PHPFUI/InstaDoc

OAuth2 supports authentication by OAuth2 2-legged flows.

It primary supports

service account authorization
authorization where a user already has an access token

CloneableInstantiable

Implements
Google\Auth\FetchAuthTokenInterface

Constants

public Google\Auth\OAuth2::DEFAULT_EXPIRY_SECONDS = 3600

public Google\Auth\OAuth2::DEFAULT_SKEW_SECONDS = 60

public Google\Auth\OAuth2::JWT_URN = 'urn:ietf:params:oauth:grant-type:jwt-bearer'

public Google\Auth\OAuth2::STS_URN = 'urn:ietf:params:oauth:grant-type:token-exchange'

Properties

public static $knownGrantTypes = ['authorization_code', 'refresh_token', 'password', 'client_credentials']

The well known grant types.

var string[]

public static $knownSigningAlgorithms = ['HS256', 'HS512', 'HS384', 'RS256']

TODO: determine known methods from the keys of JWT::methods.

var string[]

Methods

public __construct(array $config)

Create a new OAuthCredentials.

The configuration array accepts various options

authorizationUri The authorization server's HTTP endpoint capable of authenticating the end-user and obtaining authorization.
tokenCredentialUri The authorization server's HTTP endpoint capable of issuing tokens and refreshing expired tokens.
clientId A unique identifier issued to the client to identify itself to the authorization server.
clientSecret A shared symmetric secret issued by the authorization server, which is used to authenticate the client.
scope The scope of the access request, expressed either as an Array or as a space-delimited String.
state An arbitrary string designed to allow the client to maintain state.
redirectUri The redirection URI used in the initial request.
username The resource owner's username.
password The resource owner's password.
issuer Issuer ID when using assertion profile
audience Target audience for assertions
expiry Number of seconds assertions are valid for
signingKey Signing key when using assertion profile
signingKeyId Signing key id when using assertion profile
refreshToken The refresh token associated with the access token to be refreshed.
accessToken The current access token for this client.
idToken The current ID token for this client.
extensionParams When using an extension grant type, this is the set of parameters used by that extension.
codeVerifier The code verifier for PKCE for OAuth 2.0.
resource The target service or resource where the client ntends to use the requested security token.
subjectTokenFetcher A fetcher for the "subject_token", which is a security token that represents the identity of the party on behalf of whom the request is being made.
subjectTokenType An identifier that indicates the type of the security token in the subjectToken parameter.
actorToken A security token that represents the identity of the acting party.
actorTokenType An identifier for the representation of the issued security token.

param array $config Configuration array

public buildFullAuthorizationUri(array $config = [])

Builds the authorization Uri that the user should be redirected to.

param array $config configuration options that customize the return url.
return \UriInterface the authorization Url.
throws \InvalidArgumentException

public fetchAuthToken(?callable $httpHandler = NULL, array $headers = [])

Fetches the auth tokens based on the current state.

param callable|null $httpHandler callback which delivers psr7 request
param array $headers [optional] If present, add these headers to the token endpoint request.
return array the response

public generateCodeVerifier() : string

Generates a random 128-character string for the "code_verifier" parameter in PKCE for OAuth 2.0. This is a cryptographically random string that is determined using random_int, hashed using "hash" and sha256, and base64 encoded.

When this method is called, the code verifier is set on the object.

return string

public generateCredentialsRequest(?callable $httpHandler = NULL, array $headers = [])

Generates a request for token credentials.

param callable|null $httpHandler callback which delivers psr7 request
param array $headers [optional] Additional headers to pass to the token endpoint request.
return \RequestInterface the authorization Url.

public getAccessToken()

Gets the current access token.

return ?string

public getAdditionalClaims()

Gets the additional claims to be included in the JWT token.

return array

public getAudience()

Gets the target audience when issuing assertions.

return ?string

public getAuthorizationUri()

Gets the authorization server's HTTP endpoint capable of authenticating the end-user and obtaining authorization.

return ?\UriInterface

public getCacheKey()

deprecated Obtains a key that can used to cache the results of #fetchAuthToken. The key is derived from the scopes.
return ?string a key that may be used to cache the auth token.

public getClientId()

Sets a unique identifier issued to the client to identify itself to the authorization server.

return string

public getClientName(?callable $httpHandler = NULL)

Get the client ID.

