From 97a31db020a3f7f6e92c133eba354b6677225c31 Mon Sep 17 00:00:00 2001 From: matt Date: Fri, 23 Oct 2026 04:38:37 -0700 Subject: [PATCH] OIDC test - test jumbojett oidc php app --- README.md | 4 +++ web/callback.php | 71 +++++++++++++++++------------------------------ web/composer.json | 1 + web/index.php | 43 ++++++++-------------------- web/login.php | 27 +++++++++--------- web/logout.php | 31 +++++++++++++++------ 6 files changed, 79 insertions(+), 98 deletions(-) diff --git a/README.md b/README.md index 1d4d6c0..2081eef 100644 --- a/README.md +++ b/README.md @@ -3,6 +3,10 @@ This app is intended to use with tracking personal fitness providers and visits I will build this with LAPP stack - Linux, Apache, PHP & Python. I will build the front-end in PHP, and the back-end will be a Python API with a database. The database will be a SQLite file handled by the Python service. There will need to be a Users table, a Providers table, and a Visits table. The Users table will contain the information and settings for the site users. The settings can be a JSON structure inside a single text entry. The Providers table will track the Providers info and rates. The rates will also be a JSON structure in a single text field. Any user can add a provider, and set it private or not. If not private, other users can add visits for the same provider. The Visits table will contain enties for User Visits to Providers. This will have date, time, location, provider, cost. There should be a initialize_db function that checks for the file and creates it if needed, including all tables. Here is a complete list of data for each table. + +Found this for OIDC - don't wanna lose it +https://github.com/jumbojett/OpenID-Connect-PHP/blob/master/README.md + ``` Users - Name diff --git a/web/callback.php b/web/callback.php index b6b1534..bf058e1 100644 --- a/web/callback.php +++ b/web/callback.php @@ -1,59 +1,40 @@ setRedirectURL('https://fitness.matt-cloud.com/pgapi/auth/oidc/callback'); try { - // Exchange code for tokens. - $tokens = $oidc->exchangeCode($code); + // Finish the auth flow – exchanges the code, validates the ID‑token, fetches userinfo + $oidc->authenticate(); - // Validate ID token (minimal). - $idInfo = $oidc->validateIDToken($tokens['id_token'], $nonce); + // $oidc->idToken is a JWT object; you can cast to array if needed + $idToken = $oidc->idToken; - // Get userinfo (includes groups because of scope). - $userInfo = $oidc->getUserInfo($tokens['access_token']); + // Userinfo (includes groups because you requested the `groups` scope) + $userInfo = $oidc->getUserInfo(); // or $oidc->requestUserInfo('email') - // Store everything we need in the session. + // Store what you need in the session $_SESSION['user'] = [ - 'id_token' => $tokens['id_token'], - 'access_token'=> $tokens['access_token'], - 'refresh_token'=> $tokens['refresh_token'] ?? null, - 'expires_in' => $tokens['expires_in'] ?? null, - 'id_info' => $idInfo, - 'user_info' => $userInfo, + 'id_token' => $oidc->idToken, // JWT string + 'access_token'=> $oidc->accessToken, // opaque or JWT + 'refresh_token'=> $oidc->refreshToken, + 'expires_in' => $oidc->expiresIn, + 'claims' => (array)$idToken, // decoded claims + 'userinfo' => $userInfo, ]; -} catch (\Throwable $e) { +} catch (Exception $e) { http_response_code(500); - exit('Error during OIDC exchange: ' . $e->getMessage()); + echo "Authentication failed: " . $e->getMessage(); + exit; } -// Clean up the query string (code, state) by redirecting to the home page. +// Redirect to the site’s landing page header('Location: /'); exit; \ No newline at end of file diff --git a/web/composer.json b/web/composer.json index 09fd932..c08ba4a 100644 --- a/web/composer.json +++ b/web/composer.json @@ -1,5 +1,6 @@ { "require": { + "jumbojett/openid-connect-php": "^2.4", "vlucas/phpdotenv": "^5.4", "guzzlehttp/guzzle": "^7.0", "firebase/php-jwt": "^7.0" diff --git a/web/index.php b/web/index.php index 1e1c6eb..8f4a923 100644 --- a/web/index.php +++ b/web/index.php @@ -1,38 +1,19 @@ - - - - Fitness Site – OIDC Demo - - + +Fitness – OIDC Demo -

Fitness Site – OIDC Demo

+ + + +

Welcome, !

+

Email:

+

Groups:

+

JWT claims:

- -

You are not logged in.

-

- -

Logged in as:

- -
-

User Information

-
-
- -
-

ID Token Payload (claims)

-
-
- -

- + + \ No newline at end of file diff --git a/web/login.php b/web/login.php index 0f22b2b..55d4cd1 100644 --- a/web/login.php +++ b/web/login.php @@ -1,18 +1,19 @@ setRedirectURL('https://fitness.matt-cloud.com/pgapi/auth/oidc/callback'); -// Persist them in the session to validate later. -$_SESSION['oidc_state'] = $state; -$_SESSION['oidc_nonce'] = $nonce; +// If you want PKCE (recommended for public clients) +$oidc->setCodeChallengeMethod('S256'); -$oidc = new OIDC(); -header('Location: ' . $oidc->buildAuthUrl($state, $nonce)); -exit; \ No newline at end of file +// Start the auth flow +$oidc->authenticate(); \ No newline at end of file diff --git a/web/logout.php b/web/logout.php index b134ec8..de98a0e 100644 --- a/web/logout.php +++ b/web/logout.php @@ -1,15 +1,28 @@ getLogoutEndpoint(); // e.g. https://auth.matt-cloud.com/logout + +// Include the post‑logout redirect URI +$logoutUrl .= '?post_logout_redirect_uri=' . urlencode('https://fitness.matt-cloud.com/'); + +// Optionally pass the ID‑token hint so the OP can immediately terminate the session +if (isset($_SESSION['user']['id_token'])) { + $logoutUrl .= '&id_token_hint=' . urlencode($_SESSION['user']['id_token']); +} + +// Destroy the local session first session_destroy(); -// Redirect the user to Authelia’s logout endpoint. -// Authelia will clean its session and then redirect back. -$logoutUrl = OIDC_LOGOUT_ENDPOINT - . '?post_logout_redirect_uri=' . urlencode(OIDC_POST_LOGOUT_REDIRECT_URI); - +// Redirect the browser header('Location: ' . $logoutUrl); exit; \ No newline at end of file