oauth2.0服务端与客户端搭建

oauth2.0服务端与客户端搭建 - 推酷

今天搭建了oauth2.0服务端与客户端。把搭建的过程记录一下。具体实现的功能是：client.ruanwenwu.cn的用户能够通过 server.ruanwenwu.cn的用户名和密码登陆client.ruanwenwu.cn。并且登陆 后，client.ruanwenwu.cn的用户能获取server.ruanwenwu.cn哪里的一些资源。

我的个人博客原文地址： http://www.ruanwenwu.cn/2015/12/oauth-server-and-client-install.html

一、oauth2.0的作用

1、搭建第三方登录平台（就像你用很多网站支持qq登录。其实是qq提供的oauth2.0服务端支持。网站作为第三方，只要用oauth2.0标准请求服务端，求能得到用户信息，并实现登录）。

2、公共资源管理。

就 像你（Y）想通过一个打印照片的网站（A)来打印你存放在google(B)的照片。你就要通过这个A来获取B的照片。B肯定要验证是否是他的用户Y的请 求，验证通过才把照片传递给A实现打印。问题是Y不想把账号密码直接给A。用oauth2.0就是来解决这个问题的：

A先 把Y导向B的站点进行授权。授权通过，B向A发送oauth_code。A拿到这个oauth_code，连同A的client_id和 oauth_secrete发送给B，如果数据正确，B就会给A发送oauth_token。有了这个token,A就可以获取B的相关资源的。

基本的流程是这样。下面是具体的实现过程。

二、oauth2.0服务端的搭建。

oauth2.0的服务端分为验证服务器和资源服务器。这两个服务器也可以是同一个服务器（只不过把这两个功能用一个 服务器来完成罢了）。

说明：我的实现都在Thinkphp3.2.3框架下实现。

1、下载thinkphp3.2.3。

2、配置虚拟机server.ruanwenwu.cn

3、在Thinkphp的Home应用下修改配置文件（server.ruanwenwu.cn/Application/Home/Conf/config.php）如下所示：

<?php
return array(
    //'配置项'=>'配置值'
    //数据库设置
        'DB_TYPE' => 'mysql',
        'DB_HOST' => '127.0.0.1',//localhost
        'DB_NAME' => 'oauth',
        'DB_USER' => 'root',
        'DB_PWD'  => 'root',
        'DB_PORT' => '3306',
    'SCOPE_INFO'  => array(    //这是授权选项。根据你自己的项目来
        array(
            'name' => '个人信息',
            'value' => 'basicinfo'
        ),
        array(
            'name' => '论坛发帖回帖',
            'value' => 'bbsinfo'
        ),
    ),
    'OAUTH2_CODES_TABLE'   =>'oauth_code',    //这里是oauth项目需要用的三个基础表
    'OAUTH2_CLIENTS_TABLE' =>'oauth_client',
    'OAUTH2_TOKEN_TABLE'   =>'oauth_token',
    'SECRETKYE' => 'Mumayi!@#',    //下面是一些网站自定义的项目。可以根据自己的情况来写或者不写
    //session 有效期
    'SESSION_EXPIRES' => 1200,
    //key 有效期
    'PASS_KEY_EXPIRES' => 86400,
    //key 有效期
    'PHONE_KEY_EXPIRES' => 300,
    //key 加密 整型 数字 必须为 int
    'PASS_KEY_CALC' => 1314,
);

4、建oauth表。

SET FOREIGN_KEY_CHECKS=0;
-- ----------------------------
-- Table structure for oauth_client
-- ----------------------------
DROP TABLE IF EXISTS `oauth_client`;
CREATE TABLE `oauth_client` (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `client_id` varchar(32) NOT NULL,
  `client_secret` varchar(32) NOT NULL,
  `redirect_uri` varchar(200) NOT NULL,
  `create_time` int(11) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=3 DEFAULT CHARSET=utf8;
-- ----------------------------
-- Table structure for oauth_code
-- ----------------------------
DROP TABLE IF EXISTS `oauth_code`;
CREATE TABLE `oauth_code` (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `client_id` varchar(32) NOT NULL,
  `user_id` int(11) NOT NULL DEFAULT '1',
  `code` varchar(40) NOT NULL,
  `redirect_uri` varchar(200) NOT NULL,
  `expires` int(11) NOT NULL,
  `scope` varchar(250) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=57 DEFAULT CHARSET=utf8;
-- ----------------------------
-- Table structure for oauth_token
-- ----------------------------
DROP TABLE IF EXISTS `oauth_token`;
CREATE TABLE `oauth_token` (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `client_id` varchar(32) NOT NULL,
  `user_id` int(11) NOT NULL,
  `access_token` varchar(40) NOT NULL,
  `refresh_token` varchar(40) NOT NULL,
  `expires_in` int(11) NOT NULL,
  `scope` varchar(200) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=26 DEFAULT CHARSET=utf8;

