This application is designed to demo the workflow between OAuth2.0 Clients and Servers.
If this is your first time here, try experimenting with the live demo to get a better feel for OAuth2.0 flows.
This library is running the OAuth2 Server PHP library.
Use Composer to install this application:
$ git clone git://github.com/bshaffer/oauth2-demo-php.git
$ cd oauth2-demo-php
$ curl -s http://getcomposer.org/installer | php
$ ./composer.phar install
Silex requires you to configure your web server to run it.
Be sure to run the command $ chmod -R 777 data/ in the project root so that the web server can create the sqlite file.
You can use php's built-in web server, however, you will need to spin up two instances and specify one of
them in data/parameters.json in order to prevent the server from locking up. The client will issue a request
to the server, and because PHP's built-in web server is single-threaded, this will result in deadlock.
$ cd oauth2-demo-php
$ cp data/parameters.json.dist data/parameters.json
$ sed -i '' 's?"grant"?"http://localhost:8081/lockdin/token"?g' data/parameters.json
$ sed -i '' 's?"access"?"http://localhost:8081/lockdin/resource"?g' data/parameters.json
Now all you have to do is spin up two separate web servers in the web directory
$ cd web
$ php -S localhost:8080 & php -S localhost:8081
Browse to http://localhost:8080 in your browser and you're all set!
This application simulates the interaction between an OAuth2 Client (Demo App) and OAuth2 Server (Lock'd In). To get started, access the Demo App homepage:
Clicking Authorize will send you to Lock'd In, which mimics a data provider (such as twitter, facebook, etc). Lock'd In assumes you are already signed in, and asks if you'd like to grant the Demo app access to your information:
Once you click Yes, I Authorize this Request, you will be redirected back to Demo App with an authorization code, which
the client then exchanges
for an Access Token. Demo App then makes another call to the Lock'd In APIs and uses the Access Token to retrieve
the data on your behalf.
If all is successful, your data from Lock'd In will be displayed on the final page:
The OAuth2 Client can be used to test ANY OAuth2.0 server, and can be configured to do so using the the configuration file defined below.
The OAuth2 Server is created (see the setup method) and then used in the Controller Classes, which implement
the following endpoints:
- /authorize - endpoint which grants the Demo App an
authorization code - /token - endpoint which grants the Demo App an
access_tokenwhen supplied with the authorization code above - /resource - endpoint which grants the Demo App access to your protected resources (in this case, your friends) when supplied the access token above
These are the three main functions of the OAuth2 server (authorize the user, grant the user tokens, and validate api calls). When you write your OAuth2-compatible servers, your interface will be similar.
Note: the above urls are prefixed with
/serverto namespace the application.
You can test this application against your own OAuth application with ease. Just copy over the parameters.json.dist file to parameters.json:
$ cd /path/to/oauth2-demo-php
$ cp data/parameters.json.dist data/parameters.json
Open the parameters.json file, and notice the default configuration:
{
"client_id": "demoapp",
"client_secret": "demopass",
"token_route": "grant",
"authorize_route": "authorize",
"resource_route": "access",
"resource_method": "GET",
"resource_params": {},
"curl_options": {}
}
This is the configuration for the default Lock'd In OAuth2 server. To test against your own, change those parameters to fit the api server
you want to test against:
{
"client_id": "OAuth Demo Application",
"client_secret": "a3b4b74330724a927bec",
"token_route": "https://api.myapp.com/token",
"authorize_route": "https://myapp.com/authorize",
"resource_route": "https://api.myapp.com/profile",
"resource_method": "POST",
"resource_params": { "debug": true },
"curl_options": { "http_port": 443, "verifyssl": false }
}
The above example uses a new client to authenticate against a fictional oauth server at myapp.com.
This is very useful when testing your application in production
Note: The curl options are set to ignore an SSL certificate, and the
resource_paramsdefine a fictional debug parameter. These are not required for your APIs, but is meant as an example what can be done with the configuration
###Test in multiple environments
In addition, you can create multiple environments using the parameters.json file, and switch between them:
{
"LockdIn": {
"client_id": "demoapp",
"client_secret": "demopass",
"token_route": "grant",
"authorize_route": "authorize",
"resource_route": "access",
"resource_method": "GET",
"resource_params": {},
"curl_options": {}
},
"My App": {
"client_id": "OAuth Demo Application",
"client_secret": "a3b4b74330724a927bec",
"token_route": "https://api.myapp.com/token",
"authorize_route": "https://myapp.com/authorize",
"resource_route": "https://api.myapp.com/profile",
"resource_method": "POST",
"resource_params": { "debug": true },
"curl_options": { "http_port": 443, "verifyssl": false }
}
}
This will provide a dropdown at the top which will allow you to switch environments and test multiple OAuth servers
Please contact Brent Shaffer (bshafs <at> gmail <dot> com) for more information
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent