dmstr / yii2-oauth-module
Yii2 OAuth2 Module
Requires
- 2amigos/yii2-usuario: ^1.5
- dmstr/yii2-bootstrap: ^0.2.2
- dmstr/yii2-web: ^1.1
- guzzlehttp/psr7: ^2.7
- league/oauth2-server: ^8.4
- yiisoft/yii2: ^2.0
Requires (Dev)
- schmunk42/yii2-giiant: ^0.13.0
Suggests
- bizley/jwt: JWT tokens for authentication
This package is auto-updated.
Last update: 2024-11-04 08:33:38 UTC
README
The package provides a module for Yii 2.0 that allows you to use OAuth 2.0 authentication. It is based on the league/oauth2-client package.
Features
- Client credentials grant
- Admin module to manage clients
- User id attribute for clients
- Access token encryption
- Access token issuer
- Access token in JWT format
Installation
The preferred way to install this extension is through composer.
composer require dmstr/yii2-oauth-module
Setup
Add the module to your web application configuration:
<?php use dmstr\oauth\Module as OAuthModule; use dmstr\oauth\modules\admin\Module as OAuthAdminModule; return [ 'modules' => [ 'oauth' => [ 'class' => OAuthModule::class, 'tokenPrivateKey' => 'file:///path/to/private.key', // Path to private key file 'tokenEncryptionKey' => 'your-secret', // optional. Only needed if you have a passphrase for your private key 'accessTokenIssuer' => 'http://localhost:80', // Issuer of the access token. 'userIdAttribute' => 'id', // The attribute of the user model that will be added to the access token as the `sub` claim. // This is optional but recommended. It will allow you to manage your clients in the admin interface. 'modules' => [ 'admin' => [ 'class' => OAuthAdminModule::class ] ] ] ], // This is only needed if your using codemix/yii2-localeurls (https://github.com/codemix/yii2-localeurls) 'components' => [ 'urlManager' => [ 'ignoreLanguageUrlPatterns' => [ '#^oauth/token#' => '#^oauth/token#' ] ], 'rules' => [ // This is only needed if you want to use the admin module. It will create an url alias to the user module 'oauth/admin/user/index' => 'user/admin/index', 'oauth/admin/user/view' => 'user/admin/update' ] ] ];
And this to your console application configuration:
[ 'controllerMap' => [ 'migrate' => [ 'migrationPath' => [ '@vendor/dmstr/yii2-oauth-module/src/migrations' ] ] ] ]
or run
yii migrate/up --migrationPath=@vendor/dmstr/yii2-oauth-module/src/migrations
General usage
First you need to generate a public and private key pair. You can use the following command to generate a key pair:
openssl genrsa -out private.key 2048
If you want to provide a passphrase for your private key run this command instead:
openssl genrsa -aes128 -passout pass:<your-passphrase> -out private.key 2048
When you have installed the module,
Then you need to create a client. You can reach the admin client crud via <your-base-url>/oauth/admin/client/index
.
You have the option to add a user id to the client. This will allow you to use the client to log in as this user after authentication. If you don't
add a user id, the client will be able to access the api, but not log in. The user id is added to the access token in the sub
claim.
To get a new access token, you can send a post request the following endpoint:
curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=client_credentials&client_id=<your-client-id>&client_secret=<your-client-secret>" <your-base-url>/oauth/token
This will return all required information to authenticate your requests.
You can now use the access token to authenticate your requests.
Example usage with Yii 2.0 REST API
This example shows how to use the access token to authenticate your requests in a Yii 2.0 REST API. It uses the bizley/yii2-jwt package to authenticate the requests.
<?php namespace app\api\controllers; use Da\User\Model\User; use bizley\jwt\JwtHttpBearerAuth; use yii\filters\AccessControl; use yii\rest\Controller; class ItemsController extends Controller { /** * @inheritdoc */ public function behaviors() { $behaviors = parent::behaviors(); $behaviors['authenticator']['authMethods'] = [ [ 'class' => JwtHttpBearerAuth::class, // We used auth() here to keep the example simple. Implementing findIdentityByAccessToken() in your user model is recommended. 'auth' => function (Plain $token) { return User::findIdentity($token->claims()->get('sub')); } ] ]; $behaviors['access'] = [ 'class' => AccessControl::class, 'rules' => [ [ 'allow' => true, 'roles' => ['@'], 'actions' => ['index'] ] ] ]; return $behaviors; } /** * Example action. Replace with your own. */ public function actionIndex(): array { return [ [ 'id' => 1, 'name' => 'Item 1' ] ]; } }