README

microsoft-jwt

A simple library to validate and decode Microsoft Azure Active Directory (Azure AD), Microsoft Active Directory Federation Services (ADFS) JSON Web Tokens (JWT) in PHP, conforming to RFC 7519.

Multitenant support

Forked From firebase/php-jwt

Installation

Use composer to manage your dependencies and download microsoft-jwt:

composer require Invenso/microsoft-jwt

Example

ADFS

<?php

use Invenso\Microsoft\JWT\Adfs\AdfsConfiguration;
use Invenso\Microsoft\JWT\Adfs\AdfsAccessTokenJWT;
use Invenso\Microsoft\JWT\Adfs\AdfsIdTokenJWT;

...

/**
 * AdfsConfiguration class will go to https://{your_asfs_hostname}/adfs/.well-known/openid-configuration to parse the configuration for your application
 *
 */
$config_options = [
  'client_id' => '{client_id}',
  'hostname' => '{your_asfs_hostname}',
];

/**
 * You can also specific the local configuration by
 */
// $config_options = [
//   'client_id' => '{client_id}',
//   'config_uri' => 'local_path_to_configuration_json',
// ];

$config = new AdfsConfiguration($config_options);

$id_token = 'adfs.id.token.jwt';
$access_token = 'adfs.access.token.jwt';

/**
 * If id token is invalid, exception will be thrown.
 */
$id_token_jwt = new AdfsIdTokenJWT($config, $id_token);
echo "\n";
// Getting payload from id token
print_r($id_token_jwt->getPayload());
echo "\n";
// Getting value from payload by attribute of id token
print_r($id_token_jwt->get('attribute_name'));
echo "\n";

/**
 * If id token is invalid, exception will be thrown.
 * To validate and decode access token jwt, you need to pass $audience (scope name of your app)
 */
$access_token_jwt = new AdfsAccessTokenJWT($config, $access_token, $audience);
echo "\n";
// Getting payload from access token
print_r($access_token_jwt->getPayload());
echo "\n";
// Getting value from payload by attribute of access token
print_r($access_token_jwt->get('attribute_name'));
echo "\n";

/**
 * You might want to 'cache' the tokens for expire validation
 * To check whether the access token and id token are expired, simply call
 */
echo ($id_token_jwt->isExpired()) ? 'Id token is expired' : 'Id token is valid';
echo ($id_token->isExpired()) ? 'Access token is expired' : 'Access token is valid';

Azure Ad

<?php

use Invenso\Microsoft\JWT\AzureAd\AzureAdConfiguration;
use Invenso\Microsoft\JWT\AzureAd\AzureAdAccessTokenJWT;
use Invenso\Microsoft\JWT\AzureAd\AzureAdIdTokenJWT;

...

/**
 * AzureAdConfiguration class will go to https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration to parse the configuration for your application
 */
$config_options = [
  'tenant' => '{tenant_id} | common | organizations | consumers',
  'tenant_id' => '{tenant_id}' | null,
  'client_id' => '{client_id}'
];

/**
 * You can also specific the local configuration by
 */
// $config_options = [
//   'tenant' => '{tenant_id} | common | organizations | consumers',
//   'tenant_id' => '{tenant_id}' | null, // leave empty when using common | organizations | consumers to support multi-tenant
//   'client_id' => '{client_id}'
//   'config_uri' => 'local_path_to_configuration_json',
// ];

$config = new AzureAdConfiguration($config_options);

$id_token = 'azure_ad.id.token.jwt';
$access_token = 'azure_ad.access.token.jwt';

/**
 * If id token is invalid, exception will be thrown.
 */
$id_token_jwt = new AzureAdIdTokenJWT($config, $id_token);
echo "\n";
/**
 * You could also pass $audience if needed
 */
// $id_token_jwt = new AzureAdIdTokenJWT($config, $id_token, $audience);
// echo "\n";

// Getting payload from id token
print_r($id_token_jwt->getPayload());
echo "\n";
// Getting value from payload by attribute of id token
print_r($id_token_jwt->get('attribute_name'));
echo "\n";

