1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace rhertogh\Yii2Oauth2Server\controllers\console\debug; |
4
|
|
|
|
5
|
|
|
use League\OAuth2\Server\Grant\GrantTypeInterface; |
6
|
|
|
use rhertogh\Yii2Oauth2Server\controllers\console\Oauth2DebugController; |
7
|
|
|
use rhertogh\Yii2Oauth2Server\helpers\DateIntervalHelper; |
8
|
|
|
use rhertogh\Yii2Oauth2Server\interfaces\controllers\console\debug\Oauth2DebugConfigActionInterface; |
9
|
|
|
use rhertogh\Yii2Oauth2Server\Oauth2Module; |
10
|
|
|
use yii\base\Action; |
11
|
|
|
use yii\console\ExitCode; |
12
|
|
|
use yii\console\widgets\Table; |
13
|
|
|
use yii\helpers\VarDumper; |
14
|
|
|
use yii\log\Logger; |
15
|
|
|
|
16
|
|
|
/** |
17
|
|
|
* @property Oauth2DebugController $controller |
18
|
|
|
*/ |
19
|
|
|
class Oauth2DebugConfigAction extends Action implements Oauth2DebugConfigActionInterface |
20
|
|
|
{ |
21
|
1 |
|
public function run() |
22
|
|
|
{ |
23
|
1 |
|
$module = $this->controller->module; |
24
|
|
|
|
25
|
1 |
|
$configuration = $this->getConfiguration($module); |
26
|
|
|
|
27
|
1 |
|
$this->controller->stdout('Configuration:' . PHP_EOL); |
28
|
1 |
|
$this->controller->stdout(Table::widget([ |
29
|
1 |
|
'headers' => ['Setting', 'Value'], |
30
|
1 |
|
'rows' => array_map(fn($setting) => [$setting, $configuration[$setting]], array_keys($configuration)), |
31
|
1 |
|
])); |
32
|
|
|
|
33
|
1 |
|
$endpoints = $this->getEndpoints($module); |
34
|
|
|
|
35
|
1 |
|
$this->controller->stdout(PHP_EOL); |
36
|
1 |
|
$this->controller->stdout('Endpoints:' . PHP_EOL); |
37
|
1 |
|
$this->controller->stdout(Table::widget([ |
38
|
1 |
|
'headers' => ['Endpoint', 'URL', 'Setting(s)'], |
39
|
1 |
|
'rows' => $endpoints, |
40
|
1 |
|
])); |
41
|
|
|
|
42
|
1 |
|
return ExitCode::OK; |
43
|
|
|
} |
44
|
|
|
|
45
|
|
|
/** |
46
|
|
|
* @param Oauth2Module $module |
47
|
|
|
* @return array |
48
|
|
|
*/ |
49
|
3 |
|
protected function getConfiguration($module) |
50
|
|
|
{ |
51
|
3 |
|
$serverRoles = []; |
52
|
3 |
|
if ($module->serverRole & Oauth2Module::SERVER_ROLE_AUTHORIZATION_SERVER) { |
53
|
2 |
|
$serverRoles[] = 'Authorization Server'; |
54
|
2 |
|
$grantTypes = array_values(array_map( |
55
|
2 |
|
fn(GrantTypeInterface $grant) => $grant->getIdentifier(), |
56
|
2 |
|
$module->getAuthorizationServer()->getEnabledGrantTypes() |
57
|
2 |
|
)); |
58
|
2 |
|
$defaultAccessTokenTTL = DateIntervalHelper::toString($module->getDefaultAccessTokenTTL()) ?? '[NOT SET]'; |
59
|
|
|
} else { |
60
|
1 |
|
$grantTypes = '-'; |
61
|
1 |
|
$defaultAccessTokenTTL = '-'; |
62
|
|
|
} |
63
|
|
|
|
64
|
3 |
|
if ($module->serverRole & Oauth2Module::SERVER_ROLE_RESOURCE_SERVER) { |
65
|
3 |
|
$serverRoles[] = 'Resource Server'; |
66
|
