使用带有bshaffer库的JWT访问令牌

Question

i am trying to implement this option, but don't works.

Someone can guide me how to implement it?

Using Secondary Storage

This library allows you to back up the access tokens to secondary storage. Just pass an object implementing OAuth2\Storage\AccessTokenInterface to the JwtAccessToken object to have access tokens stored in an additional location:

    $pdoStorage = new OAuth2\Storage\Pdo($pdo); 
    $keyStorage = new OAuth2\Storage\Memory(array('keys' => array(
            'public_key'  => $publicKey,
            'private_key' => $privateKey,
        )));
This example pulls the public/private keys from Memory storage, and saves the granted access tokens to Pdo storage once they are signed.

Thanks!

Answer 1

I'm guessing your implementation will be User Credentials + JWT? If this is not the case, please explain your exact use case and I'll try to help you out.

I hope the following information can help you out. For each part you can set an individual storage type. You can also see the options in the Server object its storageMap variable. More info on multiple storage types can be found here BShaffer - Using Multiple Storages.

You need to set the corresponding storage types to your use case. If your users are being stored in a database, use PDO storage. If they're stored in memory, use memory storage.

User Credentials initially uses access_tokens. These are tokens that don't contain any data. They are being used to lookup the user without transferring sensitive data over and over again. To use JWT tokens you can set the 'use_jwt_access_tokens' key to true. You can see this in the example.

JWT tokens are usually not stored in a database (benefit of JWT because the token itself contains the required user info). So in the example I've set access_token storage to PDO. If you want to use access_tokens and not JWT tokens you will need to store it in the database to lookup the user later on.

After that I've added the required grant types for my use case. Remember that User Credentials grant type requires client credentials as well. You will have to set where these are located. In the example I've set memory storage.

If it's still unclear to you feel free to ask!

// create storages
$pdoStorage = new \Apps\Source\Plugins\Oauth2\PDO([
    'dsn' => $dsn, // example: 'mysql:dbname=oauth2;host=localhost'
    'username' => $username, 
    'password' => $password,
]);
$memStorage = new \OAuth2\Storage\Memory([
    'keys' => array(
        'public_key'  => $publicKey,
        'private_key' => $privateKey,
    ),
    // client_credentials & client_secret are the key names, don't edit this. 
    'client_credentials' => array(
        'client_id_here' => array('client_secret' => 'secret_here')
    )
]);

// Set the required storage objects
$this->server = new \OAuth2\Server(
    [
        'access_token' => $memStorage, // Where you want to store your access tokens 
        'public_key' => $memStorage, // Where you have stored your keys
        'client_credentials' => $memStorage, // Depends on your keysclient_credentials storage location, mine is in memory, but can be stored in different storage types.
        'user_credentials' => $pdoStorage, // Depend on your where your users are being stored
        'refresh_token' => $pdoStorage // Refresh tokens are being stored in the db
    ],
    [
        'use_jwt_access_tokens' => true,
    ]
);

// Set the grant types
$grantType = new \OAuth2\GrantType\UserCredentials($pdoStorage);
$this->server->addGrantType($grantType);

$grantType = new \OAuth2\GrantType\RefreshToken($pdoStorage, [
    'always_issue_new_refresh_token' => true,
    'refresh_token_lifetime'         => 2419200 // the refresh tokens now last 28 days
]);
$this->server->addGrantType($grantType);