My firm usually recommends PHPLeague's OAuth2 client for PHP integrations. There's is sample code in the README.md, but basically
- Include the relevant Client Key and Secret in the $Provider,
- Make the call to getAuthorizationURL() with the $Provider, which will redirect the user to the login page, and return back to your code with
?code=[stuff]
,
- You can then use the value in
$_GET['code']
to get an access token from the identity provider, and
- using that token you'll be able to use
getAuthenticatedRequest
's as needed if you need to pull something from a secured API on the identity server, or
- you can also just user information about the
$resourceOwner
that is returned.
The access token has expiry information, etc. and there are functions for refreshing the token as needed. All in all it's really simple to do with PHP.
I avoid JS for OAuth, but I'm pretty sure that's just a personal preference. There are good javascript libraries as well.
Edit:
To include OIDC support, make sure you specify the OIDC scope:
$options = ['scope' => ['openid']];
and call getAuthorizationUrl
with the $options array, like:
$authorizationUrl = $provider->getAuthorizationUrl($options);