config = $config; $this->backchannelLogout = $backchannelLogout; } /** * @return array{ * clientId: non-empty-string, * endpoint: non-empty-string, * redirectUri: non-empty-string, * scopes: non-empty-array, * claims: ?string, * prompt: 'login'|'consent'|'select_account', * maxAge: ?int, * } * @throws Forbidden * @throws Error */ public function getAuthorizationData(): array { if ($this->config->get('authenticationMethod') !== OidcLogin::NAME) { throw new ForbiddenSilent(); } /** @var ?string $clientId */ $clientId = $this->config->get('oidcClientId'); /** @var ?string $endpoint */ $endpoint = $this->config->get('oidcAuthorizationEndpoint'); /** @var string[] $scopes */ $scopes = $this->config->get('oidcScopes') ?? []; /** @var ?string $groupClaim */ $groupClaim = $this->config->get('oidcGroupClaim'); if (!$clientId) { throw new Error("No client ID."); } if (!$endpoint) { throw new Error("No authorization endpoint."); } $redirectUri = rtrim($this->config->get('siteUrl') ?? '', '/') . '/oauth-callback.php'; array_unshift($scopes, 'openid'); $claims = null; if ($groupClaim) { $claims = Json::encode([ 'id_token' => [ $groupClaim => ['essential' => true], ], ]); } /** @var 'login'|'consent'|'select_account' $prompt */ $prompt = $this->config->get('oidcAuthorizationPrompt') ?? 'consent'; /** @var ?int $maxAge */ $maxAge = $this->config->get('oidcAuthorizationMaxAge'); return [ 'clientId' => $clientId, 'endpoint' => $endpoint, 'redirectUri' => $redirectUri, 'scopes' => $scopes, 'claims' => $claims, 'prompt' => $prompt, 'maxAge' => $maxAge, ]; } /** * @throws ForbiddenSilent */ public function backchannelLogout(string $rawToken): void { if ($this->config->get('authenticationMethod') !== OidcLogin::NAME) { throw new ForbiddenSilent(); } try { $this->backchannelLogout->logout($rawToken); } catch (Invalid $e) { throw new ForbiddenSilent("OIDC logout: Invalid JWT. " . $e->getMessage()); } } }