Alias of {@see \OAuth2::getClientId()}.

param callable|null $httpHandler
return string
access private

public getClientSecret()

Gets a shared symmetric secret issued by the authorization server, which is used to authenticate the client.

return string

public getCode()

Gets the authorization code issued to this client.

return string

public getCodeVerifier() : ?string

return string|null

public getExpiresAt()

Gets the time the current access token expires at.

return ?int

public getExpiresIn()

Gets the lifetime of the access token in seconds.

return int

public getExpiry()

Gets the number of seconds assertions are valid for.

return int

public getExtensionParams()

Gets the set of parameters used by extension when using an extension grant type.

return array

public getGrantedScope()

Get the granted space-separated scopes (if they exist) for the last fetched token.

return string|null

public getGrantType()

Gets the current grant type.

return ?string

public getIdToken()

Gets the current ID token.

return ?string

public getIssuedAt()

Gets the time the current access token was issued at.

return ?int

public getIssuedTokenType()

Gets the additional claims to be included in the JWT token.

return ?string

public getIssuer()

Gets the Issuer ID when using assertion profile.

return ?string

public getLastReceivedToken()

The expiration of the last received token.

return array|null

public getPassword()

Gets the resource owner's password.

return string

public getRedirectUri()

Gets the redirection URI used in the initial request.

return ?string

public getRefreshToken()

Gets the refresh token associated with the current access token.

return ?string

public getScope()

Gets the scope of the access requests as a space-delimited String.

return ?string

public getSigningAlgorithm()

Gets the signing algorithm when using an assertion profile.

return ?string

public getSigningKey()

Gets the signing key when using an assertion profile.

return ?string

public getSigningKeyId()

Gets the signing key id when using an assertion profile.

return ?string

public getState()

Gets an arbitrary string designed to allow the client to maintain state.

return string

public getSub()

Gets the target sub when issuing assertions.

return ?string

public getSubjectTokenFetcher() : ?Google\Auth\ExternalAccountCredentialSourceInterface

Gets this instance's SubjectTokenFetcher

return null|\ExternalAccountCredentialSourceInterface

public getSubjectTokenType() : ?string

Gets the subject token type

return ?string

public getTokenCredentialUri()

Gets the authorization server's HTTP endpoint capable of issuing tokens and refreshing expired tokens.

return ?\UriInterface

public getUsername()

Gets the resource owner's username.

return string

public isExpired()

Returns true if the acccess token has expired.

return bool

public parseTokenResponse(Psr\Http\Message\ResponseInterface $resp)

Parses the fetched tokens.

param \ResponseInterface $resp the response.
return array the tokens parsed from the response body.
throws \Exception

public setAccessToken( $accessToken)

Sets the current access token.

param string $accessToken
return void

public setAdditionalClaims(array $additionalClaims)

Sets additional claims to be included in the JWT token

param array $additionalClaims
return void

public setAudience( $audience)

Sets the target audience when issuing assertions.

param string $audience
return void

public setAuthorizationUri( $uri)

Sets the authorization server's HTTP endpoint capable of authenticating the end-user and obtaining authorization.

param string $uri
return void

public setClientId( $clientId)

Sets a unique identifier issued to the client to identify itself to the authorization server.

param string $clientId
return void

public setClientSecret( $clientSecret)

Sets a shared symmetric secret issued by the authorization server, which is used to authenticate the client.

param string $clientSecret
return void

public setCode( $code)

Sets the authorization code issued to this client.

param string $code
return void

public setCodeVerifier(?string $codeVerifier) : void

A cryptographically random string that is used to correlate the authorization request to the token request.

