sngular/sngulauth

Auth package against Keycloak for Saml and Openid-Connect

1.5 2020-10-01 12:33 UTC

Requires

• firebase/php-jwt: ^4.0
• guzzlehttp/guzzle: 6.5.0
• league/oauth2-client: ^2.0

Requires (Dev)

• phpunit/phpunit: ^7.5
• symfony/var-dumper: ^4.3

MIT

• Manuel Jesús García Ruiz

• connect
• auth
• saml
• onelogin
• keycloak
• sngular

README

Before start, you need some parameters

• authServerUrl: keycloak auth url
• realm: realm name that has been set up for the project
• clientId: client id name that has been set up for the project
• clientSecret: client secret name that has been set up for the project
• redirectUri: the redirect url to be redirected after successful credentials prompt (this url must be valid on keycloak client configuration)
• encryptionAlgorithm: algorithm to decode the JWT information, default is RS256
• encryptionKeyString: the public key content in one line (without BEGIN PUBLIC KEY and END PUBLIC KEY) in order to decrypt the JWT and get the user info.

The auth process

The src/Provider/Keycloak/Protocol/Connect class needs an array to be instantiated with those parameters:

$auth = new Connect($config);

Then you can build the auth url to redirect user or display a link:

$authUrl = $auth->getAuthorizationUrl();

After user insert his credentials on Keycloak login page, it will be redirected to redirectUri parameter, with a code. Now you can fetch a token (League\OAuth2\Client\Token\AccessToken) against keycloak with those code:

$token = $auth->authByCode($_GET['code']);

Now you can get the resource owner (the user data) against keycloak

$user = $auth->getResourceOwner($token);

And decrypt the token to get the token payload:

$userData = $auth->decryptResponse($token->getToken());