/**
* @param array $claims
* @param \OAuth2\Client\ClientInterface $client
*
* @return string
*/
private function signAndEncrypt($claims, ClientInterface $client)
{
$signature_key = $this->signature_key_set->getKey(0);
Assertion::notNull($signature_key, 'Unable to find a key to sign the userinfo response. Please verify the selected key set contains suitable keys.');
$jwt = $this->getJWTCreator()->sign($claims, ['typ' => 'JWT', 'alg' => $this->signature_algorithm], $signature_key);
if ($client->hasPublicKeySet() && $client->has('id_token_encrypted_response_alg') && $client->has('id_token_encrypted_response_enc')) {
$key_set = $client->getPublicKeySet();
$key = $key_set->selectKey('enc');
if (null !== $key) {
$jwt = $this->getJWTCreator()->encrypt($jwt, ['alg' => $client->get('id_token_encrypted_response_alg'), 'enc' => $client->get('id_token_encrypted_response_enc')], $key);
}
}
return $jwt;
}
/**
* {@inheritdoc}
*/
public function grantAccessToken(ServerRequestInterface $request, ClientInterface $client, GrantTypeResponseInterface &$grant_type_response)
{
if (false === $client->hasPublicKeySet()) {
throw $this->getExceptionManager()->getBadRequestException(ExceptionManagerInterface::ERROR_INVALID_CLIENT, 'The client is not a client with signature capabilities.');
}
$jwt = $grant_type_response->getAdditionalData('jwt');
try {
$this->getJWTLoader()->verify($jwt, $client->getPublicKeySet());
} catch (\Exception $e) {
throw $this->getExceptionManager()->getBadRequestException(ExceptionManagerInterface::ERROR_INVALID_REQUEST, $e->getMessage());
}
$issue_refresh_token = $this->isRefreshTokenIssuedWithAccessToken();
$grant_type_response->setResourceOwnerPublicId($client->getPublicId());
$grant_type_response->setUserAccountPublicId(null);
$grant_type_response->setRefreshTokenIssued($issue_refresh_token);
$grant_type_response->setRefreshTokenScope($grant_type_response->getRequestedScope());
}
/**
* {@inheritdoc}
*/
public function isClientAuthenticated(ClientInterface $client, $client_credentials, ServerRequestInterface $request)
{
$jwk_set = $client->getPublicKeySet();
if (!$jwk_set instanceof JWKSetInterface) {
return false;
}
try {
$this->getJWTLoader()->verify($client_credentials, $jwk_set);
} catch (\Exception $e) {
return false;
}
return true;
}