cilogon / oauth2-orcid
ORCID OAuth 2.0 Client Provider for The PHP League OAuth2-Client
Installs: 7 196
Dependents: 1
Suggesters: 0
Security: 0
Stars: 5
Watchers: 5
Forks: 2
Open Issues: 0
Requires
- php: >=5.6.0
- lcobucci/jwt: ^4
- league/oauth2-client: ^2.6.0
Requires (Dev)
- mockery/mockery: ^1.4.4
- php-parallel-lint/php-parallel-lint: ^1.3.1
- phpunit/phpunit: ^9.5.10
- squizlabs/php_codesniffer: ^3.6.1
README
This package provides ORCID OAuth 2.0 support for the PHP League's OAuth 2.0 Client.
ORCID provides a persistent digital identifier for researchers. See Getting Started for information on integrating your application with ORCID. You will eventually need to register your application to get an ORCID client id and client secret for your integration.
This package is compliant with PSR-1, PSR-4 and PSR-12. If you notice compliance oversights, please send a patch via pull request.
Requirements
The following versions of PHP are supported.
- PHP 7.1 (v1.x)
- PHP 7.2 (v1.x)
- PHP 7.3 (v1.x)
- PHP 7.4 (v2.x)
- PHP 8.0 (v2.x)
- PHP 8.1 (v2.x)
Installation
To install, use composer:
composer require cilogon/oauth2-orcid
Usage
Authorization Code Flow
$provider = new CILogon\OAuth2\Client\Provider\ORCID([ 'clientId' => '{orcid-client-id}', 'clientSecret' => '{orcid-client-secret}', 'redirectUri' => 'https://example.com/callback-url', ]); if (!empty($_GET['error'])) { // Got an error, probably user denied access exit('Got error: ' . $_GET['error'] . 'Description: ' . $GET['error_description']); } elseif (empty($_GET['code'])) { $authUrl = $provider->getAuthorizationUrl(); $_SESSION['oauth2state'] = $provider->getState(); header('Location: '.$authUrl); exit; } elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) { // Check given state against previously stored one to mitigate CSRF attack unset($_SESSION['oauth2state']); exit('Invalid state'); } else { try { // Try to get an access token using the authorization code grant $token = $provider->getAccessToken('authorization_code', [ 'code' => $_GET['code'] ]); // Print out the access token, which can be used in // authenticated requests against the service provider's API. echo '<xmp>' . "\n"; echo 'Token : ' . $token->getToken() . "\n"; $expires = $token->getExpires(); if (!is_null($expires)) { echo 'Expires : ' . $token->getExpires(); echo ($token->hasExpired() ? ' (expired)' : ' (active)') . "\n"; } echo '</xmp>' . "\n"; // Using the access token, get the user's details $user = $provider->getResourceOwner($token); echo '<xmp>' . "\n"; echo 'User ID : ' . $user->getId() . "\n"; echo 'First name : ' . $user->getGivenName() . "\n"; // or getFirstName() echo 'Last name : ' . $user->getFamilyName() . "\n"; // or getLastName() echo 'Published name : ' . $user->getName() . "\n"; echo 'Also Known As : ' . implode(',', $user->getOtherNames()) . "\n"; echo 'Email : ' . $user->getEmail() . "\n"; // 'Primary' preferred echo 'Primary Email : ' . $user->getPrimaryEmail() . "\n";// 'Primary' ONLY echo 'All Emails : ' . implode(',', $user->getEmails()) . "\n"; echo 'AuthnMethodRef : ' . $user->getAmr() . "\n"; // Only for Member API echo '</xmp>'; } catch (Exception $e) { // Failed to get access token or user details exit('Something went wrong: ' . $e->getMessage()); } }
Sandbox vs Production
In order to authenticate ORCID users and read associated attributes, you would typically use the Production Registry. However, for special integrations, you may want to register for a Sandbox application. To use the Sandbox
environment, set a 'sandbox' parameter to true
when creating the provider.
$provider = new CILogon\OAuth2\Client\Provider\ORCID([ 'clientId' => '{orcid-client-id}', 'clientSecret' => '{orcid-client-secret}', 'redirectUri' => 'https://example.com/callback-url', 'sandbox' => true ]);
Note that you can use this in combination with the Member API (below).
Public API vs Member API
If you are an ORCID member, you can use the Member API instead of the Public API. To use the Member API, set a 'member' parameter to true
when creating the provider. The Member API provides an additional id_token field 'amr' (AuthnMethodRef). The value is either 'mfa' for users who have enabled two-factor authentication on their ORCID account, or 'pwd' otherwise. When using the Public API, getAmr()
returns null
.
$provider = new CILogon\OAuth2\Client\Provider\ORCID([ 'clientId' => '{orcid-client-id}', 'clientSecret' => '{orcid-client-secret}', 'redirectUri' => 'https://example.com/callback-url', 'member' => true ]);
Note that you can use this in combination with the Sandbox environment (above).
Refreshing a Token
Refreshing an ORCID token requires the value of the current access token as the Bearer Token for authentication. So your application needs to use both the current access token AND the refresh token to get a new access token (and associated refresh token).
$accesstoken = $token->getToken(); $refreshtoken = $token->getRefreshToken(); $newtoken = $provider->getAccessToken('refresh_token', [ 'refresh_token' => $refreshtoken, ], $accesstoken);
License
The University of Illinois/NCSA Open Source License (NCSA). Please see License File for more information.