Add OpenID Response Type

examples/src/Repositories/IdTokenRepository.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace League\OAuth2\Server\Repositories;
+
+use Lcobucci\JWT\Encoding\ChainedFormatter;
+use Lcobucci\JWT\Encoding\JoseEncoder;
+use Lcobucci\JWT\Token\Builder;
+use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
+
+/**
+ * Exmaple implemnation of IdTokenRepositoryInterface
+ *
+ * @author Marc Riemer <[email protected]>
+ * @license http://opensource.org/licenses/MIT MIT
+ */
+class IdTokenRepository implements IdTokenRepositoryInterface
+{
+    public function __construct(private string $issuedBy, private ?string $nonce = null)
+    {
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getBuilder(AccessTokenEntityInterface $accessToken): Builder
+    {
+        $builder = (new Builder(new JoseEncoder(), ChainedFormatter::withUnixTimestampDates()))
+            ->permittedFor($accessToken->getClient()->getIdentifier())
+            ->issuedBy($this->issuedBy)
+            ->issuedAt(new \DateTimeImmutable())
+            ->expiresAt($accessToken->getExpiryDateTime())
+            ->relatedTo($accessToken->getUserIdentifier());
+
+        if ($this->nonce) {
+            $builder->withClaim('nonce', $this->nonce);
+        }
+
+        return $builder;
+    }
+}

src/ClaimExtractor.php

@@ -0,0 +1,171 @@
+<?php
+
+namespace League\OAuth2\Server;
+
+use League\OAuth2\Server\Entities\ClaimSetEntry;
+use League\OAuth2\Server\Entities\ClaimSetEntryInterface;
+use League\OAuth2\Server\Entities\ScopeEntityInterface;
+
+/**
+ * ClaimExtractor
+ *
+ * @link https://github.com/steverhoades/oauth2-openid-connect-server
+ *
+ * @author Steve Rhoades <[email protected]>
+ * @author Marc Riemer <[email protected]>
+ */
+class ClaimExtractor implements ClaimExtractorIntercace
+{
+    /**
+     * claimSets
+     *
+     * @var ClaimSetEntryInterface[]
+     */
+    protected $claimSets = [];
+
+    protected $protectedClaims = ['profile', 'email', 'address', 'phone'];
+
+    /**
+     * ClaimExtractor constructor
+     *
+     * @param ClaimSetEntryInterface[] $claimSets
+     */
+    public function __construct(array $claimSets = [])
+    {
+        $this->claimSets = self::getDefaultClaimSetEnties();
+        foreach ($claimSets as $claimSet) {
+            $this->addClaimSet($claimSet);
+        }
+    }
+
+    /**
+     * @param ClaimSetEntryInterface $claimSetEntry
+     *
+     * @return $this
+     *
+     * @throws \InvalidArgumentException
+     */
+    public function addClaimSet(ClaimSetEntryInterface $claimSetEntry): ClaimExtractor
+    {
+        $scope = $claimSetEntry->getScope();
+
+        if (\in_array($scope, $this->protectedClaims) && !empty($this->claimSets[$scope])) {
+            throw new \InvalidArgumentException(
+                \sprintf('%s is a protected scope and is pre-defined by the OpenID Connect specification.', $scope)
+            );
+        }
+
+        $this->claimSets[$scope] = $claimSetEntry->getClaims();
+
+        return $this;
+    }
+
+    /**
+     * @param string $scope
+     *
+     * @return ClaimSetEntryInterface|null
+     */
+    public function getClaimSet(string $scope): ?ClaimSetEntryInterface
+    {
+        foreach ($this->claimSets as $set) {
+            if ($set->getScope() === $scope) {
+                return $set;
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Get claimSets
+     *
+     * @return array
+     */
+    public function getClaimSets(): array
+    {
+        return $this->claimSets;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function extract(array $scopes, array $claims): array
+    {
+        $claimData  = [];
+        $keys = \array_keys($claims);
+
+        foreach ($scopes as $scope) {
+            $scopeName = ($scope instanceof ScopeEntityInterface) ? $scope->getIdentifier() : $scope;
+
+            $claimSet = $this->getClaimSet($scopeName);
+            if (null === $claimSet) {
+                continue;
+            }
+
+            $intersected = \array_intersect($claimSet->getClaims(), $keys);
+
+            if (empty($intersected)) {
+                continue;
+            }
+
+            $data = \array_filter(
+                $claims,
+                function ($key) use ($intersected) {
+                    return \in_array($key, $intersected);
+                },
+                ARRAY_FILTER_USE_KEY
+            );
+
+            $claimData = \array_merge($claimData, $data);
+        }
+
+        return $claimData;
+    }
+
+    /**
+     * Create a array default openID connect claims
+     *
+     * @see http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
+     *
+     * @return ClaimSetEntry[]
+     */
+    public static function getDefaultClaimSetEnties(): array
+    {
+        return [
+            new ClaimSetEntry('profile', [
+                'name',
+                'family_name',
+                'given_name',
+                'middle_name',
+                'nickname',
+                'preferred_username',
+                'profile',
+                'picture',
+                'website',
+                'gender',
+                'birthdate',
+                'zoneinfo',
+                'locale',
+                'updated_at',
+            ]),
+            new ClaimSetEntry('email', [
+                'email',
+                'email_verified',
+            ]),
+            new ClaimSetEntry('address', [
+                'address',
+            ]),
+            new ClaimSetEntry('phone', [
+                'phone_number',
+                'phone_number_verified',
+            ]),
+            new ClaimSetEntry('openid', [
+                'nonce',
+                'auth_time',
+                'acr',
+                'amr',
+                'azp',
+            ]),
+        ];
+    }
+}

