Link a client application to the OAuthSD server

All the versions of this article: [English] [français]

This article is for a developer.

It describes how to adapt an application to make it an OpenID Connect client and how to register it on OAuth Server byDnC.

This assumes that the developer or his organization is registered on the server as an Application Administrator.

The process has two aspects:

on the OAuthSD server side, register the application,
on the side of the client application, insert the necessary code to ensure the link with the OAuth server.

1. Register as an Application Administrator

Registration is here: Registration form.

Carefully fill out your Application Administrator form, as most of this information is communicated to the end users you need to gain trust.

Warning: do not confuse the registration as an Application Administrator (a developer who registers his client application so that he can delegate authentication to OAuthSD) with the registration of a user as an end user of client applications, which is done here: I’m signing on.

Notes :
The term "Application Administrator" distinguishes the developer or owner of a client application that registers on this server, the end user, who must also register, but otherwise. In the underlying data model, it is also the editorial object of SPIP (the authors table), while the end user is a separate table.

2. Register the client application on the OAuthSD server

In the Manage section, go to Add (Register) a client application and fill out the form :

Client Id (required): String identifying the application in a unique way. Enter a short name with no spaces or special characters other than ’_’. This identifier must be unique for all administrators of applications registered on the server. It is visible to the public and should therefore be representative of the application and your business.

Secret Client (required): a short string that can be likened to a strong password. This code must remain secret. It has to be provided by the client application when requesting the token.

Redirect uri (required): URI back to the client application. This is the address at which the OAuth server returns to the client with the result of the authentication. OpenID Connect allows multiple URIs to be mentionned.

Grant Type (required): Except special case, select at least "Authorization Code". For Hybrid feeds, select "Authorization Code" and "Implicit". See OpenID Connect et OAuth 2.0 : Synthèse des flux d’autorisation (Grant Type).

Scopes (required): List of Scopes allowed for the application, separated by a space. The ’openid’ scope is mandatory. The standard scopes of OpenID Connect are: profile, email, address, phone. See the section: Réponse UserInfo. The ’offline_access’ scope is used to obtain a refresh token. In addition to these scopes, particular scopes can be defined for a given application. Example: "openid profile email administrator".

User id If a user name (username) is registered here, only this user will be able to login, this identifier being fixed in the authentication form. In the general case this field will be empty.

Check your entries and press the "Save" button.

Finally, navigate to https://oa.dnc.global/keys to create the entry for the new public / private key pair.

You will be able to find the application and modify it in the section All your client applications.

Notes:
OAuthSD creates a public / private key pair for the client application. If you want to change it, go to All your client applications and select the "keys" action corresponding to the application.

3. Insert the necessary code in the application

Although OpenID Connect is built on OAuth 2.0, do not expect to reuse the code written for this protocol. Indeed, OpenID Connect is a higher level abstraction layer, involving different exchanges and endpoints, which requires the code to be rewritten. Also note that OpenID is not the same as OpenID Connect.

If the client application is designed to delegate its authentications to a server with the OpenID Connect standard, there is nothing more to do.

If the application on which the client application is built offers an OpenID Connect plugin, all you need to do is install it. We offer some plugins here: Adapting applications.

Otherwise, it’s a developer business. There are two adaptations to make:

Write the code located at the Return URI to the client application (Endpoint Redirection). This involves requesting the OAuthSD server an access token and an identification token for the application, from the Authorization code returned by the server.

Write the authentication procedure adapted to the technique of the client application. Generally, it will be an additional authentication module, or a re-writing of the authentication code. See: Plugin OpenID Connect Client pour SPIP, Extension OpenID Connect pour phpBB, "OpenID Connect Generic Client" extension for WordPress.

Optionally, we can also:
View the status of the OIDC session and manage it (Monitoring).

A simple case

Consuming a protected HTTP REST API is extremely simple. Here is a basic example, just to test the operation, combining in a single script the authorization and consumption of UserInfo:
PHP

<?php
/*
testopenid2.php
OpenID Connect test :
Register on this server a test application,
Fill in the constants below accordingly,
Launch this script: http://oa.dnc.global/oidc/testopenid2.php
Author :
Bertrand Degoy https://degoy.com
Credits :
bschaffer https://github.com/bshaffer/oauth2-server-php
Licence : MIT licence
*/
ini_set('display_errors', 1);
$client_id = 'testopenid';
$client_secret = 'thesecret';
//$redirect_uri = '';
$authorization_endpoint = 'http://oa.dnc.global/authorize';
$token_endpoint = 'http://oa.dnc.global/token';
$userinfo_endpoint = 'http://oa.dnc.global/userinfo';
if (isset($_GET['error']))
{
exit("Error: {$_GET['error']}. Description: {$_GET['error_description']}");
}
else if (isset($_GET['code']) && isset($_GET['state']))
{
// Step 2. Token request
$code = $_GET['code'];
echo "Authorization Code is {$code}\n\n";
$data = array(
'grant_type' => 'authorization_code',
'code' => $code,
);
$h = curl_init($token_endpoint);
curl_setopt($h, CURLOPT_RETURNTRANSFER, true);
curl_setopt($h, CURLOPT_TIMEOUT, 10);
curl_setopt($h, CURLOPT_USERPWD, "{$client_id}:{$client_secret}");
curl_setopt($h, CURLOPT_POST, true);
curl_setopt($h, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
curl_setopt($h, CURLOPT_POSTFIELDS, http_build_query($data));
//curl_setopt($h, CURLOPT_SSL_VERIFYPEER, false);
$res = curl_exec($h);
if (!$res)
exit(curl_error($h));
curl_close($h);
$res = json_decode($res, true);
echo "Token Response:\n";
print_r($res);
echo "\n";
// Here you should decode JWT token and check sign using server's public key
// $payload = Jwt::decode($response['id_token'], $this->serverPublicKey);
// If Token Response is valid goto step 3
// Step 3. Get UserInfo
$access_token = $res['access_token'];
$h = curl_init($userinfo_endpoint);
curl_setopt($h, CURLOPT_RETURNTRANSFER, true);
curl_setopt($h, CURLOPT_TIMEOUT, 10);
curl_setopt($h, CURLOPT_HTTPHEADER, array('Authorization: Bearer ' . $access_token));
//curl_setopt($h, CURLOPT_SSL_VERIFYPEER, false);
$res = curl_exec($h);
if (!$res)
exit(curl_error($h));
curl_close($h);
$res = json_decode($res, true);
echo "UserInfo Response:\n";
print_r($res);
}
else
{
// Step 1. Authorization Code request
$data = array(
'response_type' => 'code',
'client_id' => $client_id,
'state' => 'xyz',
'scope' => 'openid profile',
);
$authorization_endpoint .= '?' . http_build_query($data);
header('Location: ' . $authorization_endpoint);
exit();
}
?>

Download

Run the script:https://oa.dnc.global/oidc/tests/te...

On the OAuthSD server, you can login with login = bebert and password = 012345678

A rigorous and therefore more complete version is given here: OpenID Connect : Exemples complets du flux d’Autorisation via un code puis requête UserInfo.