Is there a list of providers that work with OpenID-Connect-PHP? Does it work with GitHub

[jumbojett]

Is there a list of providers that work with OpenID-Connect-PHP? Does it work with GitHub

[christiaangoossens]

I would like to add that this library (without modifications) does not work with Azure AD, although it has been OpenID Certified. This is due to the fact that the provider (discovery) URL given to OpenIDConnectClient is on the https://login.microsoftonline.com/ domain (see: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-openid-connect-code), while the token issuer is https://sts.windows.net/ (https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-token-and-claims#idtokens). This does (possibly) not apply to version 2 tokens.

It will work if you change the provider URL between redirecting to the authorize endpoint and the validation of the JWT token.

I'll add this to the relevant wiki page.

[jumbojett]

Good question @zmon. I'm interested as well. I'd like to add a list to the documentation. Thanks for starting this thread.

[billsimon]

Re: the Google integration. Like @zmon I just use 'accounts.google.com' for the provider_url variable. The README shows a scheme and hostname like https://accounts.google.com. Which is it? I think when I first set it up I used https://accounts.google.com and it didn't work so I went with the bare name of accounts.google.com. Just today, I found that the claims validation was failing because Google is sending back the https://accounts.google.com address as the issuer and this doesn't match what's in the constructor.

[zmon]

@billsimon I just went back to my code (which has not changed since testing my pull request) and found that accounts.google.com failed... Adding the https fixed it. They must of changed something.

[zmon]

@jumbojett Added a wiki page for a list of providers.

[jricher]

Google's in the middle of testing for certification with the OpenID Foundation, so I wouldn't be surprised if they were fixing a bunch of slightly-off-spec things in the process (like the issuer value which is supposed to always start with https).

[billsimon]

Nice timing... I guess it's always the middle of the afternoon somewhere in the world. OK, thanks for the confirmation. I was puzzled.

[zmon]

A list of implementations have been granted certification by OpenID

[jumbojett]

A list of implementations have been granted certification by OpenID
@zmon Good find!

[DeepDiver1975]

@christiaangoossens Mind sharing which changes are explicit necessary to get this working? THX

[christiaangoossens]

@DeepDiver1975 As far as I remember, I just switched out the issuer before the checking part.