为Xenforo 1.5添加自定义OAuth登录功能的技术咨询

Great question—since XenForo 1.5 already supports third-party logins like Facebook and Google, adding your custom OAuth system is absolutely doable. Here's a step-by-step breakdown to make it happen:

XenForo uses auth provider classes to handle third-party login flows. You'll need to build a custom class that extends XenForo's base auth provider and implements the core OAuth logic.

Here's a skeleton for your provider (save this in your add-on's directory, e.g., library/YourAddOn/Auth/Provider/CustomOAuth.php):

<?php
class YourAddOn_Auth_Provider_CustomOAuth extends XenForo_Auth_Provider_Abstract
{
    // Return the display name for your login option
    public function getTitle()
    {
        return 'Custom OAuth Login';
    }

    // Define config options (these will show up in XenForo's admin panel)
    public function getConfigOptions()
    {
        return array(
            'client_id' => array(
                'title' => 'Client ID',
                'description' => 'Your OAuth system\'s client ID',
                'type' => 'text',
                'required' => true
            ),
            'client_secret' => array(
                'title' => 'Client Secret',
                'description' => 'Your OAuth system\'s client secret',
                'type' => 'text',
                'required' => true
            ),
            'authorize_url' => array(
                'title' => 'Authorization URL',
                'description' => 'URL of your OAuth system\'s authorization page',
                'type' => 'text',
                'required' => true
            ),
            'token_url' => array(
                'title' => 'Token URL',
                'description' => 'URL to fetch access tokens from',
                'type' => 'text',
                'required' => true
            ),
            'userinfo_url' => array(
                'title' => 'User Info URL',
                'description' => 'URL to fetch user profile data from',
                'type' => 'text',
                'required' => true
            )
        );
    }

    // Redirect users to your OAuth system's authorization page
    public function getAuthenticationRedirect(XenForo_Helper_Auth $helper, $redirectUri = null)
    {
        // Generate a CSRF state token to secure the flow
        $state = XenForo_Application::generateRandomString(32);
        XenForo_Session::get()->set('customoauth_state', $state);

        $authParams = array(
            'client_id' => $this->_config['client_id'],
            'redirect_uri' => $redirectUri,
            'response_type' => 'code',
            'state' => $state,
            'scope' => 'email profile' // Adjust scopes based on your OAuth system's requirements
        );

        return $this->_config['authorize_url'] . '?' . http_build_query($authParams);
    }

    // Handle the OAuth callback and verify the user
    public function verifyAuthentication(XenForo_Helper_Auth $helper, $redirectUri = null, &$error = null)
    {
        $session = XenForo_Session::get();
        $savedState = $session->get('customoauth_state');
        $session->remove('customoauth_state');

        // Validate CSRF state
        if (!isset($_GET['state']) || $_GET['state'] !== $savedState) {
            $error = 'Invalid state parameter - potential CSRF attack';
            return false;
        }

        // Handle OAuth errors
        if (isset($_GET['error'])) {
            $error = 'OAuth authorization failed: ' . $_GET['error'];
            return false;
        }

        // Check for authorization code
        if (!isset($_GET['code'])) {
            $error = 'Authorization code not found';
            return false;
        }

        // Fetch access token from your OAuth system
        $tokenParams = array(
            'client_id' => $this->_config['client_id'],
            'client_secret' => $this->_config['client_secret'],
            'code' => $_GET['code'],
            'redirect_uri' => $redirectUri,
            'grant_type' => 'authorization_code'
        );

        $tokenResponse = XenForo_Helper_Http::getClient()->post($this->_config['token_url'], array('form_params' => $tokenParams))->getBody();
        $tokenData = json_decode($tokenResponse, true);

        if (!isset($tokenData['access_token'])) {
            $error = 'Failed to retrieve access token';
            return false;
        }

        // Fetch user profile data
        $userInfoResponse = XenForo_Helper_Http::getClient()->get($this->_config['userinfo_url'], array(
            'headers' => array('Authorization' => 'Bearer ' . $tokenData['access_token'])
        ))->getBody();
        $userInfo = json_decode($userInfoResponse, true);

        if (!isset($userInfo['id'])) {
            $error = 'Failed to retrieve user information';
            return false;
        }

        // Map OAuth user data to XenForo's required format
        return array(
            'provider' => 'customoauth',
            'provider_id' => $userInfo['id'],
            'email' => $userInfo['email'] ?? '',
            'username' => $userInfo['username'] ?? $userInfo['email'],
            'display_name' => $userInfo['name'] ?? $userInfo['username']
            // Add additional fields like avatar URL if needed
        );
    }
}

You need to tell XenForo about your new auth provider. The best way to do this is via an add-on's setup file (to avoid modifying core files):

In your add-on's setup.php:

<?php
class YourAddOn_Setup extends XenForo_Setup
{
    public function install()
    {
        // Register your custom auth provider
        XenForo_Auth::registerProvider('customoauth', 'YourAddOn_Auth_Provider_CustomOAuth');
    }

    public function uninstall()
    {
        // Unregister the provider if the add-on is removed
        XenForo_Auth::unregisterProvider('customoauth');
    }
}

After installing the add-on, you'll see your custom OAuth provider in the XenForo admin panel under Setup > Authentication. Configure it with your OAuth system's credentials.

XenForo will automatically handle most of this logic once your provider returns valid user data:

• If the OAuth user ID is already linked to a XenForo account, the user will be logged in directly.
• If not, XenForo will prompt the user to either link the OAuth account to an existing XenForo account or create a new one.

You can customize this flow by overriding methods in your auth provider, but the default behavior should work for most cases.

To let users see your custom login option, edit the login_form template (found in Appearance > Templates):

Add this snippet where you want the button to appear (e.g., below the standard login fields or alongside other social login buttons):

<div class="login-social">
    <a href="{xen:link 'login/customoauth', '', {'redirect': $redirect}}" class="button button-primary">Login with Custom OAuth</a>
</div>

You'll also need to register the route for the login link. Create a route_prefixes.php file in your add-on's directory:

<?php
class YourAddOn_Route_Prefix_Login_CustomOAuth implements XenForo_Route_Interface
{
    public function match($routePath, Zend_Controller_Request_Http $request, XenForo_Router $router)
    {
        // Use XenForo's built-in login controller for the external auth flow
        return $router->getRouteMatch('XenForo_ControllerPublic_Login', 'external', $routePath);
    }

    public function buildLink($originalPrefix, $outputPrefix, $action, $extension, $data, array &$extraParams)
    {
        return XenForo_Link::buildBasicLink($outputPrefix, $action, $extension, $data, $extraParams);
    }
}

• CSRF Protection: Always validate the state parameter to prevent cross-site request forgery attacks—our skeleton already handles this.
• Error Logs: If something breaks, check XenForo's logs in internal_data/logs/ for detailed error messages.
• Scope Permissions: Make sure your OAuth system grants the necessary scopes (e.g., email access) to retrieve user data.
• Testing: Enable XenForo's debug mode during development to see more detailed error feedback.

内容的提问来源于stack exchange，提问作者realplay