/** * Complete the client credentials grant * @param null|array $inputParams * @return array */ public function completeFlow($authParams = null) { // Remove any old sessions the user might have $this->authServer->getStorage('session')->deleteSession($authParams['client_id'], 'user', $authParams['user_id']); // Generate a new access token $accessToken = SecureKey::make(); // Compute expiry time $accessTokenExpires = time() + $this->authServer->getAccessTokenTTL(); // Create a new session $sessionId = $this->authServer->getStorage('session')->createSession($authParams['client_id'], 'user', $authParams['user_id']); // Create an access token $accessTokenId = $this->authServer->getStorage('session')->associateAccessToken($sessionId, $accessToken, $accessTokenExpires); // Associate scopes with the access token foreach ($authParams['scopes'] as $scope) { $this->authServer->getStorage('session')->associateScope($accessTokenId, $scope['id']); } $response = array('access_token' => $accessToken); return $response; }
/** * Complete the auth code grant * @param null|array $inputParams * @return array */ public function completeFlow($inputParams = null) { // Get the required params $authParams = $this->authServer->getParam(array('client_id', 'client_secret', 'redirect_uri', 'code'), 'post', $inputParams); if (is_null($authParams['client_id'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'client_id'), 0); } if (is_null($authParams['client_secret'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'client_secret'), 0); } if (is_null($authParams['redirect_uri'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'redirect_uri'), 0); } // Validate client ID and redirect URI $clientDetails = $this->authServer->getStorage('client')->getClient($authParams['client_id'], $authParams['client_secret'], $authParams['redirect_uri'], $this->identifier); if ($clientDetails === false) { throw new Exception\ClientException($this->authServer->getExceptionMessage('invalid_client'), 8); } $authParams['client_details'] = $clientDetails; // Validate the authorization code if (is_null($authParams['code'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'code'), 0); } // Verify the authorization code matches the client_id and the request_uri $authCodeDetails = $this->authServer->getStorage('session')->validateAuthCode($authParams['client_id'], $authParams['redirect_uri'], $authParams['code']); if ( ! $authCodeDetails) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_grant'), 'code'), 9); } // Get any associated scopes $scopes = $this->authServer->getStorage('session')->getAuthCodeScopes($authCodeDetails['authcode_id']); // A session ID was returned so update it with an access token and remove the authorisation code $accessToken = SecureKey::make(); $accessTokenExpiresIn = ($this->accessTokenTTL !== null) ? $this->accessTokenTTL : $this->authServer->getAccessTokenTTL(); $accessTokenExpires = time() + $accessTokenExpiresIn; // Remove the auth code $this->authServer->getStorage('session')->removeAuthCode($authCodeDetails['session_id']); // Create an access token $accessTokenId = $this->authServer->getStorage('session')->associateAccessToken($authCodeDetails['session_id'], $accessToken, $accessTokenExpires); // Associate scopes with the access token if (count($scopes) > 0) { foreach ($scopes as $scope) { $this->authServer->getStorage('session')->associateScope($accessTokenId, $scope['scope_id']); } } $response = array( 'access_token' => $accessToken, 'token_type' => 'bearer', 'expires' => $accessTokenExpires, 'expires_in' => $accessTokenExpiresIn ); // Associate a refresh token if set if ($this->authServer->hasGrantType('refresh_token')) { $refreshToken = SecureKey::make(); $refreshTokenTTL = time() + $this->authServer->getGrantType('refresh_token')->getRefreshTokenTTL(); $this->authServer->getStorage('session')->associateRefreshToken($accessTokenId, $refreshToken, $refreshTokenTTL, $authParams['client_id']); $response['refresh_token'] = $refreshToken; } return $response; }
public function testGetScopes() { $accessToken = SecureKey::make(); $clientId = 999; $scopeId = 123; $scope = 'foo'; $scopeId2 = 124; $scope2 = 'foo2'; // Set up the test fixture // Add scopes $stmt = $this->getDbal()->prepare('INSERT INTO oauth_scopes (id, scope) VALUES (:scopeId, :scope)'); $stmt->execute(array(':scopeId' => $scopeId, ':scope' => $scope)); $stmt->execute(array(':scopeId' => $scopeId2, ':scope' => $scope2)); // Add session and access token. $sessionId = $this->store->createSession($clientId, 'user', 'xyz'); $accessTokenId = $this->store->associateAccessToken($sessionId, $accessToken, time() + 3600); // Associate scopes with access token. $this->store->associateScope($accessTokenId, $scopeId); $this->store->associateScope($accessTokenId, $scopeId2); // Get scopes and compare them. $result = $this->store->getScopes($accessToken); $this->assertInternalType('array', $result); $this->assertContains($scope, $result[0]); $this->assertContains($scope2, $result[1]); // Test that an empty array is returned if no scopes are found. $result = $this->store->getScopes('invalid-access-token'); $this->assertInternalType('array', $result); $this->assertEmpty($result); }
