|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
namespace rhertogh\Yii2Oauth2Server\controllers\console\debug; |
|
4
|
|
|
|
|
5
|
|
|
use League\OAuth2\Server\Grant\GrantTypeInterface; |
|
6
|
|
|
use rhertogh\Yii2Oauth2Server\controllers\console\Oauth2DebugController; |
|
7
|
|
|
use rhertogh\Yii2Oauth2Server\helpers\DateIntervalHelper; |
|
8
|
|
|
use rhertogh\Yii2Oauth2Server\Oauth2Module; |
|
9
|
|
|
use yii\base\Action; |
|
10
|
|
|
use yii\console\ExitCode; |
|
11
|
|
|
use yii\console\widgets\Table; |
|
12
|
|
|
use yii\helpers\VarDumper; |
|
13
|
|
|
use yii\log\Logger; |
|
14
|
|
|
|
|
15
|
|
|
/** |
|
16
|
|
|
* @property Oauth2DebugController $controller |
|
17
|
|
|
*/ |
|
18
|
|
|
class Oauth2DebugConfigAction extends Action |
|
19
|
|
|
{ |
|
20
|
1 |
|
public function run() |
|
21
|
|
|
{ |
|
22
|
1 |
|
$module = $this->controller->module; |
|
23
|
|
|
|
|
24
|
1 |
|
$configuration = $this->getConfiguration($module); |
|
25
|
|
|
|
|
26
|
1 |
|
$this->controller->stdout('Configuration:' . PHP_EOL); |
|
27
|
1 |
|
$this->controller->stdout(Table::widget([ |
|
28
|
1 |
|
'headers' => ['Setting', 'Value'], |
|
29
|
1 |
|
'rows' => array_map(fn($setting) => [$setting, $configuration[$setting]], array_keys($configuration)), |
|
30
|
1 |
|
])); |
|
31
|
|
|
|
|
32
|
1 |
|
$endpoints = $this->getEndpoints($module); |
|
33
|
|
|
|
|
34
|
1 |
|
$this->controller->stdout(PHP_EOL); |
|
35
|
1 |
|
$this->controller->stdout('Endpoints:' . PHP_EOL); |
|
36
|
1 |
|
$this->controller->stdout(Table::widget([ |
|
37
|
1 |
|
'headers' => ['Endpoint', 'URL', 'Setting(s)'], |
|
38
|
1 |
|
'rows' => $endpoints, |
|
39
|
1 |
|
])); |
|
40
|
|
|
|
|
41
|
1 |
|
return ExitCode::OK; |
|
42
|
|
|
} |
|
43
|
|
|
|
|
44
|
|
|
/** |
|
45
|
|
|
* @param Oauth2Module $module |
|
46
|
|
|
* @return array |
|
47
|
|
|
*/ |
|
48
|
3 |
|
protected function getConfiguration($module) |
|
49
|
|
|
{ |
|
50
|
3 |
|
$serverRoles = []; |
|
51
|
3 |
|
if ($module->serverRole & Oauth2Module::SERVER_ROLE_AUTHORIZATION_SERVER) { |
|
52
|
2 |
|
$serverRoles[] = 'Authorization Server'; |
|
53
|
2 |
|
$grantTypes = array_values(array_map( |
|
54
|
2 |
|
fn(GrantTypeInterface $grant) => $grant->getIdentifier(), |
|
55
|
2 |
|
$module->getAuthorizationServer()->getEnabledGrantTypes() |
|
56
|
2 |
|
)); |
|
57
|
2 |
|
$defaultAccessTokenTTL = DateIntervalHelper::toString($module->getDefaultAccessTokenTTL()) ?? '[NOT SET]'; |
|
58
|
|
|
} else { |
|
59
|
1 |
|
$grantTypes = '-'; |
|
60
|
1 |
|
$defaultAccessTokenTTL = '-'; |
|
61
|
|
|
} |
|
62
|
|
|
|
|
63
|
3 |
|
if ($module->serverRole & Oauth2Module::SERVER_ROLE_RESOURCE_SERVER) { |
|
64
|
3 |
|
$serverRoles[] = 'Resource Server'; |
|
65
|
|
|
} |
|
66
|
|
|
|
|
67
|
3 |
|
$privateKey = $module->privateKey ? '[SET]' : '[NOT SET]'; |
|
68
|
3 |
|
