### Install php-openid-client via Composer

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Use this command to install the package in your project.

```bash
composer require facile-it/php-openid-client
```

--------------------------------

### Install SessionCookieMiddleware Dependencies

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Required package installation for session management.

```bash
$ composer require "dflydev/fig-cookies:^2.0"
```

--------------------------------

### Implement OpenID Connect Client Flow

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Demonstrates initializing the issuer and client, performing authorization, handling callbacks, and retrieving user information.

```php

use Facile\OpenIDClient\Client\ClientBuilder;
use Facile\OpenIDClient\Issuer\IssuerBuilder;
use Facile\OpenIDClient\Client\Metadata\ClientMetadata;
use Facile\OpenIDClient\Service\Builder\AuthorizationServiceBuilder;
use Facile\OpenIDClient\Service\Builder\UserInfoServiceBuilder;
use Psr\Http\Message\ServerRequestInterface;

$issuer = (new IssuerBuilder())
    ->build('https://example.com/.well-known/openid-configuration');
$clientMetadata = ClientMetadata::fromArray([
    'client_id' => 'client-id',
    'client_secret' => 'my-client-secret',
    'token_endpoint_auth_method' => 'client_secret_basic', // the auth method tor the token endpoint
    'redirect_uris' => [
        'https://my-rp.com/callback',    
    ],
]);
$client = (new ClientBuilder())
    ->setIssuer($issuer)
    ->setClientMetadata($clientMetadata)
    ->build();

// Authorization

$authorizationService = (new AuthorizationServiceBuilder())->build();
$redirectAuthorizationUri = $authorizationService->getAuthorizationUri(
    $client,
    ['login_hint' => 'user_username'] // custom params
);
// you can use this uri to redirect the user


// Get access token

/** @var ServerRequestInterface::class $serverRequest */
$serverRequest = null; // get your server request
$callbackParams = $authorizationService->getCallbackParams($serverRequest, $client);
$tokenSet = $authorizationService->callback($client, $callbackParams);

$idToken = $tokenSet->getIdToken(); // Unencrypted id_token, if returned
$accessToken = $tokenSet->getAccessToken(); // Access token, if returned
$refreshToken = $tokenSet->getRefreshToken(); // Refresh token, if returned

// check if we have an authenticated user
if ($idToken) {
    $claims = $tokenSet->claims(); // IdToken claims
} else {
    throw new \RuntimeException('Unauthorized');
}


// Refresh token
$tokenSet = $authorizationService->refresh($client, $tokenSet->getRefreshToken());


// Get user info
$userInfoService = (new UserInfoServiceBuilder())->build();
$userInfo = $userInfoService->getUserInfo($client, $tokenSet);
```

--------------------------------

### Initialize UserInfoMiddleware

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Fetches user information from the provider's endpoint.

```php
use Facile\OpenIDClient\Middleware\UserInfoMiddleware;
use Facile\OpenIDClient\Service\UserInfoService;

/** @var UserInfoService $userInfoService */
$userInfoService = $container->get(UserInfoService::class);
$middleware = new UserInfoMiddleware($userInfoService);
```

--------------------------------

### Initialize ClientProviderMiddleware

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Provides the OpenID client to subsequent middlewares in the chain.

```php
use Facile\OpenIDClient\Middleware\ClientProviderMiddleware;

$client = $container->get('openid.clients.default');
$middleware = new ClientProviderMiddleware($client);
```

--------------------------------

### Initialize CallbackMiddleware

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Processes the callback from the OpenID provider and provides the TokenSet.

```php
use Facile\OpenIDClient\Middleware\CallbackMiddleware;
use Facile\OpenIDClient\Service\AuthorizationService;

/** @var AuthorizationService $authorizationService */
$authorizationService = $container->get(AuthorizationService::class);
$middleware = new CallbackMiddleware($authorizationService);
```

--------------------------------

### Initialize SessionCookieMiddleware

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Configures the middleware to manage state and nonce parameters using a PSR-16 cache.

```php
use Facile\OpenIDClient\Middleware\SessionCookieMiddleware;
use Psr\SimpleCache\CacheInterface;

// Use your PSR-16 simple-cache implementation to persist sessions
/** @var CacheInterface $cache */
$middleware = new SessionCookieMiddleware($cache/* , $cookieName = "openid", $ttl = 300 */);
```

--------------------------------

### Perform Dynamic Client Registration

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Use the RegistrationServiceBuilder to register, read, update, or delete an OpenID client.

```php
use Facile\OpenIDClient\Service\Builder\RegistrationServiceBuilder;

$registration = (new RegistrationServiceBuilder())->build();

// registration
$metadata = $registration->register(
    $issuer,
    [
        'client_name' => 'My client name',
        'redirect_uris' => ['https://my-rp.com/callback'],
    ],
    'my-initial-token'
);

// read
$metadata = $registration->read($metadata['registration_client_uri'], $metadata['registration_access_token']);

// update
$metadata = $registration->update(
    $metadata['registration_client_uri'],
    $metadata['registration_access_token'],
    array_merge($metadata, [
        // new metadata
    ])
);

// delete
$registration->delete($metadata['registration_client_uri'], $metadata['registration_access_token']);
```

