Web Authentication

Authentication for web services. Supports authenticating URLs with fragments such as https://example.com/#/users/thekid without losing information when redirecting.

☑ Verified with Twitter (OAuth 1), Microsoft Office 365, Facebook, GitHub and Google (OAuth 2).

Examples

HTTP basic authentication:

useweb\auth\Basic;
useutil\Secret;
$auth= newBasic('Administration', function($user, Secret$secret) {
return'admin' === $user && $secret->equals('secret') ? ['id' => 'admin'] : null;
});
return ['/' => $auth->required(function($req, $res) {
$res->send('Hello @'.$req->value('user')['id'], 'text/plain');
})];

Authentication via Twitter:

useweb\auth\SessionBased;
useweb\auth\oauth\OAuth1Flow;
useweb\session\ForTesting;
$flow= newOAuth1Flow(
'https://api.twitter.com/oauth',
[$credentials->named('twitter_oauth_key'), $credentials->named('twitter_oauth_secret')],
$callback
);
$auth= newSessionBased(
$flow,
newForTesting(),
$flow->fetchUser('https://api.twitter.com/1.1/account/verify_credentials.json')
);
return ['/' => $auth->required(function($req, $res) {
$res->send('Hello @'.$req->value('user')['screen_name'], 'text/plain');
})];

The $callback parameter should be the path matching the path in the callback URI registered with Twitter.

Authentication via GitHub:

useweb\auth\SessionBased;
useweb\auth\oauth\OAuth2Flow;
useweb\session\ForTesting;
$flow= newOAuth2Flow(
'https://github.com/login/oauth/authorize',
'https://github.com/login/oauth/access_token',
[$credentials->named('github_oauth_key'), $credentials->named('github_oauth_secret')],
$callback
);
$auth= newSessionBased(
$flow,
newForTesting(),
$flow->fetchUser('https://api.github.com/user')
);
return ['/' => $auth->required(function($req, $res) {
$res->send('Hello @'.$req->value('user')['login'], 'text/plain');
})];

The $callback parameter should be the path matching the path in the callback URI registered with GitHub.

Authentication via Google:

useweb\auth\SessionBased;
useweb\auth\oauth\OAuth2Flow;
useweb\session\ForTesting;
$flow= newOAuth2Flow(
'https://accounts.google.com/o/oauth2/v2/auth',
'https://oauth2.googleapis.com/token',
[$credentials->named('google_oauth_key'), $credentials->named('google_oauth_secret')],
$callback,
['https://www.googleapis.com/auth/userinfo.profile']
);
$auth= newSessionBased(
$flow,
newForTesting(),
$flow->fetchUser('https://openidconnect.googleapis.com/v1/userinfo')
);
return ['/' => $auth->required(function($req, $res) {
$res->send('Hello @'.$req->value('user')['name'], 'text/plain');
})];

The $callback parameter should be the path matching the path in the callback URI registered with GitHub.

Authentication via Office 365 Azure AD:

useutil\Secret;
useweb\auth\SessionBased;
useweb\auth\oauth\{OAuth2Flow, BySecret, ByCertificate, ByPKCE};
useweb\session\ForTesting;
// Depending on what you have set up under "Certificates & Secrets", use one// of the following. For certificate-based authentication, $privateKey can// hold either the key's contents or reference it as 'file://private.key'$credentials= newBySecret('[APP-ID]', newSecret('...'));
$credentials= newByCertificate('[APP-ID]', '[THUMBPRINT]', $privateKey);
$credentials= newByPKCE('[APP-ID]', 'S256');
$flow= newOAuth2Flow(
'https://login.microsoftonline.com/[TENANT_ID]/oauth2/v2.0/authorize',
'https://login.microsoftonline.com/[TENANT_ID]/oauth2/v2.0/token',
$credentials,
$callback,
['openid', 'profile', 'offline_access', 'User.Read']
);
$auth= newSessionBased(
$flow,
newForTesting(),
$flow->fetchUser('https://graph.microsoft.com/v1.0/me')
);
return ['/' => $auth->required(function($req, $res) {
$res->send('Hello @'.$req->value('user')['login'], 'text/plain');
})];

The $callback parameter should be the path matching the path in the callback URI registered with the Azure AD application.

Authentication via CAS ("Central Authentication Service"):

useweb\auth\SessionBased;
useweb\auth\cas\CasFlow;
useweb\session\ForTesting;
$flow= newCasFlow('https://sso.example.com/');
$auth= newSessionBased($flow, newForTesting());
return ['/' => $auth->required(function($req, $res) {
$res->send('Hello @'.$req->value('user')['username'], 'text/plain');
})];

Target URLs

By default, the flow instances use the request URI to determine where the service is running. Behind a proxy, this is most probably not the user-facing URI. To change this behavior, use the target() method and pass a UseURL instance as follows:

useweb\auth\UseURL;
useweb\auth\cas\CasFlow;
$flow= (newCasFlow('https://sso.example.com/'))->target(newUseURL('https://service.example.com/'));