$privateKeyPassphrase = $module->privateKeyPassphrase ? '[SET]' : '[NOT SET]'; |
|
69
|
3 |
|
$publicKey = $module->publicKey ? '[SET]' : '[NOT SET]'; |
|
70
|
3 |
|
$codesEncryptionKey = $module->codesEncryptionKey ? '[SET]' : '[NOT SET]'; |
|
71
|
3 |
|
$storageEncryptionKeys = $module->storageEncryptionKeys ? '[SET]' : '[NOT SET]'; |
|
72
|
|
|
|
|
73
|
3 |
|
$clientRedirectUrisEnvVarConfig = $module->clientRedirectUrisEnvVarConfig |
|
74
|
|
|
? VarDumper::export($module->clientRedirectUrisEnvVarConfig) |
|
75
|
3 |
|
: ''; |
|
76
|
|
|
|
|
77
|
3 |
|
return [ |
|
78
|
3 |
|
'serverRole' => $module->serverRole . ' (' . implode(', ', $serverRoles) . ')', |
|
79
|
|
|
|
|
80
|
3 |
|
'privateKey' => $privateKey, |
|
81
|
3 |
|
'privateKeyPassphrase' => $privateKeyPassphrase, |
|
82
|
3 |
|
'publicKey' => $publicKey, |
|
83
|
3 |
|
'codesEncryptionKey' => $codesEncryptionKey, |
|
84
|
3 |
|
'storageEncryptionKeys' => $storageEncryptionKeys, |
|
85
|
3 |
|
'defaultStorageEncryptionKey' => $module->defaultStorageEncryptionKey, |
|
86
|
|
|
|
|
87
|
3 |
|
'nonTlsAllowedRanges' => $module->nonTlsAllowedRanges, |
|
88
|
|
|
|
|
89
|
3 |
|
'clientRedirectUrisEnvVarConfig' => $clientRedirectUrisEnvVarConfig, |
|
90
|
|
|
|
|
91
|
3 |
|
'identityClass' => $module->identityClass, |
|
92
|
|
|
|
|
93
|
3 |
|
'urlRulesPrefix' => $module->urlRulesPrefix, |
|
94
|
3 |
|
'authorizePath' => $module->authorizePath, |
|
95
|
3 |
|
'accessTokenPath' => $module->accessTokenPath, |
|
96
|
3 |
|
'jwksPath' => $module->jwksPath, |
|
97
|
3 |
|
'clientAuthorizationUrl' => $module->clientAuthorizationUrl, |
|
98
|
3 |
|
'clientAuthorizationPath' => $module->clientAuthorizationPath, |
|
99
|
3 |
|
'clientAuthorizationView' => $module->clientAuthorizationView, |
|
100
|
3 |
|
'openIdConnectUserinfoPath' => $module->openIdConnectUserinfoPath, |
|
101
|
3 |
|
'openIdConnectRpInitiatedLogoutPath' => $module->openIdConnectRpInitiatedLogoutPath, |
|
102
|
|
|
|
|
103
|
3 |
|
'exceptionOnInvalidScope' => $module->exceptionOnInvalidScope, |
|
104
|
|
|
|
|
105
|
3 |
|
'grantTypes' => $grantTypes, |
|
106
|
|
|
|
|
107
|
3 |
|
'defaultAccessTokenTTL' => $defaultAccessTokenTTL, |
|
108
|
3 |
|
'resourceServerAccessTokenRevocationValidation' => $module->resourceServerAccessTokenRevocationValidation, |
|
109
|
|
|
|
|
110
|
3 |
|
'enableOpenIdConnect' => $module->enableOpenIdConnect ? 'true' : 'false', |
|
111
|
3 |
|
'enableOpenIdConnectDiscovery' => $module->enableOpenIdConnectDiscovery ? 'true' : 'false', |
|
112
|
3 |
|
'openIdConnectProviderConfigurationInformationPath' => |
|
113
|
3 |
|
$module->openIdConnectProviderConfigurationInformationPath, |
|
114
|
3 |
|
'openIdConnectDiscoveryIncludeSupportedGrantTypes' => |
|
115
|
3 |
|
$module->openIdConnectDiscoveryIncludeSupportedGrantTypes ? 'true' : 'false', |
|
116
|
3 |
|
