PHP code example of itk-dev / openid-connect

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

itk-dev / openid-connect example snippets

use ItkDev\OpenIdConnect\Security\OpenIdConfigurationProvider;

$provider = new OpenIdConfigurationProvider([
    'redirectUri' => 'https://app.example.org', // Absolute url to where the user is redirected after a successful login
    'openIDConnectMetadataUrl' => 'https://provider.example.org/.well-known/openid-configuration', // url to OpenId Discovery document
    'cacheItemPool' => $cacheItemPool, // A Psr\Cache\CacheItemPoolInterface instance, for caching the discovery document and the JWKS
    'clientId' => 'client_id', // Client id assigned by authorizer
    'clientSecret' => 'client_secret', // Client password assigned by authorizer
    // optional values
    'leeway' => 30, // Defaults to 10 (seconds)
    'cacheDuration' => 3600, // Defaults to 86400 (seconds)
    'allowHttp' => true, // Defaults to false. Allow OIDC urls with http scheme. Use only during development!
]);

$provider = new OpenIdConfigurationProvider([
    // ... .com:8080',
    'verify' => true, // only consulted by Guzzle when proxy is set
]);

// Get "state" and "nonce"
$state = $provider->generateState();
$nonce = $provider->generateNonce();

// Save to session
$session->set('oauth2state', $state);
$session->set('oauth2nonce', $nonce);

$authUrl = $provider->getAuthorizationUrl(['state' => $state, 'nonce' => $nonce]);

// redirect to $authUrl

'response_type' => 'id_token',
'response_mode' => 'query',

// Authorization request
$verifier = $provider->generatePkceVerifier();
$session->set('oauth2pkce', $verifier);

$authUrl = $provider->getAuthorizationUrl([
    'state' => $state,
    'nonce' => $nonce,
    'response_type' => 'code',
    'code_challenge' => $provider->getPkceChallenge($verifier),
]);

$verifier = $session->get('oauth2pkce');
$session->remove('oauth2pkce');

$idToken = $provider->getIdToken($request->query->get('code'), $verifier);
$claims = $provider->validateIdToken($idToken, $session->get('oauth2nonce'));

// Validate that the request state and session state match
$sessionState = $this->session->get('oauth2state');
$this->session->remove('oauth2state');
if (!is_string($sessionState) || !hash_equals($sessionState, (string) $request->query->get('state'))) {
    throw new ValidationException('Invalid state');
}

// Exchange the code for an id token, then validate it. Validation checks the
// signature against the keys published by the provider (Azure AD B2C), );
}

$claims = $provider->validateIdToken($request->query->get('id_token'), $session->get('oauth2nonce'));

use ItkDev\OpenIdConnect\Exception\OpenIdConnectExceptionInterface;

try {
    $claims = $provider->validateIdToken($idToken, $nonce);
} catch (OpenIdConnectExceptionInterface $e) {
    // Cause is preserved via $e->getPrevious()
}

shell
task analyze:php

shell
task analyze:php:lowest

shell
task lint:php:fix