Download the PHP package egroupware/openid without Composer
On this page you can find all versions of the php package egroupware/openid. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download egroupware/openid
More information about egroupware/openid
Files in egroupware/openid
Package openid
Short Description EGroupware OpenID Connect / OAuth2 server
License GPL-2.0-or-later
Homepage https://www.egroupware.org/
Informations about the package openid
OpenID Connect and OAuth2 server for EGroupware
Supported endpoints and token issuer
- Authorization: https://example.org/egroupware/openid/endpoint.php/authorize
- Token: https://example.org/egroupware/openid/endpoint.php/access_token
- Token Introspection: https://example.org/egroupware/openid/endpoint.php/introspect
- User information: https://example.org/egroupware/openid/endpoint.php/userinfo
- Public key: https://example.org/egroupware/openid/endpoint.php/jwks
- Configuration: https://example.org/.well-known/openid-configuration
- Issuer: https://example.org
Replace example.org with the full qualified domain-name your EGroupware server uses.
Supported Grants:
- Authorization Code: user authorized access and get auth-code, server requests access-token via backchannel
- Refresh Token: token to refresh access-token after it's expired
- Client Credentials: server requests access-token without further authorization
- Implicit: user authorized access and get access-token and auth-code, server requests own access-token via backchannel
- Password Credential: other server checks username/password of EGroupware user (not recommended any more, as other server gets the password!)
Client configuration in EGroupware
Go to: Admin > Applications > OpenID / OAuth2 server > Clients
More useful resources
- Integration with various clients
- OpenID Connect Core 1.0 incorporating errata set 1
- OpenID Connect Discovery 1.0 incorporating errata set 1
- OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1
- The PHP League OAuth 2.0 Server
- OpenID Connect Server plugin for The PHP League's OAuth2 Server
- Diagrams of All The OpenID Connect Flows
- Identity, Claims, & Tokens – An OpenID Connect Primer in 3 parts
Open tasks:
- [ ] PHP 8.0 compatibility: temporary fix implemented using iii. until we're ready to update steverhoades/oauth2-openid-connect-server
- https://github.com/steverhoades/oauth2-openid-connect-server/pull/33 Support for lcobucci/jwt:4.0
- https://github.com/thephpleague/oauth2-server/pull/1146/files
- https://github.com/lcobucci/jwt/blob/4.0.x/composer.json#L20 lcobucci/jwt:4.0 support PHP 8 PHP 8 for 3.4
- [ ] password grant: record and check failed login attempts like login page (see user.authentication.failed)
- [ ] wrong password on login looses oath request in session and therefore fails after correct password was entered
- [ ] test with more clients, e.g. Dovecot
- [ ] token endpoint must support response_type=code+id_token
- [ ] allow users to create personal clients
- [ ] implement full OpenID Connect Discovery
- [x] /.well-known/openid-configuration is supported now
- [x] token endpoint must return nonce of authorization request as claim in id_token
- [x] fix League OAuth2 server to support multiple response_type(s), currently it neither splits response_type by space, nor does it send responses for more then one grant, see response in this ticket
- [x] support response_type "id_token" or "token id_token" containing just an id_token (JWT) or additional to access_token an id_token
- [x] support hyprid flow / response_type contains additional "code" to also return an auth_code
- [x] allow to create clients, which behave like an EGroupware App:
- added to egw_applications
- authentication for them works only if user has run-rights for that application
- an extra defined index-url get's opened as iframe inside EGroupware framework
- [x] UI to view and revoke access- and refresh-tokens
- [x] UI to add clients as admin for all users
- [x] move to a single endpoint.php instead (implicit|auth_code|client_credentials|password).php
- [x] add additional OpenID Connect standard scopes: profile, address, phone
- [x] implement OpenID Connect /userinfo endpoint
- [x] test with Rocket.Chat, see below for Rocket.Chat custom OAuth configuration
- [x] add oauth2-server pull request #925 to implement RFC7662 OAuth 2.0 Token Introspection to allow clients to validate tokens
- [x] automatic generation of public key pair and encryption key on first use
- [x] limit clients to certain grant types and scopes (database schema supports that)
Installation
- EGroupware master and 19.1 install this app by default: composer install or install-cli.php
- Install openid app via EGroupware setup
Testing available grants
A grant is a method of acquiring an access token. Deciding which grants to use depends on the type of client the end user will be using, and the experience you want for your users.
https://oauth2.thephpleague.com/authorization-server/which-grant/
All examples require to create a client under Admin >> OpenID / OAuth2 server >> Clients with ALL grants first:
The following test assume your EGroupware installation is reachable under http://example.com/egroupware/
Testing the client credentials grant
Send the following cURL request:
Testing the password grant
Send the following cURL request (replacing <username>/<password> with one valid for your EGroupware!):
Testing the implicit grant
Here we use the OpenID Connect Debugger site, so head to https://oidcdebugger.com and add the following data:
Hit [Send request] and you will be redirected to your EGroupware, have to log in, if you not already are, and authorize the request. After that you will be redirected back to the OpenID Connect debuger, which will show if it was successful and in that case the access-token. It should also generate a row in egw_openid_access_token and egw_open_id_access_token_scopes table.
Testing the authorization code grant
Here we use again the OpenID Connect Debugger site for the first step, so head to https://oidcdebugger.com and change the URI and Response code as below:
Hit [Send request] and you will be redirected to your EGroupware, have to log in, if you not already are, and authorize the request. After that you will be redirected back to the OpenID Connect debuger, which will show if it was successful and in that case and temporary auth-code which now needs to be exchanged in a 2. step into an access- and a refresh-token.
All 3 tokens and in case of the access-token also the scopes are now also in the egwopenid(auth_codes|access_tokens|access_token_scopes|refresh_tokens) tables.
Testing /userinfo endpoint
You need a valid access_token, which you can get eg. with an implicit grant (see above), using scopes: openid profile email phone address
curl -i "http://example.org/egroupware/openid/endpoint.php/introspect" \
-H "Accept: application/json" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Authorization: Basic b2lkY2RlYnVnZ2VyLmNvbTpzZWNyZXQ=" \
--data-urlencode "token=
{"active":true,"token_type":"access_token","scope":["openid","profile"],"client_id":"oidcdebugger.com","exp":1554629779,"iat":1554626179,"sub":"2","jti":"2ab5f9fe5f4cfe0eeb49491e4cc9a313b2fb11f74969d52b8bd60ba8ec9894ae7f1c9eee697e74f2"}
All versions of openid with dependencies
steverhoades/oauth2-openid-connect-server Version ^1.0
monolog/monolog Version ^1.24
php-middleware/log-http-messages Version ^4.0
bnf/slim3-psr15 Version ^1.1