public
nobgit
read
NobMail
Based on mailcow: dockerized
Languages
Repository composition by tracked source files.
PHP
49%
JavaScript
35%
HTML
9%
CSS
4%
Shell
2%
Python
1%
Lua
0%
Perl
0%
Ruby
0%
SCSS
0%
Create file
Wiki Documentation
Clone
https://nobgit.com/orgs/nobgit/nobmail.git
ssh://[email protected]:2222/orgs/nobgit/nobmail.git
Trace
data/web/inc/lib/vendor/stevenmaguire/oauth2-keycloak/README.md
Trace helps you understand code history line by line. See who changed each line, when it changed, and which commit introduced it.
Author
Date
Commit
Line
Code
1
# Keycloak Provider for OAuth 2.0 Client
2
[](https://github.com/stevenmaguire/oauth2-keycloak/releases)
3
[](LICENSE.md)
4
[](https://travis-ci.org/stevenmaguire/oauth2-keycloak)
5
[](https://scrutinizer-ci.com/g/stevenmaguire/oauth2-keycloak/code-structure)
6
[](https://scrutinizer-ci.com/g/stevenmaguire/oauth2-keycloak)
7
[](https://packagist.org/packages/stevenmaguire/oauth2-keycloak)
9
This package provides Keycloak OAuth 2.0 support for the PHP League's [OAuth 2.0 Client](https://github.com/thephpleague/oauth2-client).
11
## Installation
13
To install, use composer:
15
```
16
composer require stevenmaguire/oauth2-keycloak
17
```
19
## Usage
21
Usage is the same as The League's OAuth client, using `\Stevenmaguire\OAuth2\Client\Provider\Keycloak` as the provider.
23
Use `authServerUrl` to specify the Keycloak server URL. You can lookup the correct value from the Keycloak client installer JSON under `auth-server-url`, eg. `http://localhost:8080/auth`.
25
Use `realm` to specify the Keycloak realm name. You can lookup the correct value from the Keycloak client installer JSON under `resource`, eg. `master`.
27
### Authorization Code Flow
29
```php
30
$provider = new Stevenmaguire\OAuth2\Client\Provider\Keycloak([
31
'authServerUrl' => '{keycloak-server-url}',
32
'realm' => '{keycloak-realm}',
33
'clientId' => '{keycloak-client-id}',
34
'clientSecret' => '{keycloak-client-secret}',
35
'redirectUri' => 'https://example.com/callback-url',
36
'encryptionAlgorithm' => 'RS256', // optional
37
'encryptionKeyPath' => '../key.pem' // optional
38
'encryptionKey' => 'contents_of_key_or_certificate' // optional
39
'version' => '20.0.1', // optional
40
]);
42
if (!isset($_GET['code'])) {
44
// If we don't have an authorization code then get one
45
$authUrl = $provider->getAuthorizationUrl();
46
$_SESSION['oauth2state'] = $provider->getState();
47
header('Location: '.$authUrl);
48
exit;
50
// Check given state against previously stored one to mitigate CSRF attack
51
} elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {
53
unset($_SESSION['oauth2state']);
54
exit('Invalid state, make sure HTTP sessions are enabled.');
56
} else {
58
// Try to get an access token (using the authorization coe grant)
59
try {
60
$token = $provider->getAccessToken('authorization_code', [
61
'code' => $_GET['code']
62
]);
63
} catch (Exception $e) {
64
exit('Failed to get access token: '.$e->getMessage());
65
}
67
// Optional: Now you have a token you can look up a users profile data
68
try {
70
// We got an access token, let's now get the user's details
71
$user = $provider->getResourceOwner($token);
73
// Use these details to create a new profile
74
printf('Hello %s!', $user->getName());
76
} catch (Exception $e) {
77
exit('Failed to get resource owner: '.$e->getMessage());
78
}
80
// Use this to interact with an API on the users behalf
81
echo $token->getToken();
82
}
83
```
85
### Refreshing a Token
87
```php
88
$provider = new Stevenmaguire\OAuth2\Client\Provider\Keycloak([
89
'authServerUrl' => '{keycloak-server-url}',
90
'realm' => '{keycloak-realm}',
91
'clientId' => '{keycloak-client-id}',
92
'clientSecret' => '{keycloak-client-secret}',
93
'redirectUri' => 'https://example.com/callback-url',
94
]);
96
$token = $provider->getAccessToken('refresh_token', ['refresh_token' => $token->getRefreshToken()]);
97
```
99
### Handling encryption
101
If you've configured your Keycloak instance to use encryption, there are some advanced options available to you.
103
#### Configure the provider to use the same encryption algorithm
105
```php
106
$provider = new Stevenmaguire\OAuth2\Client\Provider\Keycloak([
107
// ...
108
'encryptionAlgorithm' => 'RS256',
109
]);
110
```
112
or
114
```php
115
$provider->setEncryptionAlgorithm('RS256');
116
```
118
#### Configure the provider to use the expected decryption public key or certificate
120
##### By key value
122
```php
123
$key = "-----BEGIN PUBLIC KEY-----\n....\n-----END PUBLIC KEY-----";
124
// or
125
// $key = "-----BEGIN CERTIFICATE-----\n....\n-----END CERTIFICATE-----";
127
$provider = new Stevenmaguire\OAuth2\Client\Provider\Keycloak([
128
// ...
129
'encryptionKey' => $key,
130
]);
131
```
133
or
135
```php
136
$provider->setEncryptionKey($key);
137
```
139
##### By key path
141
```php
142
$keyPath = '../key.pem';
144
$provider = new Stevenmaguire\OAuth2\Client\Provider\Keycloak([
145
// ...
146
'encryptionKeyPath' => $keyPath,
147
]);
148
```
150
or
152
```php
153
$provider->setEncryptionKeyPath($keyPath);
154
```
156
## Testing
158
``` bash
159
$ ./vendor/bin/phpunit
160
```
162
## Contributing
164
Please see [CONTRIBUTING](https://github.com/stevenmaguire/oauth2-keycloak/blob/master/CONTRIBUTING.md) for details.
167
## Credits
169
- [Steven Maguire](https://github.com/stevenmaguire)
170
- [Martin Stefan](https://github.com/mstefan21)
171
- [All Contributors](https://github.com/stevenmaguire/oauth2-keycloak/contributors)
174
## License
176
The MIT License (MIT). Please see [License File](https://github.com/stevenmaguire/oauth2-keycloak/blob/master/LICENSE) for more information.