[Security] Add OidcUserInfoTokenHandler and OidcUser #48272

vincentchalamon · 2022-11-21T17:34:32Z

Q	A
Branch?	6.3
Bug fix?	no
New feature?	yes
Deprecations?	no
Tickets	N/A
License	MIT
Doc PR	symfony/symfony-docs#17463

Hi,

This PR aims to complete the previous one from @Spomky with an AccessTokenHandler ready-to-use with an OIDC server (Keycloak, Auth0).

TODO

Usage

# usage with a custom client
security:
    firewalls:
        main:
            pattern: ^/
            access_token:
                token_handler:
                    oidc_user_info:
                        client: oidc.client

# usage with generic HttpClient
security:
    firewalls:
        main:
            pattern: ^/
            access_token:
                token_handler:
                    oidc_user_info:
                        claim: email
                        client:
                            base_uri: https://www.example.com/realms/demo/protocol/openid-connect/userinfo

# usage with token decode (no call to OIDC server)
security:
    firewalls:
        main:
            pattern: ^/
            access_token:
                token_handler:
                    oidc:
                        signature:
                            # Algorithm used to sign the JWS
                            algorithm: 'HS256'
                            # A JSON-encoded JWK
                            key: '{"kty":"...","k":"..."}'

# usage with a custom UserProvider
class CustomUserProvider implements UserProviderInterface
{
    public function loadUserByIdentifier(string $identifier, array $claims = []): UserInterface
    {
        // do some magic
    }
}

wouterj · 2022-11-21T18:40:43Z

As the previous PR was merged in 6.2, I hope this one can be released with it. Otherwise, 6.3 will be good too 😃

Feature freeze started 1.5 months ago, so this will be part of 6.3 :)

vincentchalamon · 2022-11-21T18:44:00Z

Hi @wouterj, is there any 6.3, master or main branch for it?

wouterj · 2022-11-21T18:53:56Z

No, for now the focus is on stabilizing Symfony 6.2 before the release. A 6.3 branch will be created once we're in RC phase for 6.2.

Spomky

👏 Bravo: Excellent idea!
🥜 Nitpick: It is a good start. I just have a couple of remarks.

src/Symfony/Component/Security/Http/AccessToken/OidcAccessTokenHandler.php

src/Symfony/Component/Security/Core/Exception/InvalidOidcUserException.php

src/Symfony/Component/Security/Http/AccessToken/OidcAccessTokenHandler.php

chalasr · 2022-11-23T11:53:19Z

#48285 should make the overall design fit best here and avoid the need for an event.
Regarding TODO Find a way to configure and inject the oidcClient in the handler I have something in mind that I'll push asap.

fabpot · 2023-04-14T07:38:55Z

Thank you @vincentchalamon.

…r_info` (vincentchalamon) This PR was squashed before being merged into the 6.3 branch. Discussion ---------- [Security] Document `access_token.token_handler.oidc_user_info` Refs symfony/symfony#48272 - [x] document `oidc_user_info` token handler - [x] document `oidc` token handler Commits ------- 5b53159 [Security] Document `access_token.token_handler.oidc_user_info`

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

@vincentchalamon

In addition to the excellent work of @vincentchalamon symfony#48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`.

…omky) This PR was merged into the 7.3 branch. Discussion ---------- [Security] OAuth2 Introspection Endpoint (RFC7662) | Q | A | ------------- | --- | Branch? | 7.3 | Bug fix? | no | New feature? | yes | Deprecations? | no | Tickets | none | License | MIT | Doc PR | symfony/symfony-docs#[**TODO**] In addition to the excellent work of `@vincentchalamon` #48272, this PR allows getting the data from the OAuth2 Introspection Endpoint. This endpoint is defined in the [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662). It returns the following information that is used to retrieve the user: * If the access token is active * A set of claims that are similar to the OIDC one, including the `sub` or the `username`. Example of configuration: ```yaml framework: http_client: scoped_clients: oauth2.client: base_uri: 'https://authorization-server.example.com/introspection' scope: 'https://authorization-server\.example\.com' headers: Authorization: 'Basic Y2xpZW50OnBhc3N3b3Jk' # Introspection Endpoint usually requires client authentication security: firewalls: main: pattern: ^/ access_token: token_handler: oauth2: ~ token_extractors: 'header' realm: 'My API' ``` Commits ------- e68726f [Security] OAuth2 Introspection Endpoint (RFC7662)

