OIDC test - test jumbojett oidc php app
This commit is contained in:
matt committed
1 parent
a759eb206f
commit
97a31db020
6 files changed
+79
-98
No files matched your search
@@ -3,6 +3,10 @@ This app is intended to use with tracking personal fitness providers and visits
|
||||
I will build this with LAPP stack - Linux, Apache, PHP & Python. I will build the front-end in PHP, and the back-end will be a Python API with a database.
|
||||
|
||||
The database will be a SQLite file handled by the Python service. There will need to be a Users table, a Providers table, and a Visits table. The Users table will contain the information and settings for the site users. The settings can be a JSON structure inside a single text entry. The Providers table will track the Providers info and rates. The rates will also be a JSON structure in a single text field. Any user can add a provider, and set it private or not. If not private, other users can add visits for the same provider. The Visits table will contain enties for User Visits to Providers. This will have date, time, location, provider, cost. There should be a initialize_db function that checks for the file and creates it if needed, including all tables. Here is a complete list of data for each table.
|
||||
|
||||
Found this for OIDC - don't wanna lose it
|
||||
https://github.com/jumbojett/OpenID-Connect-PHP/blob/master/README.md
|
||||
|
||||
```
|
||||
Users
|
||||
- Name
|
||||
|
||||
+26
-45
@@ -1,59 +1,40 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
require_once __DIR__ . '/config.php';
|
||||
require_once __DIR__ . '/vendor/autoload.php';
|
||||
// callback.php
|
||||
require __DIR__ . '/../vendor/autoload.php';
|
||||
session_start();
|
||||
|
||||
use Fitness\OIDC\OIDC;
|
||||
|
||||
// Ensure a state was sent back.
|
||||
if (!isset($_GET['state']) || !isset($_SESSION['oidc_state'])) {
|
||||
http_response_code(400);
|
||||
exit('Missing state parameter.');
|
||||
}
|
||||
|
||||
// Verify the state matches what we stored.
|
||||
if ($_GET['state'] !== $_SESSION['oidc_state']) {
|
||||
http_response_code(400);
|
||||
exit('Invalid state.');
|
||||
}
|
||||
|
||||
// Clean up the session variables.
|
||||
$state = $_SESSION['oidc_state'];
|
||||
$nonce = $_SESSION['oidc_nonce'];
|
||||
unset($_SESSION['oidc_state'], $_SESSION['oidc_nonce']);
|
||||
|
||||
if (!isset($_GET['code'])) {
|
||||
http_response_code(400);
|
||||
exit('Missing authorization code.');
|
||||
}
|
||||
|
||||
$code = $_GET['code'];
|
||||
$oidc = new OIDC();
|
||||
$oidc = new \Jumbojett\OpenIDConnectClient(
|
||||
'https://auth.matt-cloud.com/oidc',
|
||||
'fitness-oidc',
|
||||
'egebuqzZfVnjjBG9JDQ8tjW3TzV9gJurvT7qfB6c2SX2nPBNeaGycDfx4788QzJd'
|
||||
);
|
||||
$oidc->setRedirectURL('https://fitness.matt-cloud.com/pgapi/auth/oidc/callback');
|
||||
|
||||
try {
|
||||
// Exchange code for tokens.
|
||||
$tokens = $oidc->exchangeCode($code);
|
||||
// Finish the auth flow – exchanges the code, validates the ID‑token, fetches userinfo
|
||||
$oidc->authenticate();
|
||||
|
||||
// Validate ID token (minimal).
|
||||
$idInfo = $oidc->validateIDToken($tokens['id_token'], $nonce);
|
||||
// $oidc->idToken is a JWT object; you can cast to array if needed
|
||||
$idToken = $oidc->idToken;
|
||||
|
||||
// Get userinfo (includes groups because of scope).
|
||||
$userInfo = $oidc->getUserInfo($tokens['access_token']);
|
||||
// Userinfo (includes groups because you requested the `groups` scope)
|
||||
$userInfo = $oidc->getUserInfo(); // or $oidc->requestUserInfo('email')
|
||||
|
||||
// Store everything we need in the session.