|
|
} |
67
|
|
|
|
68
|
3 |
|
$privateKey = $module->privateKey ? '[SET]' : '[NOT SET]'; |
69
|
3 |
|
$privateKeyPassphrase = $module->privateKeyPassphrase ? '[SET]' : '[NOT SET]'; |
70
|
3 |
|
$publicKey = $module->publicKey ? '[SET]' : '[NOT SET]'; |
71
|
3 |
|
$codesEncryptionKey = $module->codesEncryptionKey ? '[SET]' : '[NOT SET]'; |
72
|
3 |
|
$storageEncryptionKeys = $module->storageEncryptionKeys ? '[SET]' : '[NOT SET]'; |
73
|
|
|
|
74
|
3 |
|
$clientRedirectUrisEnvVarConfig = $module->clientRedirectUrisEnvVarConfig |
75
|
|
|
? VarDumper::export($module->clientRedirectUrisEnvVarConfig) |
76
|
3 |
|
: ''; |
77
|
|
|
|
78
|
3 |
|
$httpClientErrorsLogLevel = $module->getElaboratedHttpClientErrorsLogLevel(); |
79
|
|
|
|
80
|
3 |
|
return [ |
81
|
3 |
|
'serverRole' => $module->serverRole . ' (' . implode(', ', $serverRoles) . ')', |
82
|
|
|
|
83
|
3 |
|
'privateKey' => $privateKey, |
84
|
3 |
|
'privateKeyPassphrase' => $privateKeyPassphrase, |
85
|
3 |
|
'publicKey' => $publicKey, |
86
|
3 |
|
'codesEncryptionKey' => $codesEncryptionKey, |
87
|
3 |
|
'storageEncryptionKeys' => $storageEncryptionKeys, |
88
|
3 |
|
'defaultStorageEncryptionKey' => $module->defaultStorageEncryptionKey, |
89
|
|
|
|
90
|
3 |
|
'nonTlsAllowedRanges' => $module->nonTlsAllowedRanges, |
91
|
|
|
|
92
|
3 |
|
'clientRedirectUrisEnvVarConfig' => $clientRedirectUrisEnvVarConfig, |
93
|
|
|
|
94
|
3 |
|
'identityClass' => $module->identityClass, |
95
|
|
|
|
96
|
3 |
|
'enableTokenRevocation' => $module->enableTokenRevocation ? 'true' : 'false', |
97
|
|
|
|
98
|
3 |
|
'urlRulesPrefix' => $module->urlRulesPrefix, |
99
|
3 |
|
'authorizePath' => $module->authorizePath, |
100
|
3 |
|
'accessTokenPath' => $module->accessTokenPath, |
101
|
3 |
|
'tokenRevocationPath' => $module->tokenRevocationPath, |
102
|
3 |
|
'jwksPath' => $module->jwksPath, |
103
|
3 |
|
'clientAuthorizationUrl' => $module->clientAuthorizationUrl, |
104
|
3 |
|
'clientAuthorizationPath' => $module->clientAuthorizationPath, |
105
|
3 |
|
'clientAuthorizationView' => $module->clientAuthorizationView, |
106
|
3 |
|
'openIdConnectUserinfoPath' => $module->openIdConnectUserinfoPath, |
107
|
3 |
|
'openIdConnectRpInitiatedLogoutPath' => $module->openIdConnectRpInitiatedLogoutPath, |
108
|
3 |
|
'openIdConnectLogoutConfirmationUrl' => $module->openIdConnectLogoutConfirmationUrl, |
109
|
3 |
|
'openIdConnectLogoutConfirmationPath' => $module->openIdConnectLogoutConfirmationPath, |
110
|
3 |
|
'openIdConnectLogoutConfirmationView' => $module->openIdConnectLogoutConfirmationView, |
111
|
|
|
|
112
|
3 |
|
'exceptionOnInvalidScope' => $module->exceptionOnInvalidScope ? 'true' : 'false', |
113
|
|
|
|
114
|
3 |
|
'grantTypes' => $grantTypes, |
115
|
|