'openIdConnectUserinfoEndpoint' => $module->openIdConnectUserinfoEndpoint ? 'true' : 'false', |
|
117
|
3 |
|
'openIdConnectRpInitiatedLogoutEndpoint' => $module->openIdConnectRpInitiatedLogoutEndpoint ? 'true' : 'false', |
|
118
|
3 |
|
'openIdConnectAllowAnonymousRpInitiatedLogout' => $module->openIdConnectAllowAnonymousRpInitiatedLogout ? 'true' : 'false', |
|
119
|
3 |
|
'openIdConnectDiscoveryServiceDocumentationUrl' => $module->openIdConnectDiscoveryServiceDocumentationUrl, |
|
120
|
3 |
|
'openIdConnectIssueRefreshTokenWithoutOfflineAccessScope' => |
|
121
|
3 |
|
$module->openIdConnectIssueRefreshTokenWithoutOfflineAccessScope ? 'true' : 'false', |
|
122
|
|
|
|
|
123
|
3 |
|
'defaultUserAccountSelection' => $module->defaultUserAccountSelection, |
|
124
|
|
|
|
|
125
|
3 |
|
'displayConfidentialExceptionMessages' => $module->displayConfidentialExceptionMessages === null |
|
126
|
3 |
|
? 'null' |
|
127
|
3 |
|
: ($module->displayConfidentialExceptionMessages ? 'true' : 'false'), |
|
128
|
|
|
|
|
129
|
3 |
|
'httpClientErrorsLogLevel' => $module->httpClientErrorsLogLevel === 0 |
|
130
|
|
|
? 'disabled' |
|
131
|
3 |
|
: Logger::getLevelName($module->httpClientErrorsLogLevel), |
|
132
|
3 |
|
]; |
|
133
|
|
|
} |
|
134
|
|
|
|
|
135
|
|
|
/** |
|
136
|
|
|
* @param Oauth2Module $module |
|
137
|
|
|
* @return array |
|
138
|
|
|
*/ |
|
139
|
7 |
|
protected function getEndpoints($module) |
|
140
|
|
|
{ |
|
141
|
7 |
|
if ($module->serverRole & Oauth2Module::SERVER_ROLE_AUTHORIZATION_SERVER) { |
|
142
|
6 |
|
$authorizeClientValue = $module->urlRulesPrefix . '/' . $module->authorizePath; |
|
143
|
6 |
|
$authorizeClientSettings = 'urlRulesPrefix, authorizePath'; |
|
144
|
|
|
|
|
145
|
6 |
|
$accessTokenValue = $module->urlRulesPrefix . '/' . $module->accessTokenPath; |
|
146
|
6 |
|
$accessTokenSettings = 'urlRulesPrefix, accessTokenPath'; |
|
147
|
|
|
|
|
148
|
6 |
|
$jwksValue = $module->urlRulesPrefix . '/' . $module->jwksPath; |
|
149
|
6 |
|
$jwksSettings = 'urlRulesPrefix, jwksPath'; |
|
150
|
|
|
|
|
151
|
6 |
|
$clientAuthorizationValue = $module->urlRulesPrefix . '/' . $module->clientAuthorizationPath; |
|
152
|
6 |
|
$clientAuthorizationSettings = 'urlRulesPrefix, clientAuthorizationPath'; |
|
153
|
|
|
|
|
154
|
6 |
|
if ($module->enableOpenIdConnect) { |
|
155
|
5 |
|
if ($module->enableOpenIdConnectDiscovery) { |
|
156
|
4 |
|
$oidcProviderConfigInfoValue = $module->openIdConnectProviderConfigurationInformationPath; |
|
157
|
4 |
|
$oidcProviderConfigInfoSettings = 'openIdConnectProviderConfigurationInformationPath'; |
|
158
|
|
|
} else { |
|
159
|
1 |
|
$oidcProviderConfigInfoValue = '[OpenId Connect Discovery is disabled]'; |
|
160
|
1 |
|
$oidcProviderConfigInfoSettings = 'enableOpenIdConnectDiscovery'; |
|
161
|
|
|
} |
|
162
|
|
|
|
|
163
|
5 |
|
if (!empty($module->openIdConnectUserinfoEndpoint)) { |
