Developed with love by KnpLabs Hire us for your project!
167

oauth2-bundle

by trikoder

Symfony bundle which provides OAuth 2.0 authorization/resource server capabilities.

Trikoder OAuth 2 Bundle

Build Status
Latest Stable Version
License
Code coverage

Symfony bundle which provides OAuth 2.0 authorization/resource server capabilities. The authorization and resource server actors are implemented using the thephpleague/oauth2-server library.

Important notes

This bundle provides the "glue" between thephpleague/oauth2-server library and Symfony.
It implements thephpleague/oauth2-server library in a way specified by its official documentation.
For implementation into Symfony project, please see bundle documentation and official Symfony security documentation.

Status

This package is currently in the active development.

Features

  • API endpoint for client authorization and token issuing
  • Configurable client and token persistance (includes Doctrine support)
  • Integration with Symfony's Security layer

Requirements

Installation

  1. Require the bundle and a PSR 7/17 implementation with Composer:

    composer require trikoder/oauth2-bundle nyholm/psr7
    

    If your project is managed using Symfony Flex, the rest of the steps are not required. Just follow the post-installation instructions instead! :tada:

    NOTE: This bundle requires a PSR 7/17 implementation to operate. We recommend that you use nyholm/psr7. Check out this document if you wish to use a different implementation.

  2. Create the bundle configuration file under config/packages/trikoder_oauth2.yaml. Here is a reference configuration file:

    trikoder_oauth2:
        authorization_server: # Required
    
            # Full path to the private key file.
            # How to generate a private key: https://oauth2.thephpleague.com/installation/#generating-public-and-private-keys
            private_key:          ~ # Required, Example: /var/oauth/private.key
    
            # Passphrase of the private key, if any
            private_key_passphrase: null
    
            # The plain string or the ascii safe string used to create a Defuse\Crypto\Key to be used as an encryption key.
            # How to generate an encryption key: https://oauth2.thephpleague.com/installation/#string-password
            encryption_key:       ~ # Required
    
            # The type of value of 'encryption_key'
            encryption_key_type:  plain # One of "plain"; "defuse"
    
            # How long the issued access token should be valid for.
            # The value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters
            access_token_ttl:     PT1H
    
            # How long the issued refresh token should be valid for.
            # The value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters
            refresh_token_ttl:    P1M
    
            # How long the issued auth code should be valid for.
            # The value should be a valid interval: http://php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters
            auth_code_ttl:        PT10M
    
            # Whether to enable the client credentials grant
            enable_client_credentials_grant: true
    
            # Whether to enable the password grant
            enable_password_grant: true
    
            # Whether to enable the refresh token grant
            enable_refresh_token_grant: true
    
            # Whether to enable the authorization code grant
            enable_auth_code_grant: true
    
            # Whether to require code challenge for public clients for the auth code grant
            require_code_challenge_for_public_clients: true
    
            # Whether to enable the implicit grant
            enable_implicit_grant: true
        resource_server:      # Required
    
            # Full path to the public key file
            # How to generate a public key: https://oauth2.thephpleague.com/installation/#generating-public-and-private-keys
            public_key:           ~ # Required, Example: /var/oauth/public.key
    
        # Scopes that you wish to utilize in your application.
        # This should be a simple array of strings.
        scopes:               []
    
        # Configures different persistence methods that can be used by the bundle for saving client and token data.
        # Only one persistence method can be configured at a time.
        persistence:          # Required
            doctrine:
    
                # Name of the entity manager that you wish to use for managing clients and tokens.
                entity_manager:       default
            in_memory:            ~
    
        # The priority of the event listener that converts an Exception to a Response
        exception_event_listener_priority: 10
    
        # Set a custom prefix that replaces the default 'ROLE_OAUTH2_' role prefix
        role_prefix:          ROLE_OAUTH2_
    
  3. Enable the bundle in config/bundles.php by adding it to the array:

    Trikoder\Bundle\OAuth2Bundle\TrikoderOAuth2Bundle::class => ['all' => true]
    
  4. Update the database so bundle entities can be persisted using Doctrine:

    bin/console doctrine:schema:update --force
    
  5. Import the routes inside your config/routes.yaml file:

    oauth2:
        resource: '@TrikoderOAuth2Bundle/Resources/config/routes.xml'
    

You can verify that everything is working by issuing a POST request to the /token endpoint.

❮ NOTE ❯ It is recommended to control the access to the authorization endpoint
so that only logged in users can approve authorization requests.
You should review your security.yml file. Here is a sample configuration:

security:
    access_control:
        - { path: ^/authorize, roles: IS_AUTHENTICATED_REMEMBERED }

Configuration

Contributing

Please see CONTRIBUTING for details.

Versioning

This project adheres to Semantic Versioning 2.0.0. Randomly breaking public APIs is not an option.

However, starting with version 4, we only promise to follow SemVer on structural elements marked with the @api tag.

Changes

All the package releases are recorded in the CHANGELOG file.

Reporting issues

Use the issue tracker to report any issues you might have.

License

See the LICENSE file for license rights and limitations (MIT).

  • Add PHP CS fixer config file to linter
    By HypeMC, 3 months ago
  • Merge pull request #190 from toniperic/contribution
    By web-flow, 3 months ago
  • Add contributing guidelines
    By HypeMC, 3 months ago
  • Declare versioning policy
    By HypeMC, 3 months ago
  • Merge branch 'v2.x' into v3.x
    By HypeMC, 3 months ago
  • Merge pull request #208 from trikoder/dev-improvements
    By web-flow, 3 months ago
  • Remove IDE folders from .gitignore
    By HypeMC, 3 months ago
  • Fix invalid client fixture definition
    By HypeMC, 3 months ago
  • Allow overriding of host IP
    By HypeMC, 3 months ago
  • Use proper PHP config during development
    By HypeMC, 3 months ago
  • Don't use hardcoded PHP config paths
    By HypeMC, 3 months ago
  • Merge pull request #201 from trikoder/update-php-cs-fixer-version-and-config
    By web-flow, 3 months ago
  • Merge pull request #203 from trikoder/deprecate-legacy-service-aliases
    By web-flow, 3 months ago
  • Merge pull request #204 from trikoder/run-ci-with-prefer-lowest
    By web-flow, 3 months ago
  • Add jobs with the prefer-lowest composer flag to CI
    By HypeMC, 3 months ago
  • Deprecate legacy service aliases.
    By HypeMC, 3 months ago
  • Fix service definition, class used instead of alias
    By HypeMC, 3 months ago
  • Apply new PHP CS fixer rules to code base
    By HypeMC, 3 months ago
  • Update and sort PHP CS fixer config
    By HypeMC, 3 months ago
  • Update PHP CS fixer version
    By HypeMC, 3 months ago
  • Add upgrade notes
    By spideyfusion, 4 months ago
  • Update changelog
    By spideyfusion, 4 months ago
  • Merge pull request #197 from trikoder/fix-column-name-in-index
    By web-flow, 4 months ago
  • Temporarily remove userIdentifier
    By HypeMC, 4 months ago
  • Add upgrade notes
    By spideyfusion, 4 months ago
  • Update changelog
    By spideyfusion, 4 months ago
  • Merge pull request #178 from trikoder/add-support-for-custom-grant-types
    By web-flow, 4 months ago
  • Add support for registering custom grant types
    By spideyfusion, 4 months ago
  • Merge pull request #187 from toniperic/revoke-tokens-and-codes
    By web-flow, 4 months ago
  • Add public API for revoking all credentials
    By , 4 months ago