PHPackages                             thomseddon/cakephp-oauth-server - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. thomseddon/cakephp-oauth-server

AbandonedArchivedCakephp-plugin[Authentication & Authorization](/categories/authentication)

thomseddon/cakephp-oauth-server
===============================

CakePHP OAuth2 Server Plugin

1445.9k54[18 issues](https://github.com/thomseddon/cakephp-oauth-server/issues)[4 PRs](https://github.com/thomseddon/cakephp-oauth-server/pulls)PHP

Since Jul 27Pushed 7y ago2 watchersCompare

[ Source](https://github.com/thomseddon/cakephp-oauth-server)[ Packagist](https://packagist.org/packages/thomseddon/cakephp-oauth-server)[ RSS](/packages/thomseddon-cakephp-oauth-server/feed)WikiDiscussions master Synced 3d ago

READMEChangelogDependenciesVersions (1)Used By (0)

This project is unmaintained, see  as an alternative
=============================================================================================

[](#this-project-is-unmaintained-see-httpsgithubcomuafricaoauth-server-as-an-alternative)

---

CakePHP OAuth2 Server Plugin
============================

[](#cakephp-oauth2-server-plugin)

This is a plugin for implementing an OAuth Server/Provider in CakePHP, built on quizlets [oauth2-php library](https://github.com/quizlet/oauth2-php)

What's inside?
--------------

[](#whats-inside)

- A lovely OAuth component that allows cakey access to the oauth library
- The required models with super safe automatic beforeSave token hashing
- AuthComponent'ish interface for action allow/deny's
- Convenience functions for retrieving the current user and adding clients
- An example controller with authorize and token end points

Requirements
------------

[](#requirements)

[CakePHP 2.x](http://cakephp.org/)

A clone of [oauth2-php](https://github.com/quizlet/oauth2-php) in your Vendors folder

### Cloning oauth2-php

[](#cloning-oauth2-php)

```
$ git clone git://github.com/quizlet/oauth2-php.git Vendor/oauth2-php

```

Or via submodule:

```
$ git submodule add git://github.com/quizlet/oauth2-php.git Vendor/oauth2-php

```

Installation
------------

[](#installation)

### Populate database

[](#populate-database)

First we need to populate the database with the right tables.

Two ways: use schema.sql or Migrations using [Migrations Plugin from CakeDC](https://github.com/CakeDC/migrations)

Go to Config/Schema/schema.sql to grab the tables

**OR**

```
$ cake Migrations.migration run all --plugin OAuth

```

### Cloning

[](#cloning)

Then clone this repo into a "OAuth" folder in your Plugins folder:

```
$ git clone git://github.com/thomseddon/cakephp-oauth-server.git Plugin/OAuth

```

Or via submodule:

```
$ git submodule add git://github.com/thomseddon/cakephp-oauth-server.git Plugin/OAuth

```

### Loading the Plugin

[](#loading-the-plugin)

Load the plugin

```
CakePlugin::loadAll(); // Loads all plugins at once
CakePlugin::load('OAuth'); //Just load OAuth
```

### Include component in controller

[](#include-component-in-controller)

And include the component in your controller:

```
$components = array('OAuth.OAuth');
```

Getting Started
---------------

[](#getting-started)

### OAuth

[](#oauth)

**A good understanding of the OAuth protocol should be considered a prerequisite of using this plugin.**Good documentation explaining various OAuth2 flows is provided by [Google](https://developers.google.com/accounts/docs/OAuth2), [Facebook](http://developers.facebook.com/docs/authentication/) and [in the official spec](http://tools.ietf.org/html/draft-ietf-oauth-v2-23). For reference, this plugin currently supports the following grant types:

- [Authorization Code Grant](http://tools.ietf.org/html/draft-ietf-oauth-v2-23#section-4.1)
- [Refresh Token Grant](http://tools.ietf.org/html/draft-ietf-oauth-v2-23#section-6)
- [Resource Owner Password Credentials Grant](http://tools.ietf.org/html/draft-ietf-oauth-v2-23#section-4.3) (requires setup, see below)

If you need any others please build them into the base [oauth2-php library](https://github.com/quizlet/oauth2-php) and let me know :)

It should be noted here that most OAuth methods support both GET and POST, so you can test your setup straight from the browser.

### Controller Setup

[](#controller-setup)

To use the "Resource Owner Password Credentials Grant" you need to configure the plugin so it knows where to look for your users username/password combinations. By default it will try a "Users" model with "username" and "password" fields, you can change this in your controllers beforeFilter like so:

```
$this->OAuth->authenticate = array(
    'userModel' => 'Members',
    'fields' => array(
        'username' => 'email'
    )
);
```

You can control what actions can be accessed using an OAuth access token in the same way you control access with the AuthComponent, so for example placing this in a controller's beforeFilter:

```
$this->OAuth->allow(array('userinfo', 'example'));
```

Would allow access to the "userinfo" and "example" actions.

