oauth2-server/auth-server-client-credentials.md

89 lines
3.3 KiB
Markdown
Raw Normal View History

2014-10-01 03:14:18 +05:30
---
layout: default
2016-03-24 19:25:10 +05:30
title: Client credentials grant
2014-10-01 03:14:18 +05:30
permalink: /authorization-server/client-credentials-grant/
---
2016-03-16 02:03:44 +05:30
# Client credentials grant
This grant is suitable for machine-to-machine authentication, for example for use in a cron job which is performing maintenance tasks over an API. Another example would be a client making requests to an API that dont require users permission.
2014-10-01 03:14:18 +05:30
2016-03-23 18:14:47 +05:30
## Flow
The client sends a POST request with following body parameters to the authorization server:
* `grant_type` with the value `client_credentials`
2016-08-07 19:20:47 +05:30
* `client_id` with the client's ID
2016-03-23 18:14:47 +05:30
* `client_secret` with the client's secret
* `scope` with a space-delimited list of requested scope permissions.
The authorization server will respond with a JSON object containing the following properties:
* `token_type` with the value `Bearer`
* `expires_in` with an integer representing the TTL of the access token
* `access_token` a JWT signed with the authorization server's private key
2014-10-01 03:14:18 +05:30
## Setup
2016-03-16 02:03:44 +05:30
Wherever you initialize your objects, initialize a new instance of the authorization server and bind the storage interfaces and authorization code grant:
{% highlight php %}
2016-03-23 18:14:47 +05:30
// Init our repositories
2016-04-17 16:33:45 +05:30
$clientRepository = new ClientRepository(); // instance of ClientRepositoryInterface
$scopeRepository = new ScopeRepository(); // instance of ScopeRepositoryInterface
$accessTokenRepository = new AccessTokenRepository(); // instance of AccessTokenRepositoryInterface
2014-10-01 03:14:18 +05:30
2016-03-23 18:14:47 +05:30
// Path to public and private keys
2016-03-29 13:35:49 +05:30
$privateKey = 'file://path/to/private.key';
2016-04-17 16:33:45 +05:30
//$privateKey = new CryptKey('file://path/to/private.key', 'passphrase'); // if private key has a pass phrase
2017-07-02 23:22:06 +05:30
$encryptionKey = 'lxZFUEsBCJ2Yb14IF2ygAHI5N4+ZAUXXaSeeJm6+twsUmIen'; // generate using base64_encode(random_bytes(32))
2016-03-29 13:35:49 +05:30
2016-03-16 02:03:44 +05:30
// Setup the authorization server
2016-04-17 17:46:40 +05:30
$server = new \League\OAuth2\Server\AuthorizationServer(
2016-03-16 02:03:44 +05:30
$clientRepository,
$accessTokenRepository,
$scopeRepository,
2016-03-29 13:35:49 +05:30
$privateKey,
2017-07-02 23:22:06 +05:30
$encryptionKey
2016-03-16 02:03:44 +05:30
);
2014-10-01 03:14:18 +05:30
2016-04-17 16:33:45 +05:30
// Enable the client credentials grant on the server
2016-03-16 02:03:44 +05:30
$server->enableGrantType(
2016-03-23 18:14:47 +05:30
new \League\OAuth2\Server\Grant\ClientCredentialsGrant(),
2016-04-17 16:33:45 +05:30
new \DateInterval('PT1H') // access tokens will expire after 1 hour
2016-03-16 02:03:44 +05:30
);
{% endhighlight %}
2014-10-01 03:14:18 +05:30
## Implementation
2016-04-17 16:33:45 +05:30
_Please note: These examples here demonstrate usage with the Slim Framework; Slim is not a requirement to use this library, you just need something that generates PSR7-compatible HTTP requests and responses._
2014-10-01 03:14:18 +05:30
The client will request an access token so create an `/access_token` endpoint.
2016-03-16 02:03:44 +05:30
{% highlight php %}
$app->post('/access_token', function (ServerRequestInterface $request, ResponseInterface $response) use ($app) {
2014-10-01 03:14:18 +05:30
2016-04-17 17:46:40 +05:30
/* @var \League\OAuth2\Server\AuthorizationServer $server */
$server = $app->getContainer()->get(AuthorizationServer::class);
2016-03-23 18:14:47 +05:30
2014-10-01 03:14:18 +05:30
try {
2016-04-17 16:33:45 +05:30
// Try to respond to the request
2016-04-10 21:34:24 +05:30
return $server->respondToAccessTokenRequest($request, $response);
2016-04-17 16:33:45 +05:30
2016-03-23 18:14:47 +05:30
} catch (\League\OAuth2\Server\Exception\OAuthServerException $exception) {
2016-04-17 16:33:45 +05:30
// All instances of OAuthServerException can be formatted into a HTTP response
2016-03-16 02:03:44 +05:30
return $exception->generateHttpResponse($response);
2016-04-17 16:33:45 +05:30
2016-03-16 02:03:44 +05:30
} catch (\Exception $exception) {
2016-04-17 16:33:45 +05:30
// Unknown exception
2016-03-16 02:03:44 +05:30
$body = new Stream('php://temp', 'r+');
$body->write($exception->getMessage());
return $response->withStatus(500)->withBody($body);
2016-04-17 16:33:45 +05:30
2014-10-01 03:14:18 +05:30
}
});
2016-03-16 02:03:44 +05:30
{% endhighlight %}