OpenID Connect

We employ OpenID Connect to facilitate secure user authentication across our platforms. This protocol enables reliable verification while ensuring that interactions remain streamlined and secure.

Integrating OpenID in Authentication Requests

To initiate authentication using OpenID Connect, direct the user to the OAuth authorization endpoint. According to the guidelines specified in ./pkce.md, include openid within the scope parameter when redirecting:

https://your-auth-domain/oauth/authorize?scope=openid

Upon user authentication, the callback endpoint will provide an authorization code. Use this code to request an id_token from the OAuth token endpoint (oauth/token). The id_token is a JSON Web Token (JWT) encapsulating the user's identity information, along with other requested claims.

Additionally, you can request extended claims such as email and profile by including them in the scope. The profile claim typically contains the user's name, ID, roles, and basic organizational information.

Verifying the ID Token

To safeguard against man-in-the-middle attacks, it's crucial to verify the authenticity of the id_token received. Perform this verification using the public key available at:

https://auth.izix.eu/.well-known/oauth-public.key

Note that this key may periodically change. Ensure your system is designed to dynamically retrieve the public key to maintain the integrity of the verification process. You can find a list of suitable libraries for implementing JWT verification at jwt.io/libraries.

Example Implementation Using the Lcobucci JWT Library

Here’s a sample code snippet illustrating how to use the \Lcobucci\JWT library to verify an id_token:

$config = Configuration::forSymmetricSigner(
  new \Lcobucci\JWT\Signer\Rsa\Sha256(),
  InMemory::file(base_path('oauth-public.key'))
);

// Parse the token
$token = $config->parser()->parse($idtoken);

// Validate the signature
$signatureValid = $config->validator()->validate(
  $token,
  new \Lcobucci\JWT\Validation\Constraint\SignedWith(
    $config->signer(),
    $config->signingKey()
  )
);

This example demonstrates the basic setup and validation process using a popular PHP JWT library. Adjust the implementation details as necessary to align with your application's architecture and security requirements.