search

facile-it / php-openid-client

PHP OpenID Client
38 stars 7 forks source link

Request for information about the OpenID Connect and DPoP #1

Open drupol opened 3 years ago

drupol commented 3 years ago

Hello,

My name is Pol Dellaiera, I'm a developer working as a consultant for European Commission(EC). I'm a very lucky worker because everything that I do is OpenSource, you can find the work that we do here: https://github.com/ecphp/

I published PHP libraries and Symfony bundles for authentication, especially CAS.

Recently, I've been given the task to create a bundle that will facilitate the authentication of requests at EC.

The protocol in use is OpenID Connect (DPoP).

Basically a request with a specific header Authorization: pop AT-123456-somethingsomething comes in and I need to authenticate it, and get the claims.

While I'm not an expert into authentication, I'm checking on Github the PHP libraries that could help doing this, and there are not a lot. Documentation is not big either.

My question is then the following, is this bundle could help into doing a standard Symfony bundle for OpenID Connect authentication supporting DPoP ?

Thanks !

thomasvargiu commented 3 years ago

Hello Pol,

I didn't know the DPoP RFC Draft and I was reading it. Honestly I think that with very small changes we can support it. Right now you can create your code to support dPoP (see below).

  1. First we should create a decorator for AuthMethodInterface, in order to detect a dpop token in the Authorization header and create the DPoP JWT to inject into the request. We can also write an helper to do that on a generic PSR Request.
  2. Next step, we should fix few places where we're using the Bearer token type literally, we should use the token_type returned from the IdP, this could be a BC. The problem isn't in the AuthorizationService but in the Dynamic RegistrationService and ´UserInfoService`.
  3. Then we should write a validator to be used on the resource server.

If you don't need the RegistrationService or the UserInfoService until we resolve the 2nd issue, I think could be enough to implement the 1st step wriing a decorator for the AuthMethodInterface. Then you can use the AuthMethodFactory injecting the decorated AuthMethodInterfaces, using it when creating the client with the ClientBuilder. Now the token and refresh token requests should work.

I think we'll work on it to support DPoP in the future (or next days), but PRs are welcome.

drupol commented 3 years ago

Dear @thomasvargiu,

Thanks for your reply, this is a very good news.

However and as far as I understand (but I may be wrong), I do not need to use the whole set of features of this library. I just need to use the small subset of it.

Do you think you would have time for chat today?

Basically it would be to discuss how we can

  1. Fix our needs
  2. Contribute to your library

I've sent you an email already, let me know what you think.

drupol commented 3 years ago

This has been done and released here: https://github.com/ecphp/eu-login-api-authentication-bundle/

I'm busy writing the tests and the rest, but we have a working solution, this is great!

drupol commented 1 year ago

@thomasvargiu Hello! Any update on supporting the DPoP draft ?

thomasvargiu commented 1 year ago

I'm sorry @drupol, the issue was closed and I didn't look at it. I'm going to re-open it to remember to work on dPOP

drupol commented 1 year ago

Grazie!

I'll actively follow this.