为PHPBB加一个oauth认证方式统一登陆SSO
tag:phpbb,sso,统一登陆,oauth2,oauth
以下文章只是讲述我做这个东西的一个原理，主要实现是采用主站的认证来实现本站点的登陆，论坛采用隐式的密码认证方式；如果想要了解更多，[email protected];[email protected]?起分享！
操作步骤
一、将auth_oauth2.php加入论坛的includes/auth/这个目录当中，这是一个OAUTH的插件，使其支持这种认证方式
二、将caijicheOauthClient.php这个文件加入PHPBB的根目录中，这个文件是CAIJICHE的oauth客户端文件；
三、将论坛的数据库bbs_config表中的auth_method的值改成“oauth2”,说明使用oauth2认证；
四、为了使后台管理员也可以使用这种认证方式，把functions.php中的以下这段注释掉
if ($admin && utf8_clean_string($username) != utf8_clean_string($user->data['username']))
{
// We log the attempt to use a different username...
add_log('admin', 'LOG_ADMIN_AUTH_FAIL');
trigger_error('NO_AUTH_ADMIN_USER_DIFFER');
}
否则会报不匹配的错误；
五、更改注册链接：
将functions.php中的函数page_header中的数组中“U_REGISTER”的值改成“http://www.caijiche.com/reg”
六、更改忘记密码链接：将functions.php中的函数page_header中的数组中“ U_SEND_PASSWORD ”的值改成“http://www.caijiche.com/getpwd”
phpbb报一些警告错误的解决办法：
将对应的函数改成静态函数
七、语言文件："登录" 改成 "使用采集车帐号登陆" "用户名（USERNAME）"改成 "用户名[email]"
以下是auth_oauth2.php的内容
这个文件主要还是参考auth_db.php简单改动了一下
<?php
/**
* Database auth plug-in for phpBB3
*
* Authentication plug-ins is largely down to Sergey Kanareykin, our thanks to him.
*
* This is for authentication via the integrated user table
*
* @package login
* @version $Id: auth_db.php 10431 2010-01-20 00:20:46Z bantu $
* @copyright (c) 2005 phpBB Group
* @license http://opensource.org/licenses/gpl-license.php GNU Public License
*
*/
/**
* @ignore
*/
if (!defined('IN_PHPBB'))
{
exit;
}
/**
* Login function
*/
function login_oauth2(&$username, &$password)
{
global $db, $config,$phpbb_root_path;
include ($phpbb_root_path . 'caijicheOauthClient.php');//将客户端的类含进来
require_once($phpbb_root_path.'common.php');
require_once($phpbb_root_path.'includes/functions_user.php');
// require_once($phpbb_root_path.'includes/functions_module.php');
// 密码为空
if (!$password)
{
return array(
'status' => LOGIN_ERROR_PASSWORD,
'error_msg' => 'NO_PASSWORD_SUPPLIED',
'user_row' => array('user_id' => ANONYMOUS),
);
}
//用户名为空
if (!$username)
{
return array(
'status' => LOGIN_ERROR_USERNAME,
'error_msg' => 'LOGIN_ERROR_USERNAME',
'user_row' => array('user_id' => ANONYMOUS),
);
}
$client_config = array(
'client_id' => "3c2d81228736786e5e846fewqrewqrfedsfadsafre",
'client_secret' => "f6996b15ewqrewqt434f4342e237abf4"
);
$client = new CaijicheOAuthClient($client_config);
//$par['username'] = "[email protected]";
//$par['password'] = '$caijiche$';
$par['username'] = $username;
$par['password'] = $password;
$o_url = $client->getAccessToken($par,'password');
//var_dump($o_url);
if(isset($o_url['access_token'])){
$caijiche_user = $client->getUserInfo($o_url['access_token']);
// var_dump($caijiche_user);
}
$password='$www.CAIJICHE.com';//在这里更换用户的用户名和密码
$username=$caijiche_user['user_nick'];
$useremail=$caijiche_user['user_email'];//用户邮箱
$sql = 'SELECT user_id, username, user_password, user_passchg, user_pass_convert, user_email, user_type, user_login_attempts
FROM ' . USERS_TABLE . "
WHERE username_clean = '" . $db->sql_escape(utf8_clean_string($username)) . "'";
$result = $db->sql_query($sql);
$row = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
if (!$row)
{
$timezone = date('Z') / 3600;
$is_dst = date('I');
if ($config['board_timezone'] == $timezone || $config['board_timezone'] == ($timezone - 1))
{
$timezone = ($is_dst) ? $timezone - 1 : $timezone;
if (!isset($user->lang['tz_zones'][(string) $timezone]))
{
$timezone = $config['board_timezone'];
}
}
else
{
$is_dst = $config['board_dst'];
$timezone = $config['board_timezone'];
}
//用户所属组
$coppa=false;
