// create test clients in memory
$clients = array('TestClient' => array('client_secret' => 'TestSecret'));

// create a storage object
$storage = new OAuth2\Storage\Memory(array('client_credentials' => $clients));

// create the grant type
$grantType = new OAuth2\GrantType\ClientCredentials($storage);

// add the grant type to your OAuth server
$server->addGrantType($grantType);

// this request will only allow authorization via the Authorize HTTP Header (Http Basic)
$grantType = new OAuth2\GrantType\ClientCredentials($storage, array(
    'allow_credentials_in_request_body' => false
));

# using HTTP Basic Authentication
$ curl -u TestClient:TestSecret https://api.mysite.com/token -d 'grant_type=client_credentials'

# using POST Body
$ curl https://api.mysite.com/token -d 'grant_type=client_credentials&client_id=TestClient&client_secret=TestSecret'

{"access_token":"03807cb390319329bdf6c777d4dfae9c0d3b3c35","expires_in":3600,"token_type":"bearer","scope":null}

// create a storage object to hold refresh tokens
$storage = new OAuth2\Storage\Pdo(array('dsn' => 'sqlite:refreshtokens.sqlite'));

// create the grant type
$grantType = new OAuth2\GrantType\RefreshToken($storage);

// add the grant type to your OAuth server
$server->addGrantType($grantType);

// the refresh token grant request will have a "refresh_token" field
// with a new refresh token on each request
$grantType = new OAuth2\GrantType\RefreshToken($storage, array(
    'always_issue_new_refresh_token' => true
));

// the refresh tokens now last 28 days
$accessToken = new OAuth2\ResponseType\AccessToken($accessStorage, $refreshStorage, array(
    'refresh_token_lifetime' => 2419200,
));

$server = new OAuth2\Server($storage, $config, $grantType, array($accessToken));

$server = new OAuth2\Server($storage, array(
    'always_issue_new_refresh_token' => true,
    'refresh_token_lifetime'         => 2419200,
));

$ curl -u TestClient:TestSecret https://api.mysite.com/token -d 'grant_type=password&username=bshaffer&password=brent123'

{
    "access_token":"2YotnFZFEjr1zCsicMWpAA",
    "expires_in":3600,
    "token_type": "bearer",
    "scope":null,
    "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
}

$ curl -u TestClient:TestSecret https://api.mysite.com/token -d 'grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA'

{"access_token":"03807cb390319329bdf6c777d4dfae9c0d3b3c35","expires_in":3600,"token_type":"bearer","scope":null}

{"access_token":"03807cb390319329bdf6c777d4dfae9c0d3b3c35","expires_in":3600,"token_type":"bearer","scope":null,"refresh_token":"s6BhdRkqt303807bdf6c78"}

智威汤逊旗手

概观

所述JWT Bearer许可类型用于当客户端想要而不发送敏感信息，如客户端秘密来接收访问令牌。这也可以与受信任的客户端一起使用，以在没有用户授权的情况下访问用户资源。

阅读更多关于jwt载体

用例

• 与客户端证书授权类型相同的好处
• 允许在不传输证书的情况下进行安全呼叫
• 对于可信的客户端，允许访问用户资源而不授权

履行

创建一个实例OAuth2\GrantType\JwtBearer并将其添加到您的服务器：

// load public key from keystore
$public_key = file_get_contents('id_rsa.pub');

// assign the public key to a client and user
$clientKeys = array('TestClient' => array('subject' => 'User1', 'key' => $public_key));

// create a storage object
$storage = new OAuth2\Storage\Memory(array('jwt' => $clientKeys));

// specify your audience (typically, the URI of the oauth server)
$audience = 'https://api.mysite.com';

// create the grant type
$grantType = new OAuth2\GrantType\JwtBearer($storage, $audience);

// add the grant type to your OAuth server
$server->addGrantType($grantType);

示例请求

JWT请求需要使用公钥加密技术来签署JWT断言 。下面的代码片段提供了一个如何完成的例子。

/**
 * Generate a JWT
 *
 * @param $privateKey The private key to use to sign the token
 * @param $iss The issuer, usually the client_id
 * @param $sub The subject, usually a user_id
 * @param $aud The audience, usually the URI for the oauth server
 * @param $exp The expiration date. If the current time is greater than the exp, the JWT is invalid
 * @param $nbf The "not before" time. If the current time is less than the nbf, the JWT is invalid
 * @param $jti The "jwt token identifier", or nonce for this JWT
 *
 * @return string
 */
function generateJWT($privateKey, $iss, $sub, $aud, $exp = null, $nbf = null, $jti = null)
{
    if (!$exp) {
        $exp = time() + 1000;
    }

    $params = array(
        'iss' => $iss,
        'sub' => $sub,
        'aud' => $aud,
        'exp' => $exp,
        'iat' => time(),
    );

    if ($nbf) {
        $params['nbf'] = $nbf;
    }

    if ($jti) {
        $params['jti'] = $jti;
    }

    $jwtUtil = new OAuth2\Encryption\Jwt();

    return $jwtUtil->encode($params, $privateKey, 'RS256');
}

注意：本示例使用OAuth2\Encryption\Jwt此库中提供的类。这对于JWT身份验证不是必需的，但是方便。

然后可以调用该函数来为请求生成负载。编写一个脚本来生成jwt并请求一个令牌：

$private_key = file_get_contents('id_rsa');
$client_id   = 'TestClient';
$user_id     = 'User1';
$grant_type  = 'urn:ietf:params:oauth:grant-type:jwt-bearer';

$jwt = generateJWT($private_key, $client_id, $user_id, 'https://api.mysite.com');

passthru("curl https://api.mysite.com/token -d 'grant_type=$grant_type&assertion=$jwt'");

成功的令牌请求将返回JSON格式的标准访问令牌：

{"access_token":"03807cb390319329bdf6c777d4dfae9c0d3b3c35","expires_in":3600,"token_type":"bearer","scope":null}