5、引入oauth2.0服务端类文件。

5-1、在\server.ruanwenwu.cn\ThinkPHP\Library\Vendor\目录下建立oauth目录。

5-2、引入oauth2.0服务端PHP脚本。

在刚建立的oauth目录下引入OAuth2.class.php这个文件基本不用做修改。我们的操作都在继承这个类的子类上完成。类的代码如下：

<?php
/**
 * @mainpage
 * OAuth 2.0 server in PHP, originally written for
 * <a href="http://www.opendining.net/"> Open Dining</a>. Supports
 * <a href="http://tools.ietf.org/html/draft-ietf-oauth-v2-10">IETF draft v10</a>.
 *
 * Source repo has sample servers implementations for
 * <a href="http://php.net/manual/en/book.pdo.php"> PHP Data Objects</a> and
 * <a href="http://www.mongodb.org/">MongoDB</a>. Easily adaptable to other
 * storage engines.
 *
 * PHP Data Objects supports a variety of databases, including MySQL,
 * Microsoft SQL Server, SQLite, and Oracle, so you can try out the sample
 * to see how it all works.
 *
 * We're expanding the wiki to include more helpful documentation, but for
 * now, your best bet is to view the oauth.php source - it has lots of
 * comments.
 *
 * @author Tim Ridgely <tim.ridgely@gmail.com>
 * @author Aaron Parecki <aaron@parecki.com>
 * @author Edison Wong <hswong3i@pantarei-design.com>
 *
 * @see http://code.google.com/p/oauth2-php/
 */
/**
 * The default duration in seconds of the access token lifetime.
 */
define("OAUTH2_DEFAULT_ACCESS_TOKEN_LIFETIME", 3600);
/**
 * The default duration in seconds of the authorization code lifetime.
 */
define("OAUTH2_DEFAULT_AUTH_CODE_LIFETIME", 30);
/**
 * The default duration in seconds of the refresh token lifetime.
 */
define("OAUTH2_DEFAULT_REFRESH_TOKEN_LIFETIME", 1209600);
/**
 * @defgroup oauth2_section_2 Client Credentials
 * @{
 *
 * When interacting with the authorization server, the client identifies
 * itself using a client identifier and authenticates using a set of
 * client credentials. This specification provides one mechanism for
 * authenticating the client using password credentials.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-2
 */
/**
 * Regex to filter out the client identifier (described in Section 2 of IETF draft).
 *
 * IETF draft does not prescribe a format for these, however I've arbitrarily
 * chosen alphanumeric strings with hyphens and underscores, 3-32 characters
 * long.
 *
 * Feel free to change.
 */
define("OAUTH2_CLIENT_ID_REGEXP", "/^[a-z0-9-_]{3,32}$/i");
/**
 * @}
 */
/**
 * @defgroup oauth2_section_3 Obtaining End-User Authorization
 * @{
 *
 * When the client interacts with an end-user, the end-user MUST first
 * grant the client authorization to access its protected resources.
 * Once obtained, the end-user access grant is expressed as an
 * authorization code which the client uses to obtain an access token.
 * To obtain an end-user authorization, the client sends the end-user to
 * the end-user authorization endpoint.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3
 */
/**
 * Denotes "token" authorization response type.
 */
define("OAUTH2_AUTH_RESPONSE_TYPE_ACCESS_TOKEN", "token");
/**
 * Denotes "code" authorization response type.
 */
define("OAUTH2_AUTH_RESPONSE_TYPE_AUTH_CODE", "code");
/**
 * Denotes "code-and-token" authorization response type.
 */
define("OAUTH2_AUTH_RESPONSE_TYPE_CODE_AND_TOKEN", "code-and-token");
/**
 * Regex to filter out the authorization response type.
 */
define("OAUTH2_AUTH_RESPONSE_TYPE_REGEXP", "/^(token|code|code-and-token)$/");
/**
 * @}
 */
/**
 * @defgroup oauth2_section_4 Obtaining an Access Token
 * @{
 *
 * The client obtains an access token by authenticating with the
 * authorization server and presenting its access grant (in the form of
 * an authorization code, resource owner credentials, an assertion, or a
 * refresh token).
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4
 */
/**
 * Denotes "authorization_code" grant types (for token obtaining).
 */
define("OAUTH2_GRANT_TYPE_AUTH_CODE", "authorization_code");
/**
 * Denotes "password" grant types (for token obtaining).
 */
define("OAUTH2_GRANT_TYPE_USER_CREDENTIALS", "password");
/**
 * Denotes "assertion" grant types (for token obtaining).
 */
define("OAUTH2_GRANT_TYPE_ASSERTION", "assertion");
/**
 * Denotes "refresh_token" grant types (for token obtaining).
 */
define("OAUTH2_GRANT_TYPE_REFRESH_TOKEN", "refresh_token");
/**
 * Denotes "none" grant types (for token obtaining).
 */
define("OAUTH2_GRANT_TYPE_NONE", "none");
/**
 * Regex to filter out the grant type.
 */
define("OAUTH2_GRANT_TYPE_REGEXP", "/^(authorization_code|password|assertion|refresh_token|none)$/");
/**
 * @}
 */
/**
 * @defgroup oauth2_section_5 Accessing a Protected Resource
 * @{
 *
 * Clients access protected resources by presenting an access token to
 * the resource server. Access tokens act as bearer tokens, where the
 * token string acts as a shared symmetric secret. This requires
 * treating the access token with the same care as other secrets (e.g.
 * end-user passwords). Access tokens SHOULD NOT be sent in the clear
 * over an insecure channel.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5
 */
/**
 * Used to define the name of the OAuth access token parameter (POST/GET/etc.).
 *
 * IETF Draft sections 5.1.2 and 5.1.3 specify that it should be called
 * "oauth_token" but other implementations use things like "access_token".
 *
 * I won't be heartbroken if you change it, but it might be better to adhere
 * to the spec.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.1.2
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.1.3
 */
define("OAUTH2_TOKEN_PARAM_NAME", "oauth_token");
/**
 * @}
 */
/**
 * @defgroup oauth2_http_status HTTP status code
 * @{
 */
/**
 * "Found" HTTP status code.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3
 */
define("OAUTH2_HTTP_FOUND", "302 Found");
/**
 * "Bad Request" HTTP status code.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.3
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.2.1
 */
define("OAUTH2_HTTP_BAD_REQUEST", "400 Bad Request");
/**
 * "Unauthorized" HTTP status code.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.3
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.2.1
 */
define("OAUTH2_HTTP_UNAUTHORIZED", "401 Unauthorized");
/**
 * "Forbidden" HTTP status code.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.2.1
 */
define("OAUTH2_HTTP_FORBIDDEN", "403 Forbidden");
/**
 * @}
 */
/**
 * @defgroup oauth2_error Error handling
 * @{
 *
 * @todo Extend for i18n.
 */
/**
 * The request is missing a required parameter, includes an unsupported
 * parameter or parameter value, or is otherwise malformed.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3.2.1
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.3.1
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.2.1
 */
define("OAUTH2_ERROR_INVALID_REQUEST", "invalid_request");
/**
 * The client identifier provided is invalid.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3.2.1
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.3.1
 */
define("OAUTH2_ERROR_INVALID_CLIENT", "invalid_client");
/**
 * The client is not authorized to use the requested response type.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3.2.1
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.3.1
 */
define("OAUTH2_ERROR_UNAUTHORIZED_CLIENT", "unauthorized_client");
/**
 * The redirection URI provided does not match a pre-registered value.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3.2.1
 */
define("OAUTH2_ERROR_REDIRECT_URI_MISMATCH", "redirect_uri_mismatch");
/**
 * The end-user or authorization server denied the request.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3.2.1
 */
define("OAUTH2_ERROR_USER_DENIED", "access_denied");
/**
 * The requested response type is not supported by the authorization server.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3.2.1
 */
define("OAUTH2_ERROR_UNSUPPORTED_RESPONSE_TYPE", "unsupported_response_type");
/**
 * The requested scope is invalid, unknown, or malformed.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3.2.1
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.3.1
 */
define("OAUTH2_ERROR_INVALID_SCOPE", "invalid_scope");
/**
 * The provided access grant is invalid, expired, or revoked (e.g. invalid
 * assertion, expired authorization token, bad end-user password credentials,
 * or mismatching authorization code and redirection URI).
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.3.1
 */
define("OAUTH2_ERROR_INVALID_GRANT", "invalid_grant");
/**
 * The access grant included - its type or another attribute - is not
 * supported by the authorization server.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.3.1
 */
define("OAUTH2_ERROR_UNSUPPORTED_GRANT_TYPE", "unsupported_grant_type");
/**
 * The access token provided is invalid. Resource servers SHOULD use this
 * error code when receiving an expired token which cannot be refreshed to
 * indicate to the client that a new authorization is necessary. The resource
 * server MUST respond with the HTTP 401 (Unauthorized) status code.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.2.1
 */
define("OAUTH2_ERROR_INVALID_TOKEN", "invalid_token");
/**
 * The access token provided has expired. Resource servers SHOULD only use
 * this error code when the client is expected to be able to handle the
 * response and request a new access token using the refresh token issued
 * with the expired access token. The resource server MUST respond with the
 * HTTP 401 (Unauthorized) status code.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.2.1
 */
define("OAUTH2_ERROR_EXPIRED_TOKEN", "expired_token");
/**
 * The request requires higher privileges than provided by the access token.
 * The resource server SHOULD respond with the HTTP 403 (Forbidden) status
 * code and MAY include the "scope" attribute with the scope necessary to
 * access the protected resource.
 *
 * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.2.1
 */
define("OAUTH2_ERROR_INSUFFICIENT_SCOPE", "insufficient_scope");
/**
 * @}
 */
/**
 * OAuth2.0 draft v10 server-side implementation.
 *
 * @author Originally written by Tim Ridgely <tim.ridgely@gmail.com>.
 * @author Updated to draft v10 by Aaron Parecki <aaron@parecki.com>.
 * @author Debug, coding style clean up and documented by Edison Wong <hswong3i@pantarei-design.com>.
 */
abstract class OAuth2 {
  /**
   * Array of persistent variables stored.
   */
  protected $conf = array();
  /**
   * Returns a persistent variable.
   *
   * To avoid problems, always use lower case for persistent variable names.
   *
   * @param $name
   *   The name of the variable to return.
   * @param $default
   *   The default value to use if this variable has never been set.
   *
   * @return
   *   The value of the variable.
   */
  public function getVariable($name, $default = NULL) {
    return isset($this->conf[$name]) ? $this->conf[$name] : $default;
  }
  /**
   * Sets a persistent variable.
   *
   * To avoid problems, always use lower case for persistent variable names.
   *
   * @param $name
   *   The name of the variable to set.
   * @param $value
   *   The value to set.
   */
  public function setVariable($name, $value) {
    $this->conf[$name] = $value;
    return $this;
  }
  // Subclasses must implement the following functions.
  /**
   * Make sure that the client credentials is valid.
   *
   * @param $client_id
   *   Client identifier to be check with.
   * @param $client_secret
   *   (optional) If a secret is required, check that they've given the right one.
   *
   * @return
   *   TRUE if client credentials are valid, and MUST return FALSE if invalid.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-2.1
   *
   * @ingroup oauth2_section_2
   */
  abstract protected function checkClientCredentials($client_id, $client_secret = NULL);
  /**
   * Get the registered redirect URI of corresponding client_id.
   *
   * OAuth says we should store request URIs for each registered client.
   * Implement this function to grab the stored URI for a given client id.
   *
   * @param $client_id
   *   Client identifier to be check with.
   *
   * @return
   *   Registered redirect URI of corresponding client identifier, and MUST
   *   return FALSE if the given client does not exist or is invalid.
   *
   * @ingroup oauth2_section_3
   */
  abstract protected function getRedirectUri($client_id);
  /**
   * Look up the supplied oauth_token from storage.
   *
   * We need to retrieve access token data as we create and verify tokens.
   *
   * @param $oauth_token
   *   oauth_token to be check with.
   *
   * @return
   *   An associative array as below, and return NULL if the supplied oauth_token
   *   is invalid:
   *   - client_id: Stored client identifier.
   *   - expires: Stored expiration in unix timestamp.
   *   - scope: (optional) Stored scope values in space-separated string.
   *
   * @ingroup oauth2_section_5
   */
  abstract protected function getAccessToken($oauth_token);
  /**
   * Store the supplied access token values to storage.
   *
   * We need to store access token data as we create and verify tokens.
   *
   * @param $oauth_token
   *   oauth_token to be stored.
   * @param $client_id
   *   Client identifier to be stored.
   * @param $expires
   *   Expiration to be stored.
   * @param $user_id
   *   User ID
   * @param $scope
   *   (optional) Scopes to be stored in space-separated string.
   *
   * @ingroup oauth2_section_4
   */
  abstract protected function setAccessToken($oauth_token, $client_id, $expires, $user_id, $scope=NULL, $refresh_token='');
  // Stuff that should get overridden by subclasses.
  //
  // I don't want to make these abstract, because then subclasses would have
  // to implement all of them, which is too much work.
  //
  // So they're just stubs. Override the ones you need.
  /**
   * Return supported grant types.
   *
   * You should override this function with something, or else your OAuth
   * provider won't support any grant types!
   *
   * @return
   *   A list as below. If you support all grant types, then you'd do:
   * @code
   * return array(
   *   OAUTH2_GRANT_TYPE_AUTH_CODE,
   *   OAUTH2_GRANT_TYPE_USER_CREDENTIALS,
   *   OAUTH2_GRANT_TYPE_ASSERTION,
   *   OAUTH2_GRANT_TYPE_REFRESH_TOKEN,
   *   OAUTH2_GRANT_TYPE_NONE,
   * );
   * @endcode
   *
   * @ingroup oauth2_section_4
   */
  protected function getSupportedGrantTypes() {
    return array();
  }
  /**
   * Return supported authorization response types.
   *
   * You should override this function with your supported response types.
   *
   * @return
   *   A list as below. If you support all authorization response types,
   *   then you'd do:
   * @code
   * return array(
   *   OAUTH2_AUTH_RESPONSE_TYPE_AUTH_CODE,
   *   OAUTH2_AUTH_RESPONSE_TYPE_ACCESS_TOKEN,
   *   OAUTH2_AUTH_RESPONSE_TYPE_CODE_AND_TOKEN,
   * );
   * @endcode
   *
   * @ingroup oauth2_section_3
   */
  protected function getSupportedAuthResponseTypes() {
    return array(
      OAUTH2_AUTH_RESPONSE_TYPE_AUTH_CODE,
      OAUTH2_AUTH_RESPONSE_TYPE_ACCESS_TOKEN,
      OAUTH2_AUTH_RESPONSE_TYPE_CODE_AND_TOKEN
    );
  }
  /**
   * Return supported scopes.
   *
   * If you want to support scope use, then have this function return a list
   * of all acceptable scopes (used to throw the invalid-scope error).
   *
   * @return
   *   A list as below, for example:
   * @code
   * return array(
   *   'my-friends',
   *   'photos',
   *   'whatever-else',
   * );
   * @endcode
   *
   * @ingroup oauth2_section_3
   */
  protected function getSupportedScopes() {
    return array();
  }
  /**
   * Check restricted authorization response types of corresponding Client
   * identifier.
   *
   * If you want to restrict clients to certain authorization response types,
   * override this function.
   *
   * @param $client_id
   *   Client identifier to be check with.
   * @param $response_type
   *   Authorization response type to be check with, would be one of the
   *   values contained in OAUTH2_AUTH_RESPONSE_TYPE_REGEXP.
   *
   * @return
   *   TRUE if the authorization response type is supported by this
   *   client identifier, and FALSE if it isn't.
   *
   * @ingroup oauth2_section_3
   */
  protected function checkRestrictedAuthResponseType($client_id, $response_type) {
    return TRUE;
  }
  /**
   * Check restricted grant types of corresponding client identifier.
   *
   * If you want to restrict clients to certain grant types, override this
   * function.
   *
   * @param $client_id
   *   Client identifier to be check with.
   * @param $grant_type
   *   Grant type to be check with, would be one of the values contained in
   *   OAUTH2_GRANT_TYPE_REGEXP.
   *
   * @return
   *   TRUE if the grant type is supported by this client identifier, and
   *   FALSE if it isn't.
   *
   * @ingroup oauth2_section_4
   */
  protected function checkRestrictedGrantType($client_id, $grant_type) {
    return TRUE;
  }
  // Functions that help grant access tokens for various grant types.
  /**
   * Fetch authorization code data (probably the most common grant type).
   *
   * Retrieve the stored data for the given authorization code.
   *
   * Required for OAUTH2_GRANT_TYPE_AUTH_CODE.
   *
   * @param $code
   *   Authorization code to be check with.
   *
   * @return
   *   An associative array as below, and NULL if the code is invalid:
   *   - client_id: Stored client identifier.
   *   - redirect_uri: Stored redirect URI.
   *   - expires: Stored expiration in unix timestamp.
   *   - scope: (optional) Stored scope values in space-separated string.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.1.1
   *
   * @ingroup oauth2_section_4
   */
  protected function getAuthCode($code) {
    return NULL;
  }
  /**
