microsoft/kiota-authentication-phpleague-php

Kiota authentication provider implementation for OAuth with PHPLeague

Kiota Authentication Provider Library for PHP

The Kiota Authentication provider library for PHP uses the PHP League OAuth 2.0 client to authenticate against the Microsoft Identity platform.

A Kiota generated project will need a reference to a authentication provider library to authenticate HTTP requests to an API endpoint.

Read more about Kiota here.

Using the Kiota Authentication Provider Library for PHP

run composer require microsoft/kiota-authentication-phpleague or add the following to your composer.json file:

{
    "require": {
        "microsoft/kiota-authentication-phpleague": "^1.1.0"
    }
}

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

kiota-authentication-phpleague-php's Issues

Fix potential identity swapping in async scenarios

This lib currently caches access tokens in memory. Building on the work in #18 which abstracts the token caching layer while defaulting to an in-memory cache, a potential bug was identified.

PHP largely uses a single-process per request but using asynchronous programming frameworks like Swoole could present cases where two threads handling different user's requests could read the same cached token leading to an identity swap. This is if the same authentication provider is injected

Discussed solution is to cache tokens in a way that retrieval is unique to a user for delegated auth scenarios and unique to a tenant and client for application permission scenarios. Cached tokens to be stored/retrieved in/from a map with the following keys:

• tenantId-clientId-userId - delegated permissions
• tenantId-clientId - application permissions

ToDo

• OnBehalfOfContext to derive userId from the oid (object ID) claim of the assertion passed
• Investigate how the AuthorizationCodeContext should distinguish between users. Require nonce?

do not require https for local host in azure identity provider

reflection of microsoft/kiota-authentication-azure-go#102

Support authentication against different National Clouds

Bump PHPStan level to 8 or 9

AuthorizationUrl is not correct

Hello,

I am trying to upgrade my application to use msgraph-sdk-php v2 and found this issue in this package.

$tokenRequestContext = new AuthorizationCodeContext(
    'tenantId', 'clientId', 'clientSecret', 'authCode', 'redirectUri');

$scopes = ['User.Read'];
$authProvider = new GraphPhpLeagueAuthenticationProvider($tokenRequestContext, $scopes);
$redirectUrl = $authProvider->getAccessTokenProvider()
    ->getOauthProvider()->getAuthorizationUrl();

The authorization url is not correct because of:

1. AADSTS900144: The request body must contain the following parameter: 'client_id'.
2. AADSTS900144: The request body must contain the following parameter: 'scope'.
3. Also the redirectUri is missing, there is no specific error for this, but it is necessary.

The clientId and redirectId issues could be fixed in the ProviderFactory class when creating the GenericProvider.
The scopes issue could be fixed in the PhpLeagueAccessTokenProvider constructor and pass them to the ProviderFactory::create, and then to the GenericProvider.

The goal is to have the League\OAuth2\Client\Provider\GenericProvider class fully equipped, which might also require passing the clientSecret to it, but it is not necessary for getAuthorizationUrl().

I can imagine that this fix might not be as simple as I described, but if you could look into it, it would be greatly appreciated.

Thanks!

Add support for proxy

Azure Identity libraries in other languages support configuring a proxy in their credential classes. The PHP Graph SDK supports using a proxy, but these auth classes do not.

The PHP League provider supports a proxy: https://oauth2-client.thephpleague.com/usage/#using-a-proxy, so we should be able to support this.

PHP - Enhance auth support

Initial PHP auth provider PR microsoft/kiota#1201 adds basic support for client_credentials & auth code flows

Consider adding support for:.

• Device Code flow
• OIDC capabilities (sign out, token validation, token introspection ...)

Prevent running SonarCloud step when secret is not present

Pull requests from forks don't have access to secrets causing failures e.g. #18

Need to check for secret before executing SonarCloud step

Missing options in oauth provider

ClientId, ClientSecret and additional parameters are not persisted in oauth provider https://github.com/microsoft/kiota-authentication-phpleague-php/blob/dev/src/Oauth/ProviderFactory.php#L32

Consider the following example

$tenantId = '';
$clientId = '';
$clientSecret = '';

$clientCredentials = new ClientCredentialContext($tenantId, $clientId, $clientSecret);

$accessTokenProvider = new PhpLeagueAccessTokenProvider($clientCredentials);
$accessTokenProvider->getOauthProvider()->authorize(); 

Result: The request body must contain the following parameter: 'client_id'.

https://login.microsoftonline.com/{$tenantId}/oauth2/v2.0/authorize?state=randomstring&response_type=code&approval_prompt=auto

Authorization header is sent even when we are sending a request to a host not allowed.

Update README & add code samples