$group_name = ($coppa) ? 'REGISTERED_COPPA' : 'REGISTERED';
$sql = 'SELECT group_id
FROM ' . GROUPS_TABLE . "
WHERE group_name = '" . $db->sql_escape($group_name) . "'
AND group_type = " . GROUP_SPECIAL;
$result = $db->sql_query($sql);
$row = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
$group_id = $row['group_id'];
if (($coppa ||
$config['require_activation'] == USER_ACTIVATION_SELF ||
$config['require_activation'] == USER_ACTIVATION_ADMIN) && $config['email_enable'])
{
$user_actkey = gen_rand_string(10);
$key_len = 54 - (strlen($server_url));
$key_len = ($key_len < 6) ? 6 : $key_len;
$user_actkey = substr($user_actkey, 0, $key_len);
$user_type = USER_INACTIVE;
$user_inactive_reason = INACTIVE_REGISTER;
$user_inactive_time = time();
}
else
{
$user_type = USER_NORMAL;
$user_actkey = '';
$user_inactive_reason = 0;
$user_inactive_time = 0;
}
//如果这个用户不存在，则自动注册之，然后再登录
$user_row = array(
'username' => utf8_normalize_nfc($username),
'user_password' => phpbb_hash($password),
'user_email' => strtolower($useremail),
'group_id' => (int) $group_id,
'user_timezone' => 0,
'user_dst' => $is_dst,
'user_lang' => 'zh_cmn_hans',
'user_type' => $user_type,
'user_actkey' => $user_actkey,
'user_ip' => $user->ip,
'user_regdate' => time(),
'user_inactive_reason' => $user_inactive_reason,
'user_inactive_time' => $user_inactive_time,
'user_dateformat' => 'Y-m-d G:i',
);
$user_id = user_add($user_row);
if($user_id){
$sql = 'SELECT user_id, username, user_password, user_passchg, user_pass_convert, user_email, user_type, user_login_attempts
FROM ' . USERS_TABLE . "
WHERE username_clean = '" . $db->sql_escape(utf8_clean_string($username)) . "'";
$result = $db->sql_query($sql);
$row = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
}else{
return array(
'status' => LOGIN_ERROR_USERNAME,
'error_msg' => 'LOGIN_ERROR_USERNAME',
'user_row' => array('user_id' => ANONYMOUS),
);
}
}
$show_captcha = $config['max_login_attempts'] && $row['user_login_attempts'] >= $config['max_login_attempts'];
//这一段，好像是密码登录错误次数的统一
// If there are too much login attempts, we need to check for an confirm image
// Every auth module is able to define what to do by itself...
if ($show_captcha)
{
// Visual Confirmation handling
if (!class_exists('phpbb_captcha_factory'))
{
global $phpbb_root_path, $phpEx;
include ($phpbb_root_path . 'includes/captcha/captcha_factory.' . $phpEx);
}
$captcha =& phpbb_captcha_factory::get_instance($config['captcha_plugin']);
$captcha->init(CONFIRM_LOGIN);
$vc_response = $captcha->validate($row);
if ($vc_response)
{
return array(
'status' => LOGIN_ERROR_ATTEMPTS,
'error_msg' => 'LOGIN_ERROR_ATTEMPTS',
'user_row' => $row,
);
}
else
{
$captcha->reset();
}
}
//接下来采用oauth2的password模式登录
//这一段好像是新旧密码转换功能
// If the password convert flag is set we need to convert it
if ($row['user_pass_convert'])
{
// in phpBB2 passwords were used exactly as they were sent, with addslashes applied
$password_old_format = isset($_REQUEST['password']) ? (string) $_REQUEST['password'] : '';
$password_old_format = (!STRIP) ? addslashes($password_old_format) : $password_old_format;
$password_new_format = '';
set_var($password_new_format, stripslashes($password_old_format), 'string');
if ($password == $password_new_format)
{
if (!function_exists('utf8_to_cp1252'))
{
global $phpbb_root_path, $phpEx;
include($phpbb_root_path . 'includes/utf/data/recode_basic.' . $phpEx);
}
// cp1252 is phpBB2's default encoding, characters outside ASCII range might work when converted into that encoding
// plain md5 support left in for conversions from other systems.