   * Take the provided authorization code values and store them somewhere.
   *
   * This function should be the storage counterpart to getAuthCode().
   *
   * If storage fails for some reason, we're not currently checking for
   * any sort of success/failure, so you should bail out of the script
   * and provide a descriptive fail message.
   *
   * Required for OAUTH2_GRANT_TYPE_AUTH_CODE.
   *
   * @param $code
   *   Authorization code to be stored.
   * @param $client_id
   *   Client identifier to be stored.
   * @param $redirect_uri
   *   Redirect URI to be stored.
   * @param $expires
   *   Expiration to be stored.
   * @param $scope
   *   (optional) Scopes to be stored in space-separated string.
   *
   * @ingroup oauth2_section_4
   */
  protected function setAuthCode($code, $client_id, $redirect_uri, $expires, $userId, $scope = NULL) {
  }
  /**
   * Grant access tokens for basic user credentials.
   *
   * Check the supplied username and password for validity.
   *
   * You can also use the $client_id param to do any checks required based
   * on a client, if you need that.
   *
   * Required for OAUTH2_GRANT_TYPE_USER_CREDENTIALS.
   *
   * @param $client_id
   *   Client identifier to be check with.
   * @param $username
   *   Username to be check with.
   * @param $password
   *   Password to be check with.
   *
   * @return
   *   TRUE if the username and password are valid, and FALSE if it isn't.
   *   Moreover, if the username and password are valid, and you want to
   *   verify the scope of a user's access, return an associative array
   *   with the scope values as below. We'll check the scope you provide
   *   against the requested scope before providing an access token:
   * @code
   * return array(
   *   'scope' => <stored scope values (space-separated string)>,
   * );
   * @endcode
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.1.2
   *
   * @ingroup oauth2_section_4
   */
  protected function checkUserCredentials($client_id, $username, $password) {
    return FALSE;
  }
  /**
   * Grant access tokens for assertions.
   *
   * Check the supplied assertion for validity.
   *
   * You can also use the $client_id param to do any checks required based
   * on a client, if you need that.
   *
   * Required for OAUTH2_GRANT_TYPE_ASSERTION.
   *
   * @param $client_id
   *   Client identifier to be check with.
   * @param $assertion_type
   *   The format of the assertion as defined by the authorization server.
   * @param $assertion
   *   The assertion.
   *
   * @return
   *   TRUE if the assertion is valid, and FALSE if it isn't. Moreover, if
   *   the assertion is valid, and you want to verify the scope of an access
   *   request, return an associative array with the scope values as below.
   *   We'll check the scope you provide against the requested scope before
   *   providing an access token:
   * @code
   * return array(
   *   'scope' => <stored scope values (space-separated string)>,
   * );
   * @endcode
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.1.3
   *
   * @ingroup oauth2_section_4
   */
  protected function checkAssertion($client_id, $assertion_type, $assertion) {
    return FALSE;
  }
  /**
   * Grant refresh access tokens.
   *
   * Retrieve the stored data for the given refresh token.
   *
   * Required for OAUTH2_GRANT_TYPE_REFRESH_TOKEN.
   *
   * @param $refresh_token
   *   Refresh token to be check with.
   *
   * @return
   *   An associative array as below, and NULL if the refresh_token is
   *   invalid:
   *   - client_id: Stored client identifier.
   *   - expires: Stored expiration unix timestamp.
   *   - scope: (optional) Stored scope values in space-separated string.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.1.4
   *
   * @ingroup oauth2_section_4
   */
  protected function getRefreshToken($refresh_token) {
    return NULL;
  }
  /**
   * Take the provided refresh token values and store them somewhere.
   *
   * This function should be the storage counterpart to getRefreshToken().
   *
   * If storage fails for some reason, we're not currently checking for
   * any sort of success/failure, so you should bail out of the script
   * and provide a descriptive fail message.
   *
   * Required for OAUTH2_GRANT_TYPE_REFRESH_TOKEN.
   *
   * @param $refresh_token
   *   Refresh token to be stored.
   * @param $client_id
   *   Client identifier to be stored.
   * @param $expires
   *   expires to be stored.
   * @param $scope
   *   (optional) Scopes to be stored in space-separated string.
   *
   * @ingroup oauth2_section_4
   */
  protected function setRefreshToken($refresh_token, $client_id, $expires, $scope = NULL) {
    return;
  }
  /**
   * Expire a used refresh token.
   *
   * This is not explicitly required in the spec, but is almost implied.
   * After granting a new refresh token, the old one is no longer useful and
   * so should be forcibly expired in the data store so it can't be used again.
   *
   * If storage fails for some reason, we're not currently checking for
   * any sort of success/failure, so you should bail out of the script
   * and provide a descriptive fail message.
   *
   * @param $refresh_token
   *   Refresh token to be expirse.
   *
   * @ingroup oauth2_section_4
   */
  protected function unsetRefreshToken($refresh_token) {
    return;
  }
  /**
   * Grant access tokens for the "none" grant type.
   *
   * Not really described in the IETF Draft, so I just left a method
   * stub... Do whatever you want!
   *
   * Required for OAUTH2_GRANT_TYPE_NONE.
   *
   * @ingroup oauth2_section_4
   */
  protected function checkNoneAccess($client_id) {
    return FALSE;
  }
  /**
   * Get default authentication realm for WWW-Authenticate header.
   *
   * Change this to whatever authentication realm you want to send in a
   * WWW-Authenticate header.
   *
   * @return
   *   A string that you want to send in a WWW-Authenticate header.
   *
   * @ingroup oauth2_error
   */
  protected function getDefaultAuthenticationRealm() {
    return "Service";
  }
  // End stuff that should get overridden.
  /**
   * Creates an OAuth2.0 server-side instance.
   *
   * @param $config
   *   An associative array as below:
   *   - access_token_lifetime: (optional) The lifetime of access token in
   *     seconds.
   *   - auth_code_lifetime: (optional) The lifetime of authorization code in
   *     seconds.
   *   - refresh_token_lifetime: (optional) The lifetime of refresh token in
   *     seconds.
   *   - display_error: (optional) Whether to show verbose error messages in
   *     the response.
   */
  public function __construct($config = array()) {
    foreach ($config as $name => $value) {
      $this->setVariable($name, $value);
    }
  }
  // Resource protecting (Section 5).
  /**
   * Check that a valid access token has been provided.
   *
   * The scope parameter defines any required scope that the token must have.
   * If a scope param is provided and the token does not have the required
   * scope, we bounce the request.
   *
   * Some implementations may choose to return a subset of the protected
   * resource (i.e. "public" data) if the user has not provided an access
   * token or if the access token is invalid or expired.
   *
   * The IETF spec says that we should send a 401 Unauthorized header and
   * bail immediately so that's what the defaults are set to.
   *
   * @param $scope
   *   A space-separated string of required scope(s), if you want to check
   *   for scope.
   * @param $exit_not_present
   *   If TRUE and no access token is provided, send a 401 header and exit,
   *   otherwise return FALSE.
   * @param $exit_invalid
   *   If TRUE and the implementation of getAccessToken() returns NULL, exit,
   *   otherwise return FALSE.
   * @param $exit_expired
   *   If TRUE and the access token has expired, exit, otherwise return FALSE.
   * @param $exit_scope
   *   If TRUE the access token does not have the required scope(s), exit,
   *   otherwise return FALSE.
   * @param $realm
   *   If you want to specify a particular realm for the WWW-Authenticate
   *   header, supply it here.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5
   *
   * @ingroup oauth2_section_5
   */
  public function verifyAccessToken($scope = NULL, $exit_not_present = TRUE, $exit_invalid = TRUE, $exit_expired = TRUE, $exit_scope = TRUE, $realm = NULL) {
    $token_param = $this->getAccessTokenParams();
    if ($token_param === FALSE) // Access token was not provided
      return $exit_not_present ? $this->errorWWWAuthenticateResponseHeader(OAUTH2_HTTP_BAD_REQUEST, $realm, OAUTH2_ERROR_INVALID_REQUEST, 'The request is missing a required parameter, includes an unsupported parameter or parameter value, repeats the same parameter, uses more than one method for including an access token, or is otherwise malformed.', NULL, $scope) : FALSE;
