FoF passport, the Laravel passport oauth extension

clarkwinkelmann

NardusGrobler this extension does not provide any auto-login ability. You would have to develop that yourself.

clarkwinkelmann

Version 0.6.0

Updated deprecated Flarum beta 16 code. The previous version was likely also compatible with Flarum beta 16 as well.

Set the required version to * in composer.json before updating Flarum. You can also use composer require fof/passport:* to make that change prior to the Flarum update.

serkantumbas

Hi,
When it returns from the authorization phase, it stays in this phase. I had to enter this information. Where should I add it?

So it stays in touch. Does not continue. https://domain.com/auth/passport?code=XXX

API connections are made possible on the site as follows.

clarkwinkelmann

serkantumbas which auth server is that? Are you sure their oauth API is compatible with Laravel Passport?

I'm not sure whether the parameter is named app_id in Passport. The endpoint to retrieve user details also must be /api/user, if it's different it won't work.

EDIT: I see there's a different discussion in https://discuss.flarum.org/d/27065-oauth-from-other-php-sites . Let's continue the discussion there. Please do not create duplicate discussions about the same things.

serkantumbas

clarkwinkelmann

Hello, sorry to write twice. It came to my mind afterwards to write on the extension page. I'm reviewing the app_id part. Thanks

clarkwinkelmann

Version 1.0.0

Adds compatibility with Flarum 1.0+

guomaimang

I have problems when configuring Office 365 Azure AD Oauth with Flarum. The login process in O365 went well, but when the URL was returned, the returned URL was domain.com/auth/passport?code=XXX&state=XXX&session_state=XXX#, and the web page displayed "There was an error loading the page, please check the console."

In addition, Office 365 Azure AD requires a scope to be filled in. I have multiple scopes, and I don’t know what list format to fill in in the background.

More at FriendsOfFlarum/passport22

luceos

guomaimang this extension provides a basic implementation for oauth and most preferably the standard oauth logic. Some providers use custom urls or scopes and require a custom oauth adapter for league oauth. There is one though: https://github.com/stevenmaguire/oauth2-microsoft now that needs a flarum extension to wrap that logic.

guomaimang

luceos
Well, I will try to make it applicable.

Z_c

hi luceos

I just try to Setup this extension to Authenticate with my keycloak server
but some how this error keep coming,

Z_c

GuzzleHttp \ Exception \ RequestException
cURL error 60: SSL certificate problem: unable to get local issuer certificate

clarkwinkelmann

Z_c Flarum will perform a request to your oauth server with PHP using the Guzzle HTTP request.

Make sure the oauth server certificate is valid and that your Flarum server has an up to date CA file to validate that certificate.

You can search for "<hosting platform> update php ca certificate" or similar to find help for your specific hosting.

Z_c

clarkwinkelmann

thx for your guidance .. i have manage CA file
but now i find this new erro

TypeError thrown with message "Argument 2 passed to Flarum\Forum\Auth\ResponseFactory::make() must be of the type string, null given, called in /var/www/html/flarum/vendor/fof/passport/src/Controllers/PassportController.php on line 94"

