ElyBy-Mirror/oauth2-server
1
0
Fork 0
mirror of https://github.com/elyby/oauth2-server.git synced 2024-12-29 00:10:43 +05:30
Code Issues Packages Projects Releases Wiki Activity

Added refresh token grant

Browse Source
This commit is contained in:
Alex Bilbie 2016-03-24 14:56:24 +00:00
parent ff0d7ee5ff
commit ebd8f70509
1 changed files with 69 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

83
auth-server-refresh-token.md
View File

@ -1,26 +1,81 @@
--- ---
layout: default layout: default
title: Authorization server with refresh token grant title: Refresh token grant
permalink: /authorization-server/refresh-token-grant/ permalink: /authorization-server/refresh-token-grant/
--- ---
# Authorization server with refresh token grant # Refresh token grant
Access tokens eventually expire; however some grants respond with a refresh token which enables the client to refresh the access token.
## Flow
The client sends a POST request with following body parameters to the authorization server:
* `grant_type` with the value `refresh_token`
* `client_id` with the the client's ID
* `client_secret` with the client's secret
* `scope` with a space-delimited list of requested scope permissions. This is optional; if not sent the original scopes will be used, otherwise you can request a reduced set of scopes.
The authorization server will respond with a JSON object containing the following properties:
* `token_type` with the value `Bearer`
* `expires_in` with an integer representing the TTL of the access token
* `access_token` a new JWT signed with the authorization server's private key
* `refresh_token` an encrypted payload that can be used to refresh the access token when it expires
## Setup ## Setup
Wherever you intialise your objects, initialize a new instance of the authorization server and bind the storage interfaces and authorization code grant: Wherever you initialize your objects, initialize a new instance of the authorization server and bind the storage interfaces and authorization code grant:
~~~ php {% highlight php %}
$server = new \League\OAuth2\Server\AuthorizationServer; // Init our repositories
$clientRepository = new ClientRepository();
$accessTokenRepository = new AccessTokenRepository();
$scopeRepository = new ScopeRepository();
$refreshTokenRepository = new RefreshTokenRepository();
$server->setSessionStorage(new Storage\SessionStorage); // Path to public and private keys
$server->setAccessTokenStorage(new Storage\AccessTokenStorage); $privateKeyPath = 'file://path/to/private.key';
$server->setClientStorage(new Storage\ClientStorage); $publicKeyPath = 'file://path/to/public.key';
$server->setScopeStorage(new Storage\ScopeStorage);
$server->setRefreshTokenStorage(new Storage\RefreshTokenStorage);
$refreshTokenGrant = new \League\OAuth2\Server\Grant\RefreshTokenGrant(); // Setup the authorization server
$server->addGrantType($refreshTokenGrant); $server = new \League\OAuth2\Server\Server(
~~~ $clientRepository,
$accessTokenRepository,
$scopeRepository,
$privateKeyPath,
$publicKeyPath
);
When the refresh token grant is enabled, a refresh token will automatically be created with access tokens issued requested using the [authorization code](/authorization-server/auth-code-grant/) or [resource owner password credentials](/authorization-server/resource-owner-password-credentials-grant/) grants. // Enable the refresh token grant on the server with a token TTL of 1 hour
$server->enableGrantType(
new \League\OAuth2\Server\Grant\RefreshTokenGrant($refreshTokenRepository),
new \DateInterval('PT1H')
);
{% endhighlight %}
## Implementation
The client will request an access token so create an `/access_token` endpoint.
{% highlight php %}
$app->post('/access_token', function (ServerRequestInterface $request, ResponseInterface $response) use ($app) {
/* @var \League\OAuth2\Server\Server $server */
$server = $app->getContainer()->get(Server::class);
// Try to respond to the request
try {
return $server->respondToRequest($request, $response);
} catch (\League\OAuth2\Server\Exception\OAuthServerException $exception) {
return $exception->generateHttpResponse($response);
} catch (\Exception $exception) {
$body = new Stream('php://temp', 'r+');
$body->write($exception->getMessage());
return $response->withStatus(500)->withBody($body);
}
});
{% endhighlight %}