README

完整的OpenID客户端实现。

大部分库代码基于优秀的node-openid-client。

可能需要PHP扩展gmp。

实现的规范和功能

OAuth 2.0 RFC 6749 & OpenID Connect Core 1.0
- 授权（授权码流、隐式流、混合流）
- 用户信息端点和ID令牌，包括签名和加密（使用JWT框架库）
- 通过值或引用传递请求对象，包括签名和加密
- 离线访问/刷新令牌授权
- 客户端凭据授权
- 客户端身份验证，包括client_secret_jwt和private_key_jwt方法
OpenID Connect发现1.0
OpenID Connect动态客户端注册1.0和RFC7591 OAuth 2.0动态客户端注册协议
OAuth 2.0表单提交响应模式
RFC7009 - OAuth 2.0令牌撤销
RFC7662 - OAuth 2.0令牌洞察
RFC7592 - OAuth 2.0动态客户端注册管理协议

支持以下草案规范

安装

要求

psr/http-client-implementation实现
psr/http-factory-implementation实现
psr/http-message-implementation实现

composer require facile-it/php-openid-client

RSA签名算法已从JWT框架包中包含。如果需要其他算法，您应该手动安装。

基本用法

对于基本用法，您不需要其他任何依赖包。

每个构建器都有方法来使用其他依赖项自定义实例。

use Facile\OpenIDClient\Client\ClientBuilder;
use Facile\OpenIDClient\Issuer\IssuerBuilder;
use Facile\OpenIDClient\Client\Metadata\ClientMetadata;
use Facile\OpenIDClient\Service\Builder\AuthorizationServiceBuilder;
use Facile\OpenIDClient\Service\Builder\UserInfoServiceBuilder;
use Psr\Http\Message\ServerRequestInterface;

$issuer = (new IssuerBuilder())
    ->build('https://example.com/.well-known/openid-configuration');
$clientMetadata = ClientMetadata::fromArray([
    'client_id' => 'client-id',
    'client_secret' => 'my-client-secret',
    'token_endpoint_auth_method' => 'client_secret_basic', // the auth method tor the token endpoint
    'redirect_uris' => [
        'https://my-rp.com/callback',    
    ],
]);
$client = (new ClientBuilder())
    ->setIssuer($issuer)
    ->setClientMetadata($clientMetadata)
    ->build();

// Authorization

$authorizationService = (new AuthorizationServiceBuilder())->build();
$redirectAuthorizationUri = $authorizationService->getAuthorizationUri(
    $client,
    ['login_hint' => 'user_username'] // custom params
);
// you can use this uri to redirect the user


// Get access token

/** @var ServerRequestInterface::class $serverRequest */
$serverRequest = null; // get your server request
$callbackParams = $authorizationService->getCallbackParams($serverRequest, $client);
$tokenSet = $authorizationService->callback($client, $callbackParams);

$idToken = $tokenSet->getIdToken(); // Unencrypted id_token
$accessToken = $tokenSet->getAccessToken(); // Access token
$refreshToken = $tokenSet->getRefreshToken(); // Refresh token

$claims = $tokenSet->claims(); // IdToken claims (if id_token is available)


// Refresh token
$tokenSet = $authorizationService->refresh($client, $tokenSet->getRefreshToken());


// Get user info
$userInfoService = (new UserInfoServiceBuilder())->build();
$userInfo = $userInfoService->getUserInfo($client, $tokenSet);

客户端注册

请参阅OpenID Connect动态客户端注册1.0和RFC7591 OAuth 2.0动态客户端注册协议。

use Facile\OpenIDClient\Service\Builder\RegistrationServiceBuilder;

$registration = (new RegistrationServiceBuilder())->build();

// registration
$metadata = $registration->register(
    $issuer,
    [
        'client_name' => 'My client name',
        'redirect_uris' => ['https://my-rp.com/callback'],
    ],
    'my-initial-token'
);

// read
$metadata = $registration->read($metadata['registration_client_uri'], $metadata['registration_access_token']);

// update
$metadata = $registration->update(
    $metadata['registration_client_uri'],
    $metadata['registration_access_token'],
    array_merge($metadata, [
        // new metadata
    ])
);

// delete
$registration->delete($metadata['registration_client_uri'], $metadata['registration_access_token']);

令牌洞察

请参阅RFC7662 - OAuth 2.0令牌洞察。

use Facile\OpenIDClient\Service\Builder\IntrospectionServiceBuilder;

$service = (new IntrospectionServiceBuilder())->build();

$params = $service->introspect($client, $token);

令牌撤销

请参阅RFC7009 - OAuth 2.0令牌撤销。

use Facile\OpenIDClient\Service\Builder\RevocationServiceBuilder;

$service = (new RevocationServiceBuilder())->build();

$params = $service->revoke($client, $token);

请求对象

您可以使用Facile\OpenIDClient\RequestObject\RequestObjectFactory类创建请求对象授权请求。

这将根据您的客户端元数据创建一个签名（可选加密）的JWT令牌。

use Facile\OpenIDClient\RequestObject\RequestObjectFactory;

$factory = new RequestObjectFactory();
$requestObject = $factory->create($client, [/* custom claims to include in the JWT*/]);

然后您可以使用它来创建AuthRequest

use Facile\OpenIDClient\Authorization\AuthRequest;

$authRequest = AuthRequest::fromParams([
    'client_id' => $client->getMetadata()->getClientId(),
    'redirect_uri' => $client->getMetadata()->getRedirectUris()[0],
    'request' => $requestObject,
]);

聚合和分布式声明

该库可以处理聚合和分布式声明

use Facile\OpenIDClient\Claims\AggregateParser;
use Facile\OpenIDClient\Claims\DistributedParser;

$aggregatedParser = new AggregateParser();

$claims = $aggregatedParser->unpack($client, $userInfo);

$distributedParser = new DistributedParser();
$claims = $distributedParser->fetch($client, $userInfo);

使用中间件

有一些中间件和处理程序可用

SessionCookieMiddleware

此中间件应始终位于中间件链的顶部，以提供用于 state 和 nonce 参数的会话。

要使用它，您应该安装 dflydev/fig-cookies 包

$ composer require "dflydev/fig-cookies:^2.0"

use Facile\OpenIDClient\Middleware\SessionCookieMiddleware;
use Psr\SimpleCache\CacheInterface;

// Use your PSR-16 simple-cache implementation to persist sessions
/** @var CacheInterface $cache */
$middleware = new SessionCookieMiddleware($cache/* , $cookieName = "openid", $ttl = 300 */);

中间件提供了一个 Facile\OpenIDClient\Session\AuthSessionInterface 属性，该属性包含用于持久化会话数据的 Facile\OpenIDClient\Session\AuthSessionInterface 状态实例。

使用另一个会话存储

如果您有另一个会话存储，您可以在 Facile\OpenIDClient\Session\AuthSessionInterface 属性中处理它并提供一个 Facile\OpenIDClient\Session\AuthSessionInterface 实例。

ClientProviderMiddleware

此中间件应始终位于中间件链的顶部，以向其他中间件提供客户端。

use Facile\OpenIDClient\Middleware\ClientProviderMiddleware;

$client = $container->get('openid.clients.default');
$middleware = new ClientProviderMiddleware($client);

AuthRequestProviderMiddleware

此中间件提供用于与 AuthRedirectHandler 一起使用的认证请求。

use Facile\OpenIDClient\Middleware\AuthRequestProviderMiddleware;
use Facile\OpenIDClient\Authorization\AuthRequest;

$authRequest = AuthRequest::fromParams([
    'scope' => 'openid',
    // other params...
]);
$middleware = new AuthRequestProviderMiddleware($authRequest);

AuthRedirectHandler

此处理程序将用户重定向到 OpenID 认证页面。

use Facile\OpenIDClient\Middleware\AuthRedirectHandler;
use Facile\OpenIDClient\Service\AuthorizationService;

/** @var AuthorizationService $authorizationService */
$authorizationService = $container->get(AuthorizationService::class);
$middleware = new AuthRedirectHandler($authorizationService);

CallbackMiddleware

此中间件将处理来自 OpenID 提供者的回调。

它将提供 Facile\OpenIDClient\Token\TokenSetInterface 属性，其中包含最终的 TokenSet 对象。

use Facile\OpenIDClient\Middleware\CallbackMiddleware;
use Facile\OpenIDClient\Service\AuthorizationService;

/** @var AuthorizationService $authorizationService */
$authorizationService = $container->get(AuthorizationService::class);
$middleware = new CallbackMiddleware($authorizationService);

UserInfoMiddleware

此中间件将从 userinfo 端点获取用户数据，并将提供 Facile\OpenIDClient\Middleware\UserInfoMiddleware 属性，其中包含用户信息数组。

use Facile\OpenIDClient\Middleware\UserInfoMiddleware;
use Facile\OpenIDClient\Service\UserInfoService;

/** @var UserInfoService $userInfoService */
$userInfoService = $container->get(UserInfoService::class);
$middleware = new UserInfoMiddleware($userInfoService);

生产环境中的性能改进

使用缓存以避免在每次请求时获取发行者配置和密钥是非常重要的。

use Psr\SimpleCache\CacheInterface;
use Facile\OpenIDClient\Issuer\IssuerBuilder;
use Facile\OpenIDClient\Issuer\Metadata\Provider\MetadataProviderBuilder;
use Facile\JoseVerifier\JWK\JwksProviderBuilder;

/** @var CacheInterface $cache */
$cache = $container->get(CacheInterface::class); // get your simple-cache implementation

$metadataProviderBuilder = (new MetadataProviderBuilder())
    ->setCache($cache)
    ->setCacheTtl(86400*30); // Cache metadata for 30 days 
$jwksProviderBuilder = (new JwksProviderBuilder())
    ->setCache($cache)
    ->setCacheTtl(86400); // Cache JWKS for 1 day
$issuerBuilder = (new IssuerBuilder())
    ->setMetadataProviderBuilder($metadataProviderBuilder)
    ->setJwksProviderBuilder($jwksProviderBuilder);

$issuer = $issuerBuilder->build('https://example.com/.well-known/openid-configuration');

使用 Psalm

如果您需要使用 Psalm，您可以在 psalm.xml 中包含插件。

<plugins>
    <pluginClass class="Facile\JoseVerifier\Psalm\Plugin" />
</plugins>

marcing / php-openid-client

维护者

详细信息