Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Abstract out tokens from being tied tightly to access #981

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

bradjones1
Copy link

Some OAuth2 clients also support OpenID Connect (OIDC.) Also, some native app integrations (e.g., Google) directly return OIDC ID tokens to the native app, which then can be used by a backend for SSO. You get the idea.

There are some other issues/PRs open for OIDC functionality, e.g. #899, and those are good starts for sure. I think what is missing from at least that PR, and more generally, is the ability to represent tokens in a more abstract way. E.g., an OIDC ID token represents a resource owner, but does not contain an access token. This can also lead to some confusion like in #976.

See also thephpleague/oauth2-google#119 for the Google provider, which is an example of how these libraries can be augmented with ID token support to better serve as a backend for all types of SSO implementations, not just browser-based OAuth2 flow.

@bradjones1
Copy link
Author

I realize the code style is a bit messed up here but am jamming on a project and figure if maintainers are into this, it's easy enough to clean up. Would perhaps be nice to ship some composer commands to do CS linting and fixing locally.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant