jumbojett/openid-connect-php

To authenticate a user through the standard OpenID Connect flow, instantiate OpenIDConnectClient with the provider URL, your Client ID, and Client Secret. Call authenticate() to start the flow and requestUserInfo() to retrieve specific user attributes.

use Jumbojett\OpenIDConnectClient;

$oidc = new OpenIDConnectClient('https://id.provider.com',
                                'ClientIDHere',
                                'ClientSecretHere');
$oidc->setCertPath('/path/to/my.cert');
$oidc->authenticate();
$name = $oidc->requestUserInfo('given_name');

Install the library using Composer and include the autoloader in your project.

Requirements:

• PHP 7.2 or greater
• CURL extension
• JSON extension

composer require jumbojett/openid-connect-php

require __DIR__ . '/vendor/autoload.php';

If the UserInfo endpoint returns a response with Content-Type: application/jwt and the header contains an enc (encryption) field, the client identifies it as a JWE.

Note: The base OpenIDConnectClient throws an exception for JWEs. To support encrypted responses, you must extend the class and implement the handleJweResponse(string $jwe): string method.

To use the client, instantiate OpenIDConnectClient with the provider's URL, your client ID, and your client secret. You can also optionally provide an issuer URL. The client uses the provider URL to perform automatic discovery of the OpenID Connect configuration via the .well-known/openid-configuration endpoint.

use Jumbojett\OpenIDConnectClient;

$providerUrl = 'https://example.com/.well-known/openid-configuration';
$clientId = 'your_client_id';
$clientSecret = 'your_client_secret';
$issuer = 'https://example.com';

$client = new OpenIDConnectClient($providerUrl, $clientId, $clientSecret, $issuer);

For providers requiring the Implicit Flow, configure the client using setResponseTypes(['id_token']), setAllowImplicitFlow(true), and addAuthParam(['response_mode' => 'form_post']). Use getVerifiedClaims() to access the claims.

use Jumbojett\OpenIDConnectClient;

$oidc = new OpenIDConnectClient('https://id.provider.com',
                                'ClientIDHere',
                                'ClientSecretHere');
$oidc->setResponseTypes(['id_token']);
$oidc->setAllowImplicitFlow(true);
$oidc->addAuthParam(['response_mode' => 'form_post']);
$oidc->setCertPath('/path/to/my.cert');
$oidc->authenticate();
$sub = $oidc->getVerifiedClaims('sub');

To request a token using a Resource Owner's credentials (username/password) with client authentication, use requestResourceOwnerToken(true). Use addAuthParam() to pass the credentials.

use Jumbojett\OpenIDConnectClient;

$oidc = new OpenIDConnectClient('https://id.provider.com',
                                'ClientIDHere',
                                'ClientSecretHere');
$oidc->providerConfigParam(['token_endpoint'=>'https://id.provider.com/connect/token']);
$oidc->addScope(['my_scope']);

// Add username and password
$oidc->addAuthParam(['username'=>'<Username>']);
$oidc->addAuthParam(['password'=>'<Password>']);

// Perform the auth and return the token
$token = $oidc->requestResourceOwnerToken(TRUE)->access_token;

To use Proof Key for Code Exchange (PKCE), instantiate the client with a null secret and call setCodeChallengeMethod('S256') before calling authenticate().

use Jumbojett\OpenIDConnectClient;

$oidc = new OpenIDConnectClient('https://id.provider.com',
                                'ClientIDHere',
                                null);
$oidc->setCodeChallengeMethod('S256');
$oidc->authenticate();
$name = $oidc->requestUserInfo('given_name');

If your provider supports it, you can use the register() method to dynamically register your client. You must then retrieve and store the generated ClientID and ClientSecret using getClientID() and getClientSecret().

use Jumbojett\OpenIDConnectClient;

$oidc = new OpenIDConnectClient("https://id.provider.com");

$oidc->register();
$client_id = $oidc->getClientID();
$client_secret = $oidc->getClientSecret();

// Be sure to add logic to store the client id and client secret

To obtain an access token using the Client Credentials flow, use requestClientCredentialsToken(). You may need to manually set the token_endpoint via providerConfigParam() and define scopes using addScope().

use Jumbojett\OpenIDConnectClient;

$oidc = new OpenIDConnectClient('https://id.provider.com',
                                'ClientIDHere',
                                'ClientSecretHere');
$oidc->providerConfigParam(['token_endpoint'=>'https://id.provider.com/connect/token']);
$oidc->addScope(['my_scope']);

// Access the token from the returned object
$clientCredentialsToken = $oidc->requestClientCredentialsToken()->access_token;

You can customize the network behavior and security certificates of the client using the following methods:

• setHttpProxy(string $proxyUrl): Configure a proxy server.
• setCertPath(string $path): Specify a path to a certificate file.
• setVerifyHost(bool $verify): Disable SSL host verification (use only for development).
• setVerifyPeer(bool $verify): Disable SSL peer verification (use only for development).
• setHttpUpgradeInsecureRequests(bool $upgrade): Disable upgrading to HTTPS if your local system does not support it.

// Configure a proxy
$oidc->setHttpProxy("http://my.proxy.com:80/");

// Configure a cert
$oidc->setCertPath("/path/to/my.cert");

// Development only: disable SSL security
$oidc->setVerifyHost(false);
$oidc->setVerifyPeer(false);

// Disable HTTPS upgrade
$oidc->setHttpUpgradeInsecureRequests(false);

Use introspectToken(string $token) to check the validity of an access token according to RFC 7662. The returned object contains an active property.

use Jumbojett\OpenIDConnectClient;

$oidc = new OpenIDConnectClient('https://id.provider.com',
                                'ClientIDHere',
                                'ClientSecretHere');
$data = $oidc->introspectToken('an.access-token.as.given');
if (!$data->active) {
    // the token is no longer usable
}