OpenID module gotchas

Here is a copy of what I have so far. Currently it just does the OpenID Identity verification and prints out some messages indicating whether it was successful or not. In particular, the "doXXX" methods of the DrupalActionHandler need to actually do something.

<?php
// $Id: openid.module,v 1.9 2005/04/25 16:45:26 unconed Exp $

/**
 *  This module requires that you have version 0.0.8.X PHP-OpenID
 *  library somewhere where php can find it.
 *  The PHP-OpenID library is available at the following url:
 *
 *      http://videntity.org/openid/
 */
require_once( 'PHP-OpenID-0.0.8.3/openid/consumer.php' );


/**
 * Implements hook_help
 */
function openid_help($section) {
  switch ($section) {
  case 'admin/modules#description':
    return t('Allows users to authenticate via OpenID');
  }
}

/**
 * Return info for dist_auth usage
 */
function openid_info($field = 0) {
  $info['name'] = 'OpenID';

  if ($field) {
    return $info[$field];
  }
  else {
    return $info;
  }
}

/**
 * Implement hook_auth to show in available dist_auth list
 */
function openid_auth($username, $password, $server){
  return;
}

/**
 * Implementation of hook_block
 * Provides the OpenID login form
 */
function openid_block($op='list', $delta=0) {
  global $user;
  // listing of blocks, such as on the admin/block page
  if ($op == "list") {
    $block[0]["info"] = t("OpenID Login");
    return $block;
  } else {
    if (!$user->uid) {
      // set up the block
      $block['subject'] = 'OpenID Login';

      $content = "<div class=\"user-login-block\">\n";
      $content .= form_textfield(t('OpenID'), 'identity_url', $edit['identity_u\rl'], 15, 64);
      $content .= form_submit(t('Log in'));
      $content .= "</div>\n";
      $block['content'] = form($content, 'post', url('openid/login'));
      return $block;
    }
  }
}


/**
 * Menu entries
 * openid/login: Handles form submit from openid_block
 * openid/return: handles redirect return from identity server
 *
 */
function openid_menu($may_cache) {
  $items = array();

  if ($may_cache) {
    // OpenID Form submit
    $items[] = array('path' => 'openid/login', 'title' => t('openid login'),
                     'callback' => 'openid_login', 'type' => MENU_CALLBACK,
                     'access' => TRUE);
    $items[] = array('path' => 'openid/return', 'title' => t('openid return'),
                     'callback' => 'openid_ret', 'type' => MENU_CALLBACK,
                     'access' => TRUE);
  }

  return $items;
}


/**
 * Callback for the OpenID login form
 */
function openid_login() {
  $edit = $_POST['edit'];
  $op = $_POST['op'];

  $identity_url = $edit['identity_url'];

  $query = array_merge( $_GET, $_POST );
  $consumer = new DrupalConsumer(new DrupalHTTPClient());
  $handler = new DrupalActionHandler($query, $consumer);

  $ret = $consumer->find_identity_info($identity_url);
  if( !$ret ) {
    printf('Unable to find openid server for identity url %s', $identity_url);
  } else {
    // found identity server info
    list( $identity_url, $server_id, $server_url ) = $ret;

    $trust_root = url(NULL, NULL, NULL, TRUE);

    // build url to application for use in creating return_to
    $app_url = url('openid/return', NULL, NULL, TRUE);

    // create return_to url from app_url
    $return_to = $handler->createReturnTo($app_url, $identity_url);

    // handle the request
    $redirect_url = $consumer->handle_request(
                                              $server_id, $server_url, $return_to, $trust_root);

    // redirect the user-agent to the server
    header( 'Location: ' . $redirect_url );
    exit;
  }
}


/**
 * Callback for return_to url redirection. The Identity server will redirect
 * back to this handler with the results of the authentication attempt.
 */
function openid_ret() {
  $edit = $_POST['edit'];
  $op = $_POST['op'];

  $query = array_merge( $_GET, $_POST );
  $consumer = new DrupalConsumer(new DrupalHTTPClient());
  $handler = new DrupalActionHandler($query, $consumer);
  $openid = $handler->getOpenID();
  $req = new ConsumerRequest($openid, $query, 'GET');
  $response = $consumer->handle_response($req);
  $response->doAction($handler);
}


/**
 * Our OpenIDConsumer subclass.  See openid.consumer.OpenIDConsumer
 * for more more documentation.
 */
class DrupalConsumer extends OpenIDConsumer {

  function verify_return_to( $return_to ) {
    if( strpos($return_to, url('openid/return', NULL, NULL, TRUE)) != 0) {
      return false;
    }
    return true;
  }
};


/**
 * A handler with application specific callback logic.
 */
class DrupalActionHandler extends ActionHandler {

  function DrupalActionHandler($query, $consumer) {
    $this->query = $query;
    $this->consumer = $consumer;
  }

  /* callbacks */
  function doValidLogin($login) {
    // here is where you would do what is necessary to log an openid "user"
    // user into your system.  We just print a message confirming the
    // valid login.
    printf( '<b>Identity verified!</b> Thanks, ' .
            '<a href="/%s">' .
            '%s</a>', $this->query['open_id'], $this->query['open_id'] );
  }

  function doInvalidLogin() {
    print 'OpenID verification failed!';
  }

  function doUserCancelled() {
    print 'OpenID login Cancelled by user.';
  }

  function doCheckAuthRequired($server_url, $return_to, $post_data) {
    // do openid.mode=check_authentication call, and then change state
    $response = $this->consumer->check_auth($server_url, $return_to,
                                            $post_data, $this->getOpenID());
    $response->doAction($this);
  }

  function doErrorFromServer($message) {
    print 'Error from Identity Server: ' . $message;
  }

  /* helpers */
  function createReturnTo($base_url, $identity_url, $args=null) {
    if( !is_array( $args ) ) {
      $args = array();
    }
    $args['open_id'] = $identity_url;
    return oidUtil::append_args($base_url, $args);
  }

  function getOpenID() {
    // return the openid from the original form
    return $this->query['open_id'];
  }
};


/**
 * A wrapper around drupal_http_request presenting the
 * expected interface to the OpenID library
 */
class DrupalHTTPClient extends HTTPClient {

  function get( $url) {
    // -->(final_url, data)
    // Fetch the content of url, following redirects, and return the
    // final url and page data as a tuple.  Return NULL on failure.

    $redirs = 0;
    while ($redirs < 10) {
      $result = drupal_http_request($url, array(), 'GET', NULL, 0);

      switch ($result->code) {
      case 200:
        return array($url, $result->data);
      case 301:
      case 302:
      case 307:
        $url = $result->redirect_url;
        $redirs += 1;
        break;
      default:
        return NULL;
      }
    }
  }

  function post( $url, $body) {
    // -->(final_url, data)
    // Post the body string argument to url.
    // Reutrn the resulting final url and page data as a
    // tuple. Return NULL on failure.
    $result = drupal_http_request($url, array(), 'POST', $body, 0);

    if($result->code != 200) {
      return NULL;
    }
    return array($url, $result->data);
  }

  // static
  function getHTTPClient() {
    return new DrupalHTTPClient();
  }

};

?>