Stacktrace:
#48 TypeError in /var/www/html/flarum/vendor/flarum/core/src/Forum/Auth/ResponseFactory.php:36
#47 Flarum\Forum\Auth\ResponseFactory:make in /var/www/html/flarum/vendor/fof/passport/src/Controllers/PassportController.php:94
#46 FoF\Passport\Controllers\PassportController:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/RouteHandlerFactory.php:41
#45 Flarum\Http\RouteHandlerFactory:Flarum\Http{closure} in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ExecuteRoute.php:27
#44 Flarum\Http\Middleware\ExecuteRoute:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#43 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ContentTypeOptionsHeader.php:21
#42 Flarum\Http\Middleware\ContentTypeOptionsHeader:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#41 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ReferrerPolicyHeader.php:30
#40 Flarum\Http\Middleware\ReferrerPolicyHeader:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#39 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/FlarumPromotionHeader.php:30
#38 Flarum\Http\Middleware\FlarumPromotionHeader:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#37 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ShareErrorsFromSession.php:57
#36 Flarum\Http\Middleware\ShareErrorsFromSession:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#35 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/CheckCsrfToken.php:36
#34 Flarum\Http\Middleware\CheckCsrfToken:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#33 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ResolveRoute.php:67
#32 Flarum\Http\Middleware\ResolveRoute:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#31 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/SetLocale.php:51
#30 Flarum\Http\Middleware\SetLocale:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#29 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/AuthenticateWithSession.php:31
#28 Flarum\Http\Middleware\AuthenticateWithSession:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#27 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/RememberFromCookie.php:52
#26 Flarum\Http\Middleware\RememberFromCookie:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#25 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/StartSession.php:61
#24 Flarum\Http\Middleware\StartSession:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#23 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/CollectGarbage.php:46
#22 Flarum\Http\Middleware\CollectGarbage:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#21 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ParseJsonBody.php:28
#20 Flarum\Http\Middleware\ParseJsonBody:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#19 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/HandleErrors.php:57
#18 Flarum\Http\Middleware\HandleErrors:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#17 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/InjectActorReference.php:25
#16 Flarum\Http\Middleware\InjectActorReference:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#15 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php:76
#14 Laminas\Stratigility\MiddlewarePipe:process in /var/www/html/flarum/vendor/middlewares/request-handler/src/RequestHandler.php:84
#13 Middlewares\RequestHandler:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#12 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/middlewares/base-path-router/src/BasePathRouter.php:101
#11 Middlewares\BasePathRouter:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#10 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Middleware/OriginalMessages.php:36
#9 Laminas\Stratigility\Middleware\OriginalMessages:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#8 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/middlewares/base-path/src/BasePath.php:73
#7 Middlewares\BasePath:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#6 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ProcessIp.php:24
#5 Flarum\Http\Middleware\ProcessIp:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php:51
#4 Laminas\Stratigility\Next:handle in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php:76
#3 Laminas\Stratigility\MiddlewarePipe:process in /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php:65
#2 Laminas\Stratigility\MiddlewarePipe:handle in /var/www/html/flarum/vendor/laminas/laminas-httphandlerrunner/src/RequestHandlerRunner.php:96
#1 Laminas\HttpHandlerRunner\RequestHandlerRunner:run in /var/www/html/flarum/vendor/flarum/core/src/Http/Server.php:44
#0 Flarum\Http\Server:listen in /var/www/html/flarum/public/index.php:26

clarkwinkelmann

Z_c this could be because your oauth server doesn't return the data in the format Passport assumes by default. The response should be a JSON object with an email key at the root with a string value.

Z_c

clarkwinkelmann

this is what i get from keycloak

{
"realm": "domain",
"auth-server-url": "https://sso.domain.com:8443/auth/",
"ssl-required": "all",
"resource": "flarum",
"verify-token-audience": true,
"credentials": {
"secret": "XXXXX-XXXX-XXXX-XXXX-XXXXXXX"
},
"use-resource-role-mappings": true,
"confidential-port": 0
}

and i set OAuth scopes to request = openid profile email

Z_c

clarkwinkelmann hi clark

i have tried few things by modified my keycloak

use only email client scope
![https://prnt.sc/1qcufqm](https://)
add email mapper
![https://prnt.sc/1qcugic](https://)

but i still got same error

Z_c

i just try to connect via curl, the keyloack openid connect service work fine i think

#curl -L -X POST 'https://sso.domain.com:8443/auth/realms/domain/protocol/openid-connect/token' \