    // Get the stored token data (from the implementing subclass)
    $token = $this->getAccessToken($token_param);
    if ($token === NULL)
      return $exit_invalid ? $this->errorWWWAuthenticateResponseHeader(OAUTH2_HTTP_UNAUTHORIZED, $realm, OAUTH2_ERROR_INVALID_TOKEN, 'The access token provided is invalid.', NULL, $scope) : FALSE;
    // Check token expiration (I'm leaving this check separated, later we'll fill in better error messages)
    if (isset($token["expires"]) && time() > $token["expires"])
      return $exit_expired ? $this->errorWWWAuthenticateResponseHeader(OAUTH2_HTTP_UNAUTHORIZED, $realm, OAUTH2_ERROR_EXPIRED_TOKEN, 'The access token provided has expired.', NULL, $scope) : FALSE;
    // Check scope, if provided
    // If token doesn't have a scope, it's NULL/empty, or it's insufficient, then throw an error
    if ($scope && (!isset($token["scope"]) || !$token["scope"] || !$this->checkScope($scope, $token["scope"])))
      return $exit_scope ? $this->errorWWWAuthenticateResponseHeader(OAUTH2_HTTP_FORBIDDEN, $realm, OAUTH2_ERROR_INSUFFICIENT_SCOPE, 'The request requires higher privileges than provided by the access token.', NULL, $scope) : FALSE;
    return TRUE;
  }
  /**
   * Check if everything in required scope is contained in available scope.
   *
   * @param $required_scope
   *   Required scope to be check with.
   * @param $available_scope
   *   Available scope to be compare with.
   *
   * @return
   *   TRUE if everything in required scope is contained in available scope,
   *   and False if it isn't.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5
   *
   * @ingroup oauth2_section_5
   */
  private function checkScope($required_scope, $available_scope) {
    // The required scope should match or be a subset of the available scope
    if (!is_array($required_scope))
      $required_scope = explode(" ", $required_scope);
    if (!is_array($available_scope))
      $available_scope = explode(" ", $available_scope);
    return (count(array_diff($required_scope, $available_scope)) == 0);
  }
  /**
   * Pulls the access token out of the HTTP request.
   *
   * Either from the Authorization header or GET/POST/etc.
   *
   * @return
   *   Access token value if present, and FALSE if it isn't.
   *
   * @todo Support PUT or DELETE.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.1
   *
   * @ingroup oauth2_section_5
   */
  private function getAccessTokenParams() {
    $auth_header = $this->getAuthorizationHeader();
    if ($auth_header !== FALSE) {
      // Make sure only the auth header is set
      if (isset($_GET[OAUTH2_TOKEN_PARAM_NAME]) || isset($_POST[OAUTH2_TOKEN_PARAM_NAME]))
        $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_REQUEST, 'Auth token found in GET or POST when token present in header');
      $auth_header = trim($auth_header);
      // Make sure it's Token authorization
      if (strcmp(substr($auth_header, 0, 5), "OAuth ") !== 0)
        $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_REQUEST, 'Auth header found that doesn\'t start with "OAuth"');
      // Parse the rest of the header
      if (preg_match('/\s*OAuth\s*="(.+)"/', substr($auth_header, 5), $matches) == 0 || count($matches) < 2)
        $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_REQUEST, 'Malformed auth header');
      return $matches[1];
    }
    if (isset($_GET[OAUTH2_TOKEN_PARAM_NAME])) {
      if (isset($_POST[OAUTH2_TOKEN_PARAM_NAME])) // Both GET and POST are not allowed
        $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_REQUEST, 'Only send the token in GET or POST, not both');
      return $_GET[OAUTH2_TOKEN_PARAM_NAME];
    }
    if (isset($_POST[OAUTH2_TOKEN_PARAM_NAME]))
      return $_POST[OAUTH2_TOKEN_PARAM_NAME];
    return FALSE;
  }
  // Access token granting (Section 4).
  /**
   * Grant or deny a requested access token.
   *
   * This would be called from the "/token" endpoint as defined in the spec.
   * Obviously, you can call your endpoint whatever you want.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4
   *
   * @ingroup oauth2_section_4
   */
  public function grantAccessToken() {
    $filters = array(
      "grant_type" => array("filter" => FILTER_VALIDATE_REGEXP, "options" => array("regexp" => OAUTH2_GRANT_TYPE_REGEXP), "flags" => FILTER_REQUIRE_SCALAR),
      "scope" => array("flags" => FILTER_REQUIRE_SCALAR),
      "code" => array("flags" => FILTER_REQUIRE_SCALAR),
      "redirect_uri" => array("filter" => FILTER_SANITIZE_URL),
      "username" => array("flags" => FILTER_REQUIRE_SCALAR),
      "password" => array("flags" => FILTER_REQUIRE_SCALAR),
      "assertion_type" => array("flags" => FILTER_REQUIRE_SCALAR),
      "assertion" => array("flags" => FILTER_REQUIRE_SCALAR),
      "refresh_token" => array("flags" => FILTER_REQUIRE_SCALAR),
    );
    $input = filter_input_array(INPUT_POST, $filters);
    // Grant Type must be specified.
    if (!$input["grant_type"])
      $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_REQUEST, 'Invalid grant_type parameter or parameter missing');
    // Make sure we've implemented the requested grant type
    if (!in_array($input["grant_type"], $this->getSupportedGrantTypes()))
      $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_UNSUPPORTED_GRANT_TYPE);
    // Authorize the client
    $client = $this->getClientCredentials();
    if ($this->checkClientCredentials($client[0], $client[1]) === FALSE)
      $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_CLIENT);
    if (!$this->checkRestrictedGrantType($client[0], $input["grant_type"]))
      $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_UNAUTHORIZED_CLIENT);
    // Do the granting
    switch ($input["grant_type"]) {
      case OAUTH2_GRANT_TYPE_AUTH_CODE:
        if (!$input["code"] || !$input["redirect_uri"])
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_REQUEST);
        $stored = $this->getAuthCode($input["code"]);
        // Ensure that the input uri starts with the stored uri
        if ($stored === NULL || (strcasecmp(substr($input["redirect_uri"], 0, strlen($stored["redirect_uri"])), $stored["redirect_uri"]) !== 0) || $client[0] != $stored["client_id"])
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_GRANT);
        if ($stored["expires"] < time())
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_EXPIRED_TOKEN);
        break;
      case OAUTH2_GRANT_TYPE_USER_CREDENTIALS:
        if (!$input["username"] || !$input["password"])
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_REQUEST, 'Missing parameters. "username" and "password" required');
        $stored = $this->checkUserCredentials($client[0], $input["username"], $input["password"]);
        if ($stored === FALSE)
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_GRANT);
        break;
      case OAUTH2_GRANT_TYPE_ASSERTION:
        if (!$input["assertion_type"] || !$input["assertion"])
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_REQUEST);
        $stored = $this->checkAssertion($client[0], $input["assertion_type"], $input["assertion"]);
        if ($stored === FALSE)
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_GRANT);
        break;
      case OAUTH2_GRANT_TYPE_REFRESH_TOKEN:
        if (!$input["refresh_token"])
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_REQUEST, 'No "refresh_token" parameter found');
        $stored = $this->getRefreshToken($input["refresh_token"]);
        if ($stored === NULL || $client[0] != $stored["client_id"])
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_GRANT);
        if ($stored["expires"] < time())
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_EXPIRED_TOKEN);
        // store the refresh token locally so we can delete it when a new refresh token is generated
        $this->setVariable('_old_refresh_token', $stored["token"]);
        break;
      case OAUTH2_GRANT_TYPE_NONE:
        $stored = $this->checkNoneAccess($client[0]);
        if ($stored === FALSE)
          $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_REQUEST);
    }
    // Check scope, if provided
    if ($input["scope"] && (!is_array($stored) || !isset($stored["scope"]) || !$this->checkScope($input["scope"], $stored["scope"])))
      $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_SCOPE);
    if (!$input["scope"])
      $input["scope"] = NULL;
    $token = $this->createAccessToken($client[0], $input["scope"], $stored["user_id"]);
    //TOKEN 为 数组 (包括 TOKEN 值， 有效时间， 权限)
    // $this->sendJsonHeaders();
    echo json_encode($token);
  }
  /**
   * Internal function used to get the client credentials from HTTP basic
   * auth or POST data.
   *
   * @return
   *   A list containing the client identifier and password, for example
   * @code
   * return array(
   *   $_POST["client_id"],
   *   $_POST["client_secret"],
   * );
   * @endcode