--------------------------------

### RegistrationService::register

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Registers a new client with an OpenID Connect provider.

```APIDOC
## RegistrationService::register

### Description
Registers a new client with the OpenID Connect provider using the provided metadata and initial access token.

### Parameters
- **issuer** (string) - The issuer URL of the OpenID provider.
- **metadata** (array) - Client metadata including 'client_name' and 'redirect_uris'.
- **initialToken** (string) - The initial access token for registration.

### Returns
- **metadata** (array) - The registered client metadata.
```

--------------------------------

### Register Psalm Plugin

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Add the plugin to your psalm.xml file to enable static analysis support.

```xml
<plugins>
    <pluginClass class="Facile\JoseVerifier\Psalm\Plugin" />
</plugins>
```

--------------------------------

### Initialize AuthRequestProviderMiddleware

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Provides an authentication request object for use with the AuthRedirectHandler.

```php
use Facile\OpenIDClient\Middleware\AuthRequestProviderMiddleware;
use Facile\OpenIDClient\Authorization\AuthRequest;

$authRequest = AuthRequest::fromParams([
    'scope' => 'openid',
    // other params...
]);
$middleware = new AuthRequestProviderMiddleware($authRequest);
```

--------------------------------

### Initialize AuthRedirectHandler

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Handles redirection to the OpenID provider's authorization page.

```php
use Facile\OpenIDClient\Middleware\AuthRedirectHandler;
use Facile\OpenIDClient\Service\AuthorizationService;

/** @var AuthorizationService $authorizationService */
$authorizationService = $container->get(AuthorizationService::class);
$middleware = new AuthRedirectHandler($authorizationService);
```

--------------------------------

### Configure Caching for Issuer and JWKS

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Integrate a PSR-16 cache to reduce network requests for issuer configuration and keys. Requires a PSR-16 implementation from your dependency injection container.

```php
use Psr\SimpleCache\CacheInterface;
use Facile\OpenIDClient\Issuer\IssuerBuilder;
use Facile\OpenIDClient\Issuer\Metadata\Provider\MetadataProviderBuilder;
use Facile\JoseVerifier\JWK\JwksProviderBuilder;

/** @var CacheInterface $cache */
$cache = $container->get(CacheInterface::class); // get your simple-cache implementation

$metadataProviderBuilder = (new MetadataProviderBuilder())
    ->setCache($cache)
    ->setCacheTtl(86400*30); // Cache metadata for 30 days 
$jwksProviderBuilder = (new JwksProviderBuilder())
    ->setCache($cache)
    ->setCacheTtl(86400); // Cache JWKS for 1 day
$issuerBuilder = (new IssuerBuilder())
    ->setMetadataProviderBuilder($metadataProviderBuilder)
    ->setJwksProviderBuilder($jwksProviderBuilder);

$issuer = $issuerBuilder->build('https://example.com/.well-known/openid-configuration');
```

--------------------------------

### Create an AuthRequest

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Constructs an authorization request using parameters and the previously created request object.

```php
use Facile\OpenIDClient\Authorization\AuthRequest;

$authRequest = AuthRequest::fromParams([
    'client_id' => $client->getMetadata()->getClientId(),
    'redirect_uri' => $client->getMetadata()->getRedirectUris()[0],
    'request' => $requestObject,
]);
```

--------------------------------

### Create a Request Object

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Generates a signed JWT request object using the RequestObjectFactory.

```php
use Facile\OpenIDClient\RequestObject\RequestObjectFactory;

$factory = new RequestObjectFactory();
$requestObject = $factory->create($client, [/* custom claims to include in the JWT*/]);
```

--------------------------------

### Perform Token Introspection

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Use the IntrospectionServiceBuilder to validate and retrieve information about an OAuth 2.0 token.

```php
use Facile\OpenIDClient\Service\Builder\IntrospectionServiceBuilder;

$service = (new IntrospectionServiceBuilder())->build();

$params = $service->introspect($client, $token);
```

--------------------------------

### Parse Aggregated and Distributed Claims

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Unpacks aggregated claims or fetches distributed claims from the user info data.

```php
use Facile\OpenIDClient\Claims\AggregateParser;
use Facile\OpenIDClient\Claims\DistributedParser;

$aggregatedParser = new AggregateParser();

$claims = $aggregatedParser->unpack($client, $userInfo);

$distributedParser = new DistributedParser();
$claims = $distributedParser->fetch($client, $userInfo);
```

--------------------------------

### Perform Token Revocation

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Use the RevocationServiceBuilder to revoke an OAuth 2.0 token.

```php
use Facile\OpenIDClient\Service\Builder\RevocationServiceBuilder;

$service = (new RevocationServiceBuilder())->build();

$params = $service->revoke($client, $token);
```

--------------------------------

### RevocationService::revoke

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Revokes an OAuth 2.0 token.

```APIDOC
## RevocationService::revoke

### Description
Revokes an active OAuth 2.0 token.

### Parameters
- **client** (ClientInterface) - The client instance.
- **token** (string) - The token to revoke.

### Returns
- **params** (array) - The revocation response parameters.
```

--------------------------------

### IntrospectionService::introspect

Source: https://github.com/facile-it/php-openid-client/blob/master/README.md

Introspects an OAuth 2.0 token to determine its status.

```APIDOC
## IntrospectionService::introspect

### Description
Checks the validity and status of an OAuth 2.0 token.

### Parameters
- **client** (ClientInterface) - The client instance.
- **token** (string) - The token to introspect.

### Returns
- **params** (array) - The introspection response parameters.
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.