Download the PHP package thomasvargiu/php-openid-client without Composer

php-openid-client

Full OpenID client implementation.

Most of the library code is based on the awesome node-openid-client.

Implemented specs and features

• OAuth 2.0 RFC 6749 & OpenID Connect Core 1.0
  • Authorization (Authorization Code Flow, Implicit Flow, Hybrid Flow)
  • UserInfo Endpoint and ID Tokens including Signing and Encryption (using the JWT Framework library)
  • Passing a Request Object by Value or Reference including Signing and Encryption
  • Offline Access / Refresh Token Grant
  • Client Credentials Grant
  • Client Authentication incl. client_secret_jwt and private_key_jwt methods
• OpenID Connect Discovery 1.0
• OpenID Connect Dynamic Client Registration 1.0 and RFC7591 OAuth 2.0 Dynamic Client Registration Protocol
• OAuth 2.0 Form Post Response Mode
• RFC7009 - OAuth 2.0 Token Revocation
• RFC7662 - OAuth 2.0 Token Introspection
• RFC7592 - OAuth 2.0 Dynamic Client Registration Management Protocol

Supports of the following draft specifications

• JWT Response for OAuth Token Introspection - draft 03
• JWT Secured Authorization Response Mode for OAuth 2.0 (JARM) - draft 02
• OAuth 2.0 JWT Secured Authorization Request (JAR)
• OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens (MTLS) - draft 15

Installation

Requirements:

• psr/http-client-implementation implementation
• psr/http-factory-implementation implementation
• psr/http-message-implementation implementation

RSA signing algorithms are already included from the JWT Framework package`. If you need other algorithms you should install it manually.

Basic Usage

For a basic usage you shouldn't require any other dependency package.

Dependencies and complex usage

Some classes require dependencies. Usually they are automatically instanced for a simple basic usage, but you can inject them when necessary.

PSR-17 HTTP factories are automatically discovered. PSR-18 HTTP client is automatically discovered, but I suggest to always inject your client, specially when discovering the provider configuration and JWK Set and cache the result.

If you need other algorithms, you should create an AlgorithmManager with your algorithms and inject it when needed.

Example how to create a complete configured instance of the AuthorizationService:

`

Client registration

Token Introspection

Token Revocation

Request Object

You can create a request object authorization request with the TMV\OpenIdClient\RequestObject\RequestObjectFactory class.

This will create a signed (and optionally encrypted) JWT token based on your client metadata.

Then you can use it to create the AuthRequest:

Aggregated and Distributed Claims

The library can handle aggregated and distributed claims:

`

Using middlewares

There are some middlewares and handles available:

SessionCookieMiddleware

This middleware should always be on top of middlewares chain to provide a cookie session for state and nonce parameters.

To use it you should install the dflydev/fig-cookies package:

The middleware provides a TMV\OpenIdClient\Session\AuthSessionInterface attribute with an TMV\OpenIdClient\Session\AuthSessionInterface stateful instance used to persist session data.

Using another session storage

If you have another session storage, you can handle it and provide a TMV\OpenIdClient\Session\AuthSessionInterface instance in the TMV\OpenIdClient\Session\AuthSessionInterface attribute.

ClientProviderMiddleware

This middleware should always be on top of middlewares chain to provide the client to the other middlewares.

AuthRequestProviderMiddleware

This middleware provide the auth request to use with the AuthRedirectHandler.

AuthRedirectHandler

This handler will redirect the user to the OpenID authorization page.

CallbackMiddleware

This middleware will handle the callback from the OpenID provider.

It will provide a TMV\OpenIdClient\Token\TokenSetInterface attribute with the final TokenSet object.

UserinfoMiddleware

This middleware will fetch user data from the userinfo endpoint and will provide an TMV\OpenIdClient\Middleware\UserInfoMiddleware attribute with user infos as array.