/** * Complete the password grant * @param null|array $inputParams * @return array */ public function completeFlow($inputParams = null) { // Get the required params $authParams = $this->authServer->getParam(array('client_id', 'client_secret', 'username', 'password'), 'post', $inputParams); if (is_null($authParams['client_id'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'client_id'), 0); } if (is_null($authParams['client_secret'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'client_secret'), 0); } // Validate client credentials $clientDetails = $this->authServer->getStorage('client')->getClient($authParams['client_id'], $authParams['client_secret'], null, $this->identifier); if ($clientDetails === false) { throw new Exception\ClientException($this->authServer->getExceptionMessage('invalid_client'), 8); } $authParams['client_details'] = $clientDetails; if (is_null($authParams['username'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'username'), 0); } if (is_null($authParams['password'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'password'), 0); } // Check if user's username and password are correct $userId = call_user_func($this->getVerifyCredentialsCallback(), $authParams['username'], $authParams['password']); if ($userId === false) { throw new Exception\ClientException($this->authServer->getExceptionMessage('invalid_credentials'), 0); } // Validate any scopes that are in the request $scope = $this->authServer->getParam('scope', 'post', $inputParams, ''); $scopes = explode($this->authServer->getScopeDelimeter(), $scope); for ($i = 0; $i < count($scopes); $i++) { $scopes[$i] = trim($scopes[$i]); if ($scopes[$i] === '') { unset($scopes[$i]); } // Remove any junk scopes } if ($this->authServer->scopeParamRequired() === true && $this->authServer->getDefaultScope() === null && count($scopes) === 0) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'scope'), 0); } elseif (count($scopes) === 0 && $this->authServer->getDefaultScope() !== null) { if (is_array($this->authServer->getDefaultScope())) { $scopes = $this->authServer->getDefaultScope(); } else { $scopes = array($this->authServer->getDefaultScope()); } } $authParams['scopes'] = array(); foreach ($scopes as $scope) { $scopeDetails = $this->authServer->getStorage('scope')->getScope($scope, $authParams['client_id'], $this->identifier); if ($scopeDetails === false) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_scope'), $scope), 4); } $authParams['scopes'][] = $scopeDetails; } // Generate an access token $accessToken = SecureKey::make(); $accessTokenExpiresIn = $this->accessTokenTTL !== null ? $this->accessTokenTTL : $this->authServer->getAccessTokenTTL(); $accessTokenExpires = time() + $accessTokenExpiresIn; // Create a new session $sessionId = $this->authServer->getStorage('session')->createSession($authParams['client_id'], 'user', $userId); // Associate an access token with the session $accessTokenId = $this->authServer->getStorage('session')->associateAccessToken($sessionId, $accessToken, $accessTokenExpires); // Associate scopes with the access token foreach ($authParams['scopes'] as $scope) { $this->authServer->getStorage('session')->associateScope($accessTokenId, $scope['id']); } $response = array('access_token' => $accessToken, 'token_type' => 'Bearer', 'expires' => $accessTokenExpires, 'expires_in' => $accessTokenExpiresIn); // Associate a refresh token if set if ($this->authServer->hasGrantType('refresh_token')) { $refreshToken = SecureKey::make(); $refreshTokenTTL = time() + $this->authServer->getGrantType('refresh_token')->getRefreshTokenTTL(); $this->authServer->getStorage('session')->associateRefreshToken($accessTokenId, $refreshToken, $refreshTokenTTL, $authParams['client_id']); $response['refresh_token'] = $refreshToken; } return $response; }
/** * Complete the auth code grant * @param null|array $inputParams * @return array */ public function completeFlow($inputParams = null) { // Get the required params $authParams = $this->authServer->getParam(array('client_id', 'client_secret', 'redirect_uri', 'code'), 'post', $inputParams); if (is_null($authParams['client_id'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'client_id'), 0); } if (is_null($authParams['client_secret'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'client_secret'), 0); } if (is_null($authParams['redirect_uri'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'redirect_uri'), 0); } // Validate client ID and redirect URI $clientDetails = $this->authServer->getStorage('client')->getClient($authParams['client_id'], $authParams['client_secret'], $authParams['redirect_uri'], $this->identifier); if ($clientDetails === false) { throw new Exception\ClientException($this->authServer->getExceptionMessage('invalid_client'), 8); } $authParams['client_details'] = $clientDetails; // Validate the authorization code if (is_null($authParams['code'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'code'), 0); } // Verify the authorization code matches the client_id and the request_uri $authCodeDetails = $this->authServer->getStorage('session')->validateAuthCode($authParams['client_id'], $authParams['redirect_uri'], $authParams['code']); //dd($authCodeDetails); if (!