = 'http://axschema.org/contact/country/home';
$data['openid.ax.type.attr5'] = 'http://axschema.org/pref/language';
$data['openid.claimed_id'] = 'http://specs.openid.net/auth/2.0/identifier_select';
$data['openid.identity'] = 'http://specs.openid.net/auth/2.0/identifier_select';
$data['openid.mode'] = 'checkid_setup';
$data['openid.ns'] = 'http://specs.openid.net/auth/2.0';
$data['openid.ns.ax'] = 'http://openid.net/srv/ax/1.0';
$data['openid.ns.sreg'] = 'http://openid.net/extensions/sreg/1.1';
$data['openid.realm'] = $RealmUrl;
$data['openid.return_to'] = $AuthUrl;
$data['openid.sreg.optional'] = 'nickname,email,fullname,dob,gender,postcode,country,language,timezone';
$data['openid.sreg.policy_url'] = $PolicyUrl;
$data['openid.sreg.required'] = 'email';
$data['openid.trust_root'] = $RealmUrl;
//$data['xopenid_lang_pref'] = 'tw';

$LocationUrl = $openid_server.'?'.http_build_query($data);
}else{
if('id_res' == $_REQUEST['openid_mode']
&& $AssocHandle == $_REQUEST['openid_assoc_handle']){
$openid = !empty($_REQUEST['openid_identity']) ? formUrl($_REQUEST['openid_identity']) : formUrl($_REQUEST['openid_claimed_id']);
$email = $_REQUEST['openid_sreg_email'];
$fullname = $_REQUEST['openid_sreg_fullname'];
$nickname = $_REQUEST['openid_sreg_nickname'];
$timezone = $_REQUEST['openid_sreg_timezone'];
}
echo('<pre>');
echo("<a href=$LoginUrl>BACK</a>\n\n");
print_r($_REQUEST);
echo('</pre>');
}

注意：有部分函数和变量有遗漏，请参考Windows Live ID当作OpenID使用的方法和Google的OpenID的登陆。

上次写了Windows Live ID当作OpenID使用的方法，这次写Google的OpenID的实现方法。

 if(empty($_REQUEST['openid_mode'])){
  $openid_server = getXrdsUri('https://www.google.com/accounts/o8/id');
  $data['openid.ns'] = 'http://specs.openid.net/auth/2.0';
  $data['openid.mode'] = 'associate';
  $data['openid.assoc_type'] = 'HMAC-SHA1';
  $data['openid.session_type'] = 'no-encryption';
  $AssocHandle = getAssociationHandle($openid_server.'?'.http_build_query($data));
  setcookie('cookieAssocHandle', $AssocHandle);
  unset($data);

  $data['openid.ns'] = 'http://specs.openid.net/auth/2.0';
  $data['openid.claimed_id'] = 'http://specs.openid.net/auth/2.0/identifier_select';
  $data['openid.identity'] = 'http://specs.openid.net/auth/2.0/identifier_select';
  $data['openid.return_to'] = $AuthUrl;
  $data['openid.realm'] = $RealmUrl;
  $data['openid.assoc_handle'] = $AssocHandle;
  $data['openid.mode'] = 'checkid_setup';
  $data['openid.ns.ext1'] = 'http://openid.net/srv/ax/1.0';
  $data['openid.ext1.mode'] = 'fetch_request';
  $data['openid.ext1.type.email'] = 'http://axschema.org/contact/email';
  $data['openid.ext1.required'] = 'email';

  $LocationUrl  = $openid_server.'?'.http_build_query($data);
 }else{
  if('id_res' == $_REQUEST['openid_mode']
   && $AssocHandle == $_REQUEST['openid_assoc_handle']){
   $openid = !empty($_REQUEST['openid_ext1_value_email']) ? $_REQUEST['openid_ext1_value_email'] : formUrl($_REQUEST['openid_claimed_id']);
   $email = $_REQUEST['openid_ext1_value_email'];
  }
  echo('<pre>');
  echo("<a href=$LoginUrl>BACK</a>\n\n");
  print_r($_REQUEST);
  echo('</pre>');
 }

function getAssociationHandle($url){
$c = curl_init($url);

curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
curl_setopt($c, CURLOPT_HEADER, false);
curl_setopt($c, CURLOPT_SSL_VERIFYPEER, false);

$contents = curl_exec($c);
//print_r($contents);
//exit;

curl_close($c);

$assoc_handle = time();

$lines = explode("\n", $contents);

foreach($lines as $line){
 if(substr($line, 0, 13) == "assoc_handle:"){
  $assoc_handle = substr($line, 13);
  break;
 }
}

return $assoc_handle;
}

function getXrdsUri($url){
$c = curl_init($url);

curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
curl_setopt($c, CURLOPT_HEADER, false);
curl_setopt($c, CURLOPT_SSL_VERIFYPEER, false);

$request_contents = curl_exec($c);

curl_close($c);

$domdoc = new DOMDocument();
$domdoc->loadXML($request_contents);

$uri = $domdoc->getElementsByTagName("URI");
$uri = $uri->item(0)->nodeValue;

return $uri;
}

if(empty($openid))
LocationHtml($LocationUrl);

LocationHtml函数见Windows Live ID当作OpenID使用的方法。

注意：Google的OpenID的openid.claimed_id（即OpenID）的值，随不同网站变化，网站不同值也不同，所以不是真正的OpenID，Google真正的OpenID是他的Email。但是Email也不是每次都可以取得到的，如果你在Google的授权页面上点选了"允许 XXX 记住我"，再次登录时将略过授权页面，同时也将得不到Email的值。只有Google帐号的所有者在个人设置里更改获授权网站，将你的网站撤销访问权，才能再次得到Email的值。

Google的OpenID是个被阉割的OpenID，除了提供Email的值之外，其他一概不提供！

参考：http://code.google.com/intl/zh-CN/apis/accounts/docs/OpenID.html