-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=flarum' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'client_secret=24324234-3424-3424-7896-7245623452775' \
--data-urlencode 'scope=openid' \
--data-urlencode 'username=first.name' \
--data-urlencode 'password=XxXxXxXx'
{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJtNWNiS3NKSktTRWFhSTBfRl81R2V3bUk4S0l6QW9sZk1qVVBwN09DdnlZIn0.eyJleHAiOjE2MjkzNTQyMzEsImlhdCI6MTYyOTM1MzkzMSwianRpIjoiOGU1ODJjMjMtMWYwNy00OWJmLThkNzktNzYxN2QyZmIyNjU2IiwiaXNzIjoiaHR0cHM6Ly9zc28uYWdyaWNvbi5jb206ODQ0My9hdXRoL3JlYWxtcy9hZ3JpY29uIiwiYXVkIjpbImFncmljb25hY2FkZW15IiwiYWNjb3VudCJdLCJzdWIiOiJkY2VlYTY2Yi05YzRmLTRjMjAtODFhNC03ZTBkZTJhZTgwMzAiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJmbGFydW0iLCJzZXNzaW9uX3N0YXRlIjoiZDE1ZGVlZjYtZGUyOS00NmMxLWE3ZjctNjhjNThiODM0MWRkIiwiYWNyIjoiMSIsInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIiwiZGVmYXVsdC1yb2xlcy1hZ3JpY29uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiZmxhcnVtIjp7InJvbGVzIjpbIlVzZXIgUnVhbmcgQWdyaWNvbiJdfSwiYWdyaWNvbmFjYWRlbXkiOnsicm9sZXMiOlsiQWNhZGVteS1Vc2VyIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBlbWFpbCBwcm9maWxlIiwic2lkIjoiZDE1ZGVlZjYtZGUyOS00NmMxLWE3ZjctNjhjNThiODM0MWRkIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJuYW1lIjoiemhpYS5jaGFuZHJhIiwicHJlZmVycmVkX3VzZXJuYW1lIjoiemhpYS5jaGFuZHJhIiwiZ2l2ZW5fbmFtZSI6InpoaWEuY2hhbmRyYSIsImVtYWlsIjoiemhpYS5jaGFuZHJhQGFncmljb24uY29tIn0.dawNFPrtUq2mwe7VbiaCuMPK2iC4qC53C9hHflb4FAN1nuW-e6hCwG8dfjzK5rEwu7VevQuzkBWF3DAMM0EHdWzvzupS93vWexVetMB5oHBdPqhfWJP1949AUw-NiumasHAgE2b0sF03RGKMwpPd3fJWQnsGdsUK1Q-oH7NPPZ2YosMZZz_TDrSCi0IRns_F79C6syfgXpsgZly8ta7XMNNTlw2pwy20hl0g5qX_6NifkVBVxZYRk65fAFfwCDNYlAvCVakFpWagcoH7UrC-X69nnJLUds5voKRpTqcfRNAFK7LiLHkh1Gv-7AvZoC1GOspdt5EBFJSJUjkrTz-BHA","expires_in":300,"refresh_expires_in":1800,"refresh_token":"eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI3MjhhNjkzZS0yZmZjLTQ4MDctYTUwMi0zZWRhOTVmODFmNjAifQ.eyJleHAiOjE2MjkzNTU3MzEsImlhdCI6MTYyOTM1MzkzMSwianRpIjoiODYyODdkY2UtYmZhYi00ZDYxLThjZTQtNzdhOTQ0NGNjZTc0IiwiaXNzIjoiaHR0cHM6Ly9zc28uYWdyaWNvbi5jb206ODQ0My9hdXRoL3JlYWxtcy9hZ3JpY29uIiwiYXVkIjoiaHR0cHM6Ly9zc28uYWdyaWNvbi5jb206ODQ0My9hdXRoL3JlYWxtcy9hZ3JpY29uIiwic3ViIjoiZGNlZWE2NmItOWM0Zi00YzIwLTgxYTQtN2UwZGUyYWU4MDMwIiwidHlwIjoiUmVmcmVzaCIsImF6cCI6ImZsYXJ1bSIsInNlc3Npb25fc3RhdGUiOiJkMTVkZWVmNi1kZTI5LTQ2YzEtYTdmNy02OGM1OGI4MzQxZGQiLCJzY29wZSI6Im9wZW5pZCBlbWFpbCBwcm9maWxlIiwic2lkIjoiZDE1ZGVlZjYtZGUyOS00NmMxLWE3ZjctNjhjNThiODM0MWRkIn0.XvIcDEFX8Vrlc0UQDG864qtaFiu6VNd-9PQ4VASFgEo","token_type":"Bearer","id_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJtNWNiS3NKSktTRWFhSTBfRl81R2V3bUk4S0l6QW9sZk1qVVBwN09DdnlZIn0.eyJleHAiOjE2MjkzNTQyMzEsImlhdCI6MTYyOTM1MzkzMSwiYXV0aF90aW1lIjowLCJqdGkiOiJhYTMyYTJjYS05YmIzLTRhZTUtYTM5MC1lMjU2ZTVlYjM1MGYiLCJpc3MiOiJodHRwczovL3Nzby5hZ3JpY29uLmNvbTo4NDQzL2F1dGgvcmVhbG1zL2Fncmljb24iLCJhdWQiOiJmbGFydW0iLCJzdWIiOiJkY2VlYTY2Yi05YzRmLTRjMjAtODFhNC03ZTBkZTJhZTgwMzAiLCJ0eXAiOiJJRCIsImF6cCI6ImZsYXJ1bSIsInNlc3Npb25fc3RhdGUiOiJkMTVkZWVmNi1kZTI5LTQ2YzEtYTdmNy02OGM1OGI4MzQxZGQiLCJhdF9oYXNoIjoidl9wS0JPMlFCR0doTUtPU3hqdy00dyIsImFjciI6IjEiLCJzaWQiOiJkMTVkZWVmNi1kZTI5LTQ2YzEtYTdmNy02OGM1OGI4MzQxZGQiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsIm5hbWUiOiJ6aGlhLmNoYW5kcmEiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ6aGlhLmNoYW5kcmEiLCJnaXZlbl9uYW1lIjoiemhpYS5jaGFuZHJhIiwiZW1haWwiOiJ6aGlhLmNoYW5kcmFAYWdyaWNvbi5jb20ifQ.PgCcNbbYT-Q0JAQEL63hgEFPMtzOJML4uyjFxockH0efBTrAPWirgOyM5nz_GF5PvjLVSBEVwSz_J9TXrCcbsPkql9QOsVNidOFbsJzCuDbvdtBB7HNpr576kK2p8fAxSABb82ALDnQqTegyd32eK4zyIZNqPTwkB9x9GHMl5j0W6eW_hESk2BitzDGmic7cbKmDnBU78TOqoNrUstTQLCyknqs6rk62D9K9k6pzBYJWkKv18h-X3FICl3bReSPiBgIviq4mGmS2-WT4Ms_s7z0CARtoZhS2GFdqC8v4zUZR6iIS1dgjLXUO9JfsQ2yaWAJih1QNQYX82qvz-NAwpQ","not-before-policy":1629344076,"session_state":"d15deef6-de29-46c1-a7f7-68c58b8341dd","scope":"openid email profile"}

luceos

Z_c my apologies for not responding sooner. As I'm not entirely sure OpenID is fully oauth2 compliant in terms of it's payload, I would start by dumping the payload the OpenID server sends over. The controller that throws the error would be the best bet.

A better extension to use is probably https://discuss.flarum.org/d/28245-flarum-openid-connect-client

Digitalam

Hi! I got a question:

When I log out from my Laravel app, it is not supposed to log the user from my Flarum app too right? If I want that to happen, I have to extend the extension myself?

clarkwinkelmann

Digitalam correct, you have to handle that separately.

This extension only handles the federated login, it doesn't handle any global login or logout.

Global logout is a bit tricky to do transparently. I have it implemented in the Wordpress login extension, it uses custom signed URLs to bypass CSRF and additional redirect parameters so the user can be redirected through all domains and end back on the same page on which they were before logout.

« Previous Page Next Page »