Download the PHP package klapaudius/oauth2-php without Composer
On this page you can find all versions of the php package klapaudius/oauth2-php. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download klapaudius/oauth2-php
More information about klapaudius/oauth2-php
Files in klapaudius/oauth2-php
Package oauth2-php
Short Description OAuth2 library
License MIT
Homepage https://github.com/klapaudius/oauth2-php
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package oauth2-php
OAuth2 Server Implementation
An OAuth 2.0 authorization server for PHP, implementing draft 20 of the specification,
with the OpenID Connect hooks needed to issue id_token claims.
The library is framework-agnostic: it only depends on HttpFoundation for request/response handling and on PSR-14 for its event hook. You provide the storage.
Requirements
PHP 8.2 or later.
Installation
Using Symfony? klapaudius/oauth-server-bundle wires this library into a Symfony application, with Doctrine ORM/ODM storage, controllers and a security authenticator already provided.
Usage
Implement the storage interface(s) matching the grant types you want to support, then let
OAuth2 handle the endpoints:
Every failure is an OAuth2ServerException (or one of its subclasses,
OAuth2AuthenticateException and OAuth2RedirectException), and getHttpResponse() turns any
of them into the response the specification prescribes — right status code, JSON error body, or
redirect back to the client.
Storage interfaces
IOAuth2Storage is mandatory; each grant type adds one interface to implement:
| Interface | Enables |
|---|---|
IOAuth2Storage |
client lookup and access tokens (required) |
IOAuth2GrantCode |
authorization_code |
IOAuth2GrantUser |
password |
IOAuth2GrantClient |
client_credentials |
IOAuth2GrantImplicit |
implicit flow (response_type=token) |
IOAuth2RefreshTokens |
refresh_token, including token rotation |
IOAuth2GrantExtension |
extension grants (urn: or absolute URI) |
You only implement what you actually serve: the token endpoint rejects a grant whose interface is
missing with unsupported_grant_type, and the authorize endpoint answers
unsupported_response_type.
OpenID Connect
The library issues OAuth2 tokens; it does not build id_token JWTs for you. Instead it publishes
an event on every successful grant, carrying everything an OIDC layer needs — including the
nonce and the authentication time bound to the authorization code:
Whatever you set with setToken() is what the client receives. Subscribe on
OAuthTokenGrantedEvent::NAME.
Two notes on these two values:
nonceis read from the authorization request, stored on the authorization code by your storage, and handed back on the token request. It isnullfor grant types that involve no authorization code.auth_timeis never read from the request — only your application knows when its user authenticated. Stamp it on the authorization code when you create it; left unset, it arrives asnulland you simply omit the claim.
Upgrading
Version 3.0 removes the legacy client-side implementation and detaches clients from the Symfony security layer. See CHANGELOG.txt for the BC breaks.
Contributing
Both run in CI on PHP 8.2 through 8.5. Patches are expected to keep PHPStan clean at level 8 and to come with tests.
History
This library is a fork of https://github.com/quizlet/oauth2-php, itself a fork of
http://code.google.com/p/oauth2-php/ (the original, long abandoned). Compared to the quizlet
version it is namespaced, PSR-4 autoloaded, free of require(_once), built on HttpFoundation,
and considerably better covered by tests.
All versions of oauth2-php with dependencies
psr/event-dispatcher Version ^1.0
symfony/http-foundation Version ~5.0|~6.0|~7.0|~8.0