$authCodeDetails) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_grant'), 'code'), 9); } // Get any associated scopes $scopes = $this->authServer->getStorage('session')->getAuthCodeScopes($authCodeDetails['authcode_id']); //dd($scopes); // A session ID was returned so update it with an access token and remove the authorisation code $accessToken = SecureKey::make(); $accessTokenExpiresIn = $this->accessTokenTTL !== null ? $this->accessTokenTTL : $this->authServer->getAccessTokenTTL(); $accessTokenExpires = time() + $accessTokenExpiresIn; // Remove the auth code $this->authServer->getStorage('session')->removeAuthCode($authCodeDetails['session_id']); // Create an access token $accessTokenId = $this->authServer->getStorage('session')->associateAccessToken($authCodeDetails['session_id'], $accessToken, $accessTokenExpires); /* iss: Issuer Identifier for the Issuer of the response sub: Subject identifier. A locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client aud: Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value exp: Expiration time on or after which the ID Token MUST NOT be accepted for processing iat: Time at which the JWT was issued acr:0 nonce: */ //Create ID Token here, for OpenID Connect $id_token = array("iss" => \Config::get('app.url'), "sub" => \User::where('id', $this->authServer->getStorage('session')->validateAccessToken($accessToken)['owner_id'])->first()->pid, "aud" => $clientDetails['metadata']['website'], "iat" => time(), "exp" => $accessTokenExpires, "acr" => 0, "nonce" => \Cache::get($authParams['code'])); \Cache::forget($authParams['code']); // Associate scopes with the access token if (count($scopes) > 0) { foreach ($scopes as $scope) { $this->authServer->getStorage('session')->associateScope($accessTokenId, $scope['scope_id']); } } $response = array('access_token' => $accessToken, 'token_type' => 'Bearer', 'expires' => $accessTokenExpires, 'expires_in' => $accessTokenExpiresIn, 'id_token' => $id_token); // Associate a refresh token if set if ($this->authServer->hasGrantType('refresh_token')) { $refreshToken = SecureKey::make(); $refreshTokenTTL = time() + $this->authServer->getGrantType('refresh_token')->getRefreshTokenTTL(); $this->authServer->getStorage('session')->associateRefreshToken($accessTokenId, $refreshToken, $refreshTokenTTL, $authParams['client_id']); $response['refresh_token'] = $refreshToken; } return $response; }
/** * Complete the client credentials grant * @param null|array $inputParams * @return array */ public function completeFlow($inputParams = null) { // Get the required params $authParams = $this->authServer->getParam(array('client_id', 'client_secret'), 'post', $inputParams); if (is_null($authParams['client_id'])) { throw new Exception\ClientException(sprintf(Authorization::getExceptionMessage('invalid_request'), 'client_id'), 0); } if (is_null($authParams['client_secret'])) { throw new Exception\ClientException(sprintf(Authorization::getExceptionMessage('invalid_request'), 'client_secret'), 0); } // Validate client ID and client secret $clientDetails = $this->authServer->getStorage('client')->getClient($authParams['client_id'], $authParams['client_secret'], null, $this->identifier); if ($clientDetails === false) { throw new Exception\ClientException(Authorization::getExceptionMessage('invalid_client'), 8); } $authParams['client_details'] = $clientDetails; // Validate any scopes that are in the request $scope = $this->authServer->getParam('scope', 'post', $inputParams, ''); $scopes = explode($this->authServer->getScopeDelimeter(), $scope); for ($i = 0; $i < count($scopes); $i++) { $scopes[$i] = trim($scopes[$i]); if ($scopes[$i] === '') { unset($scopes[$i]); } // Remove any junk scopes } if ($this->authServer->scopeParamRequired() === true && $this->authServer->getDefaultScope() === null && count($scopes) === 0) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'scope'), 0); } elseif (count($scopes) === 0 && $this->authServer->getDefaultScope() !== null) { if (is_array($this->authServer->getDefaultScope())) { $scopes = $this->authServer->getDefaultScope(); } else { $scopes = array($this->authServer->getDefaultScope()); } } $authParams['scopes'] = array(); foreach ($scopes as $scope) { $scopeDetails = $this->authServer->getStorage('scope')->getScope($scope, $authParams['client_id'], $this->identifier); if ($scopeDetails === false) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_scope'), $scope), 4); } $authParams['scopes'][] = $scopeDetails; } // Generate an access token $accessToken = SecureKey::make(); $accessTokenExpiresIn = $this->accessTokenTTL !