|
||||
// Store what you need in the session
|
||||
$_SESSION['user'] = [
|
||||
'id_token' => $tokens['id_token'],
|
||||
'access_token'=> $tokens['access_token'],
|
||||
'refresh_token'=> $tokens['refresh_token'] ?? null,
|
||||
'expires_in' => $tokens['expires_in'] ?? null,
|
||||
'id_info' => $idInfo,
|
||||
'user_info' => $userInfo,
|
||||
'id_token' => $oidc->idToken, // JWT string
|
||||
'access_token'=> $oidc->accessToken, // opaque or JWT
|
||||
'refresh_token'=> $oidc->refreshToken,
|
||||
'expires_in' => $oidc->expiresIn,
|
||||
'claims' => (array)$idToken, // decoded claims
|
||||
'userinfo' => $userInfo,
|
||||
];
|
||||
} catch (\Throwable $e) {
|
||||
} catch (Exception $e) {
|
||||
http_response_code(500);
|
||||
exit('Error during OIDC exchange: ' . $e->getMessage());
|
||||
echo "Authentication failed: " . $e->getMessage();
|
||||
exit;
|
||||
}
|
||||
|
||||
// Clean up the query string (code, state) by redirecting to the home page.
|
||||
// Redirect to the site’s landing page
|
||||
header('Location: /');
|
||||
exit;
|
||||
@@ -1,5 +1,6 @@
|
||||
{
|
||||
"require": {
|
||||
"jumbojett/openid-connect-php": "^2.4",
|
||||
"vlucas/phpdotenv": "^5.4",
|
||||
"guzzlehttp/guzzle": "^7.0",
|
||||
"firebase/php-jwt": "^7.0"
|
||||
|
||||
+12
-31
@@ -1,38 +1,19 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
require_once __DIR__ . '/config.php';
|
||||
session_start();
|
||||
?>
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<title>Fitness Site – OIDC Demo</title>
|
||||
<style>
|
||||
body { font-family: Arial, sans-serif; margin: 2rem; }
|
||||
.info { margin-top: 1rem; }
|
||||
pre { background: #f4f4f4; padding: 1rem; }
|
||||
</style>
|
||||
</head>
|
||||
<html>
|
||||
<head><title>Fitness – OIDC Demo</title></head>
|
||||
<body>
|
||||
<h1>Fitness Site – OIDC Demo</h1>
|
||||
<?php if (!isset($_SESSION['user'])): ?>
|
||||
<a href="/login.php"><button>Login with Authelia</button></a>
|
||||
<?php else: ?>
|
||||
<h2>Welcome, <?= htmlspecialchars($_SESSION['user']['userinfo']['name'] ?? '??') ?>!</h2>
|
||||
<p>Email: <?= htmlspecialchars($_SESSION['user']['userinfo']['email'] ?? '') ?></p>
|
||||
<p>Groups: <?= htmlspecialchars(implode(', ', $_SESSION['user']['userinfo']['groups'] ?? [])) ?></p>
|
||||
<p>JWT claims: <pre><?= htmlspecialchars(print_r($_SESSION['user']['claims'], true)) ?></pre></p>
|
||||
|
||||
<?php if (!isset($_SESSION['user'])): ?>
|
||||
<p>You are not logged in.</p>
|
||||
<p><a href="/login.php"><button>Login with Authelia</button></a></p>
|
||||
<?php else: ?>
|
||||
<p>Logged in as: <strong><?=htmlspecialchars($_SESSION['user']['user_info']['name'] ?? 'N/A')?></strong></p>
|
||||
|
||||
<div class="info">
|
||||
<h2>User Information</h2>
|
||||
<pre><?=htmlspecialchars(json_encode($_SESSION['user']['user_info'], JSON_PRETTY_PRINT))?></pre>
|
||||
</div>
|
||||
|
||||
<div class="info">
|
||||
<h2>ID Token Payload (claims)</h2>
|
||||
<pre><?=htmlspecialchars(json_encode($_SESSION['user']['id_info'], JSON_PRETTY_PRINT))?></pre>
|
||||
</div>
|
||||
|
||||
<p><a href="/logout.php"><button>Logout</button></a></p>
|
||||
<?php endif; ?>
|
||||
<a href="/logout.php"><button>Logout</button></a>
|
||||
<?php endif; ?>
|
||||
</body>
|
||||
</html>
|
||||
+14
-13
@@ -1,18 +1,19 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
require_once __DIR__ . '/config.php';
|
||||
require_once __DIR__ . '/vendor/autoload.php';
|
||||
// login.php
|
||||
require __DIR__ . '/../vendor/autoload.php';
|
||||
session_start();
|
||||
|
||||
use Fitness\OIDC\OIDC;
|
||||
$oidc = new \Jumbojett\OpenIDConnectClient(
|
||||
'https://auth.matt-cloud.com/oidc',
|
||||
'fitness-oidc',
|
||||
'egebuqzZfVnjjBG9JDQ8tjW3TzV9gJurvT7qfB6c2SX2nPBNeaGycDfx4788QzJd'
|
||||
);
|
||||
|
||||
// Generate a cryptographically random state & nonce.
