Microsoft OAuth Service

[nicojmb]

Hi all,

I've added a Microsoft OAuth service and i would like to share with community.

I take this opportunity to request that it be made configurable whether or not new users can be registered

Here are de code :)

config file: App\Config\ShieldOAuthConfig.php

<?php
public array $oauthConfigs = [
    'microsoft' => [
        'client_id'     => 'Get it from Microsoft Entra ID',
        'client_secret' => 'Get it from Microsoft Entra ID',
        'allow_login' => true,
    ],
];

library file: App\Libraries\ShieldOAuth\MicrosoftOAuth.php

<?php

declare(strict_types=1);

namespace App\Libraries\ShieldOAuth;

use Datamweb\ShieldOAuth\Libraries\Basic\AbstractOAuth;
use Exception;
use stdClass;

class MicrosoftOAuth extends AbstractOAuth
{
    private static $API_CODE_URL = 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize';
    private static $API_TOKEN_URL = 'https://login.microsoftonline.com/common/oauth2/token';
    private static $API_USER_INFO_URL = 'https://graph.microsoft.com/v1.0/me';
    private static $APPLICATION_NAME = 'ShieldOAuth';

    protected string $token;
    protected $client;
    protected $config;
    protected string $client_id;
    protected string $client_secret;
    protected string $callback_url;

    public function __construct(string $token = '')
    {
        $this->token  = $token;
        $this->client = \Config\Services::curlrequest();
        $this->config = new \Config\ShieldOAuthConfig();
        $this->callback_url = base_url('oauth/' . $this->config->call_back_route);
        $this->client_id = env('ShieldOAuthConfig.microsoft.client_id', $this->config->oauthConfigs['microsoft']['client_id']);
        $this->client_secret = env('ShieldOAuthConfig.microsoft.client_secret', $this->config->oauthConfigs['microsoft']['client_secret']);
    }
    public function makeGoLink(string $state): string
    {
        try
        {
            if (empty($this->client_id))
            {
                throw new Exception('Microsoft Tenant ID is empty,');
            }

            if (empty($this->client_id))
            {
                throw new Exception('Microsoft Client ID is empty,');
            }

            if (empty($this->client_secret))
            {
                throw new Exception('Microsoft Secret is empty,');
            }

            $query = http_build_query([
                'client_id' => $this->client_id,
                'response_type' => 'code',
                'redirect_uri' => $this->callback_url,
                'response_mode' => 'query',
                'approval_prompt' => 'auto',
                'scope' => 'User.Read profile openid email',
                'state' => $state
            ]);

            $microsoftURL = self::$API_CODE_URL . '?' . $query;

            return $microsoftURL;
        }
        catch (\Throwable $e)
        {
            die($e->getMessage());
        }
    }

    public function fetchAccessTokenWithAuthCode(array $allGet): void
    {
        $client = \Config\Services::curlrequest();

        try
        {
            $response = $client->request('POST', self::$API_TOKEN_URL, [
                'form_params' => [
                    'client_id'     => $this->client_id,
                    'client_secret' => $this->client_secret,
                    'grant_type'    => 'authorization_code',
                    'redirect_uri'  => $this->callback_url,
                    'code'          => $allGet['code']
                ],
                'http_errors' => false,
            ]);

            $response = json_decode($response->getBody());

            if (!empty($response->error))
            {
                throw new Exception($response->error);
            }

            $this->setToken($response->access_token);
        }
        catch (Exception $e)
        {
            die($e->getMessage());
        }
    }

    public function fetchUserInfoWithToken(): object
    {
        try
        {
            $response = $this->client->request('GET', self::$API_USER_INFO_URL, [
                'headers' => [
                    'Authorization' => 'Bearer ' . $this->getToken(),
                ],
                'http_errors' => false,
            ]);
        }
        catch (Exception $e)
        {
            die($e->getMessage());
        }

        $response = json_decode($response->getBody());

        $userInfo = new stdClass();
        $userInfo->username = $response->userPrincipalName;
        $userInfo->email = $response->mail;
        $userInfo->first_name = $response->givenName;
        $userInfo->last_name = $response->surname;
        $userInfo->avatar = '';

        return $userInfo;
    }

    public function setColumnsName(string $nameOfProcess, object $userInfo): array
    {
        if ($nameOfProcess === 'syncingUserInfo')
        {
            $usersColumnsName = [
                $this->config->usersColumnsName['first_name'] => $userInfo->first_name,
                $this->config->usersColumnsName['last_name']  => $userInfo->last_name,
                //$this->config->usersColumnsName['avatar']  => $userInfo->last_name, // No get avantar from request
            ];
        }

        if ($nameOfProcess === 'newUser')
        {

            die('Auto-register users is disabled;');