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-2
   *
   * @ingroup oauth2_section_2
   */
  protected function getClientCredentials() {
    if (isset($_SERVER["PHP_AUTH_USER"]) && $_POST && isset($_POST["client_id"]))
        $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_CLIENT);
    // Try basic auth
    if (isset($_SERVER["PHP_AUTH_USER"]))
        return array($_SERVER["PHP_AUTH_USER"], $_SERVER["PHP_AUTH_PW"]);
    // Try POST
    if ($_POST && isset($_POST["client_id"])) {
      if (isset($_POST["client_secret"]))
        return array($_POST["client_id"], $_POST["client_secret"]);
      return array($_POST["client_id"], NULL);
    }
    // No credentials were specified
    $this->errorJsonResponse(OAUTH2_HTTP_BAD_REQUEST, OAUTH2_ERROR_INVALID_CLIENT);
  }
  // End-user/client Authorization (Section 3 of IETF Draft).
  /**
   * Pull the authorization request data out of the HTTP request.
   *
   * @return
   *   The authorization parameters so the authorization server can prompt
   *   the user for approval if valid.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3
   *
   * @ingroup oauth2_section_3
   */
  public function getAuthorizeParams() {
    $filters = array(
      "client_id" => array("filter" => FILTER_VALIDATE_REGEXP, "options" => array("regexp" => OAUTH2_CLIENT_ID_REGEXP), "flags" => FILTER_REQUIRE_SCALAR),
      "response_type" => array("filter" => FILTER_VALIDATE_REGEXP, "options" => array("regexp" => OAUTH2_AUTH_RESPONSE_TYPE_REGEXP), "flags" => FILTER_REQUIRE_SCALAR),
      "redirect_uri" => array("filter" => FILTER_SANITIZE_URL),
      "state" => array("flags" => FILTER_REQUIRE_SCALAR),
      "scope" => array("flags" => FILTER_REQUIRE_SCALAR),
    );
    $input = filter_input_array(INPUT_GET, $filters);
    // Make sure a valid client id was supplied
    if (!$input["client_id"]) {
      if ($input["redirect_uri"])
        $this->errorDoRedirectUriCallback($input["redirect_uri"], OAUTH2_ERROR_INVALID_CLIENT, NULL, NULL, $input["state"]);
      $this->errorJsonResponse(OAUTH2_HTTP_FOUND, OAUTH2_ERROR_INVALID_CLIENT); // We don't have a good URI to use
    }
    // redirect_uri is not required if already established via other channels
    // check an existing redirect URI against the one supplied
    $redirect_uri = $this->getRedirectUri($input["client_id"]);
    // At least one of: existing redirect URI or input redirect URI must be specified
    if (!$redirect_uri && !$input["redirect_uri"])
      $this->errorJsonResponse(OAUTH2_HTTP_FOUND, OAUTH2_ERROR_INVALID_REQUEST);
    // getRedirectUri() should return FALSE if the given client ID is invalid
    // this probably saves us from making a separate db call, and simplifies the method set
    if ($redirect_uri === FALSE)
      $this->errorDoRedirectUriCallback($input["redirect_uri"], OAUTH2_ERROR_INVALID_CLIENT, NULL, NULL, $input["state"]);
    // If there's an existing uri and one from input, verify that they match
    if ($redirect_uri && $input["redirect_uri"]) {
      // Ensure that the input uri starts with the stored uri
      if (strcasecmp(substr($input["redirect_uri"], 0, strlen($redirect_uri)), $redirect_uri) !== 0)
        $this->errorDoRedirectUriCallback($input["redirect_uri"], OAUTH2_ERROR_REDIRECT_URI_MISMATCH, NULL, NULL, $input["state"]);
    }
    elseif ($redirect_uri) { // They did not provide a uri from input, so use the stored one
      $input["redirect_uri"] = $redirect_uri;
    }
    // type and client_id are required
    if (!$input["response_type"])
      $this->errorDoRedirectUriCallback($input["redirect_uri"], OAUTH2_ERROR_INVALID_REQUEST, 'Invalid response type.', NULL, $input["state"]);
    // Check requested auth response type against the list of supported types
    if (array_search($input["response_type"], $this->getSupportedAuthResponseTypes()) === FALSE)
      $this->errorDoRedirectUriCallback($input["redirect_uri"], OAUTH2_ERROR_UNSUPPORTED_RESPONSE_TYPE, NULL, NULL, $input["state"]);
    // Restrict clients to certain authorization response types
    if ($this->checkRestrictedAuthResponseType($input["client_id"], $input["response_type"]) === FALSE)
      $this->errorDoRedirectUriCallback($input["redirect_uri"], OAUTH2_ERROR_UNAUTHORIZED_CLIENT, NULL, NULL, $input["state"]);
    // Validate that the requested scope is supported
    if ($input["scope"] && !$this->checkScope($input["scope"], $this->getSupportedScopes()))
      $this->errorDoRedirectUriCallback($input["redirect_uri"], OAUTH2_ERROR_INVALID_SCOPE, NULL, NULL, $input["state"]);
    return $input;
  }
  /**
   * Redirect the user appropriately after approval.
   *
   * After the user has approved or denied the access request the
   * authorization server should call this function to redirect the user
   * appropriately.
   *
   * @param $is_authorized
   *   TRUE or FALSE depending on whether the user authorized the access.
   * @param $params
   *   An associative array as below:
   *   - response_type: The requested response: an access token, an
   *     authorization code, or both.
   *   - client_id: The client identifier as described in Section 2.
   *   - redirect_uri: An absolute URI to which the authorization server
   *     will redirect the user-agent to when the end-user authorization
   *     step is completed.
   *   - scope: (optional) The scope of the access request expressed as a
   *     list of space-delimited strings.
   *   - state: (optional) An opaque value used by the client to maintain
   *     state between the request and callback.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3
   *
   * @ingroup oauth2_section_3
   */
  public function finishClientAuthorization($is_authorized, $params = array()) {
    $params += array(
      // 'scope' => NULL,
      'state' => NULL,
    );
    extract($params);
    if ($state !== NULL)
      $result["query"]["state"] = $state;
    if ($is_authorized === FALSE) {
      $result["query"]["error"] = OAUTH2_ERROR_USER_DENIED;
    }
    else {
      if ($response_type == OAUTH2_AUTH_RESPONSE_TYPE_AUTH_CODE || $response_type == OAUTH2_AUTH_RESPONSE_TYPE_CODE_AND_TOKEN)
        $result["query"]["code"] = $this->createAuthCode($client_id, $redirect_uri, $user_id, $scope);
      if ($response_type == OAUTH2_AUTH_RESPONSE_TYPE_ACCESS_TOKEN || $response_type == OAUTH2_AUTH_RESPONSE_TYPE_CODE_AND_TOKEN)
        $result["fragment"] = $this->createAccessToken($client_id, $scope, $user_id);
    }
    $result['display'] = !empty($display) ? $display : '';
    $this->doRedirectUriCallback($redirect_uri, $result);
  }
  // Other/utility functions.
  /**
   * Redirect the user agent.
   *
   * Handle both redirect for success or error response.
   *
   * @param $redirect_uri
   *   An absolute URI to which the authorization server will redirect
   *   the user-agent to when the end-user authorization step is completed.
   * @param $params
   *   Parameters to be pass though buildUri().
   *
   * @ingroup oauth2_section_3
   */
  private function doRedirectUriCallback($redirect_uri, $params) {
    header("HTTP/1.1 ". OAUTH2_HTTP_FOUND);
    if($params['display'] == 'frame') {
        echo '<script>window.top.location.href="'.$this->buildUri($redirect_uri, $params).'";</script>';
    } else {
        header("Location: " . $this->buildUri($redirect_uri, $params));
    }
    exit;
  }
  /**
   * Build the absolute URI based on supplied URI and parameters.
   *
   * @param $uri
   *   An absolute URI.
   * @param $params
   *   Parameters to be append as GET.
   *
   * @return
   *   An absolute URI with supplied parameters.
   *
   * @ingroup oauth2_section_3
   */
  private function buildUri($uri, $params) {
    session_start();
    $parse_url = parse_url($uri);
    // Add our params to the parsed uri
    foreach ($params as $k => $v) {
      if (isset($parse_url[$k]))
        $parse_url[$k] .= "&" . http_build_query($v);
      else
        $parse_url[$k] = http_build_query($v);
    }
    // Put humpty dumpty back together
    $return =
      ((isset($parse_url["scheme"])) ? $parse_url["scheme"] . "://" : "")
      . ((isset($parse_url["user"])) ? $parse_url["user"] . ((isset($parse_url["pass"])) ? ":" . $parse_url["pass"] : "") . "@" : "")
      . ((isset($parse_url["host"])) ? $parse_url["host"] : "")
      . ((isset($parse_url["port"])) ? ":" . $parse_url["port"] : "")
      . ((isset($parse_url["path"])) ? $parse_url["path"] : "")
      . ((isset($parse_url["query"])) ? "?" . $parse_url["query"] : "")
      . ((isset($parse_url["fragment"])) ? "#" . $parse_url["fragment"] : "") . "&ssid=".base64_encode('2egc83'.session_id());
    return $return;
  }
  /**
   * Handle the creation of access token, also issue refresh token if support.
   *
   * This belongs in a separate factory, but to keep it simple, I'm just
   * keeping it here.
   *
   * @param $client_id
