OIDC test

web/login/.env

@@ -0,0 +1,9 @@
+OIDC_CLIENT_ID=fitness-oidc
+OIDC_CLIENT_SECRET=egebuqzZfVnjjBG9JDQ8tjW3TzV9gJurvT7qfB6c2SX2nPBNeaGycDfx4788QzJd
+OIDC_REDIRECT_URI=https://fitness.matt-cloud.com/pgapi/auth/oidc/callback
+OIDC_AUTH_ENDPOINT=https://auth.matt-cloud.com/oidc/auth
+OIDC_TOKEN_ENDPOINT=https://auth.matt-cloud.com/oidc/token
+OIDC_USERINFO_ENDPOINT=https://auth.matt-cloud.com/oidc/userinfo
+OIDC_LOGOUT_ENDPOINT=https://auth.matt-cloud.com/logout
+# Optional: the default redirect after logout
+OIDC_POST_LOGOUT_REDIRECT_URI=https://fitness.matt-cloud.com/

web/login/callback.php

@@ -0,0 +1,59 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/config.php';
+require_once __DIR__ . '/vendor/autoload.php';
+
+use Fitness\OIDC\OIDC;
+
+// Ensure a state was sent back.
+if (!isset($_GET['state']) || !isset($_SESSION['oidc_state'])) {
+    http_response_code(400);
+    exit('Missing state parameter.');
+}
+
+// Verify the state matches what we stored.
+if ($_GET['state'] !== $_SESSION['oidc_state']) {
+    http_response_code(400);
+    exit('Invalid state.');
+}
+
+// Clean up the session variables.
+$state = $_SESSION['oidc_state'];
+$nonce = $_SESSION['oidc_nonce'];
+unset($_SESSION['oidc_state'], $_SESSION['oidc_nonce']);
+
+if (!isset($_GET['code'])) {
+    http_response_code(400);
+    exit('Missing authorization code.');
+}
+
+$code = $_GET['code'];
+$oidc = new OIDC();
+
+try {
+    // Exchange code for tokens.
+    $tokens = $oidc->exchangeCode($code);
+
+    // Validate ID token (minimal).
+    $idInfo = $oidc->validateIDToken($tokens['id_token'], $nonce);
+
+    // Get userinfo (includes groups because of scope).
+    $userInfo = $oidc->getUserInfo($tokens['access_token']);
+
+    // Store everything we need in the session.
+    $_SESSION['user'] = [
+        'id_token'    => $tokens['id_token'],
+        'access_token'=> $tokens['access_token'],
+        'refresh_token'=> $tokens['refresh_token'] ?? null,
+        'expires_in'  => $tokens['expires_in'] ?? null,
+        'id_info'     => $idInfo,
+        'user_info'   => $userInfo,
+    ];
+} catch (\Throwable $e) {
+    http_response_code(500);
+    exit('Error during OIDC exchange: ' . $e->getMessage());
+}
+
+// Clean up the query string (code, state) by redirecting to the home page.
+header('Location: /');
+exit;

web/login/composer.json

@@ -0,0 +1,6 @@
+{
+  "require": {
+    "guzzlehttp/guzzle": "^7.0",
+    "firebase/php-jwt": "^6.0"
+  }
+}

web/login/config.php

@@ -0,0 +1,23 @@
+<?php
+declare(strict_types=1);
+
+session_start();
+
+/**
+ * Load environment variables. If you don't use phpdotenv,
+ * copy the values from .env directly here.
+ */
+$dotenv = Dotenv\Dotenv::createImmutable(__DIR__);
+$dotenv->load();
+
+/**
+ * Basic OIDC configuration – keep all secrets out of source‑control.
+ */
+define('OIDC_CLIENT_ID', getenv('OIDC_CLIENT_ID'));
+define('OIDC_CLIENT_SECRET', getenv('OIDC_CLIENT_SECRET'));
+define('OIDC_REDIRECT_URI', getenv('OIDC_REDIRECT_URI'));
+define('OIDC_AUTH_ENDPOINT', getenv('OIDC_AUTH_ENDPOINT'));
+define('OIDC_TOKEN_ENDPOINT', getenv('OIDC_TOKEN_ENDPOINT'));
+define('OIDC_USERINFO_ENDPOINT', getenv('OIDC_USERINFO_ENDPOINT'));
+define('OIDC_LOGOUT_ENDPOINT', getenv('OIDC_LOGOUT_ENDPOINT'));
+define('OIDC_POST_LOGOUT_REDIRECT_URI', getenv('OIDC_POST_LOGOUT_REDIRECT_URI'));