if ((strlen($row['user_password']) == 34 && (phpbb_check_hash(md5($password_old_format), $row['user_password']) || phpbb_check_hash(md5(utf8_to_cp1252($password_old_format)), $row['user_password'])))
|| (strlen($row['user_password']) == 32 && (md5($password_old_format) == $row['user_password'] || md5(utf8_to_cp1252($password_old_format)) == $row['user_password'])))
{
$hash = phpbb_hash($password_new_format);
// Update the password in the users table to the new format and remove user_pass_convert flag
$sql = 'UPDATE ' . USERS_TABLE . '
SET user_password = \'' . $db->sql_escape($hash) . '\',
user_pass_convert = 0
WHERE user_id = ' . $row['user_id'];
$db->sql_query($sql);
$row['user_pass_convert'] = 0;
$row['user_password'] = $hash;
}
else
{
// Although we weren't able to convert this password we have to
// increase login attempt count to make sure this cannot be exploited
$sql = 'UPDATE ' . USERS_TABLE . '
SET user_login_attempts = user_login_attempts + 1
WHERE user_id = ' . $row['user_id'];
$db->sql_query($sql);
return array(
'status' => LOGIN_ERROR_PASSWORD_CONVERT,
'error_msg' => 'LOGIN_ERROR_PASSWORD_CONVERT',
'user_row' => $row,
);
}
}
}
//检查用户输入的密码是否正确
// Check password ...
if (!$row['user_pass_convert'] && phpbb_check_hash($password, $row['user_password']))
{
// Check for old password hash...
if (strlen($row['user_password']) == 32)
{
$hash = phpbb_hash($password);
// Update the password in the users table to the new format
$sql = 'UPDATE ' . USERS_TABLE . "
SET user_password = '" . $db->sql_escape($hash) . "',
user_pass_convert = 0
WHERE user_id = {$row['user_id']}";
$db->sql_query($sql);
$row['user_password'] = $hash;
}
//当登录成功时，将用户重试的次数清零
if ($row['user_login_attempts'] != 0)
{
// Successful, reset login attempts (the user passed all stages)
$sql = 'UPDATE ' . USERS_TABLE . '
SET user_login_attempts = 0
WHERE user_id = ' . $row['user_id'];
$db->sql_query($sql);
}
// 用户未激活时返回的错误消息
if ($row['user_type'] == USER_INACTIVE || $row['user_type'] == USER_IGNORE)
{
return array(
'status' => LOGIN_ERROR_ACTIVE,
'error_msg' => 'ACTIVE_ERROR',
'user_row' => $row,
);
}
//用户登录成功
// uccessful login... set user_login_attempts to zero...
return array(
'status' => LOGIN_SUCCESS,
'error_msg' => false,
'user_row' => $row,
);
}
// Password incorrect - increase login attempts
$sql = 'UPDATE ' . USERS_TABLE . '
SET user_login_attempts = user_login_attempts + 1
WHERE user_id = ' . $row['user_id'];
$db->sql_query($sql);
// Give status about wrong password...