|
||||
$state = bin2hex(random_bytes(16));
|
||||
$nonce = bin2hex(random_bytes(16));
|
||||
// Tell the client where the user should be redirected after Auth
|
||||
$oidc->setRedirectURL('https://fitness.matt-cloud.com/pgapi/auth/oidc/callback');
|
||||
|
||||
// Persist them in the session to validate later.
|
||||
$_SESSION['oidc_state'] = $state;
|
||||
$_SESSION['oidc_nonce'] = $nonce;
|
||||
// If you want PKCE (recommended for public clients)
|
||||
$oidc->setCodeChallengeMethod('S256');
|
||||
|
||||
$oidc = new OIDC();
|
||||
header('Location: ' . $oidc->buildAuthUrl($state, $nonce));
|
||||
exit;
|
||||
// Start the auth flow
|
||||
$oidc->authenticate();
|
||||
+22
-9
@@ -1,15 +1,28 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
require_once __DIR__ . '/config.php';
|
||||
|
||||
// Destroy the PHP session.
|
||||
// logout.php
|
||||
require __DIR__ . '/../vendor/autoload.php';
|
||||
session_start();
|
||||
|
||||
$oidc = new \Jumbojett\OpenIDConnectClient(
|
||||
'https://auth.matt-cloud.com/oidc',
|
||||
'fitness-oidc',
|
||||
'egebuqzZfVnjjBG9JDQ8tjW3TzV9gJurvT7qfB6c2SX2nPBNeaGycDfx4788QzJd'
|
||||
);
|
||||
|
||||
// Build the end‑session endpoint (back‑channel logout)
|
||||
$logoutUrl = $oidc->getLogoutEndpoint(); // e.g. https://auth.matt-cloud.com/logout
|
||||
|
||||
// Include the post‑logout redirect URI
|
||||
$logoutUrl .= '?post_logout_redirect_uri=' . urlencode('https://fitness.matt-cloud.com/');
|
||||
|
||||
// Optionally pass the ID‑token hint so the OP can immediately terminate the session
|
||||
if (isset($_SESSION['user']['id_token'])) {
|
||||
$logoutUrl .= '&id_token_hint=' . urlencode($_SESSION['user']['id_token']);
|
||||
}
|
||||
|
||||
// Destroy the local session first
|
||||
session_destroy();
|
||||
|
||||
// Redirect the user to Authelia’s logout endpoint.
|
||||
// Authelia will clean its session and then redirect back.
|
||||
$logoutUrl = OIDC_LOGOUT_ENDPOINT
|
||||
. '?post_logout_redirect_uri=' . urlencode(OIDC_POST_LOGOUT_REDIRECT_URI);
|
||||
|
||||
// Redirect the browser
|
||||
header('Location: ' . $logoutUrl);
|
||||
exit;
|
||||
Reference in new issue
Block a user