| 25 |
- |
1 |
<?php
|
|
|
2 |
/*
|
|
|
3 |
* Copyright 2012 Google Inc.
|
|
|
4 |
*
|
|
|
5 |
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
6 |
* you may not use this file except in compliance with the License.
|
|
|
7 |
* You may obtain a copy of the License at
|
|
|
8 |
*
|
|
|
9 |
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
10 |
*
|
|
|
11 |
* Unless required by applicable law or agreed to in writing, software
|
|
|
12 |
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
13 |
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
14 |
* See the License for the specific language governing permissions and
|
|
|
15 |
* limitations under the License.
|
|
|
16 |
*/
|
|
|
17 |
|
|
|
18 |
/**
|
|
|
19 |
* Credentials object used for OAuth 2.0 Signed JWT assertion grants.
|
|
|
20 |
*
|
|
|
21 |
* @author Chirag Shah <chirags@google.com>
|
|
|
22 |
*/
|
|
|
23 |
class Google_AssertionCredentials {
|
|
|
24 |
const MAX_TOKEN_LIFETIME_SECS = 3600;
|
|
|
25 |
|
|
|
26 |
public $serviceAccountName;
|
|
|
27 |
public $scopes;
|
|
|
28 |
public $privateKey;
|
|
|
29 |
public $privateKeyPassword;
|
|
|
30 |
public $assertionType;
|
|
|
31 |
public $prn;
|
|
|
32 |
|
|
|
33 |
/**
|
|
|
34 |
* @param $serviceAccountName
|
|
|
35 |
* @param $scopes array List of scopes
|
|
|
36 |
* @param $privateKey
|
|
|
37 |
* @param string $privateKeyPassword
|
|
|
38 |
* @param string $assertionType
|
|
|
39 |
* @param bool|string $prn The email address of the user for which the
|
|
|
40 |
* application is requesting delegated access.
|
|
|
41 |
*/
|
|
|
42 |
public function __construct(
|
|
|
43 |
$serviceAccountName,
|
|
|
44 |
$scopes,
|
|
|
45 |
$privateKey,
|
|
|
46 |
$privateKeyPassword = 'notasecret',
|
|
|
47 |
$assertionType = 'http://oauth.net/grant_type/jwt/1.0/bearer',
|
|
|
48 |
$prn = false) {
|
|
|
49 |
$this->serviceAccountName = $serviceAccountName;
|
|
|
50 |
$this->scopes = is_string($scopes) ? $scopes : implode(' ', $scopes);
|
|
|
51 |
$this->privateKey = $privateKey;
|
|
|
52 |
$this->privateKeyPassword = $privateKeyPassword;
|
|
|
53 |
$this->assertionType = $assertionType;
|
|
|
54 |
$this->prn = $prn;
|
|
|
55 |
}
|
|
|
56 |
|
|
|
57 |
public function generateAssertion() {
|
|
|
58 |
$now = time();
|
|
|
59 |
|
|
|
60 |
$jwtParams = array(
|
|
|
61 |
'aud' => Google_OAuth2::OAUTH2_TOKEN_URI,
|
|
|
62 |
'scope' => $this->scopes,
|
|
|
63 |
'iat' => $now,
|
|
|
64 |
'exp' => $now + self::MAX_TOKEN_LIFETIME_SECS,
|
|
|
65 |
'iss' => $this->serviceAccountName,
|
|
|
66 |
);
|
|
|
67 |
|
|
|
68 |
if ($this->prn !== false) {
|
|
|
69 |
$jwtParams['prn'] = $this->prn;
|
|
|
70 |
}
|
|
|
71 |
|
|
|
72 |
return $this->makeSignedJwt($jwtParams);
|
|
|
73 |
}
|
|
|
74 |
|
|
|
75 |
/**
|
|
|
76 |
* Creates a signed JWT.
|
|
|
77 |
* @param array $payload
|
|
|
78 |
* @return string The signed JWT.
|
|
|
79 |
*/
|
|
|
80 |
private function makeSignedJwt($payload) {
|
|
|
81 |
$header = array('typ' => 'JWT', 'alg' => 'RS256');
|
|
|
82 |
|
|
|
83 |
$segments = array(
|
|
|
84 |
Google_Utils::urlSafeB64Encode(json_encode($header)),
|
|
|
85 |
Google_Utils::urlSafeB64Encode(json_encode($payload))
|
|
|
86 |
);
|
|
|
87 |
|
|
|
88 |
$signingInput = implode('.', $segments);
|
|
|
89 |
$signer = new Google_P12Signer($this->privateKey, $this->privateKeyPassword);
|
|
|
90 |
$signature = $signer->sign($signingInput);
|
|
|
91 |
$segments[] = Google_Utils::urlSafeB64Encode($signature);
|
|
|
92 |
|
|
|
93 |
return implode(".", $segments);
|
|
|
94 |
}
|
|
|
95 |
}
|