This project is based on an open source implementation of OpenID Connect in PHP by Nomura Research Institute, Ltd.
Even though the code is close to the code base, it still needs to be tested for interoperability, as the base project did not provide any tests.
It provides:
-
Fully interoperable OpenID Connect Provider. It implements the following specifications :
-
OpenID Connect Core 1.0
-
OpenID Connect Discovery 1.0
-
OpenID Connect Registration 1.0
-
OpenID Connect Dynamic Registration 1.0
-
OpenID Connect Session Management 1.0
-
-
End-user authentication, authorization, and provides identity and basic profile information to Relying Parties
-
Web pages with themes (the default theme relies on nauvalazhar’s pages)
-
A relying provider, used for testing or demonstration
-
Docker images and docker compose ready to start (see 5 minutes quickstart)
-
Registration page to create a local account
-
Password reset page
-
Internationalization (currently English and French)
|
Warning
|
This is implementation still lacks proper administration pages. |
There are few implementations of an OpenID Connect implementation in PHP. It provided a lot of interoperability. However, the old implementation lacked from:
-
Capability to customize the pages: HTML code was hardcoded in the PHP page
-
Lack of documentation: the documentation referred to a Debian package or few indications split among different files
-
No tests
-
Use of PEAR and composer
-
Old version of libraries
-
No Dockerfile
This tutorial walks you through a quick setup of phpOIDC, a MySQL instance and MailDev on Docker Compose. You need to have the latest Docker and Docker Compose version installed.
We will use the Docker Compose configuration in this repository.
To get the source code, you can:
-
if you have Git installed:
git clone https://github.com/r3dlin3/phpOIDC.git -
Otherwise: download the source code. and extract it somewhere
Change into the directory with the source code and run the following command to start the needed containers:
$ docker-compose -f quickstart.yml up --build Starting app Starting phpoidc_mysql_1 Starting maildev [...]
Then execute the following command:
$ docker-compose -f .\quickstart.yml exec app libs/bin/doctrine orm:schema-tool:create
You can access the homepage by going to http://localhost:8001.
It is possible to quickly deploy phpOIDC OpenID Connect Provider in Azure. Follow this doc.
There are two folders: phpOp and phpRp.
They are the source code for OpenID Connect Provider and OpenID Connect Relying Party respectively.
Both can be installed on Apache or NGINX.
The installation of the following components is not detailed and each component must be installed beforehand:
-
Apache Web Server or NGINX. SSL is MANDATORY for production
-
MySQL (tested with MySQL 5 and 8)
-
PHP 7.2+
-
PHP Modules:
-
PDO MySQL
-
cURL
-
Install MySQL and create a database and its user with a password.
|
Note
|
As the solution relies on Doctrine, it might work with other database but it has not already been tested. |
$ sudo apt-get install mysql-server $ mysql -p mysql> create database `phpOidc`; mysql> grant all on phpOidc.* to phpOidc identified by 'new_password'; mysql> quit;
The SQL script to import is provided in phpOp/create_db.sql.
To enable "Dynamic Discovery", add the following configuration to Apache’s web site configuration:
Alias /.well-known/webfinger /var/www/html/phpOp/discovery.php
Alias /.well-known/openid-configuration /var/www/html/phpOp/discovery.php
Alias /phpOp/.well-known/openid-configuration /var/www/html/phpOp/discovery.phpThe path /var/www/html/ may be different depending on the location of the server’s web document root directory.
An example of the Apache configuration is provided in the folder apache
If you do not have to Apache configuration, you may use a .htaccess file with mod_rewrite
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule ^.well-known/webfinger.*$ /phpOp/discovery.php$1 [NC,L]
RewriteRule ^.well-known/openid-configuration.*$ /phpOp/discovery.php$1 [NC,L]
RewriteRule ^phpOp/.well-known/openid-configuration.*$ /phpOp/discovery.php$1 [NC,L]
</IfModule>An example of .htaccess is provided in this repository.
To enable "Dynamic Discovery", add the following configuration to NGINX configuration (e.g. /etc/nginx/sites-enabled/default):
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
if (!-f $document_root$fastcgi_script_name) {
return 404;
}
fastcgi_pass app:9000;
# With php-fpm locally:
# fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
}
location ~ /\.well-known/[webfinger|openid\-configuration] {
alias /var/www/html/phpOp/discovery.php;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass app:9000;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
}The path /var/www/html may be different depending on the location of the server’s web document root directory.
The fastcgi_pass directive should be correctly configured for sockets or tcp.
An example of NGINX configuration is provided in this repository.
Configuration of OP is done by leveraging PHP dotenv.
Copy phpOp/.env.example as phpOp/.env and edit the file to set the configuration.
The parameters are described below:
| Parameter | Description | Default Value |
|---|---|---|
|
Where logs are stored |
|
|
Log level. Possible values are DEBUG, INFO, NOTICE, WARNING, ERROR, CRITICAL, ALERT, EMERGENCY |
|
|
Name of the theme |
|
|
Part of the URL for the theme. It is used to load on the client-side CSS, JavaScript, Images, etc. |
|
|
Path to view files. Used by BladeOne. |
|
|
Enable password reset. Must be |
|
|
Password reset URL. Can be outside current URL |
|
|
Enable registration reset. Must be |
|
|
Registration URL. Can be outside current URL |
|
|
Enable admin interface. Beware that current implementation of admin is insecure as there is no access control. Must be |
|
|
Enable dynamic client registration as per defined in the specification.