return array(
'status' => ($show_captcha) ? LOGIN_ERROR_ATTEMPTS : LOGIN_ERROR_PASSWORD,
'error_msg' => ($show_captcha) ? 'LOGIN_ERROR_ATTEMPTS' : 'LOGIN_ERROR_PASSWORD',
'user_row' => $row,
);
}
caijicheOauthClient.php的主要内容符下：
<?php
class CaijicheOAuthClient{
//private $params = array();//参数数组
//客户端的用户名
public $client_id;
//客户端的密码
public $client_secret;
//返回网址
public $callback_url;
private $requestToken;
private $requestTokenSecret;
private $access_token;
private $expires_in = 3600;//access_token的生命周期。
// 服务器描述信息
private $server = array(
"server_uri" => "http://www.caijiche.com",
'request_token_uri' => 'http://www.caijiche.com/?mod=OAuth&action=requestToken',
'authorize_uri' => 'http://www.caijiche.com/?mod=OAuth&action=authorize',
'access_token_uri' => 'http://www.caijiche.com/?mod=OAuth&action=accesstoken',//获取请求令牌
'getuserinfo_uri' => 'http://www.caijiche.com/?mod=OAuth&action=getUserInfo',//获取用户信息的服务器地址
);
/**
* authorize接口
*
* @param string $url 授权后的回调地址,站外应用需与回调地址一致,站内应用需要填写canvas page的地址
* @param string $response_type 支持的值包括 code 和token 默认值为code
* @param string $state 用于保持请求和回调的状态。在回调时,会在Query Parameter中回传该参数
* @return array
*/
public function getAuthorizeURL( $url=NULL, $response_type = 'code', $state = NULL, $display = NULL ) {
$params = array();
$params['client_id'] = $this->client_id;
$params['redirect_uri'] = is_null($url)?$this->callbackurl:$url;
$params['response_type'] = $response_type;
$params['state'] = $state;
//log::debug("getAuthorizeURL params".var_export($params,true));
return $this->server['authorize_uri']. "&" . http_build_query($params);
}
/**
* 构造函数
* @param array $config
*/
public function __construct($config)
{
if(is_array($config)){
if(isset($config['client_id']))$this->client_id = $config['client_id'];
if(isset($config['client_secret']))$this->client_secret = $config['client_secret'];
if(isset($config['callback_url']))$this->callbackurl = $config['callback_url'];
}
}
/**
* 获取未授权的令牌
*/
public function getRequestToken(){
$data = "oauth_client_key=".$this->key;
$result = json_decode($this->do_call($this->server['request_token_uri'],$data));
$this->requestToken = $result->token;
$this->requestTokenSecret = $result->token_secret;
return $this->requestToken;
}
/**
* 发送请求用的
* @param unknown_type $url
* @param unknown_type $postdata
*/
private function do_call($url, $postdata=NULL)
{
//log::debug("do_call url = " . $url);
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_POST, TRUE);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata);
curl_setopt($ch, CURLOPT_URL, $url);
$ret =curl_exec($ch);
//var_dump($ret);
//log::debug("do_call return:" . var_export($ret,true));
curl_close($ch);
return $ret;
}
/**
* access_token接口
*
* @param string $type 请求的类型,可以为:code, password, token
* @param array $keys 其他参数：
* - 当$type为code时： array('code'=>..., 'redirect_uri'=>...)
* - 当$type为password时： array('username'=>..., 'password'=>...)
* - 当$type为token时： array('refresh_token'=>...)
* @return array
*/
public function getAccessToken( $keys ,$type = 'code' ) {
$params = array();
$params['client_id'] = $this->client_id;
$params['client_secret'] = $this->client_secret;
if($type=='code'){
$params['grant_type'] = 'authorization_code';
$params['code'] = $keys['code'];
$params['redirect_uri'] = $keys['redirect_uri'];
}else if($type=='password'){
$params['grant_type'] = 'password';
$params['username'] = $keys['username'];
$params['password'] = $keys['password'];
}else{
//未知的请求类型
return;
}
$response = $this->do_call($this->server['access_token_uri']."&".http_build_query($params));
$token = json_decode($response, true);//转换成数组
if ( is_array($token) && !isset($token['error']) ) {
$this->access_token = $token['access_token'];
$this->expires_in = $token['expires_in'];
} else {
//throw new OAuthException("get access token failed." . $token['error']);
//授权出错
}
return $token;
}
/**
*
* 获取用户访问信息
* @param unknown_type $access
* @param unknown_type $openid
* @param unknown_type $aid
*/
public function getUserInfo($access_token){
$data="access_token={$access_token}&format=json";
$user=$this->do_call($this->server['getuserinfo_uri'],$data);
$arr=json_decode($user,true);
return $arr;
}
/**
* 签名生成算法
* @param array $params API调用的请求参数集合的关联数组，不包含sign参数
* @param string $secret 签名的密钥即获取access token时返回的session secret
* @return string 返回参数签名值
*/
function getSignature($params, $secret)
{
$str = ''; //待签名字符串
//先将参数以其参数名的字典序升序进行排序
ksort($params);
//遍历排序后的参数数组中的每一个key/value对
foreach ($params as $k => $v) {
//为key/value对生成一个key=value格式的字符串，并拼接到待签名字符串后面
$str .= "$k=$v";
}
//将签名密钥拼接到签名字符串最后面
$str .= $secret;
//通过md5算法为签名字符串生成一个md5签名，该签名就是我们要追加的sign参数值
return md5($str);
}
}
?>