59 lines
1.6 KiB
PHP
59 lines
1.6 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
require_once __DIR__ . '/config.php';
|
|
require_once __DIR__ . '/vendor/autoload.php';
|
|
|
|
use Fitness\OIDC\OIDC;
|
|
|
|
// Ensure a state was sent back.
|
|
if (!isset($_GET['state']) || !isset($_SESSION['oidc_state'])) {
|
|
http_response_code(400);
|
|
exit('Missing state parameter.');
|
|
}
|
|
|
|
// Verify the state matches what we stored.
|
|
if ($_GET['state'] !== $_SESSION['oidc_state']) {
|
|
http_response_code(400);
|
|
exit('Invalid state.');
|
|
}
|
|
|
|
// Clean up the session variables.
|
|
$state = $_SESSION['oidc_state'];
|
|
$nonce = $_SESSION['oidc_nonce'];
|
|
unset($_SESSION['oidc_state'], $_SESSION['oidc_nonce']);
|
|
|
|
if (!isset($_GET['code'])) {
|
|
http_response_code(400);
|
|
exit('Missing authorization code.');
|
|
}
|
|
|
|
$code = $_GET['code'];
|
|
$oidc = new OIDC();
|
|
|
|
try {
|
|
// Exchange code for tokens.
|
|
$tokens = $oidc->exchangeCode($code);
|
|
|
|
// Validate ID token (minimal).
|
|
$idInfo = $oidc->validateIDToken($tokens['id_token'], $nonce);
|
|
|
|
// Get userinfo (includes groups because of scope).
|
|
$userInfo = $oidc->getUserInfo($tokens['access_token']);
|
|
|
|
// Store everything we need in the session.
|
|
$_SESSION['user'] = [
|
|
'id_token' => $tokens['id_token'],
|
|
'access_token'=> $tokens['access_token'],
|
|
'refresh_token'=> $tokens['refresh_token'] ?? null,
|
|
'expires_in' => $tokens['expires_in'] ?? null,
|
|
'id_info' => $idInfo,
|
|
'user_info' => $userInfo,
|
|
];
|
|
} catch (\Throwable $e) {
|
|
http_response_code(500);
|
|
exit('Error during OIDC exchange: ' . $e->getMessage());
|
|
}
|
|
|
|
// Clean up the query string (code, state) by redirecting to the home page.
|
|
header('Location: /');
|
|
exit; |