Блог

Я работаю над проектом OAuth2 для школы с использованием ORI Hydra.

Я следовал 5-минутному уроку, и мой сервер работает «довольно» хорошо. Я использую PHP-клиент Hydra (https://github.com/ory/hydra-client-php), чтобы создать свой собственный логин, страницы согласия.

Этот клиент может отправлять HTTP-запрос в API Hydra, настроенный на моем сервере.

Мой сервер получил общедоступный API на порту 4444, а администратор-на порту 4445.

Я могу создать и получить список клиентов OAuth2 из PHP-клиента, но я думаю о безопасности. Как я могу ограничить доступ к API администратора моего сервера ?

Я попытался найти, как настроить «пароль» или правило безопасности, чтобы внешние пользователи не делали запрос API администратора, но я ничего не нашел.

Конфигурация Гидры :

 serve:
  cookies:
    same_site_mode: Lax
admin:
    # The port to listen on. Defaults to 4445
    port: 4445
    # The interface or unix socket ORY Hydra should listen and handle administrative API requests on.
    # Use the prefix "unix:" to specify a path to a unix socket.
    # Leave empty to listen on all interfaces.
    host: localhost # leave this out or empty to listen on all devices which is the default
    # host: unix:/path/to/socket
    # socket:
    #   owner: hydra
    #   group: hydra
    #   mode: 0775

    # cors configures Cross Origin Resource Sharing for admin endpoints.
    cors:
      # set enabled to true to enable CORS. Defaults to false.
      enabled: true
      # allowed_origins is a list of origins (comma separated values) a cross-domain request can be executed from.
      # If the special * value is present in the list, all origins will be allowed. An origin may contain a wildcard (*)
      # to replace 0 or more characters (i.e.: http://*.domain.com). Only one wildcard can be used per origin.
      #
      # If empty or undefined, this defaults to `*`, allowing CORS from every domain (if cors.enabled: true).
      allowed_origins:
        - https://example.com
        - https://*.example.com
      # allowed_methods is list of HTTP methods the user agent is allowed to use with cross-domain
      # requests. Defaults to GET and POST.
      allowed_methods:
        - POST
        - GET
        - PUT
        - PATCH
        - DELETE

      # A list of non simple headers the client is allowed to use with cross-domain requests. Defaults to the listed values.
      allowed_headers:
        - Authorization
        - Content-Type

      # Sets which headers (comma separated values) are safe to expose to the API of a CORS API specification. Defaults to the listed values.
      exposed_headers:
        - Content-Type

      # Sets whether the request can include user credentials like cookies, HTTP authentication
      # or client side SSL certificates.
      allow_credentials: true

      # Sets how long (in seconds) the results of a preflight request can be cached. If set to 0, every request
      # is preceded by a preflight request. Defaults to 0.
      max_age: 10

      # If set to true, adds additional log output to debug server side CORS issues. Defaults to false.
      debug: true

    # Access Log configuration for admin server.
    access_log:
      # Disable access log for health endpoints.
      disable_for_health: false

urls:
  self:
    issuer: http://127.0.0.1:4444
  consent: http://127.0.0.1:3000/consent
  login: http://127.0.0.1:3000/login
  logout: http://127.0.0.1:3000/logout

secrets:
  system:
    - youReallyNeedToChangeThis

oidc:
  subject_identifiers:
    supported_types:
      - pairwise
      - public
    pairwise:
      salt: youReallyNeedToChangeThis

 

Клиентский код PHP :

 <?php
    require_once(__DIR__ . '/vendor/autoload.php');
    
    $apiInstance = new OryHydraClientApiAdminApi(
        // If you want use custom http client, pass your client which implements `GuzzleHttpClientInterface`.
        // This is optional, `GuzzleHttpClient` will be used as default.
        new GuzzleHttpClient()
    );
    $config = $apiInstance->getConfig();
    $config->setHost("http://localhost:4445");

    /*$body = new OryHydraClientModelOAuth2Client(); // OryHydraClientModelOAuth2Client
    $body->setClientId("fromphp");
    $body->setClientSecret("fromphp");
    $body->setRedirectUris(array("http://localhost:8010/result.php"));
    $body->setGrantTypes(array("authorization_code"));
    $body->setResponseTypes(array("code"));
    $body->setScope("openid");*/
   
    try {
        $result = $apiInstance->listOAuth2Clients();
        print_r($result);
    } catch (Exception $e) {
        echo 'Exception when calling AdminApi->createOAuth2Client: ', $e->getMessage(), PHP_EOL;
    }

?>
 

Есть идеи ?