PHP Integration

Integrate WamISSO into a PHP or Laravel application using the Authorization Code grant.

Environment variables

SSO_BASE_URL=https://wamisso.rendovations.com
SSO_CLIENT_ID=your-client-id
SSO_CLIENT_SECRET=your-client-secret
SSO_REDIRECT_URI=http://localhost:8001/sso/callback

Step 1 — Redirect to authorize

<?php

session_start();

$state = bin2hex(random_bytes(16));
$_SESSION['oauth_state'] = $state;

$params = http_build_query([
    'client_id'     => getenv('SSO_CLIENT_ID'),
    'redirect_uri'  => getenv('SSO_REDIRECT_URI'),
    'response_type' => 'code',
    'scope'         => 'openid profile email',
    'state'         => $state,
]);

header('Location: ' . getenv('SSO_BASE_URL') . '/oauth/authorize?' . $params);
exit;

Step 2 — Handle callback & exchange code

<?php

session_start();

if (empty($_GET['code']) || ($_GET['state'] ?? '') !== ($_SESSION['oauth_state'] ?? '')) {
    http_response_code(400);
    exit('Invalid OAuth callback');
}

unset($_SESSION['oauth_state']);

$response = file_get_contents(getenv('SSO_BASE_URL') . '/oauth/token', false, stream_context_create([
    'http' => [
        'method'  => 'POST',
        'header'  => "Accept: application/json\r\nContent-Type: application/x-www-form-urlencoded\r\n",
        'content' => http_build_query([
            'grant_type'    => 'authorization_code',
            'client_id'     => getenv('SSO_CLIENT_ID'),
            'client_secret' => getenv('SSO_CLIENT_SECRET'),
            'redirect_uri'  => getenv('SSO_REDIRECT_URI'),
            'code'          => $_GET['code'],
        ]),
    ],
]));

$tokens = json_decode($response, true);
$_SESSION['access_token'] = $tokens['access_token'];

Step 3 — Fetch user profile

<?php

$profileResponse = file_get_contents(getenv('SSO_BASE_URL') . '/api/user', false, stream_context_create([
    'http' => [
        'header' => "Accept: application/json\r\nAuthorization: Bearer {$_SESSION['access_token']}\r\n",
    ],
]));

$user = json_decode($profileResponse, true);
// $user['sub'], $user['name'], $user['email']

Laravel example (Guzzle)

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

// Login redirect
public function redirect()
{
    $state = Str::random(40);
    session(['oauth_state' => $state]);

    $query = http_build_query([
        'client_id'     => config('services.wamisso.client_id'),
        'redirect_uri'  => config('services.wamisso.redirect'),
        'response_type' => 'code',
        'scope'         => 'openid profile email',
        'state'         => $state,
    ]);

    return redirect(config('services.wamisso.base_url') . '/oauth/authorize?' . $query);
}

// Callback
public function callback(Request $request)
{
    if ($request->state !== session('oauth_state')) {
        abort(403, 'Invalid state');
    }

    $token = Http::asForm()->post(config('services.wamisso.base_url') . '/oauth/token', [
        'grant_type'    => 'authorization_code',
        'client_id'     => config('services.wamisso.client_id'),
        'client_secret' => config('services.wamisso.client_secret'),
        'redirect_uri'  => config('services.wamisso.redirect'),
        'code'          => $request->code,
    ])->throw()->json();

    $user = Http::withToken($token['access_token'])
        ->get(config('services.wamisso.base_url') . '/api/user')
        ->throw()
        ->json();

    // Log in local user or create session from $user
}

Refresh token

$response = Http::asForm()->post(config('services.wamisso.base_url') . '/oauth/token', [
    'grant_type'    => 'refresh_token',
    'refresh_token' => $refreshToken,
    'client_id'     => config('services.wamisso.client_id'),
    'client_secret' => config('services.wamisso.client_secret'),
]);

Logout

Revoke the SSO access token when the user signs out of your app:

public function logout(Request $request, SsoService $sso)
{
    $accessToken = session('sso_access_token');

    if ($accessToken) {
        Http::withToken($accessToken)
            ->post(config('services.wamisso.base_url') . '/api/sso/logout');
    }

    Auth::logout();
    $request->session()->invalidate();
    $request->session()->regenerateToken();

    return redirect('/');
}