matt/Fitness
0
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OIDC test - test jumbojett oidc php app

Browse Source
This commit is contained in:
matt committed 2026-10-23 04:38:37 -07:00
1 parent a759eb206f
commit 97a31db020
6 files changed
+79 -98
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

web/callback.php
+26 -45
View File
@@ -1,59 +1,40 @@
<?php
declare(strict_types=1);
require_once __DIR__ . '/config.php';
require_once __DIR__ . '/vendor/autoload.php';
// callback.php
require __DIR__ . '/../vendor/autoload.php';
session_start();
use Fitness\OIDC\OIDC;
// Ensure a state was sent back.
if (!isset($_GET['state']) || !isset($_SESSION['oidc_state'])) {
http_response_code(400);
exit('Missing state parameter.');
}
// Verify the state matches what we stored.
if ($_GET['state'] !== $_SESSION['oidc_state']) {
http_response_code(400);
exit('Invalid state.');
}
// Clean up the session variables.
$state = $_SESSION['oidc_state'];
$nonce = $_SESSION['oidc_nonce'];
unset($_SESSION['oidc_state'], $_SESSION['oidc_nonce']);
if (!isset($_GET['code'])) {
http_response_code(400);
exit('Missing authorization code.');
}
$code = $_GET['code'];
$oidc = new OIDC();
$oidc = new \Jumbojett\OpenIDConnectClient(
'https://auth.matt-cloud.com/oidc',
'fitness-oidc',
'egebuqzZfVnjjBG9JDQ8tjW3TzV9gJurvT7qfB6c2SX2nPBNeaGycDfx4788QzJd'
);
$oidc->setRedirectURL('https://fitness.matt-cloud.com/pgapi/auth/oidc/callback');
try {
// Exchange code for tokens.
$tokens = $oidc->exchangeCode($code);
// Finish the auth flow – exchanges the code, validates the ID‑token, fetches userinfo
$oidc->authenticate();
// Validate ID token (minimal).
$idInfo = $oidc->validateIDToken($tokens['id_token'], $nonce);
// $oidc->idToken is a JWT object; you can cast to array if needed
$idToken = $oidc->idToken;
// Get userinfo (includes groups because of scope).
$userInfo = $oidc->getUserInfo($tokens['access_token']);
// Userinfo (includes groups because you requested the `groups` scope)
$userInfo = $oidc->getUserInfo(); // or $oidc->requestUserInfo('email')
// Store everything we need in the session.
// Store what you need in the session
$_SESSION['user'] = [
'id_token' => $tokens['id_token'],
'access_token'=> $tokens['access_token'],
'refresh_token'=> $tokens['refresh_token'] ?? null,
'expires_in' => $tokens['expires_in'] ?? null,
'id_info' => $idInfo,
'user_info' => $userInfo,
'id_token' => $oidc->idToken, // JWT string
'access_token'=> $oidc->accessToken, // opaque or JWT
'refresh_token'=> $oidc->refreshToken,
'expires_in' => $oidc->expiresIn,
'claims' => (array)$idToken, // decoded claims
'userinfo' => $userInfo,
];
} catch (\Throwable $e) {
} catch (Exception $e) {
http_response_code(500);
exit('Error during OIDC exchange: ' . $e->getMessage());
echo "Authentication failed: " . $e->getMessage();
exit;
}
// Clean up the query string (code, state) by redirecting to the home page.