Must be |
|
|
Path to cache. Used by BladeOne. |
|
|
Specifies the OP’s server name/IP address. |
|
|
Name of the OP (for end-user display) |
|
|
Base URL of the OP (without |
|
|
Enable PKCE |
|
|
path to the OP’s private key for signing |
|
|
OP’s pass phrase for the private key file |
|
|
path to the OP’s private key for encryption |
|
|
OP’s pass phrase for the private key file |
|
|
URL to OP’s public JWK |
|
|
OP’s Signature Kid |
|
|
OP’s Encryption Kid |
|
|
Type of database |
|
|
Port used by the database |
|
|
Name of the database |
|
|
User used to connect to the database |
|
|
password to connect to the database |
|
|
Hostname of the database server |
|
|
Prefix for tables |
|
|
Using |
|
|
Hostname of the SMTP server to send through |
|
|
Port used by SMTP. |
|
|
Enable SMTP authentication |
|
|
Enable encryption: 'ssl' , 'tls' accepted |
|
|
User for SMTP authentication |
|
|
Password for SMTP authentication |
|
|
Enable encryption: 'ssl' , 'tls' accepted |
|
|
Set the reply-to e-mail |
|
|
Boolean to enable TLS encryption automatically if a server supports it, even if |
|
|
Client ID for Facebook |
|
|
Client secret for Facebook |
|
|
URL use for the callback for Facebook |
|
|
Client ID for Google |
|
|
Client secret for Google |
|
|
URL use for the callback for Google |
|
|
Client ID for GitHub |
|
|
Client secret for GitHub |
|
|
URL use for the callback for GitHub |
|
|
Client ID for linkedIn |
|
|
Client secret for linkedIn |
|
|
URL use for the callback for linkedIn |
|
The relies partly on OP’s configuration and on the file phpRp/abconstants.php.
Edit this file to set the parameters/
-
RP_PKEY -
RP_PKEY_PASSPHRASE -
RP_SIG_KID -
RP_JWK_URL -
RP_ENC_JWK_URL
the OP and RP samples come with demo keys. You may want to create new 2048 bit RSA keys.
A new private key can be generated by using the following command:
openssl genrsa -out filename 2048
A JWK can be generated by using the following command:
php phpOp/makejwk.php path_to_key_filename kid ''
To renew all keys, you can execute the following command from the root folder:
-
On Windows (OpenSSL binaries for Windows can be found on their wiki):
openssl.exe genrsa -out .\phpOp\op\op_sig.key 2048 openssl.exe genrsa -out .\phpOp\op\op_enc.key 2048 php .\phpOp\makejwk.php .\phpOp\op\op_sig.key PHPOP-00S 'sig' > .\phpOp\op\op_sig.jwk php .\phpOp\makejwk.php .\phpOp\op\op_enc.key PHPOP-00E 'enc' > .\phpOp\op\op_enc.jwk php .\phpOp\makejwk.php mergejwks .\phpOp\op\op_sig.jwk .\phpOp\op\op_enc.jwk > .\phpOp\public\op.jwk
-
On Linux:
openssl.exe genrsa -out ./phpOp/op/op_sig.key 2048 openssl.exe genrsa -out ./phpOp/op/op_enc.key 2048 php ./phpOp/makejwk.php ./phpOp/op/op_sig.key PHPOP-00S 'sig' > ./phpOp/op/op_sig.jwk php ./phpOp/makejwk.php ./phpOp/op/op_enc.key PHPOP-00E 'enc' > ./phpOp/op/op_enc.jwk php ./phpOp/makejwk.php mergejwks ./phpOp/op/op_sig.jwk ./phpOp/op/op_enc.jwk > ./phpOp/public/op.jwk
As for the 5 minutes quickstart, you can run the following commands to spin off an instance
docker-compose -f quickstart.yml up --build docker-compose -f .\quickstart.yml exec app libs/bin/doctrine orm:schema-tool:create
In dev, the container is running a ubuntu-based image using root, so you can install anything.
For instance:
$ docker-compose -f .\quickstart.yml exec app bash # apt update && apt install vim -y
XDEBUG is activated automatically thanks to the environment variable XDEBUG_CONFIG set in the Docker Compose file.
With Visual Studio Code, add the following configuration
{
"name": "Listen for XDebug in Docker",
"type": "php",
"request": "launch",
"port": 9002,
"pathMappings": {
"/var/www/html": "${workspaceFolder}"
}
}Pages are rendered using the template engine BladeOne, a lightweight standalone implementation of Laravel’s template engine: Blade.
It is possible to clear cache if needed but running the following PowerShell script
cd phpOp
Get-ChildItem .\cache\*.bladec | Remove-ItemAcceptance tests and API tests relies on CODECEPTION.
You can execute them by running the following command inside phpOp:
cd phpOp
.\libs\bin\codecept.bat run