The code verifier for PKCE for OAuth 2.0. When set, the authorization URI will contain the Code Challenge and Code Challenge Method querystring parameters, and the token URI will contain the Code Verifier parameter.

see https://datatracker.ietf.org/doc/html/rfc7636
param string|null $codeVerifier

public setExpiresAt( $expiresAt)

Sets the time the current access token expires at.

param int $expiresAt
return void

public setExpiresIn( $expiresIn)

Sets the lifetime of the access token in seconds.

param ?int $expiresIn
return void

public setExpiry( $expiry)

Sets the number of seconds assertions are valid for.

param int $expiry
return void

public setExtensionParams( $extensionParams)

Sets the set of parameters used by extension when using an extension grant type.

param array $extensionParams
return void

public setGrantedScope( $grantedScope)

Sets the current ID token.

param string $grantedScope
return void

public setGrantType( $grantType)

Sets the current grant type.

param string $grantType
return void
throws \InvalidArgumentException

public setIdToken( $idToken)

Sets the current ID token.

param string $idToken
return void

public setIssuedAt( $issuedAt)

Sets the time the current access token was issued at.

param int $issuedAt
return void

public setIssuer( $issuer)

Sets the Issuer ID when using assertion profile.

param string $issuer
return void

public setPassword( $password)

Sets the resource owner's password.

param string $password
return void

public setRedirectUri( $uri)

Sets the redirection URI used in the initial request.

param ?string $uri
return void

public setRefreshToken( $refreshToken)

Sets the refresh token associated with the current access token.

param string $refreshToken
return void

public setScope( $scope)

Sets the scope of the access request, expressed either as an Array or as a space-delimited String.

param string|string[]|null $scope
return void
throws \InvalidArgumentException

public setSigningAlgorithm( $signingAlgorithm)

Sets the signing algorithm when using an assertion profile.

param ?string $signingAlgorithm
return void

public setSigningKey( $signingKey)

Sets the signing key when using an assertion profile.

param string $signingKey
return void

public setSigningKeyId( $signingKeyId)

Sets the signing key id when using an assertion profile.

param string $signingKeyId
return void

public setState( $state)

Sets an arbitrary string designed to allow the client to maintain state.

param string $state
return void

public setSub( $sub)

Sets the target sub when issuing assertions.

param string $sub
return void

public setTokenCredentialUri( $uri)

Sets the authorization server's HTTP endpoint capable of issuing tokens and refreshing expired tokens.

param string $uri
return void

public setUsername( $username)

Sets the resource owner's username.

param string $username
return void

public toJwt(array $config = [])

Obtains the encoded jwt from the instance data.

param array $config array optional configuration parameters
return string

public updateToken(array $config)

Updates an OAuth 2.0 client.

Example:

$oauth->updateToken([
    'refresh_token' => 'n4E9O119d',
    'access_token' => 'FJQbwq9',
    'expires_in' => 3600
]);

param
array $config The configuration parameters related to the token.
- refresh_token The refresh token associated with the access token to be refreshed.
- access_token The current access token for this client.
- id_token The current ID token for this client.
- expires_in The time in seconds until access token expiration.
- expires_at The time as an integer number of seconds since the Epoch
- issued_at The timestamp that the token was issued at.
return void

public verifyIdToken( $publicKey = NULL, $allowed_algs = [])

Verifies the idToken if present.

if none is present, return null
if present, but invalid, raises DomainException.
otherwise returns the payload in the idtoken as a PHP object.

The behavior of this method varies depending on the version of firebase/php-jwt you are using. In versions 6.0 and above, you cannot provide multiple $allowed_algs, and instead must provide an array of Key objects as the $publicKey.

param string|\Key|\Key[] $publicKey The public key to use to authenticate the token
param string|string[] $allowed_algs algorithm or array of supported verification algorithms. Providing more than one algorithm will throw an exception.
throws \DomainException if the token is missing an audience.
throws \DomainException if the audience does not match the one set in the OAuth2 class instance.
throws \UnexpectedValueException If the token is invalid
throws \InvalidArgumentException If more than one value for allowed_algs is supplied
throws \Firebase\JWT\SignatureInvalidException If the signature is invalid.
throws \Firebase\JWT\BeforeValidException If the token is not yet valid.
throws \Firebase\JWT\ExpiredException If the token has expired.
return null|object

Constants

private Google\Auth\OAuth2::STS_REQUESTED_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:access_token'

Properties

private $accessToken = NULL

The current access token.

var string

private ?string $actorToken

For STS requests.

A security token that represents the identity of the acting party.

private ?string $actorTokenType

For STS requests.