            // Commented because i not use register new users

            // $usersColumnsName = [
            //     'username'                                    => $userInfo->username,
            //     'email'                                           => $userInfo->email,
            //     'password'                                    => random_string('crypto', 32),
            //     'active'                                          => TRUE,
            //     $this->config->usersColumnsName['first_name'] => $userInfo->first_name,
            //     $this->config->usersColumnsName['last_name']  => $userInfo->last_name,
            //     $this->config->usersColumnsName['avatar']     => $userInfo->avatar,
            // ];
        }

        return $usersColumnsName;
    }
}

[datamweb]

@nicojmb Thank you for sharing this driver. I know people have been looking for this.
I will move this to the discussion section.

[LufinityLucas]

I've just came here as I was looking for a solution myself.
For others configuring this as well, I want to share what else needs to be done.

1. In the /app/config/FIlters.php file, 'oauth/*' must be added to the $globals['before']['session'] array.

2. In Azure, create an application without configuring any SSO options, and configure a secret. As for the redirect URL, add a Web platform with https://your-site.com/oauth/call-back as the call-back URL.

3. Give the app the following delegated Microsoft Graph API permissions, with admin grant:

• email
• openid
• profile
• User.Read
• User.Read.All

In addition, to enhance security the common endpoint should NOT be used (causing late binding). Instead, use the tetant ID as the endpoint. For this, I added the tenant_id property to the OAuth class, and an extra option in the .env and ShieldOAuthConfig.php files. I also modified the URLs in the various methods.

EDIT
If you enable the user creation feature, you should change the password generator function to a more supported one:
bin2hex(random_bytes(16)).

[edobrauer-hrpro]

I know this has been a while, but would you by chance have examples of what you did for the last paragraph (before the edit)? I think I'm just being braindead, but I keep getting errors. I need a sanity check.

[LufinityLucas]

Sure thing!

Add tenant_id to the .env file. E.g.,

ShieldOAuthConfig.azure.tenant_id = abcdefgh-1234-5678-9ijk-lmnobqrstuvw

Add the corresponding option in the app/Config/ShieldOAuthConfig.php file:

public array $oauthConfigs = [
        'azure' => [
            'tenant_id' => '',
            ...

And then modify the app/Libraries/ShieldOAuth/AzureOAuth.php file:

class AzureOAuth extends AbstractOAuth
{
    ...
    protected string $tenant_id;
    ...
...
public function __construct(string $token = "")
    {
        ...
        $this->tenant_id = env("ShieldOAuthConfig.azure.tenant_id", $this->config->oauthConfigs["azure"]["tenant_id"]);
        ...
...
    public function makeGoLink(string $state): string
    {
        try {

            // Abort if config is missing
            if (empty($this->tenant_id)) {

                throw new \CodeIgniter\Exceptions\ConfigException("Microsoft Tenant ID is empty,");
            }
            ...
...

In the same file, modify the URLs to make use of the tenant_id:

...
return "https://login.microsoftonline.com/" . $this->tenant_id . "/oauth2/v2.0/authorize?" . $query;
...
$response = $client->request("POST", "https://login.microsoftonline.com/" . $this->tenant_id . "/oauth2/token", [
...

[LufinityLucas]

I also want to share my quick and dirty way to also fetch the users avatar. Please improve the code as needed.
Add the following to the fetchUserInfoWithToken method.

try {
    $photo = $this->client->request('GET', 'https://graph.microsoft.com/v1.0/me/photos/48x48/\$value', [
        'headers' => [
            'Authorization' => 'Bearer ' . $this->getToken(),
        ],
        'http_errors' => false,
    ]);
} catch (Exception $e) {
    die($e->getMessage());
}

try {
    $photoMeta = $this->client->request('GET', 'https://graph.microsoft.com/v1.0/me/photos/48x48', [
        'headers' => [
            'Authorization' => 'Bearer ' . $this->getToken(),
        ],
        'http_errors' => false,
    ]);
} catch (Exception $e) {
    die($e->getMessage());
}

$body = $photo->getBody();
$base64 = base64_encode($body);
$meta = json_decode($photoMeta->getBody(), true);
$mime = $meta['@odata.mediaContentType'];
$img = ('data:' . $mime . ';base64,' . $base64);

$userInfo->avatar = $img;

And uncomment the commented out code in the setColumnsName method (also make sure it's $userInfo->avatar and not $userInfo->last_name).

EDIT
You also want to change the column avatar in the users table in your database, to something like varchar(3000) (depending on the image size).