This library extends the 'League OAuth2 Client' library to provide OpenID Connect Discovery support for supporting providers that expose a .well-known configuration endpoint.

Overview

OpenID Connect Discovery support for League - OAuth 2.0 Client

This library extends the League OAuth2 Client library to provide OpenID Connect Discovery support for providers that expose a .well-known configuration endpoint.

Installation

To install in an existing (or new) Oauth2 Client Provider library:

  1. Use composer:
composer require cloudcogsio/oauth2-openid-connect-discovery
  1. Change the client to extend \Cloudcogs\OAuth2\Client\OpenIDConnect\AbstractOIDCProvider instead of \League\OAuth2\Client\Provider\AbstractProvider

  2. Remove the following methods

getResourceOwnerDetailsUrl getBaseAuthorizationUrl getBaseAccessTokenUrl

Existing OAuth2 Client
class MyCustomClient extends \League\OAuth2\Client\Provider\AbstractProvider
{
    public function getResourceOwnerDetailsUrl(AccessToken $token)
    {
        ...
    }

    public function getBaseAuthorizationUrl()
    {
        ...
    }

    public function getBaseAccessTokenUrl(array $params)
    {
        ...
    }
}
Updated OAuth2 Client with OpenID Connect Discovery Support
class MyCustomClient extends \Cloudcogs\OAuth2\Client\OpenIDConnect\AbstractOIDCProvider
{
    ...
}

The existing client can now make use of the OIDC mechanisms implemented by this library.

See https://oauth2-client.thephpleague.com/providers/implementing for more information on implementing a new Client Provider.

Usage

Usage is the same as The League's OAuth client. Configuration options changes are required.

URL options can be removed

'urlAuthorize' 'urlAccessToken' 'urlResourceOwnerDetails'

Existing configuration
$provider = new MyCustomClient([
   'clientId'                => 'XXXXXX',    // The client ID assigned to you by the provider
   'clientSecret'            => 'XXXXXX',    // The client password assigned to you by the provider
   'redirectUri'             => 'https://my.example.com/your-redirect-url/',
   'urlAuthorize'            => 'https://service.example.com/authorize',
   'urlAccessToken'          => 'https://service.example.com/token',
   'urlResourceOwnerDetails' => 'https://service.example.com/resource'
]);
New configuration
$provider = new MyCustomClient([
    'clientId'                => 'XXXXXX',    // The client ID assigned to you by the provider
    'clientSecret'            => 'XXXXXX',    // The client password assigned to you by the provider
    'redirectUri'             => 'https://my.example.com/your-redirect-url/',
    'well_known_endpoint'     => 'https://identity.provider.com/.well-known/openid-configuration',
    'publickey_cache_provider'=> '',
]);
  • well_known_endpoint - The URL of the .well-known/openid-configuration endpoint of the IDP.
  • publickey_cache_provider - An empty string OR An instance of a \Laminas\Cache\Storage\Adapter\* storage adapter. See https://github.com/laminas/laminas-cache

Additional Notes and Usage

Your client provider instance will now have added functionality such as token introspection (if supported by your IDP) and the ability to obtain further configuration details from the provider.

Configuration data is accessed by proxying to the Discovery object from the client provider.

// Get the discovered configurations from the provider instance
$discovered = $provider->Discovery();

// Access standard OpenID Connect configuration via supported methods
$issuer = $discovered->getIssuer();
$supported_grants = $discovered->getGrantTypesSupported();
$authorization_endpoint = $discovered->getAuthorizationEndpoint();

// Or overloading for provider specific configuration
$custom_config = $discovered->custom_config;

// Cast to string to obtain the raw JSON discovery response
// All available properties for overloading can be seen in the JSON object.
$json_string = (string) $discovered;

IDP Public Key(s)

During endpoint discovery, the IDP public key(s) are retrieved and cached locally. This is needed to decode the access token (if required).

Caching of Public Keys

Caching of JWKs are handled by an instance of a \Laminas\Cache\Storage\Adapter\* storage adapter. If none is provided, \Laminas\Cache\Storage\Adapter\FileSystem is used.

You can provide your own instance of a \Laminas\Cache\Storage\Adapter\* to handle storage of the public keys.

Example
$storageAdapter = new \Laminas\Cache\Storage\Adapter\MongoDB($mdbOptions);

$provider = new MyCustomClient([
    'clientId'                => 'XXXXXX',    // The client ID assigned to you by the provider
    'clientSecret'            => 'XXXXXX',    // The client password assigned to you by the provider
    'redirectUri'             => 'https://my.example.com/your-redirect-url/',
    'well_known_endpoint'     => 'https://identity.provider.com/.well-known/openid-configuration',
    'publickey_cache_provider'=> $storageAdapter,
]);

Token Introspection

The AccessToken issued by the IDP can be decoded locally to obtain additional information.

// Decode the access token
$access_token = $AccessToken->getToken();
$data = $provider->introspectToken($access_token);

Token Introspection via the IDP (optional)

All tokens issued by the IDP (accessToken, refreshToken etc.) can be introspected using the token introspection endpoint if one is made available by the IDP.

// Decode the refresh token
$refresh_token = $AccessToken->getRefreshToken();
$data = $provider->introspectToken($refresh_token);

License

The MIT License (MIT). Please see License File for more information.

You might also like...
EvaOAuth provides a standard interface for OAuth1.0(a) / OAuth2.0 client authorization, it is easy to integrate with any PHP project by very few lines code.

EvaOAuth EvaOAuth provides a standard interface for OAuth1.0 / OAuth2.0 client authorization, it is easy to integrate with any PHP project by very few

Laravel with NTPC OpenID skeleton

這是啥? 本專案已整合了新北市 OpenID 登入,實作了基本身分驗證系統。 本機帳號登入 新北市 OpenID 登入,初次登入時會建立本機帳號,密碼隨機產生 系統需求 PHP 建議使用 8.0.11 以上 使用方式 以下 FOLDER_NAME 自行替換成想要的資料夾名稱 執行 git clone

documentation for the oauth2-server-php library

OAuth2 Server PHP Documentation This repository hosts the documentation for the oauth2-server-php library. All submissions are welcome! To submit a ch

Open source social sign on PHP Library. HybridAuth goal is to act as an abstract api between your application and various social apis and identities providers such as Facebook, Twitter and Google.

Hybridauth 3.7.1 Hybridauth enables developers to easily build social applications and tools to engage websites visitors and customers on a social lev

:octocat: Socialite is an OAuth2 Authentication tool. It is inspired by laravel/socialite, you can easily use it without Laravel.

Socialite Socialite is an OAuth2 Authentication tool. It is inspired by laravel/socialite, You can easily use it in any PHP project. 中文文档 This tool no

Cliente OAuth2 para Gov.br

Cliente OAuth2 para Gov.br Este pacote fornece suporte OAuth 2.0 para Gov.br usando a biblioteca cliente do League PHP. Requisitos Versões suportadas

This is a basic Oauth2 authorization/authentication server implemented using Mezzio.
This is a basic Oauth2 authorization/authentication server implemented using Mezzio.

Mezzio-OAuth2-Authorization-Authentication-Server This is a basic OAuth2 authorization/authentication server implemented using Mezzio. I have found so

A plugin for implementing an OAuth2 server in CakePHP 3

OAuth2 Server for CakePHP 3 A plugin for implementing an OAuth2 server in CakePHP 3. Built on top of the PHP League's OAuth2 Server. Currently we supp

Comments
  • Composer Installation error

    Composer Installation error

    Hi, when I try to install the library using composer I get this error:

    [InvalidArgumentException]
    Could not find a version of package cloudcogsio / oauth2-openid-connect-discovery matching your minimum-stability (stable). Require it with an explicit version constraint allowing its desired stability.
    

    Thanks!

    opened by jjavierfg 1
Owner
null
PHP OpenID Connect Basic Client

PHP OpenID Connect Basic Client A simple library that allows an application to authenticate a user through the basic OpenID Connect flow. This library

Michael Jett 469 Dec 23, 2022
:atom: Social (OAuth1\OAuth2\OpenID\OpenIDConnect) sign with PHP :shipit:

SocialConnect Auth Getting Started :: Documentation :: Demo Open source social sign on PHP. Connect your application(s) with social network(s). Code e

SocialConnect 518 Dec 28, 2022
:atom: Social (OAuth1\OAuth2\OpenID\OpenIDConnect) sign with PHP :shipit:

SocialConnect Auth Getting Started :: Documentation :: Demo Open source social sign on PHP. Connect your application(s) with social network(s). Code e

SocialConnect 458 Apr 1, 2021
Social (OAuth1\OAuth2\OpenID\OpenIDConnect) sign with PHP

Open source social sign on PHP. Connect your application(s) with social network(s).

SocialConnect 517 Dec 11, 2022
PHP implementation of openid connect-core

OIDC Discovery PHP implementation of https://openid.net/specs/openid-connect-core-1_0.html Install Via Composer $ composer require digitalcz/openid-co

DigitalCz 3 Dec 14, 2022
EAuth extension allows to authenticate users by the OpenID, OAuth 1.0 and OAuth 2.0 providers

EAuth extension allows to authenticate users with accounts on other websites. Supported protocols: OpenID, OAuth 1.0 and OAuth 2.0.

Maxim Zemskov 330 Jun 3, 2022
Discord-oauth2 - At the end of oAuth2, which I have been researching and reading for a long time,

Discord-oauth2 - At the end of oAuth2, which I have been researching and reading for a long time, I finally found the way to connect with discord and get information, that's how I did it. If I'm wrong, feel free to email me so I can correct it.

Uğur Mercan 2 Jan 1, 2022
The Salla OAuth Client library is designed to provide client applications with secure delegated access to Salla Merchant stores.

Salla Provider for OAuth 2.0 Client This package provides Salla OAuth 2.0 support for the PHP League's OAuth 2.0 Client. To use this package, it will

Salla 14 Nov 27, 2022
OAuth client integration for Symfony. Supports both OAuth1.0a and OAuth2.

HWIOAuthBundle The HWIOAuthBundle adds support for authenticating users via OAuth1.0a or OAuth2 in Symfony. Note: this bundle adds easy way to impleme

Hardware Info 2.2k Dec 30, 2022
EvaOAuth provides a standard interface for OAuth1.0(a) / OAuth2.0 client authorization, it is easy to integrate with any PHP project by very few lines code.

EvaOAuth EvaOAuth provides a standard interface for OAuth1.0 / OAuth2.0 client authorization, it is easy to integrate with any PHP project by very few

AlloVince 256 Nov 16, 2022