PHP怎样处理OAuth2.0断言 OAuth2.0断言处理技巧分享

composer require firebase/php-jwt

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

try {
    $decoded = JWT::decode($assertion, new Key($publicKey, 'RS256'));
    // 签名验证成功，可以安全地使用 $decoded 中的信息
    print_r($decoded);
} catch (\Exception $e) {
    // 签名验证失败
    echo '签名验证失败: ' . $e->getMessage();
}

$tokenUrl = 'https://example.com/oauth2/token'; // 授权服务器的令牌端点
$clientId = 'your_client_id';
$clientSecret = 'your_client_secret'; // 如果需要的话

$params = [
    'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',
    'assertion' => $assertion,
    'client_id' => $clientId,
    'client_secret' => $clientSecret, // 某些授权服务器需要
];

$postData = http_build_query($params);

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, $tokenUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); // 验证SSL证书
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);   // 验证SSL主机名

$response = curl_exec($ch);

if (curl_errno($ch)) {
    echo 'cURL 错误: ' . curl_error($ch);
}

curl_close($ch);

$responseData = json_decode($response, true);

if (isset($responseData['access_token'])) {
    // 成功获取访问令牌
    $accessToken = $responseData['access_token'];
    echo '访问令牌: ' . $accessToken;
} else {
    // 获取令牌失败
    echo '获取令牌失败: ' . $response;
}

// ... (前面的代码)

if (isset($responseData['error'])) {
    // 授权服务器返回错误
    $errorCode = $responseData['error'];
    $errorDescription = isset($responseData['error_description']) ? $responseData['error_description'] : '未知错误';
    echo "OAuth 2.0 错误: $errorCode - $errorDescription";

    // 根据错误代码采取不同的措施，例如：
    if ($errorCode === 'invalid_grant') {
        // 断言无效，可能需要重新生成断言
    } elseif ($errorCode === 'invalid_client') {
        // 客户端ID或密钥无效，检查配置
    }
}

use Ramsey\Uuid\Uuid;

$now = time();
$assertionData = [
    'iss' => 'your_issuer',
    'sub' => 'your_subject',
    'aud' => 'https://example.com/oauth2/token',
    'exp' => $now + 3600, // 1小时后过期
    'jti' => Uuid::uuid4()->toString(), // 生成唯一ID
    // ... 其他声明
];

// 使用JWT库生成断言
$assertion = JWT::encode($assertionData, $privateKey, 'RS256');

0 * * * * /usr/bin/php /path/to/your/script.php

use League\OAuth2\Client\Provider\GenericProvider;

$provider = new GenericProvider([
    'clientId'                => 'your_client_id',
    'clientSecret'            => 'your_client_secret',
    'urlAccessToken'          => 'https://example.com/oauth2/token',
    'urlAuthorize'            => 'https://example.com/oauth2/authorize',
    'urlResourceOwnerDetails' => 'https://example.com/oauth2/resource',
]);

$assertion = 'your_assertion';

try {
    $accessToken = $provider->getAccessToken('jwt_bearer', [
        'assertion' => $assertion,
    ]);

    echo '访问令牌: ' . $accessToken->getToken();
} catch (\League\OAuth2\Client\Provider\Exception\IdentityProviderException $e) {
    echo '获取令牌失败: ' . $e->getMessage();
}