steverhoades / oauth2-openid-connect-client
OAuth2 OpenID Connect Client that utilizes the PHP Leagues OAuth2 Client
Installs: 349 989
Dependents: 3
Suggesters: 0
Security: 0
Stars: 50
Watchers: 5
Forks: 36
Open Issues: 14
Requires
- php: >= 7.4
- lcobucci/jwt: ~4.0
- league/oauth2-client: ^2.0
- webmozart/assert: ^1.10
Requires (Dev)
- dg/bypass-finals: ^1.3
- enlightn/security-checker: ^1.9
- ergebnis/composer-normalize: ^2.15
- insolita/unused-scanner: ^2.3
- maglnet/composer-require-checker: ^3.3
- php-parallel-lint/php-parallel-lint: ^1.3
- phpunit/phpunit: ^9.5
- roave/security-advisories: dev-master
- squizlabs/php_codesniffer: ^3.6
This package is auto-updated.
Last update: 2024-11-04 12:23:33 UTC
README
This package uses the PHP League's OAuth2 Client and this JWT Token Library to provide an OAuth2 OpenID Connect client.
Requirements
The following versions of PHP are supported.
- PHP 7.4
- PHP 8.0
- PHP 8.1
Usage
You may test your OpenID Connect Client against bshaffer's demo oauth2 server.
<?php $signer = new \Lcobucci\JWT\Signer\Rsa\Sha256(); $provider = new \OpenIDConnectClient\OpenIDConnectProvider([ 'clientId' => 'demoapp', 'clientSecret' => 'demopass', // the issuer of the identity token (id_token) this will be compared with what is returned in the token. 'idTokenIssuer' => 'brentertainment.com', // Your server 'redirectUri' => 'http://example.com/your-redirect-url/', 'urlAuthorize' => 'http://brentertainment.com/oauth2/lockdin/authorize', 'urlAccessToken' => 'http://brentertainment.com/oauth2/lockdin/token', 'urlResourceOwnerDetails' => 'http://brentertainment.com/oauth2/lockdin/resource', // Find the public key here: https://github.com/bshaffer/oauth2-demo-php/blob/master/data/pubkey.pem // to test against brentertainment.com 'publicKey' => 'file:///myproj/data/public.key', ], [ 'signer' => $signer ] ); // send the authorization request if (empty($_GET['code'])) { $redirectUrl = $provider->getAuthorizationUrl(); header(sprintf('Location: %s', $redirectUrl), true, 302); return; } // receive authorization response try { $token = $provider->getAccessToken('authorization_code', [ 'code' => $_GET['code'] ]); } catch (\OpenIDConnectClient\Exception\InvalidTokenException $e) { $errors = $provider->getValidatorChain()->getMessages(); return; } $accessToken = $token->getToken(); $refreshToken = $token->getRefreshToken(); $expires = $token->getExpires(); $hasExpired = $token->hasExpired(); $idToken = $token->getIdToken(); $email = $idToken->claims()->get('email', false); $allClaims = $idToken->claims();
Run the Example
An example client has been provided and can be found in the /example directory of this repository. To run the example you can utilize PHPs built-in web server.
$ php -S localhost:8081 client.php
Then open this link: http://localhost:8081/
This should send you to bshaffer's OAuth2 Live OpenID Connect Demo site.
Token Verification
The id_token is verified using the lcobucci/jwt library. You will need to pass the appropriate signer and publicKey to the OpenIdConnectProvider.
Install
Via Composer
$ composer require steverhoades/oauth2-openid-connect-client
Clock difference tolerance in nbf
Some clock difference can be tolerated between the IdP and the SP by using the nbfToleranceSeconds
option in the
getAccessToken
method call.
<?php ... // receive authorization response try { $token = $provider->getAccessToken('authorization_code', [ 'code' => $_GET['code'], //adds 60 seconds to currentTime to tolerate 1 minute difference in clocks between IdP and SP 'nbfToleranceSeconds' => 60 ]); } catch (\OpenIDConnectClient\Exception\InvalidTokenException $e) { $errors = $provider->getValidatorChain()->getMessages(); return; }
License
The MIT License (MIT). Please see License File for more information.
TODO
- add support for OpenID Connect Authentication Request Parameters
- add tests
- check implicit and hybrid flow support
- example endpoints showing usage