如何为PHP应用快速集成OpenIDConnect？使用ronvanderheijden/openid-connect和Composer轻松实现安全认证。

<code class="bash">composer require ronvanderheijden/openid-connect</code>

<pre class="brush:php;toolbar:false;">mkdir -m 700 -p tmp

openssl genrsa -out tmp/private.key 2048
openssl rsa -in tmp/private.key -pubout -out tmp/public.key

chmod 600 tmp/private.key
chmod 644 tmp/public.key

<pre class="brush:php;toolbar:false;">use OpenIDConnect\Entities\IdentityRepository;
use OpenIDConnect\Grant\AuthCodeGrant;
use OpenIDConnect\IdTokenResponse;
use OpenIDConnect\Claims\ClaimExtractor;
use Lcobucci\JWT\Configuration;
use Lcobucci\JWT\Signer\Key\InMemory;
use Lcobucci\JWT\Signer\Rsa\Sha256;
use League\OAuth2\Server\AuthorizationServer;
use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
use Nyholm\Psr7\Factory\ServerRequestFactory;
use OpenIDConnect\Services\CurrentRequestService;

// ... (你的其他仓库和密钥配置) ...
$privateKeyPath = 'tmp/private.key';
$encryptionKey = 'def00000e700b08088b90b9b3921588669e4695027581b0a85233e7920786520b22a075308696d07e9d7240f9599554a9d7240f9599554a9'; // 示例加密密钥

$currentRequestService = new CurrentRequestService();
$currentRequestService->setRequest(ServerRequestFactory::fromGlobals());

// 创建 OpenID Connect 响应类型
$responseType = new IdTokenResponse(
    new IdentityRepository(), // 你的 Identity 仓库
    new ClaimExtractor(),
    Configuration::forSymmetricSigner(
        new Sha256(),
        InMemory::file($privateKeyPath),
    ),
    $currentRequestService,
    $encryptionKey,
);

$server = new AuthorizationServer(
    $clientRepository,
    $accessTokenRepository,
    $scopeRepository,
    $privateKeyPath, // 用于 OAuth2 的私钥路径
    $encryptionKey,  // 用于 OAuth2 的加密密钥
    $responseType // 注入 OpenID Connect 响应类型
);

// 如果需要 Nonce 支持，记得使用 OpenIDConnect\Grant\AuthCodeGrant
$server->enableGrantType(new AuthCodeGrant($userRepository, $authCodeRepository, $this->app->make(IdentityRepository::class), new \DateInterval('PT10M')), new \DateInterval('PT1H'));

<pre class="brush:php;toolbar:false;">// config/app.php
'providers' => [
    // ... 其他服务提供者
    OpenIDConnect\Laravel\PassportServiceProvider::class,
],

<pre class="brush:php;toolbar:false;">// app/Entities/IdentityEntity.php
namespace App\Entities;

use App\Models\User; // 假设你的用户模型是 App\Models\User
use League\OAuth2\Server\Entities\Traits\EntityTrait;
use OpenIDConnect\Claims\Traits\WithClaims;
use OpenIDConnect\Interfaces\IdentityEntityInterface;

class IdentityEntity implements IdentityEntityInterface
{
    use EntityTrait;
    use WithClaims;

    protected User $user;

    public function setIdentifier($identifier): void
    {
        $this->identifier = $identifier;
        $this->user = User::findOrFail($identifier);
    }

    public function getClaims(): array
    {
        return [
            'email' => $this->user->email,
            'name' => $this->user->name, // 示例：添加用户姓名
            // ... 其他你希望包含在 id_token 中的声明
        ];
    }
}