Initial commit

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[*.j2]
+insert_final_newline = false

.github/workflows/php74.yml

@@ -0,0 +1,27 @@
+name: PHP 7.4
+
+on: push
+
+jobs:
+  php74:
+    name: Check PHP 7.4
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Install dependencies
+        uses: php-actions/composer@v5
+        with:
+          php_version: 7.4
+          args: --prefer-dist --ignore-platform-reqs
+
+      - name: Check code styling
+        run: composer ecs-check
+
+      - name: Create keys
+        run: ./bin/create_keys
+
+      - name: Run unit and feature tests
+        run: composer test

.github/workflows/php80.yml

@@ -0,0 +1,27 @@
+name: PHP 8.0
+
+on: push
+
+jobs:
+  php80:
+    name: Check PHP 8.0
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Install dependencies
+        uses: php-actions/composer@v5
+        with:
+          php_version: 8.0
+          args: --prefer-dist --ignore-platform-reqs
+
+      - name: Check code styling
+        run: composer ecs-check
+
+      - name: Create keys
+        run: ./bin/create_keys
+
+      - name: Run unit and feature tests
+        run: composer test

.gitignore

@@ -0,0 +1,7 @@
+vendor/
+.phpunit.result.cache
+composer.lock
+tmp/
+dev/
+.phplint-cache
+phpd.log

CHANGELOG.md

@@ -0,0 +1,4 @@
+# Changelog
+
+## 1.0.0 (2021/../..)
+* Initial version

LICENCE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Ron van der Heijden
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,133 @@
+# OpenID Connect
+
+This package adds the OpenID Connect identity layer to the PHP League's OAuth2 Server. 
+
+**With [Laravel Passport](https://laravel.com/docs/8.x/passport) support!**
+
+## Requirements
+
+* Requires PHP version `^7.4|^8.0`.
+* [lcobucci/jwt](https://github.com/lcobucci/jwt) version `^4.0`.
+* [league/oauth2-server](https://github.com/thephpleague/oauth2-server) `^8.2`.
+
+## Installation
+```sh
+composer require ronvanderheijden/openid-connect
+```
+
+## Keys
+
+To sign and encrypt the tokens, we need a private and a public key.
+```sh
+mkdir -m 700 -p tmp
+
+openssl genrsa -out tmp/private.key 2048
+openssl rsa -in tmp/private.key -pubout -out tmp/public.key
+
+chmod 600 tmp/private.key
+chmod 644 tmp/public.key
+```
+
+## Example
+I recommand to [read this](https://oauth2.thephpleague.com/authorization-server/auth-code-grant/) first.
+
+To enable OpenID Connect, follow these simple steps
+
+```php
+$privateKeyPath = 'tmp/private.key';
+
+// create the response_type
+$responseType = new IdTokenResponse(
+    new IdentityRepository(),
+    new ClaimExtractor(),
+    Configuration::forSymmetricSigner(
+        new Sha256(),
+        InMemory::file($privateKeyPath),
+    ),
+);
+
+$server = new \League\OAuth2\Server\AuthorizationServer(
+    $clientRepository,
+    $accessTokenRepository,
+    $scopeRepository,
+    $privateKeyPath,
+    $encryptionKey,
+    // add the response_type
+    $responseType,
+);
+```
+
+Now when calling the `/authorize` endpoint, provide the `openid` scope to get an `id_token`.  
+Provide more scopes (e.g. `openid profile email`) to receive additional claims in the `id_token`.
+
+For a complete implementation, visit [the OAuth2 Server example](https://github.com/ronvanderheijden/openid-connect/tree/main/example).
+
+## Laravel Passport
+
+You can use this package with Laravel Passport.
+
+### add the service provider
+```php
+# config/app.php
+'providers' => [
+    /*
+     * Package Service Providers...
+     */
+    OpenIDConnect\Laravel\PassportServiceProvider::class,
+],
+```
+
+### create an entity
+Create an entity class in `app/Entities/` named `IdentityEntity` or `UserEntity`. This entity is used to collect the claims.
+```php
+# app/Entities/IdentityEntity.php
+namespace App\Entities;
+
+use League\OAuth2\Server\Entities\Traits\EntityTrait;
+use OpenIDConnect\Claims\Traits\WithClaims;
+use OpenIDConnect\Interfaces\IdentityEntityInterface;
+
+class IdentityEntity implements IdentityEntityInterface
+{
+    use EntityTrait;
+    use WithClaims;
+
+    /**
+     * The user to collect the additional information for
+     */
+    protected User $user;
+
+    /**
+     * The identity repository creates this entity and provides the user id
+     * @param mixed $identifier
+     */
+    public function setIdentifier($identifier): void
+    {
+        $this->identifier = $identifier;
+        $this->user = User::findOrFail($identifier);
+    }
+
+    /**
+     * When building the id_token, this entity's claims are collected
+     */
+    public function getClaims(): array
+    {
+        return [
+            'email' => $this->user->email,
+        ];
+    }
+}
+```
+
+### Publishing the config
+```sh
+php artisan vendor:publish --tag=openidconnect
+```
+
+In this config, you can change the default scopes, add custom claim sets and change the repositories.
+
+## Support
+Found a bug? Got a feature request?  [Create an issue](https://github.com/ronvanderheijden/openid-connect/issues).
+
+## License
+OpenID Connect is open source and licensed under [the MIT licence](https://github.com/ronvanderheijden/openid-connect/blob/master/LICENSE.txt).

