Protect this OAuth2 server with Shibboleth (ie Australian Access Federation) and use client apps to authorize against it.

Works with clients such as the MyTardis AAF Auth plugin: https://github.com/steveandroulakis/mytardis-app-auth-aaf

An auth server is a complex thing, and there are several dependencies.

• The server must be a Shibboleth Service Provider. This guide shows you how to be one for the Australian Access Federation.
• mod_shib for Apache to protect URLs (or nginx equivalent, see this guide.
• php
• Composer package manager for php
• Install this php OAuth2 server using Composer
• MySQL with this db / table defined
• Install Predis (Redis data structure store API for PHP) via Composer
• Redis data structure store to temporarily hold credentials

• Create the database structure defined in the OAuth2 server above.
• Execute the following sql statement in your MySQL db

INSERT INTO oauth_clients (client_id, client_secret, redirect_uri)
  VALUES ("YOUR-TEST-CLIENT-NAME", "testpass", "http://YOUR-CLIENT-APP-URL/")

This is the url and a key for your client app that the OAuth2 server will redirect its auth code to.

• Clone this repository to the directory Apache is serving.
• Protect oauth-aaf/ with Shibboleth. For example, in /etc/httpd/conf.d/shib.conf

<Location /oauth-aaf>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require valid-user
</Location>

This means that calls to authorize.php such as oauth-aaf/authorize.php?response_type=code&client_id=test-client-1&state=c39ffae096f1b691dd5e78e48e06458c will be intercepted by Shibboleth and make the user log in via their idP (ie via the Australian Access Federation).

• Edit oauth-aaf/include/config.php, setting your MySQL database credentials, and php dependency (Composer Autoloader) paths.
• Make sure your Redis server is running :)

Note: Each request to authorize.php from your client should have a randomly generated state string in the URL. You should keep this and use it along with your authorization code to retreive user credentials later on.

A call to oauth-aaf/authorize.php from your client app, such as the URL example above with your client ID and random state string will:

• Trigger mod_shib to ask the user for credentials, eg Australian Access Federation login
• Once authenticated, redirects to the client defined in your MySQL database. Shibboleth headers (at the moment, mail and common name - cn, will be stored temporarily on the server and you'll retreive them in the next step).

The OAuth2-generated Authorization Code and State will be included in the redirect and should be used to call oauth-aaf-insecure/code.php to receive a JSON string back with credentials. These credentials will be available temporarily (default 120 seconds in config.php).

Example client code, given an authorization_code and state redirected to us from authorize.php:

$code = $_GET['code'];
$state = $_GET['state'];

// finds credentials for given authorization_code and matches state for anti-forgery
$url = "http://bdp-aaf-dev.dyndns.org/oauth-aaf-insecure/code.php?code=" . $code . "&state=" . $state;

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $url);
$result = curl_exec($ch);
curl_close($ch);

echo $result

The result will take the form of:

{
    "mail": "[email protected]",
    "cn": "Steve Androulakis"
}

Which should be used to create a user in your system, or start a user session (ie log them in).