== null ? $this->accessTokenTTL : $this->authServer->getAccessTokenTTL(); $accessTokenExpires = time() + $accessTokenExpiresIn; // Create a new session $sessionId = $this->authServer->getStorage('session')->createSession($authParams['client_id'], 'client', $authParams['client_id']); // Add the access token $accessTokenId = $this->authServer->getStorage('session')->associateAccessToken($sessionId, $accessToken, $accessTokenExpires); // Associate scopes with the new session foreach ($authParams['scopes'] as $scope) { $this->authServer->getStorage('session')->associateScope($accessTokenId, $scope['id']); } $response = array('access_token' => $accessToken, 'token_type' => 'Bearer', 'expires' => $accessTokenExpires, 'expires_in' => $accessTokenExpiresIn); return $response; }
/** * Complete the refresh token grant * @param null|array $inputParams * @return array */ public function completeFlow($inputParams = null) { // Get the required params $authParams = $this->authServer->getParam(array('client_id', 'client_secret', 'refresh_token', 'scope'), 'post', $inputParams); if (is_null($authParams['client_id'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'client_id'), 0); } if (is_null($authParams['client_secret'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'client_secret'), 0); } // Validate client ID and client secret $clientDetails = $this->authServer->getStorage('client')->getClient($authParams['client_id'], $authParams['client_secret'], null, $this->identifier); if ($clientDetails === false) { throw new Exception\ClientException($this->authServer->getExceptionMessage('invalid_client'), 8); } $authParams['client_details'] = $clientDetails; if (is_null($authParams['refresh_token'])) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'refresh_token'), 0); } // Validate refresh token $accessTokenId = $this->authServer->getStorage('session')->validateRefreshToken($authParams['refresh_token'], $authParams['client_id']); if ($accessTokenId === false) { throw new Exception\ClientException($this->authServer->getExceptionMessage('invalid_refresh'), 0); } // Get the existing access token $accessTokenDetails = $this->authServer->getStorage('session')->getAccessToken($accessTokenId); // Get the scopes for the existing access token $scopes = $this->authServer->getStorage('session')->getScopes($accessTokenDetails['access_token']); // Generate new tokens and associate them to the session $accessToken = SecureKey::make(); $accessTokenExpiresIn = $this->accessTokenTTL !== null ? $this->accessTokenTTL : $this->authServer->getAccessTokenTTL(); $accessTokenExpires = time() + $accessTokenExpiresIn; // Associate the new access token with the session $newAccessTokenId = $this->authServer->getStorage('session')->associateAccessToken($accessTokenDetails['session_id'], $accessToken, $accessTokenExpires); if ($this->rotateRefreshTokens === true) { // Generate a new refresh token $refreshToken = SecureKey::make(); $refreshTokenExpires = time() + $this->getRefreshTokenTTL(); // Revoke the old refresh token $this->authServer->getStorage('session')->removeRefreshToken($authParams['refresh_token']); // Associate the new refresh token with the new access token $this->authServer->getStorage('session')->associateRefreshToken($newAccessTokenId, $refreshToken, $refreshTokenExpires, $authParams['client_id']); } // There isn't a request for reduced scopes so assign the original ones (or we're not rotating scopes) if (!isset($authParams['scope'])) { foreach ($scopes as $scope) { $this->authServer->getStorage('session')->associateScope($newAccessTokenId, $scope['id']); } } elseif (isset($authParams['scope']) && $this->rotateRefreshTokens === true) { // The request is asking for reduced scopes and rotate tokens is enabled $reqestedScopes = explode($this->authServer->getScopeDelimeter(), $authParams['scope']); for ($i = 0; $i < count($reqestedScopes); $i++) { $reqestedScopes[$i] = trim($reqestedScopes[$i]); if ($reqestedScopes[$i] === '') { unset($reqestedScopes[$i]); } // Remove any junk scopes } // Check that there aren't any new scopes being included $existingScopes = array(); foreach ($scopes as $s) { $existingScopes[] = $s['scope']; } foreach ($reqestedScopes as $reqScope) { if (!in_array($reqScope, $existingScopes)) { throw new Exception\ClientException(sprintf($this->authServer->getExceptionMessage('invalid_request'), 'scope'), 0); } // Associate with the new access token $scopeDetails = $this->authServer->getStorage('scope')->getScope($reqScope, $authParams['client_id'], $this->identifier); $this->authServer->getStorage('session')->associateScope($newAccessTokenId, $scopeDetails['id']); } } $response = array('access_token' => $accessToken, 'token_type' => 'Bearer', 'expires' => $accessTokenExpires, 'expires_in' => $accessTokenExpiresIn); if ($this->rotateRefreshTokens === true) { $response['refresh_token'] = $refreshToken; } return $response; }