iansimpson / ss-oauth2-server

An OAuth 2.0 Server library for Silverstripe

OAuth2 Server

Introduction 👋

This allows your Silverstripe site to be in OAuth 2.0 provider.

Please note that this is under development. It should work just fine, but has not been extensively tested, and is poorly documented.

It supports the following grants:

• Authorization code grant
• Refresh grant

Requirements 🦺

• PHP ^8.1
• Silverstripe ^4.13

Installation 👷‍♀️

Install the add-on with Composer:

composer require iansimpson/ss-oauth2-server

Next, generate a private/public key pair:

openssl genrsa -out private.key 2048
openssl rsa -in private.key -pubout -out public.key
chmod 600 private.key
chmod 600 public.key

Put these on your web server, somewhere outside the web root

Generate encryption key:

php -r 'echo base64_encode(random_bytes(36)), PHP_EOL;'

Add the following lines in your .env, updating the OAUTH_PRIVATE_KEY_PATH and OAUTH_PUBLIC_KEY_PATH to point to the key files, and adding the encryption key you have just generated:

OAUTH_PRIVATE_KEY_PATH="/path/to/my/private.key"
OAUTH_PUBLIC_KEY_PATH="/path/to/my/public.key"
OAUTH_ENCRYPTION_KEY="my-encryption-key"

Finally, after doing a /dev/build/ go into your site settings and on the OAuth Configuration and add a new Client. Using this you should now be able to generate a key at /oauth/authorize, per the OAuth 2.0 spec (https://tools.ietf.org/html/rfc6749).

Usage 🏃🏃🏃

To verify the Authorization header being submitted is correct, add this to your Controller:

$member = IanSimpson\OAuth2\OauthServerController::getMember($this);

it will return a Member object if the Authorization header is correct, or null if there's an error. Simple!

ss-oauth2-server's Issues

Question: are you activity working on this repository

Hello there

Thanks for the work. Are you actively working on this repository? If not, would it be ok to get a maintainer access to update the codebase? We have a few in-progress works such ask PHP 8.1 support that would be nice to have in a tagged release

https://github.com/torque-foxes/ss-oauth2-server

Thanks

Missing authorization interface

Not sure if this is on purpose, but the step where user would be asked to approve access to specific scopes is missing.

This is fine for me, as I have a very limited scope (just one resource - for "sso/profile"), use it exclusively for SSO, and I control both server and the client, but might not be so palatable if people want to use it as more full-fledged resource gatekeeper?

Would it make sense to put a note in README about that?

UserEntity might be dangerous

I think UserEntity should not be a proxy global state because it could be dangerous or lead to confusion. As an example of how the problem can manifest see the comment here 2be7b46 .

It looks like the interface is intended to represent an actual object, so it should be tied explicitly and permanently to one concrete Member.

This is a bit arbitrary though - so asking for your feedback - is my concern legitimate?

SS4?

Hello @IanSimpson

thanks for building this OAuth lib! From having a look around the code it should be almost (already?) SS4 ready. Have you tested the module on SS4?

Cheers,
Peter

getMember() doesn't return ID of user

$member = \DataObject::get_by_id("Member", $request->getAttributes()['oauth_user_id']);
change to:
$member = \Member::get()->filter("ID", $request->getAttributes()['oauth_user_id'])->first();