Download the PHP package sk-id-solutions/mobile-id-php-client without Composer

Mobile-ID (MID) PHP Rest Client

Running locally

Run composer install to get all the dependencies. Then you can run tests php vendor/phpunit/phpunit/phpunit

Demo application

There is a demo application that you can run locally.

Features

• Simple interface for mobile-id authentication
• Pulling user's signing certificate

This PHP client cannot be used to create digitally signed containers as there no library like DigiDoc4J exists for PHP.

Requirements

• PHP 7.4 or later
• PHP must be compiled with GMP support by using the --with-gmp option

Installation

The recommended way to install Mobile-ID PHP Client is through Composer

How to use it

Here are examples of authentication with Mobile-ID PHP client

You need to have Composer auto loading available for your application

Example of authentication

// See ReadmeTest.php for list of classes to 'use'

See mid-rest-php-demo for a more detailed real-world example.

Long-polling configuration

You have two options for asking status of authentication session. You can configure long polling which means that the server doesn't respond immediately to session status request but waits until there is input from user (User has entered PIN1 or pressed cancel) or if there is a timeout. However, this blocks the thread on caller's side and may be unwanted. For this there is also option to withPollingSleepTimeoutSeconds(2) which means that the client keeps making requests towards the server every 2 seconds.

If you don't set a positive value either to longPollingTimeoutSeconds or pollingSleepTimeoutSeconds then pollingSleepTimeoutSeconds defaults to value 3 seconds.

With long-polling

Without long-polling

Checking if MID API host is trusted

When negotiating SSL connection with MID API, the MID server sends a certificate indicating its identity. A public key is extracted from this certificate and sha256 hash of the public key is calculated. This hash must exactly match with one of the hashes provided to this library:

Otherwise, the connection to MID API is aborted before sending or receiving any data.

Internally the library uses https://curl.se/libcurl/c/CURLOPT_PINNEDPUBLICKEY.html for this.

Obtaining digest of production API endpoint certificate

Open https://www.skidsolutions.eu/en/repository/certs/ And download mid.sk.ee certificate in PEM format and save it as "mid_sk_ee.PEM.cer".

Copy the output (something like "fqp7yWK7iGGKj+3unYdm2DA3VCPDkwtyX+DrdZYSC6o=" and add "sha256//" in front of it) so the outcome would be: "sha256//fqp7yWK7iGGKj+3unYdm2DA3VCPDkwtyX+DrdZYSC6o="

Adding future production certificate

About once a year the server's SSL certificate gets switched. All RP-s get a notification by e-mail from SK when this is going to happen. Download new certificate and calculate its sha-256 digest (using instructions above) and add the digest to the list by separating it with a semicolon. So the value is going to be something like this:

"sha256//fqp7yWK7iGGKj+3unYdm2DA3VCPDkwtyX+DrdZYSC6o=;sha256//digest-of-future-prod-certificate"

Obtaining digest of demo API endpoint certificate

Demo server (tsp.demo.sk.ee) certificate is be available here: https://www.skidsolutions.eu/en/Repository/certs/certificates-for-testing or you can download it directly from server.

Setting public IP or interface

Sometimes the server has multiple network interfaces or IP addresses and the client needs to specify which one to use for MID requests. This can be done using withNetworkInterface() paramter.

Internally this sets CURLOPT_INTERFACE flag

Pulling user's signing certificate

This client also supports downloading user's mobile-id signing certificate.

Signing

Signing is not supported with PHP library.

Set up logging

Look into src/Util/Logger.php The most basic option is to add

into debug_to_console() method.