src/ClaimExtractorIntercace.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace League\OAuth2\Server;
+
+interface ClaimExtractorIntercace
+{
+    /**
+     * For given scopes and aggregated claims get all claims that have been configured on the extractor.
+     *
+     * @param array $scopes
+     * @param array $claims
+     *
+     * @return array
+     */
+    public function extract(array $scopes, array $claims): array;
+}

src/Entities/ClaimSetEntry.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace League\OAuth2\Server\Entities;
+
+/**
+ * ClaimSetEntry
+ *
+ * @author Steve Rhoades <[email protected]>
+ * @author Marc Riemer <[email protected]>
+ * @license http://opensource.org/licenses/MIT MIT
+ */
+class ClaimSetEntry implements ClaimSetEntryInterface
+{
+    /**
+     * @var string
+     */
+    protected $scope;
+
+    /**
+     * @var array
+     */
+    protected $claims;
+
+    public function __construct(
+        string $scope,
+        array $claims
+    ) {
+        $this->scope = $scope;
+        $this->claims = $claims;
+    }
+
+    /**
+     * Get scope
+     *
+     * @return string
+     */
+    public function getScope(): string
+    {
+        return $this->scope;
+    }
+
+    /**
+     * Get claims
+     *
+     * @return ClaimSetInterface[]
+     */
+    public function getClaims(): array
+    {
+        return $this->claims;
+    }
+}

src/Entities/ClaimSetEntryInterface.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace League\OAuth2\Server\Entities;
+
+/**
+ * ClaimSetEntryInterface
+ *
+ * @author Steve Rhoades <[email protected]>
+ * @author Marc Riemer <[email protected]>
+ * @license http://opensource.org/licenses/MIT MIT
+ */
+interface ClaimSetEntryInterface extends ClaimSetInterface
+{
+    public function getScope(): string;
+}

src/Entities/ClaimSetInterface.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace League\OAuth2\Server\Entities;
+
+/**
+ * ClaimSetEntryInterface
+ *
+ * @author Steve Rhoades <[email protected]>
+ * @author Marc Riemer <[email protected]>
+ * @license http://opensource.org/licenses/MIT MIT
+ */
+interface ClaimSetInterface
+{
+    public function getClaims(): array;
+}

src/IdTokenClaimsCreatedEvent.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace League\OAuth2\Server;
+
+use Lcobucci\JWT\Builder;
+
+/**
+ * IdTokenClaimsCreatedEvent Event helps to extend claims of the id_token
+ *
+ * A usecase is to add nonce If requested by the client
+ *
+ * @author Marc Riemer <[email protected]>
+ */
+final class IdTokenClaimsCreatedEvent extends IdTokenEvent
+{
+    /**
+     * Builder
+     *
+     * @var Builder
+     */
+    private $builder;
+
+    public function __construct($name, Builder $builder)
+    {
+        parent::__construct($name);
+        $this->builder = $builder;
+    }
+
+    public function getBuilder(): Builder
+    {
+        return $this->builder;
+    }
+}

src/IdTokenEvent.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace League\OAuth2\Server;
+
+use League\Event\Event;
+
+/**
+ * IdTokenEvent
+ *
+ * @author Marc Riemer <[email protected]>
+ */
+class IdTokenEvent extends Event
+{
+    const ID_TOKEN_ISSUED = 'id_token.issued';
+
+    // This event can be used to extent claims of the id_token
+    const ID_TOKEN_CLAIMS_CREATED = 'id_token.claims.created';
+}