Comments (3)
The client ID identifies the client -- your application -- to the server. It does not identify the user at all. What you can do is use your client ID (and secret) to get an ID Token for each user. The ID token will have two fields inside of it that, when taken together, uniquely identify the user: iss
and sub
. The iss
is a URL that identifies the identity provider and the sub
is an opaque value (not a username) that uniquely identifies the current user at the identity provider.
So the first time you talk to a given IdP, you register. But you still need to get the ID token to actually log the user in. For subsequent users, you don't need to register anymore, but you do still need to get ID tokens.
from openid-connect-php.
@kace91 I'd like to add the following in addition to what @jricher has stated.
You can think of client id and client secret has the global user name and password for our application in regards to the identity provider. (Identity provider being google, salesforce, etc...)
Consider the following snippet. Hope this helps!
require "OpenIDConnectClient.php5";
$oidc = new OpenIDConnectClient("https://my.id.provider.url/");
//
// BEGIN
//
// This block stores information in $_SESSION
// It is not practical for production for many obvious reasons.
// You should change it to store the CLIENT ID and CLIENT SECRET in a database or text file
//
if (!$_SESSION['i']) {
$oidc->register();
$_SESSION['i'] = $oidc->getClientID();
$_SESSION['d'] = $oidc->getClientSecret();
}
$oidc->setClientID($_SESSION['i']);
$oidc->setClientSecret($_SESSION['d']);
//
// END
//
// Let's ask for all of the user's information!
$attrib = array('name','family_name','given_name','middle_name','nickname','preferred_username','profile','picture','website','gender','birthdate','zoneinfo','locale','updated_at');
$oidc->addScope(array('openid','profile'));
// This will prompt the user to login.
//
// It will also prompt the user for permission
// Hey user! do we have permission to use your ____ ?
$oidc->authenticate();
//
// For demo purposes! Let's see what we have!
//
$object = new stdClass();
foreach ($attrib as $key => $value) {
$object->$value = $oidc->requestUserInfo($value);
}
print_r($object);
from openid-connect-php.
@jumbojett thanks for your help! It's all much clearer now.
One last question: The authenticate method is supposed to ask the user for permission. However, I see there's code below it showing the retrieved data. Isn't the authenticating process supposed to redirect to a callback page? If so, how (and when) does the code below authenticate get executed? (given that php is executed server side before the page reaches the user). And it does not redirect you, then why does google require a redirection url?
from openid-connect-php.
Related Issues (20)
- Bugs - Azure B2C - URL char issue HOT 2
- Issue when running composer require jumbojett/openid-connect-php HOT 1
- signout() does not sign me out of my application HOT 9
- requestClientCredentialsToken invalid scope in Keycloak HOT 2
- Throwed error if the server returns one is complete HOT 1
- OpenID Connect can return an id_token as part of the refresh_token grant type
- Keycloak 22.0 not supported? HOT 5
- Release new major ... HOT 1
- Cant get codeVerifier in redirectUri if we make authorization flow using PKCE HOT 1
- SERVER_PORT always causes port in redirect URL HOT 4
- Redirect doesn't remove state, session_state, and code params HOT 2
- Support dropped for phpseclib 2.*? HOT 2
- Invalid Client - Connect Token HOT 1
- Support for `id_token_signing_alg_values_supported` HOT 1
- Return types are too strict
- requestTokenExchange error Passing null to parameter #2 of http_build_query
- Debug Mode ? HOT 1
- scopes attribut are NULL HOT 1
- could you maybe help out the heimdall project to add oidc support?
- $verifiedClaims is no array but an object
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from openid-connect-php.