Setting up a PHP OAuth Client

Our firm usually recommends PHPLeague’s OAuth2 client for PHP integrations. There’s is sample code in the README.md, but basically

• Include the relevant Client Key and Secret in the $Provider element, i.e.

  $provider = new \League\OAuth2\Client\Provider\GenericProvider([
  'clientId'                => 'fake-id-741648bdf4e3ffc8e1e3607898e16870',
  'clientSecret'            => 'fake-secret-548755e9e3717974f7a378cd25b24e85',
  'redirectUri'             => 'https://app.example.com/callback.php',
  'urlAuthorize'            => 'https://oauth.server.com/oauth2/authz/',
  'urlAccessToken'          => 'https://oauth.server.com/oauth2/access/',
  'urlResourceOwnerDetails' => 'https://oauth.server.com/userinfo/',
]);

• Make the call to getAuthorizationURL() with the $Provider, which will redirect the user to the login page, and return back to your code with ?code=[stuff]. To include OIDC support, make sure you specify the OIDC scope (as well as any others that you care about):

$options = [
  'scope' => ['openid profile email']
];

and call getAuthorizationUrl with the _$options array, like:

$authorizationUrl = $provider->getAuthorizationUrl($options);

• You can then use the value in $_GET['code'] to get an access token from the identity provider, like:

$accessToken = $provider->getAccessToken('authorization_code', [
  'code' => $_GET['code']
]);

• using that token you’ll be able to use getAuthenticatedRequest‘s along with the $accessToken as needed if you need to pull something from a secured API on the identity server:

$request = $provider->getAuthenticatedRequest(
  'GET',
  'https://oauth.server.com/some-api-endpoint',
  $accessToken
);
$entitlementResponse = $provider->getParsedResponse($request);

• you can also just user information about the $resourceOwner that is returned (because of the scopes that we chose:

$resourceOwner = $provider->getResourceOwner($accessToken)->toArray();

The access token has expiry information, etc. and there are functions for refreshing the token as needed. All in all it’s really simple to do with PHP.

I avoid JS for OAuth, but I’m pretty sure that’s just a personal preference. There are good javascript libraries as well.

Note: Loosely based off of this StackOverflow answer from the author.