README

服务及其客户端使用的外部微服务身份验证库。

使用说明

使用composer安装kba-team/micro-auth-lib。

服务器

浏览器被重定向到受保护的认证微服务。微服务读取请求并将浏览器重定向回指定的引用者，带上认证结果。

在此示例中，微服务由Kerberos认证保护。认证成功后，Apache2将认证名称写入REMOTE_USER服务器变量。

为认证创建一个keytab文件，启用auth_kerb Apache2模块，并将以下内容添加到您的（虚拟主机）配置中。

<Directory /path/to/your/micro-service>
    AuthName "Kerberos Login"
    AuthType Kerberos
    Krb5Keytab /etc/apache2/keytabs/auth.service.test.keytab
    KrbSaveCredentials off
    KrbVerifyKDC off
    KrbMethodNegotiate on
    KrbMethodK5Passwd on
    KrbServiceName HTTP
    KrbLocalUserMapping on
    Require valid-user
    Require env
    Options FollowSymLinks
    AllowOverride All
</Directory>

微服务本身只是一个PHP文件。

<?php
require_once 'vendor/autoload.php';

use kbATeam\MicroAuthLib\AuthResult;
use kbATeam\MicroAuthLib\Checksum;
use kbATeam\MicroAuthLib\Exceptions\InvalidParameterException;
use kbATeam\MicroAuthLib\Request;
use kbATeam\MicroAuthLib\Response;

//shared secret of client and server
Checksum::setSecret('shared secret');
try {
    //read and validate the GET request
    $request = Request::read($_GET);
    //get the authentication result from apache2 in REMOTE_USER
    $authResult = AuthResult::read($_SERVER);
} catch (InvalidParameterException $exception) {
    header($_SERVER['SERVER_PROTOCOL'] . ' 500 Internal Server Error', true, 500);
    exit(500); //This is just a quick example. Please don't do this in your code.
}

//build client response and redirect there
$response = new Response($authResult->getAuthName(), $request->getId());
header('Location: ' . $response->getLocation($request->getReferer()), true, 302);

客户端

将浏览器重定向到微服务，并读取以下GET请求中编码的响应。

<?php
require_once 'vendor/autoload.php';

use kbATeam\MicroAuthLib\Checksum;
use kbATeam\MicroAuthLib\Exceptions\InvalidParameterException;
use kbATeam\MicroAuthLib\Request;
use kbATeam\MicroAuthLib\Response;
use kbATeam\MicroAuthLib\Url;

//Insert the shared secret for kba-auth here.
Checksum::setSecret('shared secret');

if (isset($_COOKIE['micro-auth-id'])) {
    //Get the ID from the cookie and delete the cookie.
    $kbaAuthId = (int)$_COOKIE['micro-auth-id'];
    setcookie('micro-auth-id', null, -1);
    //Read the parameters from the GET request generated by kba-auth.
    try {
        $response = Response::read($_GET);
    } catch (InvalidParameterException $exception) {
        echo $exception->getMessage();
        die(); //This is just a quick example. Please don't do this in your code.
    }
    //Compare the ID from the request and the cookie for extra security.
    if ($response->getId() === $kbaAuthId) {
        echo 'Hello ' . $response->getAuthName() . '!';
        die(); //This is just a quick example. Please don't do this in your code.
    }
}

//Generate a random ID and save it to a cookie.
$kbaAuthId = rand(1000, 9999);
setcookie('micro-auth-id', $kbaAuthId);
//Generate a new request for kba-auth and add the ID and the referer.
$referer = new Url('https://myapp.test/test.php');
$request = new Request($referer, $kbaAuthId);
//Redirect the browser to the kba-auth service.
$kbaAuth = new Url('https://auth.service.test/');
header('Location: ' . $request->getLocation($kbaAuth), true, 302);