vincentchalamon requested review from wouterj and chalasr as code owners November 21, 2022 17:34

carsonbot added Status: Needs Review Feature Security labels Nov 21, 2022

carsonbot added this to the 6.2 milestone Nov 21, 2022

wouterj modified the milestones: 6.2, 6.3 Nov 21, 2022

Spomky reviewed Nov 21, 2022

View reviewed changes

src/Symfony/Component/Security/Http/AccessToken/OidcAccessTokenHandler.php Outdated Show resolved Hide resolved

src/Symfony/Component/Security/Http/AccessToken/OidcAccessTokenHandler.php Outdated Show resolved Hide resolved

dunglas reviewed Nov 22, 2022

View reviewed changes

src/Symfony/Component/Security/Http/AccessToken/OidcAccessTokenHandler.php Outdated Show resolved Hide resolved

src/Symfony/Component/Security/Http/AccessToken/OidcAccessTokenHandler.php Outdated Show resolved Hide resolved

dunglas reviewed Nov 22, 2022

View reviewed changes

src/Symfony/Component/Security/Http/AccessToken/OidcAccessTokenHandler.php Outdated Show resolved Hide resolved

chalasr requested changes Nov 22, 2022

View reviewed changes

carsonbot added Status: Needs Work and removed Status: Needs Review labels Nov 22, 2022

vincentchalamon mentioned this pull request Nov 24, 2022

Add Keycloak authentication api-platform/demo#265

Merged

4 tasks

vincentchalamon changed the title ~~[Security] Add OidcAccessTokenHandler~~ [Security] Add OidcUserInfoTokenHandler Nov 24, 2022

vincentchalamon force-pushed the feat/oidc-access-token-handler branch 2 times, most recently from e7644e7 to e1caab1 Compare November 24, 2022 17:36

vincentchalamon requested review from chalasr and removed request for wouterj November 24, 2022 17:36

carsonbot added Status: Needs Review and removed Status: Needs Work labels Nov 24, 2022

vincentchalamon requested review from dunglas and Spomky and removed request for chalasr and dunglas November 24, 2022 17:36

carsonbot added the Status: Needs Work label Apr 14, 2023

vincentchalamon requested a review from fabpot April 14, 2023 07:34

carsonbot added Status: Needs Review and removed Status: Needs Work labels Apr 14, 2023

[Security] Add OidcUserInfoTokenHandler and OidcUser

99a35f0

fabpot force-pushed the feat/oidc-access-token-handler branch from d34f877 to 99a35f0 Compare April 14, 2023 07:39

fabpot merged commit 1c79c79 into symfony:6.3 Apr 14, 2023

vincentchalamon deleted the feat/oidc-access-token-handler branch April 14, 2023 07:40

Spomky mentioned this pull request Apr 15, 2023

[Security] OAuth2 Introspection Endpoint (RFC7662) #50027

Merged

cesurapp mentioned this pull request May 31, 2023

UserLoader Not Called #50511

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security] Add OidcUserInfoTokenHandler and OidcUser #48272

[Security] Add OidcUserInfoTokenHandler and OidcUser #48272

vincentchalamon commented Nov 21, 2022 •

edited

Loading

wouterj commented Nov 21, 2022

vincentchalamon commented Nov 21, 2022

wouterj commented Nov 21, 2022 •

edited

Loading

Spomky left a comment

chalasr commented Nov 23, 2022

fabpot commented Apr 14, 2023

[Security] Add OidcUserInfoTokenHandler and OidcUser #48272

[Security] Add OidcUserInfoTokenHandler and OidcUser #48272

Conversation

vincentchalamon commented Nov 21, 2022 • edited Loading

TODO

Usage

wouterj commented Nov 21, 2022

vincentchalamon commented Nov 21, 2022

wouterj commented Nov 21, 2022 • edited Loading

Spomky left a comment

Choose a reason for hiding this comment

chalasr commented Nov 23, 2022

fabpot commented Apr 14, 2023

vincentchalamon commented Nov 21, 2022 •

edited

Loading

wouterj commented Nov 21, 2022 •

edited

Loading