fn openid_init { # uses the global variable $datastore which is the root of the writable directories  $OpenID_redirect which is where to redirect logged in clients
	switch($local_path) {
	case */OpenID/begin_login
		post_redirect `{openid_begin_login}
		exit
	case */OpenID/complete_login
		openid_complete_login
		hid=`{echo -n $OpenID_identity(1) |  md5sum | sed 's/ .*//'}
		hsig=`{openid_randhash $OpenID_identity(2)}
		echo 'Set-cookie: openid_identity='$hid'; path=/;'
		echo 'Set-cookie: openid_sig='$hsig'; path=/;'
		mkdir -p $datastore/$hid
		echo $hsig `{date -n} $OpenID_identity(1) >> $datastore/$hid/openids
		post_redirect $OpenID_redirect
		exit
	case *
		ifs=$nl id= `{get_cookie openid_identity}
		if(! ~ $#id 0) {
			ifs=$nl sig=`{get_cookie openid_sig}
			if(! ~ $#sig 0) {
				if(echo -n $id^$sig | grep -s '^[a-f0-9]*$') {
					if(test -s $datastore/$id/openids) {
						ifs=$spc$nl e=`{grep '^'^$sig^' ' $datastore/$id/openids }
						if(~ $#e 3)
							OpenID_identity = ($e(3) $e(1))
					}
				}
			}
		}
	}
}

fn openid_randhash { 
	{
		if(test -e /dev/urandom)
			dd -if /dev/urandom -count 1 >[2] /dev/null 
		if not
			dd -if /dev/random -bs 1 -count 1 >[2] /dev/null # lame 1 byte randomisity on Plan 9 
		echo $1
		date
	} | md5sum  | sed 's/ .*//'
}

fn openid_begin_login {
	OpenID_Servers_html = `{hget $post_arg_openid_url}
	OpenID_Servers = `{echo $OpenID_Servers_html | awk ' BEGIN { RS="<link|/>" } /openid\.server/ { sub(/.*href="/, ""); sub(/".*/, ""); print } ' }
	OpenID_Delegates =`{echo $OpenID_Servers_html | awk ' BEGIN { RS="<link|/>" } /openid\.delegate/ { sub(/.*href="/, ""); sub(/".*/, ""); print } ' }

	if(~ $#OpenID_Delegates 0)
		OpenID_url_identity=$post_arg_openid_url
	if not 
		OpenID_url_identity=$OpenID_Delegates(1)

	echo  $OpenID_Servers(1) ^'?openid.return_to=' ^`{urlencode http://$HTTP_HOST/OpenID/complete_login } ^'&openid.mode=checkid_setup&openid.identity=' ^$OpenID_url_identity ^'&openid.trust_root=' ^`{urlencode http://$HTTP_HOST/} ^'&openid.sreg.required=email,fullname&openid.sreg.optional=language'
}

fn openid_signed_args {
	{
		ifs=,
		for(s in `{echo -n $post_arg_openidsigned }) {
			if(! ~ $s mode) {
				a = post_arg_openid ^$s
				echo '&openid.' ^$s ^'=' ^`{urlencode $$a}
			}
		}
	} | tr -d \012 | sed -e 's/^&/?/' 
}

fn openid_validate_with_server {
	hget $post_arg_openidop_endpoint/ ^`{openid_signed_args} ^'&openid.sig=' ^`{urlencode $post_arg_openidsig} ^'&openid.mode=check_authentication' | grep -s 'is_valid:true'
}

fn openid_complete_login {
	get_to_post
	if(~ $post_arg_openidmode cancel) {
		OpenID_identity = ()
	}
	if not {
		if(openid_validate_with_server) {
			OpenID_identity = ($post_arg_openididentity $post_arg_openidsig)
		}
		if not {
			OpenID_identity = ()
		}
	}
}

fn openid_clickpass_standard { # uses globals $OpenID_identity (are you logged in already)and $OpenID_clickpass_site_key (this application's id as per http://www.clickpass.com/developer Clickpass site_key
	if(~ $#OpenID_identity 0)
		echo '<style> @import ''http://www.clickpass.com/stylesheets/container.css''; </style>
<div id="clickpass_button" style="width: 176px; height: 28px; position: relative; z-index : 9999 ;">
  <iframe src="http://www.clickpass.com/embedded_buttons/login-standard/'$OpenID_clickpass_site_key'" width="176" height="28" frameborder="0" allowtransparency="true" scrolling="no" style="z-index:9999;position: absolute; top: 0; left: 0;"></iframe> 
</div>
<script type="text/javascript" src="http://www.clickpass.com/javascripts/ClickpassPanel.class.external.js?v1"></script>
<script type="text/javascript">  
      var clickpassPanel = new ClickpassPanel(''clickpass_button'');   </script>'
}