PHPackages                             cloudcogsio/oauth2-openid-connect-discovery - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. cloudcogsio/oauth2-openid-connect-discovery

ActiveLibrary[Authentication & Authorization](/categories/authentication)

cloudcogsio/oauth2-openid-connect-discovery
===========================================

This library extends the 'League OAuth2 Client' library to provide OpenID Connect Discovery support for supporting providers that expose a .well-known configuration endpoint.

518631PHP

Since Oct 6Pushed 2y ago1 watchersCompare

[ Source](https://github.com/cloudcogsio/oauth2-openid-connect-discovery)[ Packagist](https://packagist.org/packages/cloudcogsio/oauth2-openid-connect-discovery)[ RSS](/packages/cloudcogsio-oauth2-openid-connect-discovery/feed)WikiDiscussions master Synced 1w ago

READMEChangelogDependenciesVersions (2)Used By (1)

OpenID Connect Discovery support for League - OAuth 2.0 Client
==============================================================

[](#openid-connect-discovery-support-for-league---oauth-20-client)

This library extends the [League OAuth2 Client](https://github.com/thephpleague/oauth2-client) library to provide OpenID Connect Discovery support for providers that expose a `.well-known` configuration endpoint.

Installation
------------

[](#installation)

To install in an existing (or new) Oauth2 Client Provider library:

1. Use composer:

```
composer require cloudcogsio/oauth2-openid-connect-discovery

```

2. Change the client to extend `\Cloudcogs\OAuth2\Client\OpenIDConnect\AbstractOIDCProvider` instead of `\League\OAuth2\Client\Provider\AbstractProvider`
3. Remove the following methods

> getResourceOwnerDetailsUrlgetBaseAuthorizationUrlgetBaseAccessTokenUrl

##### Existing OAuth2 Client

[](#existing-oauth2-client)

```
class MyCustomClient extends \League\OAuth2\Client\Provider\AbstractProvider
{
    public function getResourceOwnerDetailsUrl(AccessToken $token)
    {
        ...
    }

    public function getBaseAuthorizationUrl()
    {
        ...
    }

    public function getBaseAccessTokenUrl(array $params)
    {
        ...
    }
}
```

##### Updated OAuth2 Client with OpenID Connect Discovery Support

[](#updated-oauth2-client-with-openid-connect-discovery-support)

```
class MyCustomClient extends \Cloudcogs\OAuth2\Client\OpenIDConnect\AbstractOIDCProvider
{
    ...
}
```

The existing client can now make use of the OIDC mechanisms implemented by this library.

See  for more information on implementing a new Client Provider.

Usage
-----

[](#usage)

Usage is the same as The League's OAuth client. Configuration options changes are required.

##### URL options can be removed

[](#url-options-can-be-removed)

> 'urlAuthorize''urlAccessToken''urlResourceOwnerDetails'

##### Existing configuration

[](#existing-configuration)

```
$provider = new MyCustomClient([
   'clientId'                => 'XXXXXX',    // The client ID assigned to you by the provider
   'clientSecret'            => 'XXXXXX',    // The client password assigned to you by the provider
   'redirectUri'             => 'https://my.example.com/your-redirect-url/',
   'urlAuthorize'            => 'https://service.example.com/authorize',
   'urlAccessToken'          => 'https://service.example.com/token',
   'urlResourceOwnerDetails' => 'https://service.example.com/resource'
]);
```

##### New configuration

[](#new-configuration)

```
$provider = new MyCustomClient([
    'clientId'                => 'XXXXXX',    // The client ID assigned to you by the provider
    'clientSecret'            => 'XXXXXX',    // The client password assigned to you by the provider
    'redirectUri'             => 'https://my.example.com/your-redirect-url/',
    'well_known_endpoint'     => 'https://identity.provider.com/.well-known/openid-configuration',
    'publickey_cache_provider'=> '',
]);
```

- **well\_known\_endpoint** - The URL of the `.well-known/openid-configuration` endpoint of the IDP.
- **publickey\_cache\_provider** - An empty string OR An instance of a `\Laminas\Cache\Storage\Adapter\*` storage adapter. See

Additional Notes and Usage
--------------------------

[](#additional-notes-and-usage)

Your client provider instance will now have added functionality such as token introspection (if supported by your IDP) and the ability to obtain further configuration details from the provider.

