ElyBy-Mirror/oauth2-server
1
0
Fork 0
mirror of https://github.com/elyby/oauth2-server.git synced 2024-12-23 13:39:48 +05:30
Code Issues Packages Projects Releases Wiki Activity

Updated password grant

Browse Source
This commit is contained in:
Alex Bilbie 2016-03-23 12:44:53 +00:00
parent fd55b78c05
commit 3aa15a22af
1 changed files with 69 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

113
auth-server-password.md
View File

@ -1,64 +1,89 @@
--- ---
layout: default layout: default
title: Authorization server with resource owner password credentials grant title: Resource owner password credentials grant
permalink: /authorization-server/resource-owner-password-credentials-grant/ permalink: /authorization-server/resource-owner-password-credentials-grant/
--- ---
# Authorization server with resource owner password credentials grant # Resource owner password credentials grant
This grant is a great user experience for <u>trusted</u> first party clients both on the web and in native applications.
## Flow
The client will ask the user for their authorization credentials (ususally a username and password).
The client then sends a POST request with following body parameters to the authorization server:
* `grant_type` with the value `password`
* `client_id` with the the client's ID
* `client_secret` with the client's secret
* `scope` with a space-delimited list of requested scope permissions.
* `username` with the user's username
* `password` with the user's password
The authorization server will respond with a JSON object containing the following properties:
* `token_type` with the value `Bearer`
* `expires_in` with an integer representing the TTL of the access token
* `access_token` a JWT signed with the authorization server's private key
* `refresh_token` an encrypted payload that can be used to refresh the access token when it expires.
## Setup ## Setup
Wherever you intialise your objects, initialize a new instance of the authorization server and bind the storage interfaces and authorization code grant: Wherever you initialize your objects, initialize a new instance of the authorization server and bind the storage interfaces and authorization code grant:
~~~ php {% highlight php %}
$server = new \League\OAuth2\Server\AuthorizationServer; // Init our repositories
$clientRepository = new ClientRepository();
$accessTokenRepository = new AccessTokenRepository();
$scopeRepository = new ScopeRepository();
$userRepository = new UserRepository();
$refreshTokenRepository = new RefreshTokenRepository();
$server->setSessionStorage(new Storage\SessionStorage); // Path to public and private keys
$server->setAccessTokenStorage(new Storage\AccessTokenStorage); $privateKeyPath = 'file://path/to/private.key';
$server->setClientStorage(new Storage\ClientStorage); $publicKeyPath = 'file://path/to/public.key';
$server->setScopeStorage(new Storage\ScopeStorage);
// Setup the authorization server
$passwordGrant = new \League\OAuth2\Server\Grant\PasswordGrant(); $server = new \League\OAuth2\Server\Server(
$passwordGrant->setVerifyCredentialsCallback(function ($username, $password) { $clientRepository,
// implement logic here to validate a username and password, return an ID if valid, otherwise return false $accessTokenRepository,
}); $scopeRepository,
$privateKeyPath,
$server->addGrantType($passwordGrant); $publicKeyPath
~~~ );
// Enable the password grant on the server with an access token TTL of 1 hour
$server->enableGrantType(
new \League\OAuth2\Server\Grant\PasswordGrant(
$userRepository,
$refreshTokenRepository
),
new \DateInterval('PT1H')
);
{% endhighlight %}
## Implementation ## Implementation
The client will request an access token so create an `/access_token` endpoint. The client will request an access token so create an `/access_token` endpoint.
~~~ php {% highlight php %}
$router->post('/access_token', function (Request $request) use ($server) { $app->post('/access_token', function (ServerRequestInterface $request, ResponseInterface $response) use ($app) {
/* @var \League\OAuth2\Server\Server $server */
$server = $app->getContainer()->get(Server::class);
// Try to respond to the request
try { try {
return $server->respondToRequest($request, $response);
$response = $server->issueAccessToken();
return new Response( } catch (\League\OAuth2\Server\Exception\OAuthServerException $exception) {
json_encode($response), return $exception->generateHttpResponse($response);
200,
[ } catch (\Exception $exception) {
'Content-type' => 'application/json', $body = new Stream('php://temp', 'r+');
'Cache-Control' => 'no-store', $body->write($exception->getMessage());
'Pragma' => 'no-store' return $response->withStatus(500)->withBody($body);
]
);
} catch (OAuthException $e) {
return new Response(
json_encode([
'error' => $e->errorType,
'message' => $e->getMessage()
]),
$e->httpStatusCode,
$e->getHttpHeaders()
);
} }
}); });
~~~ {% endhighlight %}