Kirby OAuth 2 Plugin
This plugin is an interface to use OAuth 2.0 providers for user authentication in Kirby 3. It uses the PHP League’s OAuth 2 Client, so all official and third-party providers are supported. It’s even possible to implement your own.
Because of secondary dependencies for providers, installation via composer is the only currently supported method.
composer require thathoff/kirby-oauth
The Plugin uses PHP League’s OAuth 2 Client so you can select from all official and third-party providers. It’s also possible to use your own provider by using the
GenericProvider or implement your own provider.
For example to install support for Google run:
composer require league/oauth2-google
The following configuration options are available. And can be added to the Kirby
return [ //... other config options 'thathoff' => [ 'oauth' => [ // Add your providers configuration here 'providers' => [ // for details see „Provider Options” below ], // Only allow logins for existing kirby users (don’t create new users) 'onlyExistingUsers' => false, // Set the default role of newly created users. 'defaultRole' => 'admin', // Allow every valid user of all OAuth providers to login. // For details see “Configure Allowed Users” below. // DANGEROUS: Make sure you know what you’re doing when setting this to true! 'allowEveryone' => false, // List of E-mail domains which are allowed to login 'domainWhitelist' => [ // For details see “Configure Allowed Users” below. ], // List of E-mail addresses which are allowed to login 'emailWhitelist' => [ // For details see “Configure Allowed Users” below. ], // Remove the standard Kirby login form and only display OAuth options. 'onlyOauth' => false, ], ], ];
thathoff.oauth.providers array is a list of all configured OAuth Providers with a unique key for each entry. Each array entry is used as the configuration option to a new OAauth Provider Class instance so all options which are documented for the selected OAuth Provider class are available.
Additionally the two properties
class are supported to supply a display name for the login screen and the Provider class to use when you don’t want to use the
//... 'providers' => [ 'google' => [ 'class' => "League\OAuth2\Client\Provider\Google", // use special google class from league/oauth2-google 'clientId' => 'somerandomstring.apps.googleusercontent.com', 'clientSecret' => 'clientsecret', ], 'custom' => [ // this one uses \League\OAuth2\Client\Provider\GenericProvider automatically 'name' => 'My Custom Provider' // The name is optional 'clientId' => 'demoapp', // The client ID assigned to you by the provider 'clientSecret' => 'demopass', // The client password assigned to you by the provider 'redirectUri' => 'https://example.com/your-redirect-url/', 'urlAuthorize' => 'https://example.com/oauth2/lockdin/authorize', 'urlAccessToken' => 'https://example.com/oauth2/lockdin/token', 'urlResourceOwnerDetails' => 'https://example.com/oauth2/lockdin/resource' ],
By default only whitelisted users are allowed to login into the Kirby panel.
Domain Whitelist: By adding domains to the domain whitelist (
domainWhitelist) all accounts with a verified email address at one of the domains are permitted.
Email Whitelist: By adding email addresses to the email whitelist (
emailWhitelist) all accounts with a verified email address matching one of the entires are permitted.
Allow Everyone: By setting
true all authenticated accounts are able to login. Please use this option with care! You probably want to change the default user role to a more restricted one then the default
Default Role: Newly created users get the role defined with
defaultRole when they first login. The default is
admin. Please note that when the user has ben created already the role will not be updated. You can set this role to
nobody if you want to manually whitelist users by changing the role in the Kirby panel.
Only Existing User: By setting
onlyExistingUsers to true only created uses are able to login with an OAuth provider, no new users are created.