php oauth授权实例,OAuth 2.0 Server PHP实现示例
需求
实现三方OAuth2.0授权登录
使用OAuth服务
OAuth 2.0 Server PHP
环境
nginx
mysql
php
框架
Yii
一 安装
项目目录下安装应用
composer.phar require bshaffer/oauth2-server-php "^1.10"
二 构建数据结构
注意 user表需要自定义
CREATE TABLE oauth_clients (
client_id VARCHAR(80) NOT NULL,
client_secret VARCHAR(80),
redirect_uri VARCHAR(2000),
grant_types VARCHAR(80),
scope VARCHAR(4000),
user_id VARCHAR(80),
PRIMARY KEY (client_id)
);
CREATE TABLE oauth_access_tokens (
access_token VARCHAR(40) NOT NULL,
client_id VARCHAR(80) NOT NULL,
user_id VARCHAR(80),
expires TIMESTAMP NOT NULL,
scope VARCHAR(4000),
PRIMARY KEY (access_token)
);
CREATE TABLE oauth_authorization_codes (
authorization_code VARCHAR(40) NOT NULL,
client_id VARCHAR(80) NOT NULL,
user_id VARCHAR(80),
redirect_uri VARCHAR(2000),
expires TIMESTAMP NOT NULL,
scope VARCHAR(4000),
id_token VARCHAR(1000),
PRIMARY KEY (authorization_code)
);
CREATE TABLE oauth_refresh_tokens (
refresh_token VARCHAR(40) NOT NULL,
client_id VARCHAR(80) NOT NULL,
user_id VARCHAR(80),
expires TIMESTAMP NOT NULL,
scope VARCHAR(4000),
PRIMARY KEY (refresh_token)
);
CREATE TABLE oauth_users (
username VARCHAR(80),
password VARCHAR(80),
first_name VARCHAR(80),
last_name VARCHAR(80),
email VARCHAR(80),
email_verified BOOLEAN,
scope VARCHAR(4000),
PRIMARY KEY (username)
);
CREATE TABLE oauth_scopes (
scope VARCHAR(80) NOT NULL,
is_default BOOLEAN,
PRIMARY KEY (scope)
);
CREATE TABLE oauth_jwt (
client_id VARCHAR(80) NOT NULL,
subject VARCHAR(80),
public_key VARCHAR(2000) NOT NULL
);
三 代码实现
/**
* Created by PhpStorm.
* User: parker
* Date: 2020/9/8
* Time: 7:08 下午
*
* 使用 OAuth 2.0 Server PHP 搭建三方授权服务
* 相关文档地址 https://bshaffer.github.io/oauth2-server-php-docs/
* 本服务使用 授权码形式
* 授权码(authorization code)方式，指的是第三方应用先申请一个授权码，然后再用该码获取令牌。
* 这种方式是最常用的流程，安全性也最高，它适用于那些有后端的 Web 应用。授权码通过前端传送，令牌则是储存在后端，而且所有与资源服务器的通信都在后端完成。这样的前后端分离，可以避免令牌泄漏。
*
*/
namespace backend\controllers\api;
use common\lib\LController;
use common\lib\LError;
use common\models\admin\AdminModel;
use OAuth2\GrantType\AuthorizationCode;
use OAuth2\Request;
use OAuth2\Response;
use OAuth2\Server;
use OAuth2\Storage\Pdo;
use yii\helpers\Json;
use Yii;
class OauthController extends LController
{
public $enableCsrfValidation = false;
/** @var Pdo $storage */
public $storage;
/** @var Server $server */
public $server;
/** @var Request $request */
public $request;
/** @var Response $response */
public $response;
public function init()
{
$this->storage = new Pdo([
'dsn' => 'mysql:host=10.0.80.10;dbname=ylsrc_admin',
'username' => 'root',
'password' => '2Q5@a5X6fh'
], [
'client_table' => 'src_oauth_clients',
'access_token_table' => 'src_oauth_access_tokens',
'refresh_token_table' => 'src_oauth_refresh_tokens',
'code_table' => 'src_oauth_authorization_codes',
'user_table' => 'src_admin',
'scope_table' => 'src_oauth_scopes',
'public_key_table' => 'src_oauth_public_keys',
]);
$this->server = new Server($this->storage);
$this->request = Request::createFromGlobals();
$this->response = new Response();
}
/**
* 获取授权码(测试使用生产环境服务添加到登录接口)
*
* 获取链接
* GET http://usrc.com/api/oauth/get-code?response_type=code&client_id=1&state=xyz
* response_type 必填 请求类型
* client_id 必填 三方授权id
* state 必填 回调验证字段
*
* 响应方式为跳转到src_oauth_clients表对应id条目设置的redirect_url跳转连接返回第三方应用, 并且携带code
* 示例:对应的redirect_url为 https://host.com 那么对应的跳转连接为(state未使用)
* https://host.com?code=d53d363349951c29593b722a7d2fb05c054f5e65&state=xyz
*
*/
public function actionGetCode()
{
$uid = Yii::$app->user->id;
if($uid){
$this->server->addGrantType(new AuthorizationCode($this->storage)); // or any grant type you like!
$this->server->validateAuthorizeRequest($this->request, $this->response);
$this->server->handleAuthorizeRequest($this->request, $this->response, true, $uid);
$this->response->send();
}else{
$this->ajaxReturn( LError::NO_PERMISSION, LError::getErrMsgByCode( LError::NO_PERMISSION ), [] );
}
}
/**
* 获取access_toke
* 获取链接
* POST http://usrc.com/api/oauth/get-token
* data
* grant_type 必填 请求类型 authorization_code
* client_id 必填 三方授权id
* client_secret 必填 三方授权秘钥
* code 必填 上一步获取的授权码
*
* return
*
* {
* "access_token": "b2d91c2764bdde79e4f1e92349b969e8ee031e8a",
* "expires_in": 3600,
* "token_type": "Bearer",
* "scope": null,
* "refresh_token": "d9293e82c22523ad6500d6b584b484cc3aeb4736"
* }
*/
public function actionGetToken()
{
$response = $this->server->handleTokenRequest($this->request);
$response->send();
}
/**
* 使用token获取用户信息
* 获取连接
* GET http://usrc.com/api/oauth/get-user-info?access_token=b2d91c2764bdde79e4f1e92349b969e8ee031e8a
*
* access_token 上一步获取的token
*
*/
public function actionGetUserInfo()
{
if (!$this->server->verifyResourceRequest($this->request)) {
$this->server->getResponse()->send();
}else{
$token = $this->server->getAccessTokenData($this->request);
$user = AdminModel::findIdentity($token['user_id']);
$data = [
'id' => $user->id,
'username' => $user->account_name,
'mobile' => $user->mobile,
'email' => $user->email,
];
echo Json::encode($data);
}
}
}