An identifier that indicates the type of the security token in the actorToken parameter.

private $additionalClaims = NULL

When using the toJwt function, these claims will be added to the JWT payload.

var array

private array $additionalOptions

From STS response.

An identifier for the representation of the issued security token.

var array

private $audience = NULL

The target audience for assertions.

var string

private $authorizationUri = NULL

authorizationUri The authorization server's HTTP endpoint capable of authenticating the end-user and obtaining authorization.

var ?\UriInterface

private $clientId = NULL

A unique identifier issued to the client to identify itself to the authorization server.

var string

private $clientSecret = NULL

A shared symmetric secret issued by the authorization server, which is used to authenticate the client.

var string

private $code = NULL

The authorization code issued to this client.

Only used by the authorization code access grant type.

var ?string

private $codeVerifier = NULL

see https://datatracker.ietf.org/doc/html/rfc7636
var ?string

private $expiresAt = NULL

The expiration time of the access token as a number of seconds since the unix epoch.

var ?int

private $expiresIn = NULL

The lifetime in seconds of the current access token.

var ?int

private $expiry = NULL

The number of seconds assertions are valid for.

var int

private $extensionParams = NULL

When using an extension grant type, this is the set of parameters used by that extension.

var array

private $grantedScope = NULL

The scopes granted to the current access token

var string

private $grantType = NULL

The current grant type.

var ?string

private $idToken = NULL

The current ID token.

var string

private $issuedAt = NULL

The issue time of the access token as a number of seconds since the unix epoch.

var ?int

private ?string $issuedTokenType = NULL

From STS response.

An identifier for the representation of the issued security token.

private $issuer = NULL

The issuer ID when using assertion profile.

var ?string

private $password = NULL

The resource owner's password.

var ?string

private $redirectUri = NULL

The redirection URI used in the initial request.

var ?string

private $refreshToken = NULL

The refresh token associated with the access token to be refreshed.

var ?string

private ?string $resource

For STS requests.

A URI that indicates the target service or resource where the client intends to use the requested security token.

private $scope = NULL

The scope of the access request, expressed either as an Array or as a space-delimited string.

var ?string[]

private $signingAlgorithm = NULL

The signing algorithm when using an assertion profile.

var ?string

private $signingKey = NULL

The signing key when using assertion profile.

var ?string

private $signingKeyId = NULL

The signing key id when using assertion profile. Param kid in jwt header

var string

private $state = NULL

An arbitrary string designed to allow the client to maintain state.

var string

private $sub = NULL

The target sub when issuing assertions.

var string

private ?Google\Auth\ExternalAccountCredentialSourceInterface $subjectTokenFetcher

For STS requests.

A fetcher for the "subject_token", which is a security token that represents the identity of the party on behalf of whom the request is being made.

private ?string $subjectTokenType

For STS requests.

An identifier, that indicates the type of the security token in the subjectToken parameter.

private $tokenCredentialUri = NULL

tokenCredentialUri The authorization server's HTTP endpoint capable of issuing tokens and refreshing expired tokens.

var \UriInterface

private $username = NULL

The resource owner's username.

var ?string

Methods

private addClientCredentials( $params)

param array $params
return array

private coerceUri( $uri)

todo handle uri as array
param ?string $uri
return null|\UriInterface

private generateRandomString(int $length) : string

private getCodeChallenge(string $randomString) : string

private getCodeChallengeMethod() : string

private getFirebaseJwtKeys( $publicKey, $allowedAlgs)

param \Key|\Key[]|string|string[] $publicKey
param string|string[] $allowedAlgs
return \Key[]

private isAbsoluteUri( $uri)

Determines if the URI is absolute based on its scheme and host or path (RFC 3986).

param string $uri
return bool

private jwtDecode( $idToken, $publicKey, $allowedAlgs)

param string $idToken
param \Key|\Key[]|string|string[] $publicKey
param string|string[] $allowedAlgs
return object

Properties

public static $knownGrantTypes = ['authorization_code', 'refresh_token', 'password', 'client_credentials']

The well known grant types.

var string[]

public static $knownSigningAlgorithms = ['HS256', 'HS512', 'HS384', 'RS256']

TODO: determine known methods from the keys of JWT::methods.

var string[]