PHP code example of dskripchenko / laravel-oidc

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

dskripchenko / laravel-oidc example snippets

use Dskripchenko\Oidc\Exceptions\OidcException;
use Dskripchenko\Oidc\OidcClient;
use Dskripchenko\Oidc\SignIn\SignInFlow;

Route::get('/auth/oidc/redirect', function (Request $request, SignInFlow $flow) {
    abort_unless(OidcClient::enabled(), 404);

    return redirect()->away($flow->start($request->session(), ['back' => '/']));
});

Route::get('/auth/oidc/callback', function (Request $request, SignInFlow $flow) {
    try {
        $result = $flow->finish($request);         // state, ID token, userinfo checked
    } catch (OidcException $e) {
        return redirect('/login?sso='.$e->reason()); // state, nonce_mismatch, ...
    }
    $info = $result->user;                          // Dskripchenko\Oidc\UserInfo
    $user = User::firstWhere('oidc_subject', $info->subject)
        ?? User::firstWhere('email', $info->verifiedEmail()); // null unless email_verified === true
    // ... your rules, then:
    Auth::login($user);
    $request->session()->regenerate();

    return redirect($result->context['back']);
});

$result = $flow->finish($request);
$tokens = $result->tokens;            // Dskripchenko\Oidc\Tokens\TokenSet
// $tokens->accessToken, ->refreshToken, ->expiresIn, ->refreshExpiresIn, ->idToken

use Dskripchenko\Oidc\Exceptions\ProviderError;

try {
    $fresh = app(OidcClient::class)->refresh($stored->refreshToken);
    // keep $fresh->refreshToken ?? $stored->refreshToken
} catch (ProviderError $e) {
    if ($e->reason() === 'refresh_rejected') {
        // blocked, signed out or the session ended at the provider: end the session here too
    }
    // 'refresh': the provider could not answer; try again later
}

use Dskripchenko\Oidc\Http\Middleware\AuthenticateProviderToken;
use Dskripchenko\Oidc\Tokens\ProviderAccessToken;

Route::middleware([AuthenticateProviderToken::class, 'auth:sanctum'])->get('/api/me', function (Request $request) {
    $token = ProviderAccessToken::of($request); // null for any other credential

    return ['user' => $request->user()->id, 'client' => $token?->client];
});

use Dskripchenko\Oidc\Groups\GroupClaims;
use Dskripchenko\Oidc\Groups\RoleMapping;

GroupClaims::of($claims);          // list<string>|null from OIDC_GROUPS_CLAIM
GroupClaims::blocks($groups);      // in OIDC_BLOCKED_GROUP?

RoleMapping::pairs();              // OIDC_ROLE_GROUPS="admins=admin,auditors=auditor"
RoleMapping::decide($givingGroups, $groups, $heldFromProvider); // RoleChange|null