Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

[Security] Add OidcUserInfoTokenHandler and OidcUser#48272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged

Conversation

vincentchalamon
Copy link
Contributor

@vincentchalamonvincentchalamon commentedNov 21, 2022•
edited
Loading

QA
Branch?6.3
Bug fix?no
New feature?yes
Deprecations?no
TicketsN/A
LicenseMIT
Doc PRsymfony/symfony-docs#17463

Hi,

This PR aims to completethe previous one from@Spomky with an AccessTokenHandler ready-to-use with an OIDC server (Keycloak, Auth0).

TODO

Usage

# usage with a custom clientsecurity:firewalls:main:pattern:^/access_token:token_handler:oidc_user_info:client:oidc.client
# usage with generic HttpClientsecurity:firewalls:main:pattern:^/access_token:token_handler:oidc_user_info:claim:emailclient:base_uri:https://www.example.com/realms/demo/protocol/openid-connect/userinfo
# usage with token decode (no call to OIDC server)security:firewalls:main:pattern:^/access_token:token_handler:oidc:signature:# Algorithm used to sign the JWSalgorithm:'HS256'# A JSON-encoded JWKkey:'{"kty":"...","k":"..."}'
# usage with a custom UserProviderclass CustomUserProviderimplements UserProviderInterface{publicfunctionloadUserByIdentifier(string$identifier,array$claims = []):UserInterface    {// do some magic    }}

welcoMattic, dunglas, Spomky, graste, chalasr, ping-localhost, Tayfun74, LeJeanbono, walva, alexander-schranz, and 8 more reacted with thumbs up emojiping-localhost, Tayfun74, Neirda24, and RadnoK reacted with rocket emoji
@wouterj
Copy link
Member

As the previous PR was merged in 6.2, I hope this one can be released with it. Otherwise, 6.3 will be good too 😃

Feature freeze started 1.5 months ago, so this will be part of 6.3 :)

welcoMattic and lyrixx reacted with thumbs up emoji

@wouterjwouterj modified the milestones:6.2,6.3Nov 21, 2022
@vincentchalamon
Copy link
ContributorAuthor

Hi@wouterj, is there any 6.3, master or main branch for it?

@wouterj
Copy link
Member

wouterj commentedNov 21, 2022•
edited
Loading

No, for now the focus is on stabilizing Symfony 6.2 before the release. A 6.3 branch will be created once we're in RC phase for 6.2.

vincentchalamon and chalasr reacted with thumbs up emoji

Copy link
Contributor

@SpomkySpomky left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

👏 Bravo: Excellent idea!
🥜 Nitpick: It is a good start. I just have a couple of remarks.

@chalasr
Copy link
Member

#48285 should make the overall design fit best here and avoid the need for an event.
RegardingTODO Find a way to configure and inject the oidcClient in the handler I have something in mind that I'll push asap.

Spomky and vincentchalamon reacted with thumbs up emoji

@vincentchalamonvincentchalamon changed the title[Security] Add OidcAccessTokenHandler[Security] Add OidcUserInfoTokenHandlerNov 24, 2022
@vincentchalamonvincentchalamonforce-pushed thefeat/oidc-access-token-handler branch 2 times, most recently frome7644e7 toe1caab1CompareNovember 24, 2022 17:36
@vincentchalamonvincentchalamon requested review fromchalasr and removed request forwouterjNovember 24, 2022 17:36
@vincentchalamonvincentchalamon requested review fromdunglas andSpomky and removed request forchalasr anddunglasNovember 24, 2022 17:36
@fabpot
Copy link
Member

Thank you@vincentchalamon.

COil and Spomky reacted with thumbs up emojivincentchalamon, GregoireHebert, nickbg321, welcoMattic, Spomky, chalasr, and wouterj reacted with hooray emojiwelcoMattic reacted with rocket emoji

@fabpotfabpotforce-pushed thefeat/oidc-access-token-handler branch fromd34f877 to99a35f0CompareApril 14, 2023 07:39
@fabpotfabpot merged commit1c79c79 intosymfony:6.3Apr 14, 2023
@vincentchalamonvincentchalamon deleted the feat/oidc-access-token-handler branchApril 14, 2023 07:40
javiereguiluz added a commit to symfony/symfony-docs that referenced this pull requestMay 10, 2023
…r_info` (vincentchalamon)This PR was squashed before being merged into the 6.3 branch.Discussion----------[Security] Document `access_token.token_handler.oidc_user_info`Refssymfony/symfony#48272- [x] document `oidc_user_info` token handler- [x] document `oidc` token handlerCommits-------5b53159 [Security] Document `access_token.token_handler.oidc_user_info`
@cesurappcesurapp mentioned this pull requestMay 31, 2023
Spomky added a commit to Spomky/symfony that referenced this pull requestJul 13, 2024
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestJul 14, 2024
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestDec 25, 2024
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestDec 25, 2024
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestDec 25, 2024
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestDec 25, 2024
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestDec 25, 2024
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestDec 25, 2024
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestDec 25, 2024
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestDec 26, 2024
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestJan 5, 2025
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestJan 5, 2025
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestJan 5, 2025
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestJan 18, 2025
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestFeb 7, 2025
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
Spomky added a commit to Spomky/symfony that referenced this pull requestFeb 13, 2025
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
fabpot pushed a commit to Spomky/symfony that referenced this pull requestFeb 26, 2025
In addition to the excellent work of@vincentchalamonsymfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.
fabpot added a commit that referenced this pull requestFeb 26, 2025
…omky)This PR was merged into the 7.3 branch.Discussion----------[Security] OAuth2 Introspection Endpoint (RFC7662)| Q             | A| ------------- | ---| Branch?       | 7.3| Bug fix?      | no| New feature?  | yes| Deprecations? | no| Tickets       | none| License       | MIT| Doc PR        | symfony/symfony-docs#[**TODO**]In addition to the excellent work of `@vincentchalamon`#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user:* If the access token is active* A set of claims that are similar to the OIDC one, including the `sub` or the `username`.Example of configuration:```yamlframework:    http_client:        scoped_clients:            oauth2.client:                base_uri: 'https://authorization-server.example.com/introspection'                scope: 'https://authorization-server\.example\.com'                headers:                    Authorization: 'Basic Y2xpZW50OnBhc3N3b3Jk' # Introspection Endpoint usually requires client authenticationsecurity:    firewalls:        main:            pattern: ^/            access_token:                token_handler:                    oauth2: ~                token_extractors: 'header'                realm: 'My API'```Commits-------e68726f [Security] OAuth2 Introspection Endpoint (RFC7662)
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@dunglasdunglasdunglas left review comments

@wouterjwouterjwouterj requested changes

@welcoMatticwelcoMatticwelcoMattic left review comments

@SpomkySpomkySpomky left review comments

@JeroenyJeroenyJeroeny left review comments

@chalasrchalasrchalasr approved these changes

@fabpotfabpotAwaiting requested review from fabpot

Assignees
No one assigned
Projects
None yet
Milestone
6.3
Development

Successfully merging this pull request may close these issues.

9 participants
@vincentchalamon@wouterj@chalasr@Spomky@fabpot@dunglas@welcoMattic@Jeroeny@carsonbot
[8]ページ先頭
©2009-2025 Movatter.jp