|
164
|
4 |
|
if ($module->openIdConnectUserinfoEndpoint === true) { |
|
165
|
3 |
|
$oidcUserinfoValue = $module->urlRulesPrefix . '/' . $module->openIdConnectUserinfoPath; |
|
166
|
3 |
|
$oidcUserinfoSettings = 'urlRulesPrefix, openIdConnectUserinfoPath'; |
|
167
|
|
|
} else { |
|
168
|
1 |
|
$oidcUserinfoValue = $module->openIdConnectUserinfoEndpoint; |
|
169
|
4 |
|
$oidcUserinfoSettings = 'openIdConnectUserinfoEndpoint'; |
|
170
|
|
|
} |
|
171
|
|
|
} else { |
|
172
|
1 |
|
$oidcUserinfoValue = '[Userinfo Endpoint is disabled]'; |
|
173
|
5 |
|
$oidcUserinfoSettings = 'openIdConnectUserinfoEndpoint'; |
|
174
|
|
|
} |
|
175
|
|
|
} else { |
|
176
|
1 |
|
$oidcProviderConfigInfoValue = '[OpenID Connect is disabled]'; |
|
177
|
1 |
|
$oidcProviderConfigInfoSettings = 'enableOpenIdConnect'; |
|
178
|
|
|
|
|
179
|
1 |
|
$oidcUserinfoValue = '[OpenID Connect is disabled]'; |
|
180
|
6 |
|
$oidcUserinfoSettings = 'enableOpenIdConnect'; |
|
181
|
|
|
} |
|
182
|
|
|
} else { |
|
183
|
1 |
|
$authorizeClientValue = '[Only available for "authorization_server" role]'; |
|
184
|
1 |
|
$authorizeClientSettings = 'serverRole'; |
|
185
|
|
|
|
|
186
|
1 |
|
$accessTokenValue = '[Only available for "authorization_server" role]'; |
|
187
|
1 |
|
$accessTokenSettings = 'serverRole'; |
|
188
|
|
|
|
|
189
|
1 |
|
$jwksValue = '[Only available for "authorization_server" role]'; |
|
190
|
1 |
|
$jwksSettings = 'serverRole'; |
|
191
|
|
|
|
|
192
|
1 |
|
$clientAuthorizationValue = '[Only available for "authorization_server" role]'; |
|
193
|
1 |
|
$clientAuthorizationSettings = 'serverRole'; |
|
194
|
|
|
|
|
195
|
1 |
|
$oidcProviderConfigInfoValue = '[Only available for "authorization_server" role]'; |
|
196
|
1 |
|
$oidcProviderConfigInfoSettings = 'serverRole'; |
|
197
|
|
|
|
|
198
|
1 |
|
$oidcUserinfoValue = '[Only available for "authorization_server" role]'; |
|
199
|
1 |
|
$oidcUserinfoSettings = 'serverRole'; |
|
200
|
|
|
} |
|
201
|
|
|
|
|
202
|
7 |
|
return [ |
|
203
|
7 |
|
'authorizeClient' => ['Authorize Client', $authorizeClientValue, $authorizeClientSettings], |
|
204
|
7 |
|
'accessToken' => ['Access Token', $accessTokenValue, $accessTokenSettings], |
|
205
|
7 |
|
'jwks' => ['JSON Web Key Sets', $jwksValue, $jwksSettings], |
|
206
|
7 |
|
'clientAuthorization' => ['Client Authorization', $clientAuthorizationValue, $clientAuthorizationSettings], |
|
207
|
7 |
|
'oidcProviderConfigInfo' => [ |
|
208
|
7 |
|
'OpenID Connect Provider Configuration Information', |
|
209
|
7 |
|
$oidcProviderConfigInfoValue, |
|
210
|
7 |
|
$oidcProviderConfigInfoSettings, |
|
211
|
7 |
|
], |
|
212
|
7 |
|
'oidcUserinfo' => ['OpenId Connect Userinfo', $oidcUserinfoValue, $oidcUserinfoSettings], |
|
213
|
7 |
|
]; |
|
214
|
|
|
} |
|
215
|
|
|
} |
|
216
|
|
|
|
rhertogh /
yii2-oauth2-server