|
|
116
|
3 |
|
'defaultAccessTokenTTL' => $defaultAccessTokenTTL, |
117
|
3 |
|
'resourceServerAccessTokenRevocationValidation' => $module->resourceServerAccessTokenRevocationValidation, |
118
|
|
|
|
119
|
3 |
|
'enableOpenIdConnect' => $module->enableOpenIdConnect ? 'true' : 'false', |
120
|
3 |
|
'enableOpenIdConnectDiscovery' => $module->enableOpenIdConnectDiscovery ? 'true' : 'false', |
121
|
3 |
|
'openIdConnectProviderConfigurationInformationPath' => |
122
|
3 |
|
$module->openIdConnectProviderConfigurationInformationPath, |
123
|
3 |
|
'openIdConnectDiscoveryIncludeSupportedGrantTypes' => |
124
|
3 |
|
$module->openIdConnectDiscoveryIncludeSupportedGrantTypes ? 'true' : 'false', |
125
|
3 |
|
'openIdConnectUserinfoEndpoint' => $module->openIdConnectUserinfoEndpoint ? 'true' : 'false', |
126
|
3 |
|
'openIdConnectRpInitiatedLogoutEndpoint' => $module->openIdConnectRpInitiatedLogoutEndpoint ? 'true' : 'false', |
127
|
3 |
|
'openIdConnectAllowAnonymousRpInitiatedLogout' => $module->openIdConnectAllowAnonymousRpInitiatedLogout ? 'true' : 'false', |
128
|
3 |
|
'openIdConnectDiscoveryServiceDocumentationUrl' => $module->openIdConnectDiscoveryServiceDocumentationUrl, |
129
|
3 |
|
'openIdConnectIssueRefreshTokenWithoutOfflineAccessScope' => |
130
|
3 |
|
$module->openIdConnectIssueRefreshTokenWithoutOfflineAccessScope ? 'true' : 'false', |
131
|
|
|
|
132
|
3 |
|
'defaultUserAccountSelection' => Oauth2Module::USER_ACCOUNT_SELECTION_NAMES[$module->defaultUserAccountSelection], |
133
|
|
|
|
134
|
3 |
|
'displayConfidentialExceptionMessages' => $module->displayConfidentialExceptionMessages === null |
135
|
3 |
|
? 'null' |
136
|
3 |
|
: ($module->displayConfidentialExceptionMessages ? 'true' : 'false'), |
137
|
|
|
|
138
|
3 |
|
'httpClientErrorsLogLevel' => $httpClientErrorsLogLevel === 0 |
139
|
|
|
? 'disabled' |
140
|
3 |
|
: Logger::getLevelName($httpClientErrorsLogLevel), |
141
|
3 |
|
]; |
142
|
|
|
} |
143
|
|
|
|
144
|
|
|
/** |
145
|
|
|
* @param Oauth2Module $module |
146
|
|
|
* @return array |
147
|
|
|
*/ |
148
|
10 |
|
protected function getEndpoints($module) |
149
|
|
|
{ |
150
|
10 |
|
if ($module->serverRole & Oauth2Module::SERVER_ROLE_AUTHORIZATION_SERVER) { |
151
|
9 |
|
$authorizeClientValue = $module->urlRulesPrefix . '/' . $module->authorizePath; |
152
|
9 |
|
$authorizeClientSettings = 'urlRulesPrefix, authorizePath'; |
153
|
|
|
|
154
|
9 |
|
$accessTokenValue = $module->urlRulesPrefix . '/' . $module->accessTokenPath; |
155
|
9 |
|
$accessTokenSettings = 'urlRulesPrefix, accessTokenPath'; |
156
|
|
|
|
157
|
9 |
|
if ($module->enableTokenRevocation) { |
158
|
8 |
|
$tokenRevocationValue = $module->urlRulesPrefix . '/' . $module->tokenRevocationPath; |
159
|
8 |
