OpenID用户验证如何工作？

Question

好吧,我试图实现Steam OpenID登录到一个网站,但我不太确定它是如何完成的,以及Steam如何验证使用OpenID的用户.

至于现在我发现的是,蒸汽只返回用户身份而没有其他任何东西,所以对于其余的事情,我将不得不使用API​​来获取用户的其他信息.

但我不太确定一旦有人通过OpenID进入网站,用户如何在网站上进行验证.

一旦用户从OpenID中获取信息,我是否需要进行会话或设置cookie或将用户存储到数据库中？

try {
# Change 'localhost' to your domain name.
$openid = new LightOpenID('http://localhost/openid');
if(!$openid->mode) {
    if(isset($_GET['login'])) {
        $openid->identity = 'http://steamcommunity.com/openid';
        header('Location: ' . $openid->authUrl());
    }
echo '<li><a href="?login"><img border="0" src="http://cdn.steamcommunity.com/public/images/signinthroughsteam/sits_small.png" /></a></li>';
}

elseif($openid->mode == 'cancel') {
    echo 'User has canceled authentication!';
}

else {
    $_SESSION['loged']=1;

    header('Location: http://localhost/openid');

}

if(isset($_SESSION['loged'])) {

echo '<li><a href="?logout">Logout</a></li>';

}
if(isset($_GET['logout'])) {
    unset($_SESSION['loged']);
}

echo 'User ' . ($openid->validate() ? $openid->identity . ' has ' : 'has not ') . 'logged in.';

}

catch(ErrorException $e) {
echo $e->getMessage();
}

我以此代码为例

我猜这个

if(!openid->mode)

意味着如果没有设置openid？我应该显示登录按钮,如果按下该按钮,请转到openid提供程序登录

如果用户没有登录显示取消消息,则接下来是其他

或者下一部分是如果用户被插入,所以因为openid只返回用户ID我需要以某种方式与他打交道并让他登录我的网站,对于那部分我应该设置一些会话或cookie,我确实设置了会话并重定向用户返回主页.

但我不明白一些事情.

为什么我的登录按钮一直显示？

还有这个

echo 'User ' . ($openid->validate() ? $openid->identity . ' has ' : 'has not ') . 'logged in.';

为什么它不起作用？它始终显示用户未登录

Answer 1

这是我用来通过Steam的OpenID进行身份验证的代码

<?php
require 'includes/lightopenid/openid.php';
$_STEAMAPI = "YOURSTEAMAPIKEY";

// CHECK IF COOKIE EXISTS WITH PROFILE ID. IF NOT, LOG THE USER IN

try 
{
    $openid = new LightOpenID('http://URL.TO.REDIRECT.TO.AFTER.LOGIN/');
    if(!$openid->mode) 
    {
        if(isset($_GET['login'])) 
        {
            $openid->identity = 'http://steamcommunity.com/openid/?l=english';    // This is forcing english because it has a weird habit of selecting a random language otherwise
            header('Location: ' . $openid->authUrl());
        }
?>
<form action="?login" method="post">
    <input type="image" src="http://cdn.steamcommunity.com/public/images/signinthroughsteam/sits_small.png">
</form>
<?php
    } 
    elseif($openid->mode == 'cancel') 
    {
        echo 'User has canceled authentication!';
    } 
    else 
    {
        if($openid->validate()) 
        {
                $id = $openid->identity;
                // identity is something like: http://steamcommunity.com/openid/id/76561197960435530
                // we only care about the unique account ID at the end of the URL.
                $ptn = "/^http:\/\/steamcommunity\.com\/openid\/id\/(7[0-9]{15,25}+)$/";
                preg_match($ptn, $id, $matches);
                echo "User is logged in (steamID: $matches[1])\n";
                // HERE YOU CAN SET A COOKIE, SAVE TO A DATABASE, CREATE A SESSION, ETC.

                // This is an example of what you can do once you have the profile id    
                $url = "http://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=$_STEAMAPI&steamids=$matches[1]";
                $json_object= file_get_contents($url);
                $json_decoded = json_decode($json_object);

                foreach ($json_decoded->response->players as $player)
                {
                    echo "
                    <br/>Player ID: $player->steamid
                    <br/>Player Name: $player->personaname
                    <br/>Profile URL: $player->profileurl
                    <br/>SmallAvatar: <img src='$player->avatar'/> 
                    <br/>MediumAvatar: <img src='$player->avatarmedium'/> 
                    <br/>LargeAvatar: <img src='$player->avatarfull'/> 
                    ";
                }

        } 
        else 
        {
                echo "User is not logged in.\n";
        }
    }
} 
catch(ErrorException $e) 
{
    echo $e->getMessage();
}
?>

这将向用户显示Steam登录ID按钮,单击该按钮将用户重定向到Steam社区登录页面.登录后,用户将被发送回您的域.这是LightOpenID构造函数中设置的内容.如果用户已经过验证,它将从返回的值中提取唯一的玩家ID.返回的值看起来像http://steamcommunity.com/openid/id/76561194350435530,你需要的76561194350435530部分.使用此方法,您可以查询采用配置文件ID的任何Valve API.

设置cookie和会话可以在登录过程结束时完成.