### Adding OAuth Clients

[](#adding-oauth-clients)

An OAuth client is an application that can access resources on behalf of resource owner, i.e. someone who can use your API.

This plugin ships with all required models, including the "Clients" model for adding and accessing OAuth clients. You may wish to handle adding clients yourself, see the tables.sql for the schema, or you can use the convenience method included in the model, like so:

```
$client = $this->OAuth->Client->add('http://www.return_url.com')
```

Which will generate then client\_id and client\_secret and return something like:

```
Array(
    [client_id] => NGYcZDRjODcxYzFkY2Rk
    [client_secret] => 8e7ff3208eed06d101bf3da2473fc92ac1c6d2e7
    [redirect_uri] => http://www.return_url.com
)

```

The method includes various schemes for generating client id's, [pick your favourite](https://github.com/thomseddon/cakephp-oauth-server/blob/master/Model/Client.php#L122).

**NOTE:** This convenience method will generate a random client secret **and hash it** for security before storage. Although it will pass back the actual raw client secret when you first add a new client, it is not possible to ever determine this from the hash stored in the database. So if the client forgets their secret, [a new one will have to be issued](https://github.com/thomseddon/cakephp-oauth-server/blob/master/Model/Client.php#L139).

### Included Endpoints

[](#included-endpoints)

This plugin ships with an example controller that provides the necessary endpoints to generate access tokens. Routes are also included to give you sexy URL's like: "/oauth/token", you can fire them up by placing this in your bootstrap.php:

```
CakePlugin::loadAll(array(
    'OAuth' => array('routes' => true)
));
```

As an example, once you have registered a client, you could then use the Authorization Code Grant like so:

1. Get an Authorization code

- `/oauth/authorize?response_type=code&client_id=xxxx&redirect_url=http%3a%2f%2flocalhost`
- (note the URL encoding on the redirect\_uri)

2. Swap code for access token

- `/oauth/token?grant_type=authorization_code&code=from_above&client_id=xxxx&client_secret=xxxx`

3. Use access token

- `/oauth/userinfo?access_token=from_above`

There is quite a bit of documentation through the code, so dive in, get your hands dirty and submit any issues here!

###  Health Score

30

—

LowBetter than 64% of packages

Maintenance18

Infrequent updates — may be unmaintained

Popularity36

Limited adoption so far

Community20

Small or concentrated contributor base

Maturity40

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 72.5% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

### Community

Maintainers

![](https://www.gravatar.com/avatar/96ecf519c9ed6c657769399f8c12e4f6f665a6541b162219b4928ec56adad779?d=identicon)[thomseddon](/maintainers/thomseddon)

---

Top Contributors

[![thomseddon](https://avatars.githubusercontent.com/u/747138?v=4)](https://github.com/thomseddon "thomseddon (29 commits)")[![rchavik](https://avatars.githubusercontent.com/u/39490?v=4)](https://github.com/rchavik "rchavik (6 commits)")[![luissquall](https://avatars.githubusercontent.com/u/28030?v=4)](https://github.com/luissquall "luissquall (2 commits)")[![jwellner](https://avatars.githubusercontent.com/u/224667?v=4)](https://github.com/jwellner "jwellner (1 commits)")[![rickmills](https://avatars.githubusercontent.com/u/103707?v=4)](https://github.com/rickmills "rickmills (1 commits)")[![steefaan](https://avatars.githubusercontent.com/u/5982785?v=4)](https://github.com/steefaan "steefaan (1 commits)")

### Embed Badge

![Health badge](/badges/thomseddon-cakephp-oauth-server/health.svg)

```
[![Health](https://phpackages.com/badges/thomseddon-cakephp-oauth-server/health.svg)](https://phpackages.com/packages/thomseddon-cakephp-oauth-server)
```

###  Alternatives

[namshi/jose

JSON Object Signing and Encryption library for PHP.

1.8k99.6M101](/packages/namshi-jose)[league/oauth1-client

OAuth 1.0 Client Library

99698.8M106](/packages/league-oauth1-client)[bezhansalleh/filament-shield

Filament support for `spatie/laravel-permission`.

2.8k2.9M88](/packages/bezhansalleh-filament-shield)[gesdinet/jwt-refresh-token-bundle

Implements a refresh token system over Json Web Tokens in Symfony

70516.4M35](/packages/gesdinet-jwt-refresh-token-bundle)[league/oauth2-google

Google OAuth 2.0 Client Provider for The PHP League OAuth2-Client

41721.2M118](/packages/league-oauth2-google)[illuminate/auth

The Illuminate Auth package.

9327.3M1.0k](/packages/illuminate-auth)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)