Question

我正在尝试使用openid作为我的登录系统。为此，我使用了以下代码

<?php
require 'openid.php';

try {
if(!isset($_GET['openid_mode']))
{
    if(isset($_GET['login']))
    {
        $openid = new LightOpenID;
        $openid->identity = 'https://www.google.com/accounts/o8/id';
        $openid->required = array('contact/email');
        header('Location: ' . $openid->authUrl());
    }
?>

<form action="?login" method="post">
<button>Login with Google</button>
</form>

<?php
 }
 elseif($_GET['openid_mode'] == 'cancel')
 {
    echo 'User has canceled authentication!';
 }
 else
 {
    $openid = new LightOpenID;
    echo 'User ' . ($openid->validate() ? $openid->identity . ' has ' : 'has not ') . 'logged in.';
 }
} catch(ErrorException $e) {
echo $e->getMessage();
}
?>

但我在代码中遇到了一些问题。 $ openid-＆gt; validate在此代码中做了什么。我在互联网上搜索，但我没有得到任何信息。

提前致谢....

Answer 1

编辑：在validate（）函数之前删除行$openid = new LightOpenID;。请查看此示例：https://gitorious.org/lightopenid/lightopenid/blobs/master/example.php

我猜您应该看到openid.php并检查validate（）函数。 使用OP执行OpenID验证。

/**
 * Performs OpenID verification with the OP.
 * @return Bool Whether the verification was successful.
 * @throws ErrorException
 */
function validate()
{
    # If the request was using immediate mode, a failure may be reported
    # by presenting user_setup_url (for 1.1) or reporting
    # mode 'setup_needed' (for 2.0). Also catching all modes other than
    # id_res, in order to avoid throwing errors.
    if(isset($this->data['openid_user_setup_url'])) {
        $this->setup_url = $this->data['openid_user_setup_url'];
        return false;
    }
    if($this->mode != 'id_res') {
        return false;
    }

    $this->claimed_id = isset($this->data['openid_claimed_id'])?$this->data['openid_claimed_id']:$this->data['openid_identity'];
    $params = array(
        'openid.assoc_handle' => $this->data['openid_assoc_handle'],
        'openid.signed'       => $this->data['openid_signed'],
        'openid.sig'          => $this->data['openid_sig'],
        );

    if (isset($this->data['openid_ns'])) {
        # We're dealing with an OpenID 2.0 server, so let's set an ns
        # Even though we should know location of the endpoint,
        # we still need to verify it by discovery, so $server is not set here
        $params['openid.ns'] = 'http://specs.openid.net/auth/2.0';
    } elseif (isset($this->data['openid_claimed_id'])
        && $this->data['openid_claimed_id'] != $this->data['openid_identity']
    ) {
        # If it's an OpenID 1 provider, and we've got claimed_id,
        # we have to append it to the returnUrl, like authUrl_v1 does.
        $this->returnUrl .= (strpos($this->returnUrl, '?') ? '&' : '?')
                         .  'openid.claimed_id=' . $this->claimed_id;
    }

    if ($this->data['openid_return_to'] != $this->returnUrl) {
        # The return_to url must match the url of current request.
        # I'm assuing that noone will set the returnUrl to something that doesn't make sense.
        return false;
    }

    $server = $this->discover($this->claimed_id);

    foreach (explode(',', $this->data['openid_signed']) as $item) {
        # Checking whether magic_quotes_gpc is turned on, because
        # the function may fail if it is. For example, when fetching
        # AX namePerson, it might containg an apostrophe, which will be escaped.
        # In such case, validation would fail, since we'd send different data than OP
        # wants to verify. stripslashes() should solve that problem, but we can't
        # use it when magic_quotes is off.
        $value = $this->data['openid_' . str_replace('.','_',$item)];
        $params['openid.' . $item] = function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc() ? stripslashes($value) : $value;
    }

    $params['openid.mode'] = 'check_authentication';

    $response = $this->request($server, 'POST', $params);

    return preg_match('/is_valid\s*:\s*true/i', $response);
}

Answer 2

$openid->validate()不接受任何参数并返回布尔值。

其定义必须在openid.php中。

仅凭直觉，我们可以说它验证用户名和密码（验证有效用户）。

什么是函数$ openid-＆gt;验证吗？

2 个答案: