Download the PHP package charithar/oauth2-openid-connect-server without Composer

On this page you can find all versions of the php package charithar/oauth2-openid-connect-server. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of charithar/oauth2-openid-connect-server

Informations about the package oauth2-openid-connect-server

charithar/oauth2-openid-connect-server

CI Latest Version Total Downloads

A framework-agnostic OpenID Connect Core 1.0 layer for league/oauth2-server, built on PHP 8.2+, PSR-7/PSR-15, and lcobucci/jwt v5.

This is a clean-room implementation built directly on league's own extension points, adding the OAuth2/OIDC surface (revocation, introspection, RP-Initiated Logout, response_mode, key rotation) needed for general-purpose use.

Install

What this library owns

Everything is interface-based for persistence - there are no bundled repository implementations. You supply league's own repository interfaces plus this library's UserRepositoryInterface and SigningKeyRepositoryInterface.

Wiring example

Mount the standard endpoints wherever your router/framework of choice puts them:

ClientRepositoryInterface::validateClient() note: revocation and introspection aren't tied to any grant, so both handlers call validateClient($clientId, $clientSecret, null) - a null grant type. If your implementation switches on the third argument (e.g. to restrict a secret to specific grants), make sure it treats null as "just verify the secret," not as an unrecognized/rejected case.

Interfaces you implement

Interface Purpose
Repositories\UserRepositoryInterface Look up a claims-bearing user by identifier
Keys\SigningKeyRepositoryInterface Supply one or more RSA signing keys for id_token signing and JWKS, enabling kid rotation (RS256 only in this version - see Limitations)
Entities\ClaimsAwareUserEntityInterface Your user entity: extends league's UserEntityInterface, adds getClaims(): array
Entities\ClaimsAwareClientEntityInterface Your client entity: extends league's ClientEntityInterface, adds getPostLogoutRedirectUris(): array
Logout\LogoutSessionHandlerInterface (optional) Hook for your own session teardown on RP-Initiated Logout

Plus league/oauth2-server's own repository interfaces (ClientRepositoryInterface, AccessTokenRepositoryInterface, RefreshTokenRepositoryInterface, AuthCodeRepositoryInterface, ScopeRepositoryInterface).

Not in scope (v1)

Hybrid/implicit flow, id_token encryption (JWE), pairwise subject identifiers, a consent screen, dynamic client registration, and front/back-channel logout are deliberately not implemented. Authorization Code (with PKCE, via league's own support) and Refresh Token are the supported grants.

Limitations

Development

License

MIT.

Acknowledgments

Inspired by steverhoades/oauth2-openid-connect-server, an OIDC add-on for league/oauth2-server. This library is an independent, clean-room implementation - no code is shared - built to add the OAuth2/OIDC surface and fixes needed for general-purpose use.

All versions of oauth2-openid-connect-server with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
league/oauth2-server Version ^9.1
lcobucci/jwt Version ^5.3
lcobucci/clock Version ^3.0
psr/http-message Version ^1.1 || ^2.0
psr/http-server-handler Version ^1.0
psr/http-server-middleware Version ^1.0
psr/http-factory Version ^1.1
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package charithar/oauth2-openid-connect-server contains the following files

Loading the files please wait ...