// Redirect to the site’s landing page
header('Location: /');
exit;
web/composer.json
+1
View File
@@ -1,5 +1,6 @@
{
"require": {
"jumbojett/openid-connect-php": "^2.4",
"vlucas/phpdotenv": "^5.4",
"guzzlehttp/guzzle": "^7.0",
"firebase/php-jwt": "^7.0"
web/index.php
+12 -31
View File
@@ -1,38 +1,19 @@
<?php
declare(strict_types=1);
require_once __DIR__ . '/config.php';
session_start();
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Fitness Site – OIDC Demo</title>
<style>
body { font-family: Arial, sans-serif; margin: 2rem; }
.info { margin-top: 1rem; }
pre { background: #f4f4f4; padding: 1rem; }
</style>
</head>
<html>
<head><title>Fitness – OIDC Demo</title></head>
<body>
<h1>Fitness Site – OIDC Demo</h1>
<?php if (!isset($_SESSION['user'])): ?>
<a href="/login.php"><button>Login with Authelia</button></a>
<?php else: ?>
<h2>Welcome, <?= htmlspecialchars($_SESSION['user']['userinfo']['name'] ?? '??') ?>!</h2>
<p>Email: <?= htmlspecialchars($_SESSION['user']['userinfo']['email'] ?? '') ?></p>
<p>Groups: <?= htmlspecialchars(implode(', ', $_SESSION['user']['userinfo']['groups'] ?? [])) ?></p>
<p>JWT claims: <pre><?= htmlspecialchars(print_r($_SESSION['user']['claims'], true)) ?></pre></p>
<?php if (!isset($_SESSION['user'])): ?>
<p>You are not logged in.</p>
<p><a href="/login.php"><button>Login with Authelia</button></a></p>
<?php else: ?>
<p>Logged in as: <strong><?=htmlspecialchars($_SESSION['user']['user_info']['name'] ?? 'N/A')?></strong></p>
<div class="info">
<h2>User Information</h2>
<pre><?=htmlspecialchars(json_encode($_SESSION['user']['user_info'], JSON_PRETTY_PRINT))?></pre>
</div>
<div class="info">
<h2>ID Token Payload (claims)</h2>
<pre><?=htmlspecialchars(json_encode($_SESSION['user']['id_info'], JSON_PRETTY_PRINT))?></pre>
</div>
<p><a href="/logout.php"><button>Logout</button></a></p>
<?php endif; ?>
<a href="/logout.php"><button>Logout</button></a>
<?php endif; ?>
</body>
</html>
web/login.php
+14 -13
View File
@@ -1,18 +1,19 @@
<?php
declare(strict_types=1);
require_once __DIR__ . '/config.php';
require_once __DIR__ . '/vendor/autoload.php';
// login.php
require __DIR__ . '/../vendor/autoload.php';
session_start();
use Fitness\OIDC\OIDC;
$oidc = new \Jumbojett\OpenIDConnectClient(
'https://auth.matt-cloud.com/oidc',
'fitness-oidc',
'egebuqzZfVnjjBG9JDQ8tjW3TzV9gJurvT7qfB6c2SX2nPBNeaGycDfx4788QzJd'
);
// Generate a cryptographically random state & nonce.
$state = bin2hex(random_bytes(16));
$nonce = bin2hex(random_bytes(16));
// Tell the client where the user should be redirected after Auth
$oidc->setRedirectURL('https://fitness.matt-cloud.com/pgapi/auth/oidc/callback');
// Persist them in the session to validate later.
$_SESSION['oidc_state'] = $state;
$_SESSION['oidc_nonce'] = $nonce;
// If you want PKCE (recommended for public clients)
$oidc->setCodeChallengeMethod('S256');
$oidc = new OIDC();
header('Location: ' . $oidc->buildAuthUrl($state, $nonce));
exit;
// Start the auth flow
$oidc->authenticate();
web/logout.php
+22 -9
View File
@@ -1,15 +1,28 @@
<?php
declare(strict_types=1);
require_once __DIR__ . '/config.php';
// Destroy the PHP session.
// logout.php
require __DIR__ . '/../vendor/autoload.php';
session_start();
$oidc = new \Jumbojett\OpenIDConnectClient(
'https://auth.matt-cloud.com/oidc',
'fitness-oidc',
'egebuqzZfVnjjBG9JDQ8tjW3TzV9gJurvT7qfB6c2SX2nPBNeaGycDfx4788QzJd'
);
// Build the end‑session endpoint (back‑channel logout)
$logoutUrl = $oidc->getLogoutEndpoint(); // e.g. https://auth.matt-cloud.com/logout
// Include the post‑logout redirect URI
$logoutUrl .= '?post_logout_redirect_uri=' . urlencode('https://fitness.matt-cloud.com/');
// Optionally pass the ID‑token hint so the OP can immediately terminate the session
if (isset($_SESSION['user']['id_token'])) {
$logoutUrl .= '&id_token_hint=' . urlencode($_SESSION['user']['id_token']);
}
// Destroy the local session first
session_destroy();
// Redirect the user to Authelia’s logout endpoint.
// Authelia will clean its session and then redirect back.
$logoutUrl = OIDC_LOGOUT_ENDPOINT
. '?post_logout_redirect_uri=' . urlencode(OIDC_POST_LOGOUT_REDIRECT_URI);
// Redirect the browser
header('Location: ' . $logoutUrl);
exit;