|
$tokenRevocationSettings = 'urlRulesPrefix, tokenRevocationPath'; |
160
|
|
|
} else { |
161
|
1 |
|
$tokenRevocationValue = '[Token Revocation is disabled]'; |
162
|
1 |
|
$tokenRevocationSettings = 'enableTokenRevocation'; |
163
|
|
|
} |
164
|
|
|
|
165
|
9 |
|
$jwksValue = $module->urlRulesPrefix . '/' . $module->jwksPath; |
166
|
9 |
|
$jwksSettings = 'urlRulesPrefix, jwksPath'; |
167
|
|
|
|
168
|
9 |
|
$clientAuthorizationValue = $module->urlRulesPrefix . '/' . $module->clientAuthorizationPath; |
169
|
9 |
|
$clientAuthorizationSettings = 'urlRulesPrefix, clientAuthorizationPath'; |
170
|
|
|
|
171
|
9 |
|
if ($module->enableOpenIdConnect) { |
172
|
8 |
|
if ($module->enableOpenIdConnectDiscovery) { |
173
|
7 |
|
$oidcProviderConfigInfoValue = $module->openIdConnectProviderConfigurationInformationPath; |
174
|
7 |
|
$oidcProviderConfigInfoSettings = 'openIdConnectProviderConfigurationInformationPath'; |
175
|
|
|
} else { |
176
|
1 |
|
$oidcProviderConfigInfoValue = '[OpenId Connect Discovery is disabled]'; |
177
|
1 |
|
$oidcProviderConfigInfoSettings = 'enableOpenIdConnectDiscovery'; |
178
|
|
|
} |
179
|
|
|
|
180
|
8 |
|
if (!empty($module->openIdConnectUserinfoEndpoint)) { |
181
|
7 |
|
if ($module->openIdConnectUserinfoEndpoint === true) { |
182
|
6 |
|
$oidcUserinfoValue = $module->urlRulesPrefix . '/' . $module->openIdConnectUserinfoPath; |
183
|
6 |
|
$oidcUserinfoSettings = 'urlRulesPrefix, openIdConnectUserinfoPath'; |
184
|
|
|
} else { |
185
|
1 |
|
$oidcUserinfoValue = $module->openIdConnectUserinfoEndpoint; |
186
|
7 |
|
$oidcUserinfoSettings = 'openIdConnectUserinfoEndpoint'; |
187
|
|
|
} |
188
|
|
|
} else { |
189
|
1 |
|
$oidcUserinfoValue = '[Userinfo Endpoint is disabled]'; |
190
|
1 |
|
$oidcUserinfoSettings = 'openIdConnectUserinfoEndpoint'; |
191
|
|
|
} |
192
|
|
|
|
193
|
8 |
|
if (!empty($module->openIdConnectRpInitiatedLogoutEndpoint)) { |
194
|
2 |
|
if ($module->openIdConnectRpInitiatedLogoutEndpoint === true) { |
195
|
1 |
|
$oidcRpInitiatedLogoutValue = $module->urlRulesPrefix . '/' . $module->openIdConnectRpInitiatedLogoutPath; |
196
|
1 |
|
$oidcRpInitiatedLogoutSettings = 'urlRulesPrefix, openIdConnectRpInitiatedLogoutPath'; |
197
|
|
|
} else { |
198
|
1 |
|
$oidcRpInitiatedLogoutValue = $module->openIdConnectRpInitiatedLogoutEndpoint; |
199
|
2 |
|
$oidcRpInitiatedLogoutSettings = 'openIdConnectRpInitiatedLogoutEndpoint'; |
200
|
|
|
} |
201
|
|
|
} else { |
202
|
6 |
|
$oidcRpInitiatedLogoutValue = '[Rp Initiated Logout is disabled]'; |
203
|
8 |
|
$oidcRpInitiatedLogoutSettings = 'openIdConnectRpInitiatedLogoutEndpoint'; |
204
|
|
|
} |
205
|
|
|
|
|
|
|
|
206
|
|
|
} else { |
207
|
1 |
|
$oidcProviderConfigInfoValue = '[OpenID Connect is disabled]'; |
208
|
1 |
|
$oidcProviderConfigInfoSettings = 'enableOpenIdConnect'; |
209
|
|
|
|
210
|
1 |
|
$oidcUserinfoValue = '[OpenID Connect is disabled]'; |
211
|
1 |
|
$oidcUserinfoSettings = 'enableOpenIdConnect'; |
212
|
|
|
|
213
|
1 |
|
$oidcRpInitiatedLogoutValue = '[OpenID Connect is disabled]'; |
214
|
9 |
|
$oidcRpInitiatedLogoutSettings = 'enableOpenIdConnect'; |
215
|
|
|
} |
216
|
|
|
} else { |
217
|
1 |
|
$authorizeClientValue = '[Only available for "authorization_server" role]'; |
218
|
1 |
|
$authorizeClientSettings = 'serverRole'; |
219
|
|
|
|
220
|
1 |
|
$accessTokenValue = '[Only available for "authorization_server" role]'; |
221
|
1 |
|
$accessTokenSettings = 'serverRole'; |
222
|
|
|
|
223
|
1 |
|
$tokenRevocationValue = '[Only available for "authorization_server" role]'; |
224
|
1 |
|
$tokenRevocationSettings = 'serverRole'; |
225
|
|
|
|
226
|
1 |
|
$jwksValue = '[Only available for "authorization_server" role]'; |
227
|
1 |
|
$jwksSettings = 'serverRole'; |
228
|
|
|
|
229
|
1 |
|
$clientAuthorizationValue = '[Only available for "authorization_server" role]'; |
230
|
1 |
|
$clientAuthorizationSettings = 'serverRole'; |
231
|
|
|
|
232
|
1 |
|
$oidcProviderConfigInfoValue = '[Only available for "authorization_server" role]'; |
233
|
1 |
|
$oidcProviderConfigInfoSettings = 'serverRole'; |
234
|
|
|
|
235
|
1 |
|
$oidcUserinfoValue = '[Only available for "authorization_server" role]'; |
236
|
1 |
|
$oidcUserinfoSettings = 'serverRole'; |
237
|
|
|
|
238
|
1 |
|
$oidcRpInitiatedLogoutValue = '[Only available for "authorization_server" role]'; |
239
|
1 |
|
$oidcRpInitiatedLogoutSettings = 'serverRole'; |
240
|
|
|
} |
241
|
|
|
|
242
|
10 |
|
return [ |
243
|
10 |
|
'authorizeClient' => ['Authorize Client', $authorizeClientValue, $authorizeClientSettings], |
244
|
10 |
|
'accessToken' => ['Access Token', $accessTokenValue, $accessTokenSettings], |
245
|
10 |
|
'tokenRevocation' => ['Token Revocation', $tokenRevocationValue, $tokenRevocationSettings], |
246
|
10 |
|
'jwks' => ['JSON Web Key Sets', $jwksValue, $jwksSettings], |
247
|
10 |
|
'clientAuthorization' => ['Client Authorization', $clientAuthorizationValue, $clientAuthorizationSettings], |
248
|
10 |
|
'oidcProviderConfigInfo' => [ |
249
|
10 |
|
'OpenID Connect Provider Configuration Information', |
250
|
10 |
|
$oidcProviderConfigInfoValue, |
251
|
10 |
|
$oidcProviderConfigInfoSettings, |
252
|
10 |
|
], |
253
|
10 |
|
'oidcUserinfo' => ['OpenId Connect Userinfo', $oidcUserinfoValue, $oidcUserinfoSettings], |
254
|
10 |
|
'oidcRpInitiatedLogout' => ['OpenId Connect Rp Initiated Logout', $oidcRpInitiatedLogoutValue, $oidcRpInitiatedLogoutSettings], |
255
|
10 |
|
]; |
256
|
|
|
} |
257
|
|
|
} |
258
|
|
|
|