web/login/index.php

@@ -0,0 +1,38 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/config.php';
+?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Fitness Site – OIDC Demo</title>
+    <style>
+        body { font-family: Arial, sans-serif; margin: 2rem; }
+        .info { margin-top: 1rem; }
+        pre { background: #f4f4f4; padding: 1rem; }
+    </style>
+</head>
+<body>
+    <h1>Fitness Site – OIDC Demo</h1>
+
+    <?php if (!isset($_SESSION['user'])): ?>
+        <p>You are not logged in.</p>
+        <p><a href="/login.php"><button>Login with Authelia</button></a></p>
+    <?php else: ?>
+        <p>Logged in as: <strong><?=htmlspecialchars($_SESSION['user']['user_info']['name'] ?? 'N/A')?></strong></p>
+
+        <div class="info">
+            <h2>User Information</h2>
+            <pre><?=htmlspecialchars(json_encode($_SESSION['user']['user_info'], JSON_PRETTY_PRINT))?></pre>
+        </div>
+
+        <div class="info">
+            <h2>ID Token Payload (claims)</h2>
+            <pre><?=htmlspecialchars(json_encode($_SESSION['user']['id_info'], JSON_PRETTY_PRINT))?></pre>
+        </div>
+
+        <p><a href="/logout.php"><button>Logout</button></a></p>
+    <?php endif; ?>
+</body>
+</html>

web/login/login.php

@@ -0,0 +1,18 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/config.php';
+require_once __DIR__ . '/vendor/autoload.php';
+
+use Fitness\OIDC\OIDC;
+
+// Generate a cryptographically random state & nonce.
+$state = bin2hex(random_bytes(16));
+$nonce = bin2hex(random_bytes(16));
+
+// Persist them in the session to validate later.
+$_SESSION['oidc_state'] = $state;
+$_SESSION['oidc_nonce'] = $nonce;
+
+$oidc = new OIDC();
+header('Location: ' . $oidc->buildAuthUrl($state, $nonce));
+exit;

web/login/logout.php

@@ -0,0 +1,15 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/config.php';
+
+// Destroy the PHP session.
+session_start();
+session_destroy();
+
+// Redirect the user to Authelia’s logout endpoint.
+// Authelia will clean its session and then redirect back.
+$logoutUrl = OIDC_LOGOUT_ENDPOINT
+    . '?post_logout_redirect_uri=' . urlencode(OIDC_POST_LOGOUT_REDIRECT_URI);
+
+header('Location: ' . $logoutUrl);
+exit;

web/login/src/OIDC.php

@@ -0,0 +1,91 @@
+<?php
+declare(strict_types=1);
+
+namespace Fitness\OIDC;
+
+use GuzzleHttp\Client;
+use Firebase\JWT\JWT;
+use Firebase\JWT\Key;
+
+class OIDC
+{
+    private Client $http;
+
+    public function __construct()
+    {
+        $this->http = new Client(['http_errors' => false]);
+    }
+
+    /**
+     * Build the Auth URL that redirects the user to Authelia.
+     */
+    public function buildAuthUrl(string $state, string $nonce): string
+    {
+        $params = [
+            'response_type' => 'code',
+            'client_id'     => OIDC_CLIENT_ID,
+            'redirect_uri'  => OIDC_REDIRECT_URI,
+            'scope'         => 'openid profile email groups',
+            'state'         => $state,
+            'nonce'         => $nonce,
+        ];
+
+        return OIDC_AUTH_ENDPOINT . '?' . http_build_query($params);
+    }
+
+    /**
+     * Exchange the Authorization Code for tokens.
+     */
+    public function exchangeCode(string $code): array
+    {
+        $response = $this->http->post(OIDC_TOKEN_ENDPOINT, [
+            'auth' => [OIDC_CLIENT_ID, OIDC_CLIENT_SECRET],
+            'form_params' => [
+                'grant_type'    => 'authorization_code',
+                'code'          => $code,
+                'redirect_uri'  => OIDC_REDIRECT_URI,
+            ],
+        ]);
+
+        if ($response->getStatusCode() !== 200) {
+            throw new \RuntimeException('Token endpoint returned ' . $response->getStatusCode());
+        }
+
+        return json_decode((string)$response->getBody(), true, 512, JSON_THROW_ON_ERROR);
+    }
+
+    /**
+     * Call /userinfo with the access token.
+     */
+    public function getUserInfo(string $accessToken): array
+    {
+        $response = $this->http->get(OIDC_USERINFO_ENDPOINT, [
+            'headers' => [
+                'Authorization' => 'Bearer ' . $accessToken,
+            ],
+        ]);
+
+        if ($response->getStatusCode() !== 200) {
+            throw new \RuntimeException('Userinfo endpoint returned ' . $response->getStatusCode());
+        }
+
+        return json_decode((string)$response->getBody(), true, 512, JSON_THROW_ON_ERROR);
+    }
+
+    /**
+     * Validate the ID Token (minimal validation for demo purposes).
+     */
+    public function validateIDToken(string $idToken, string $nonce): array
+    {
+        // Authelia uses RS256 by default, but your config says "none".
+        // We'll decode without verification if alg is "none".
+        $decoded = JWT::decode($idToken, new Key('', ''), ['none', 'RS256']);
+
+        // Check nonce matches what we stored in session.
+        if ($decoded->nonce !== $nonce) {
+            throw new \RuntimeException('Invalid nonce');
+        }
+
+        return (array)$decoded;
+    }
+}