oauth2-server/auth-server-password.md

layout	title	permalink
default	Resource owner password credentials grant	/authorization-server/resource-owner-password-credentials-grant/

Resource owner password credentials grant

This grant is a great user experience for trusted first party clients both on the web and in native applications.

Flow

The client will ask the user for their authorization credentials (ususally a username and password).

The client then sends a POST request with following body parameters to the authorization server:

• grant_type with the value password
• client_id with the the client's ID
• client_secret with the client's secret
• scope with a space-delimited list of requested scope permissions.
• username with the user's username
• password with the user's password

The authorization server will respond with a JSON object containing the following properties:

• token_type with the value Bearer
• expires_in with an integer representing the TTL of the access token
• access_token a JWT signed with the authorization server's private key
• refresh_token an encrypted payload that can be used to refresh the access token when it expires.

Setup

Wherever you initialize your objects, initialize a new instance of the authorization server and bind the storage interfaces and authorization code grant:

{% highlight php %} // Init our repositories $clientRepository = new ClientRepository(); // instance of ClientRepositoryInterface $scopeRepository = new ScopeRepository(); // instance of ScopeRepositoryInterface $accessTokenRepository = new AccessTokenRepository(); // instance of AccessTokenRepositoryInterface $userRepository = new UserRepository(); // instance of UserRepositoryInterface $refreshTokenRepository = new RefreshTokenRepository(); // instance of RefreshTokenRepositoryInterface

// Path to public and private keys $privateKey = 'file://path/to/private.key'; //$privateKey = new CryptKey('file://path/to/private.key', 'passphrase'); // if private key has a pass phrase $encryptionKey = 'lxZFUEsBCJ2Yb14IF2ygAHI5N4+ZAUXXaSeeJm6+twsUmIen'; // generate using base64_encode(random_bytes(32))

// Setup the authorization server $server = new \League\OAuth2\Server\AuthorizationServer( $clientRepository, $accessTokenRepository, $scopeRepository, $privateKey, $encryptionKey );

$grant = new \League\OAuth2\Server\Grant\PasswordGrant( $userRepository, $refreshTokenRepository );

$grant->setRefreshTokenTTL(new \DateInterval('P1M')); // refresh tokens will expire after 1 month

// Enable the password grant on the server $server->enableGrantType( $grant, new \DateInterval('PT1H') // access tokens will expire after 1 hour ); {% endhighlight %}

Implementation

Please note: These examples here demonstrate usage with the Slim Framework; Slim is not a requirement to use this library, you just need something that generates PSR7-compatible HTTP requests and responses.

The client will request an access token so create an /access_token endpoint.

{% highlight php %} $app->post('/access_token', function (ServerRequestInterface $request, ResponseInterface $response) use ($app) {

/* @var \League\OAuth2\Server\AuthorizationServer $server */
$server = $app->getContainer()->get(AuthorizationServer::class);

try {

    // Try to respond to the request
    return $server->respondToAccessTokenRequest($request, $response);
    
} catch (\League\OAuth2\Server\Exception\OAuthServerException $exception) {

    // All instances of OAuthServerException can be formatted into a HTTP response
    return $exception->generateHttpResponse($response);
    
} catch (\Exception $exception) {

    // Unknown exception
    $body = new Stream('php://temp', 'r+');
    $body->write($exception->getMessage());
    return $response->withStatus(500)->withBody($body);
    
}

}); {% endhighlight %}