Configuration data is accessed by proxying to the `Discovery` object from the client provider.

```
// Get the discovered configurations from the provider instance
$discovered = $provider->Discovery();

// Access standard OpenID Connect configuration via supported methods
$issuer = $discovered->getIssuer();
$supported_grants = $discovered->getGrantTypesSupported();
$authorization_endpoint = $discovered->getAuthorizationEndpoint();

// Or overloading for provider specific configuration
$custom_config = $discovered->custom_config;

// Cast to string to obtain the raw JSON discovery response
// All available properties for overloading can be seen in the JSON object.
$json_string = (string) $discovered;
```

### IDP Public Key(s)

[](#idp-public-keys)

During endpoint discovery, the IDP public key(s) are retrieved and cached locally. This is needed to decode the access token (if required).

#### Caching of Public Keys

[](#caching-of-public-keys)

Caching of JWKs are handled by an instance of a `\Laminas\Cache\Storage\Adapter\*` storage adapter. If none is provided, `\Laminas\Cache\Storage\Adapter\FileSystem` is used.

You can provide your own instance of a `\Laminas\Cache\Storage\Adapter\*` to handle storage of the public keys.

##### Example

[](#example)

```
$storageAdapter = new \Laminas\Cache\Storage\Adapter\MongoDB($mdbOptions);

$provider = new MyCustomClient([
    'clientId'                => 'XXXXXX',    // The client ID assigned to you by the provider
    'clientSecret'            => 'XXXXXX',    // The client password assigned to you by the provider
    'redirectUri'             => 'https://my.example.com/your-redirect-url/',
    'well_known_endpoint'     => 'https://identity.provider.com/.well-known/openid-configuration',
    'publickey_cache_provider'=> $storageAdapter,
]);
```

### Token Introspection

[](#token-introspection)

The AccessToken issued by the IDP can be decoded locally to obtain additional information.

```
// Decode the access token
$access_token = $AccessToken->getToken();
$data = $provider->introspectToken($access_token);
```

#### Token Introspection via the IDP (optional)

[](#token-introspection-via-the-idp-optional)

All tokens issued by the IDP (accessToken, refreshToken etc.) can be introspected using the token introspection endpoint if one is made available by the IDP.

```
// Decode the refresh token
$refresh_token = $AccessToken->getRefreshToken();
$data = $provider->introspectToken($refresh_token);
```

License
-------

[](#license)

The MIT License (MIT). Please see [License File](https://github.com/cloudcogsio/oauth2-openid-connect-discovery/blob/master/LICENSE.md) for more information.

###  Health Score

20

—

LowBetter than 14% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity19

Limited adoption so far

Community11

Small or concentrated contributor base

Maturity26

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

### Community

Maintainers

![](https://www.gravatar.com/avatar/1d2ff1bf8c9106dd0a4a8962cfc90c3450e288f5bc7abe69f0aa44d8e0761022?d=identicon)[cloudcogs](/maintainers/cloudcogs)

---

Top Contributors

[![cloudcogsio](https://avatars.githubusercontent.com/u/66295280?v=4)](https://github.com/cloudcogsio "cloudcogsio (7 commits)")

### Embed Badge

![Health badge](/badges/cloudcogsio-oauth2-openid-connect-discovery/health.svg)

```
[![Health](https://phpackages.com/badges/cloudcogsio-oauth2-openid-connect-discovery/health.svg)](https://phpackages.com/packages/cloudcogsio-oauth2-openid-connect-discovery)
```

###  Alternatives

[bezhansalleh/filament-shield

Filament support for `spatie/laravel-permission`.

2.8k2.9M88](/packages/bezhansalleh-filament-shield)[gesdinet/jwt-refresh-token-bundle

Implements a refresh token system over Json Web Tokens in Symfony

70516.4M35](/packages/gesdinet-jwt-refresh-token-bundle)[illuminate/auth

The Illuminate Auth package.

9327.3M1.0k](/packages/illuminate-auth)[beatswitch/lock

A flexible, driver based Acl package for PHP 5.4+

870304.7k2](/packages/beatswitch-lock)[amocrm/amocrm-api-library

amoCRM API Client

182728.5k6](/packages/amocrm-amocrm-api-library)[vonage/jwt

A standalone package for creating JWTs for Vonage APIs

424.1M4](/packages/vonage-jwt)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)