OAuth2ServerBundle

The password grant issues access and refresh tokens bound to both a client and a user. Because user authentication logic varies between applications, the bundle provides the league.oauth2_server.event.user_resolve event.

To implement custom user resolution, you must create an event listener that listens for this event. Inside the listener, you are responsible for:

1. Retrieving the user from your user provider using the username provided in the event.
2. Verifying that the user implements Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface.
3. Validating the provided password against the user's stored hash.
4. Calling $event->setUser($user) to bind the authenticated user to the token issuance process.

If the credentials are invalid or the user cannot be found, simply return from the listener without calling setUser().

<?php

namespace App\EventListener;

use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
use League\Bundle\OAuth2ServerBundle\Event\UserResolveEvent;

final class UserResolveListener
{
    private $userProvider;
    private $userPasswordHasher;

    public function __construct(UserProviderInterface $userProvider, UserPasswordHasherInterface $userPasswordHasher)
    {
        $this->userProvider = $userProvider;
        $this->userPasswordHasher = $userPasswordHasher;
    }

    public function onUserResolve(UserResolveEvent $event): void
    {
        try {
            $user = $this->userProvider->loadUserByIdentifier($event->getUsername());
        } catch (AuthenticationException $e) {
            return;
        }

        if (null === $user || !($user instanceof PasswordAuthenticatedUserInterface)) {
            return;
        }

        if (!$this->userPasswordHasher->isPasswordValid($user, $event->getPassword())) {
            return;
        }

        $event->setUser($user);
    }
}

The bundle does not provide a built-in route or UI for user code input. You must implement the verification logic yourself.

To complete a device authorization request, you should:

1. Retrieve the device code using the DeviceCodeManagerInterface::findByUserCode() method.
2. Call AuthorizationServer::completeDeviceAuthorizationRequest() with the device code identifier, the authenticated user's ID, and a boolean indicating approval.

Note: Ensure you handle OAuthServerException cases, such as invalid codes or missing user IDs.

// Inside your controller handling the verification form
try {
    $deviceCode = $this->deviceCodeManager->findByUserCode($form->get('userCode')->getData());
    if (null === $deviceCode) {
        throw OAuthServerException::invalidGrant('Invalid user code');
    }
    
    $this->authorizationServer->completeDeviceAuthorizationRequest(
        $deviceCode->getIdentifier(),
        $this->getUser()->getId(),
        true // User has approved the device
    );
} catch (OAuthServerException $e) {
    // Handle exception
}

You can dynamically modify the scopes assigned to an access token by subscribing to the league.oauth2_server.event.scope_resolve event.

To implement this:

1. Create an event listener that accepts a League\Bundle\OAuth2ServerBundle\Event\ScopeResolveEvent object.
2. Use $event->getScopes() to retrieve the currently requested scopes.
3. Perform your logic to add, remove, or modify scopes.
4. Use $event->setScopes(...) to apply the changes.
5. Register the listener in your service configuration using the kernel.event_listener tag, targeting the league.oauth2_server.event.scope_resolve event.

<?php

namespace App\EventListener;

use League\Bundle\OAuth2ServerBundle\Event\ScopeResolveEvent;

final class ScopeResolveListener
{
    public function onScopeResolve(ScopeResolveEvent $event): void
    {
        $requestedScopes = $event->getScopes();

        // ...Make adjustments to the client's requested scopes...

        $event->setScopes(...$requestedScopes);
    }
}

App\EventListener\ScopeResolveListener:
    tags:
        - { name: kernel.event_listener, event: league.oauth2_server.event.scope_resolve, method: onScopeResolve }

To implement a custom grant type, create a class that implements the League\OAuth2\Server\Grant\GrantTypeInterface. It is recommended to extend League\OAuth2\Server\Grant\AbstractGrant to simplify the implementation.

Your class must implement:

• getIdentifier(): Returns the unique string identifier for the grant (e.g., 'fake_grant').
• respondToAccessTokenRequest(ServerRequestInterface $request, ResponseTypeInterface $responseType, DateInterval $accessTokenTTL): Handles the logic for responding to an access token request.

<?php

declare(strict_types=1);

namespace App\Grant;

use DateInterval;
use League\OAuth2\Server\Grant\AbstractGrant;
use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
use Nyholm\Psr7\Response;
use Psr\Http\Message\ServerRequestInterface;
use League\OAuth2\Server\Grant\GrantTypeInterface;

final class FakeGrant extends AbstractGrant implements GrantTypeInterface
{
    private $foo;

    public function __construct(SomeDependency $foo)
    {
        $this->foo = $foo;
    }

    public function getIdentifier()
    {
        return 'fake_grant';
    }

    public function respondToAccessTokenRequest(ServerRequestInterface $request, ResponseTypeInterface $responseType, DateInterval $accessTokenTTL)
    {
        return new Response();
    }
}