slim-oauth2 invalid token (Slimframework 3) - php

Question

I'm using the chadicus/slim-oauth2 collection for slimframework 3.
This is my code atm (running on Apache2):
<?php
use \Psr\Http\Message\ServerRequestInterface as Request;
use \Psr\Http\Message\ResponseInterface as Response;
use \Slim\Middleware\HttpBasicAuthentication\PdoAuthenticator;
use Chadicus\Slim\OAuth2\Http\RequestBridge;
use Chadicus\Slim\OAuth2\Http\ResponseBridge;
use Chadicus\Slim\OAuth2\Middleware;
use OAuth2;
use OAuth2\GrantType;
use OAuth2\Storage;
use Slim;
require '../vendor/autoload.php';
define(KUNDEN,'kunden');
define(VERTRAEGE,'vertraege');
define(ADRESSE,'adresse');
$config['displayErrorDetails'] = true;
$config['addContentLengthHeader'] = false;
$config['db']['host'] = "localhost";
$config['db']['user'] = "vv";
$config['db']['pass'] = "vv";
$config['db']['dbname'] = "vv";
$storage = new Storage\Memory(
[
'client_credentials' => [
'administrator' => [
'client_id' => 'administrator',
'client_secret' => 'password',
'scope' => 'superUser',
],
'foo-client' => [
'client_id' => 'foo-client',
'client_secret' => 'p4ssw0rd',
'scope' => 'basicUser canViewFoos',
],
'bar-client' => [
'client_id' => 'foo-client',
'client_secret' => '!password1',
'scope' => 'basicUser',
],
],
]
);
$server = new OAuth2\Server(
$storage,
[
'access_lifetime' => 3600,
],
[
new GrantType\ClientCredentials($storage),
]
);
$app = new \Slim\App(["settings"=>$config]);
$authMiddleware = new Middleware\Authorization($server, $app->getContainer());
$container=$app->getContainer();
$container['db'] = function ($c) {
$db = $c['settings']['db'];
$pdo = new PDO("mysql:host=" . $db['host'] . ";dbname=" . $db['dbname'],
$db['user'], $db['pass']);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$pdo->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
return $pdo;
};
$app->post('/token', function ($psrRequest, $psrResponse, array $args) use ($app, $server) {
//create an \OAuth2\Request from the current \Slim\Http\Request Object
$oauth2Request = RequestBridge::toOAuth2($psrRequest);
//Allow the oauth2 server instance to handle the oauth2 request
$oauth2Response = $server->handleTokenRequest($oauth2Request);
//Map the oauth2 response into the slim response
//print_r($server['storage']);
return ResponseBridge::fromOAuth2($oauth2Response);
});
$app->get('/'.KUNDEN, function (Request $request, Response $response) {
$query=$this->db->prepare("Select * from customer");
$query->execute();
return $response->withJson($query->fetchAll());
})->add($authMiddleware);
$app->run();
If i now request access to /token with postman and the administrator/password credentials, I get a token back. But if I try to open /kunden with this token I get: "Invalid token".
Get token back from server
Invalid token
I'm not sure if the token were stored in the memory correctly. And, to be honest, I have not many experience with oAuth2.
Can anyone give me a push in the right direction. I need a hint, where I have to search on the internet. Because "Slimframework oauth2 invalid token" are not the right keywords for google :-/
Thanks in advance!
Franz

Answer 1

I had the same problem and it was that i just didn't know how to work with OAuth2 Server PHP.
You must create the OAuth2 tables on your database as you can read here: https://bshaffer.github.io/oauth2-server-php-docs/cookbook/
Then you can create your users in the database and use PDO to authenticate and save the user token:
$pdo = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);
$storage = new Storage\Pdo($pdo);
$server = new OAuth2\Server(
$storage,
[
'access_lifetime' => 3600,
],
[
new GrantType\ClientCredentials($storage),
new GrantType\AuthorizationCode($storage),
]
);

Answer 2

For anyone else who stumbles upon this question from search engines.
First, you must understand that the "Memory" storage in OAuth2 is not persistent, meaning that when you create a token, it will not be saved anywhere. It's meant to show you that the token creation part of the mechanism is working.
Second, you must use another storage (PDO or Redis) if you want to authenticate clients to your routes. This is fairly simple to do with Redis. You just install redis-server on your server, secure it, and then implement it in your code. For an easy-to-use implementation of Redis, check the composer package predis/predis.
For more information how to implement OAuth2 with Redis, visit: https://bshaffer.github.io/oauth2-server-php-docs/storage/redis/
Have a nice day :)