bin/create_keys

@@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+
+set -eu
+
+if [ ! -f "$(pwd)/tmp/private.key" ]; then
+    mkdir -m 700 -p tmp
+
+    openssl genrsa -out tmp/private.key 2048
+    openssl rsa -in tmp/private.key -pubout -out tmp/public.key
+
+    chmod 600 tmp/private.key
+    chmod 644 tmp/public.key
+fi

composer.json

@@ -0,0 +1,69 @@
+{
+    "name": "ronvanderheijden/openid-connect",
+    "type": "library",
+    "description": "This package adds the OpenID Connect identity layer to the PHP League's OAuth2 Server. With Laravel Passport support.",
+    "version": "0.1.0",
+    "license": "MIT",
+    "homepage": "https://github.com/ronvanderheijden/openid-connect",
+    "authors": [
+        {
+            "name": "Ron van der Heijden",
+            "email": "r.heijden@live.nl"
+        }
+    ],
+    "keywords": [
+        "openid",
+        "openid-connect",
+        "oidc",
+        "oauth",
+        "oauth2",
+        "laravel",
+        "passport"
+    ],
+    "require": {
+        "php": "^7.4|^8.0",
+        "lcobucci/jwt": "^4.0",
+        "league/oauth2-server": "^8.2.0"
+    },
+    "require-dev": {
+        "guzzlehttp/psr7": "^1.7",
+        "http-interop/http-factory-guzzle": "^1.0",
+        "overtrue/phplint": "^2.3",
+        "phpunit/phpunit": "^9.4.2",
+        "slevomat/coding-standard": "^6.4.1",
+        "slim/slim": "4.*",
+        "symplify/easy-coding-standard": "^9.2",
+        "league/oauth2-client": "^2.6"
+    },
+    "autoload": {
+        "psr-4": {
+            "OpenIDConnect\\": "src/"
+        }
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "OpenIDConnect\\Example\\": "example/",
+            "OpenIDConnect\\Tests\\": "tests/"
+        }
+    },
+    "scripts": {
+        "test": "vendor/bin/phpunit",
+        "dev": "vendor/bin/phpunit --group dev",
+        "ecs-check": "vendor/bin/ecs check",
+        "ecs-fix": "vendor/bin/ecs check --fix",
+        "lint": "vendor/bin/phplint --exclude=vendor .",
+        "fix": [
+            "composer update",
+            "composer ecs-fix",
+            "composer check"
+        ],
+        "check": [
+            "composer lint",
+            "composer ecs-check",
+            "composer test",
+            "composer check-platform-reqs",
+            "composer outdated --direct --no-ansi",
+            "composer outdated --minor-only --strict --direct"
+        ]
+    }
+}