/**
 * If id token is invalid, exception will be thrown.
 * To validate and decode access token jwt, you need to pass $audience (scope name of your app)
 */
$access_token_jwt = new AzureAdAccessTokenJWT($config, $access_token, $audience);
echo "\n";
// Getting payload from access token
print_r($access_token_jwt->getPayload());
echo "\n";
// Getting value from payload by attribute of access token
print_r($access_token_jwt->get('attribute_name'));
echo "\n";

/**
 * You might want to 'cache' the tokens for expire validation
 * To check whether the access token and id token are expired, simply call
 */
echo ($id_token_jwt->isExpired()) ? 'Id token is expired' : 'Id token is valid';
echo ($id_token->isExpired()) ? 'Access token is expired' : 'Access token is valid';

Cache support

We provide a option to cache the open id configuration in order to reduce the network traffic. You can use one of these cache options:

• File
• Redis
• Memcached

ADFS

File

$config_options = [
  'client_id' => '{client_id}',
  'hostname' => '{your_asfs_hostname}',
  'cache' => [
    'type' => 'file',
    'path' => '{cache_file_path}'
  ]
];
$config = new AdfsConfiguration($config_options);

Redis

Client expects a Redis or Predis instance

$redis_client = new \Redis();
$redis_client->pconnect('redis', 6379);

$predis_client = new \Predis\Client([
  'scheme' => 'tcp',
  'host'   => 'redis',
  'port'   => 6379,
]);

$config_options = [
  'client_id' => '{client_id}',
  'hostname' => '{your_asfs_hostname}',
  'cache' => [
    'type' => 'redis',
    'client' => $redis_client // or $predis_client
  ]
];
$config = new AdfsConfiguration($config_options);

Memcached

Client expects a Memcached instance

$memcached_client = new \Memcached();
$memcached_client->addServer('memcached', 11211);

$config_options = [
  'client_id' => '{client_id}',
  'hostname' => '{your_asfs_hostname}',
  'cache' => [
    'type' => 'memcache',
    'client' => $memcached_client
  ]
];
$config = new AdfsConfiguration($config_options);

Azure Ad

File

$config_options = [
  'tenant' => '{tenant_id} | common | organizations | consumers',
  'tenant_id' => '{tenant_id}',
  'client_id' => '{client_id}',
  'cache' => [
    'type' => 'file',
    'path' => '{cache_file_path}'
  ]
];

$config = new AzureAdConfiguration($config_options);

Redis

Client expects a Redis or Predis instance

$redis_client = new \Redis();
$redis_client->pconnect('redis', 6379);

$predis_client = new \Predis\Client([
  'scheme' => 'tcp',
  'host'   => 'redis',
  'port'   => 6379,
]);

$config_options = [
  'tenant' => '{tenant_id} | common | organizations | consumers',
  'tenant_id' => '{tenant_id}',
  'client_id' => '{client_id}',
  'cache' => [
    'type' => 'redis',
    'client' => $redis_client // or $predis_client
  ]
];
$config = new AzureAdConfiguration($config_options);

Memcached

Client expects a Memcached instance

$memcached_client = new \Memcached();
$memcached_client->addServer('memcached', 11211);

$config_options = [
  'tenant' => '{tenant_id} | common | organizations | consumers',
  'tenant_id' => '{tenant_id}',
  'client_id' => '{client_id}',
  'cache' => [
    'type' => 'memcache',
    'client' => $memcached_client
  ]
];
$config = new AzureAdConfiguration($config_options);

Tests

Run the tests using phpunit:

$ composer install
$ composer run test

License

3-Clause BSD.

Build options

install with docker composer

docker run -ti -v ./:/app composer:latest composer install

PHP CS Fix

docker run -ti -v ./:/app composer:latest composer php-cs-fix

PHPstan

docker run -ti -v ./:/app composer:latest composer phpstan

Find deprecations

docker run -ti -v ./:/app composer:latest composer outdated