   *   Client identifier related to the access token.
   * @param $scope
   *   (optional) Scopes to be stored in space-separated string.
   *
   * @ingroup oauth2_section_4
   */
  protected function createAccessToken($client_id, $scope = NULL, $user_id = 10) {
    $token = array(
      "access_token" => $this->genAccessToken(),
      "expires_in" => $this->getVariable('access_token_lifetime', OAUTH2_DEFAULT_ACCESS_TOKEN_LIFETIME),
      "user_id" => $user_id,
      "scope" => $scope
    );
    $refresh_token = '';
    // Issue a refresh token also, if we support them
    if (in_array(OAUTH2_GRANT_TYPE_REFRESH_TOKEN, $this->getSupportedGrantTypes())) {
      $refresh_token = $this->genAccessToken();
      // $this->setRefreshToken($token["refresh_token"], $client_id, time() + $this->getVariable('refresh_token_lifetime', OAUTH2_DEFAULT_REFRESH_TOKEN_LIFETIME), $user_id, $scope);
      $token["refresh_token"] = $refresh_token;
      // If we've granted a new refresh token, expire the old one
      if ($this->getVariable('_old_refresh_token'))
        $this->unsetRefreshToken($this->getVariable('_old_refresh_token'));
    }
    $access_token = $token['access_token'];
    $this->setAccessToken($access_token, $client_id, time() + $this->getVariable('access_token_lifetime', OAUTH2_DEFAULT_ACCESS_TOKEN_LIFETIME), $token['user_id'], $scope, $refresh_token);
    return $token;
  }
  /**
   * Handle the creation of auth code.
   *
   * This belongs in a separate factory, but to keep it simple, I'm just
   * keeping it here.
   *
   * @param $client_id
   *   Client identifier related to the access token.
   * @param $redirect_uri
   *   An absolute URI to which the authorization server will redirect the
   *   user-agent to when the end-user authorization step is completed.
   * @param $scope
   *   (optional) Scopes to be stored in space-separated string.
   *
   * @ingroup oauth2_section_3
   */
  private function createAuthCode($client_id, $redirect_uri, $userId, $scope = NULL) {
    $code = $this->genAuthCode();
    $this->setAuthCode($code, $client_id, $redirect_uri, time() + $this->getVariable('auth_code_lifetime', OAUTH2_DEFAULT_AUTH_CODE_LIFETIME), $userId, $scope);
    return $code;
  }
  /**
   * Generate unique access token.
   *
   * Implementing classes may want to override these function to implement
   * other access token or auth code generation schemes.
   *
   * @return
   *   An unique access token.
   *
   * @ingroup oauth2_section_4
   */
  protected function genAccessToken() {
    return md5(base64_encode(pack('N6', mt_rand(), mt_rand(), mt_rand(), mt_rand(), mt_rand(), uniqid())));
  }
  /**
   * Generate unique auth code.
   *
   * Implementing classes may want to override these function to implement
   * other access token or auth code generation schemes.
   *
   * @return
   *   An unique auth code.
   *
   * @ingroup oauth2_section_3
   */
  protected function genAuthCode() {
    return md5(base64_encode(pack('N6', mt_rand(), mt_rand(), mt_rand(), mt_rand(), mt_rand(), uniqid())));
  }
  /**
   * Pull out the Authorization HTTP header and return it.
   *
   * Implementing classes may need to override this function for use on
   * non-Apache web servers.
   *
   * @return
   *   The Authorization HTTP header, and FALSE if does not exist.
   *
   * @todo Handle Authorization HTTP header for non-Apache web servers.
   *
   * @ingroup oauth2_section_5
   */
  private function getAuthorizationHeader() {
    if (array_key_exists("HTTP_AUTHORIZATION", $_SERVER))
      return $_SERVER["HTTP_AUTHORIZATION"];
    if (function_exists("apache_request_headers")) {
      $headers = apache_request_headers();
      if (array_key_exists("Authorization", $headers))
        return $headers["Authorization"];
    }
    return FALSE;
  }
  /**
   * Send out HTTP headers for JSON.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.2
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.3
   *
   * @ingroup oauth2_section_4
   */
  private function sendJsonHeaders() {
    header("Content-Type: application/json");
    header("Cache-Control: no-store");
  }
  /**
   * Redirect the end-user's user agent with error message.
   *
   * @param $redirect_uri
   *   An absolute URI to which the authorization server will redirect the
   *   user-agent to when the end-user authorization step is completed.
   * @param $error
   *   A single error code as described in Section 3.2.1.
   * @param $error_description
   *   (optional) A human-readable text providing additional information,
   *   used to assist in the understanding and resolution of the error
   *   occurred.
   * @param $error_uri
   *   (optional) A URI identifying a human-readable web page with
   *   information about the error, used to provide the end-user with
   *   additional information about the error.
   * @param $state
   *   (optional) REQUIRED if the "state" parameter was present in the client
   *   authorization request. Set to the exact value received from the client.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-3.2
   *
   * @ingroup oauth2_error
   */
  private function errorDoRedirectUriCallback($redirect_uri, $error, $error_description = NULL, $error_uri = NULL, $state = NULL) {
    $result["query"]["error"] = $error;
    if ($state)
      $result["query"]["state"] = $state;
    if ($this->getVariable('display_error') && $error_description)
      $result["query"]["error_description"] = $error_description;
    if ($this->getVariable('display_error') && $error_uri)
      $result["query"]["error_uri"] = $error_uri;
    $this->doRedirectUriCallback($redirect_uri, $result);
  }
  /**
   * Send out error message in JSON.
   *
   * @param $http_status_code
   *   HTTP status code message as predefined.
   * @param $error
   *   A single error code.
   * @param $error_description
   *   (optional) A human-readable text providing additional information,
   *   used to assist in the understanding and resolution of the error
   *   occurred.
   * @param $error_uri
   *   (optional) A URI identifying a human-readable web page with
   *   information about the error, used to provide the end-user with
   *   additional information about the error.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.3
   *
   * @ingroup oauth2_error
   */
  private function errorJsonResponse($http_status_code, $error, $error_description = NULL, $error_uri = NULL) {
    $result['error'] = $error;
    if ($this->getVariable('display_error') && $error_description)
      $result["error_description"] = $error_description;
    if ($this->getVariable('display_error') && $error_uri)
      $result["error_uri"] = $error_uri;
    header("HTTP/1.1 " . $http_status_code);
    $this->sendJsonHeaders();
    echo json_encode($result);
    exit;
  }
  /**
   * Send a 401 unauthorized header with the given realm and an error, if
   * provided.
   *
   * @param $http_status_code
   *   HTTP status code message as predefined.
   * @param $realm
   *   The "realm" attribute is used to provide the protected resources
   *   partition as defined by [RFC2617].
   * @param $scope
   *   A space-delimited list of scope values indicating the required scope
   *   of the access token for accessing the requested resource.
   * @param $error
   *   The "error" attribute is used to provide the client with the reason
   *   why the access request was declined.
   * @param $error_description
   *   (optional) The "error_description" attribute provides a human-readable text
   *   containing additional information, used to assist in the understanding
   *   and resolution of the error occurred.
   * @param $error_uri
   *   (optional) The "error_uri" attribute provides a URI identifying a human-readable
   *   web page with information about the error, used to offer the end-user
   *   with additional information about the error. If the value is not an
   *   absolute URI, it is relative to the URI of the requested protected
   *   resource.
   *
   * @see http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-5.2
   *
   * @ingroup oauth2_error
   */
  private function errorWWWAuthenticateResponseHeader($http_status_code, $realm, $error, $error_description = NULL, $error_uri = NULL, $scope = NULL) {
    $realm = $realm === NULL ? $this->getDefaultAuthenticationRealm() : $realm;
    $result = "WWW-Authenticate: OAuth realm='" . $realm . "'";
    if ($error)
      $result .= ", error='" . $error . "'";
    if ($this->getVariable('display_error') && $error_description)
      $result .= ", error_description='" . $error_description . "'";
    if ($this->getVariable('display_error') && $error_uri)
      $result .= ", error_uri='" . $error_uri . "'";
    if ($scope)
      $result .= ", scope='" . $scope . "'";
    header("HTTP/1.1 ". $http_status_code);
    header($result);
    exit;
  }
}

代码比较多。有兴趣的可以细看。

由于采用Vendor方法引入，所以这里的文件都没有采用命名空间。

5-3、在同目录下，建ThinkOAuth2.php文件，这个文件里的类继承上面那个基类：

<?php
require "oauth2.class.php";
class ThinkOAuth2 extends OAuth2{
    private $db;
    private $table;
    /**
     * 构造
     */
    public function __construct() {
        parent::__construct();
        $this -> db = M();
        $this -> table = array(
            'auth_codes'=>C('OAUTH2_CODES_TABLE'),
            'clients'=>C('OAUTH2_CLIENTS_TABLE'),
            'tokens'=>C('OAUTH2_TOKEN_TABLE')
        );
    }
    /**
     * 析构
     */
    function __destruct() {
        $this->db = NULL; // Release db connection
    }
    private function handleException($e) {
        echo "Database error: " . $e->getMessage();
        exit;
    }
    /**
     *
     * 增加client
     * @param string $client_id
     * @param string $client_secret
     * @param string $redirect_uri
     */
    public function addClient($client_id, $client_secret, $redirect_uri) {
        $time = time();
        $sql = "INSERT INTO {$this -> table['clients']} (client_id, client_secret, redirect_uri,create_time) VALUES ('{$client_id}', '{$client_secret}', '{$redirect_uri}','{$time}')";
        $res = $this -> db -> execute($sql);
        return res;    
    }
    /**
     * Implements OAuth2::checkClientCredentials()
     * @see OAuth2::checkClientCredentials()
     */
    protected function checkClientCredentials($client_id, $client_secret = NULL) {
        $sql = "SELECT client_secret FROM {$this -> table['clients']} WHERE client_id = {$client_id}";
        $result = $this -> db -> query($sql);
        if ($client_secret === NULL) {
            return $result !== FALSE;
        }
        //Log::write("checkClientCredentials : ".$result);
        //Log::write("checkClientCredentials : ".$result[0]);
        //Log::write("checkClientCredentials : ".$result[0]["client_secret"]);
        return $result[0]["client_secret"] == $client_secret;
    }
    /**
     * Implements OAuth2::getRedirectUri().
     * @see OAuth2::getRedirectUri()
     */
    protected function getRedirectUri($client_id) {
        $sql = "SELECT redirect_uri FROM {$this -> table['clients']} WHERE client_id = {$client_id}";
        $result = $this -> db -> query($sql);
        if ($result === FALSE) {
            return FALSE;
        }
        //Log::write("getRedirectUri : ".$result);
        //Log::write("getRedirectUri : ".$result[0]);
        //Log::write("getRedirectUri : ".$result[0]["redirect_uri"]);
        return isset($result[0]["redirect_uri"]) && $result[0]["redirect_uri"] ? $result[0]["redirect_uri"] : NULL;
    }
    /**
     * Implements OAuth2::getAccessToken().
     * @see OAuth2::getAccessToken()
     */
    protected function getAccessToken($access_token) {
        $sql = "SELECT client_id, expires_in, scope FROM {$this -> table['tokens']} WHERE access_token = '{$access_token}'";
        $result = $this -> db -> query($sql);
        //Log::write("getAccessToken : ".$result);
        //Log::write("getAccessToken : ".$result[0]);
        return $result !== FALSE ? $result : NULL;
    }
    /**
     * Implements OAuth2::setAccessToken().
     * @see OAuth2::setAccessToken()
     */
    protected function setAccessToken($access_token, $client_id, $expires, $user_id, $scope=NULL, $refresh_token='') {
$sql = "INSERT INTO {$this -> table['tokens']} (access_token, client_id, expires_in, scope,user_id,refresh_token) VALUES ('{$access_token}', '{$client_id}', '{$expires}', '{$scope}',{$user_id},'{$refresh_token}')";
        $this -> db -> execute($sql);
    }
    /**
     * Overrides OAuth2::getSupportedGrantTypes().
     * @see OAuth2::getSupportedGrantTypes()
     */
    protected function getSupportedGrantTypes() {
        return array(
            OAUTH2_GRANT_TYPE_AUTH_CODE
        );
    }
    /**
     * Overrides OAuth2::getAuthCode().
     * @see OAuth2::getAuthCode()
     */
    protected function getAuthCode($code) {
        $sql = "SELECT user_id, code, client_id, redirect_uri, expires, scope FROM {$this -> table['auth_codes']} WHERE code = '{$code}'";
        $result = $this -> db -> query($sql);
        //Log::write("getAuthcode : ".$result);
        //Log::write("getAuthcode : ".$result[0]);
        //Log::write("getAuthcode : ".$result[0]["code"]);
        return $result !== FALSE ? $result[0] : NULL;
    }
    /**
     * Overrides OAuth2::setAuthCode().
     * @see OAuth2::setAuthCode()
     */
    protected function setAuthCode($code, $client_id, $redirect_uri, $expires, $scope = NULL) {
        $time = time();
        $sql = "INSERT INTO {$this -> table['auth_codes']} (code, client_id, redirect_uri, expires, scope) VALUES ('{$code}', '{$client_id}', '{$redirect_uri}', '{$expires}', '{$scope}')";
        $result = $this -> db -> execute($sql);
  }
  /**
   * Overrides OAuth2::checkUserCredentials().
   * @see OAuth2::checkUserCredentials()
   */
  protected function checkUserCredentials($client_id, $username, $password){
      return TRUE;
  }
}

这里涉及到一些数据库的操作。继承出来操作，还是比较一目了然的。

5-4、准备好类了。我们就可以实现控制器里的功能代码。动手之前先搞清楚我们的意图。

首先，我们需要分配一个oauth_client和一个oauth_secrete给第三方网站（也就是client.ruanwenwu.cn)来获取oauth服务。

其次，client.ruanwenwu.cn会把用户导入到server.ruanwenwu.cn来进行授权。所以我们我们还需要准备授权页面。

因为涉及到服务端和客户端的数据交互，所以可能服务端和客户端的相关介绍我会交叉进行。

5-4-1、创建oauth_client。

5-4-2、获取oauth_cliest列表。

5-4-3、准备获取用户授权的页面和逻辑。（授权服务器）

5-4-4、准备提供用户数据的逻辑。（资源服务器）

这些逻辑我都写在一个控制器OauthController.class.php里。代码如下：

<?php
namespace Home\Controller;
use Think\Controller;
class OauthController extends Controller{
    private $oauth = NULL;
    function _initialize(){
        header("Content-Type: application/json");
        Vendor("oauth.ThinkOAuth2");
        $this -> oauth = new \ThinkOAuth2();
    }
    public function index(){
        header("Content-Type:application/json; charset=utf-8");
        $this -> ajaxReturn(null, 'oauth-server-start', 1, 'json');
    }
    public function access_token() {
        $this -> oauth -> grantAccessToken();
    }
    //权限验证
    public function authorize() {
        if (IS_POST) {
            if(true){
                //这个地方验证成功后要把用户的uid加进来
                $_POST['user_id'] = 1;
            $this -> oauth -> finishClientAuthorization(true, $_POST);    //第一个参数很重要，是用户是否授权
            }
            return;
        }
        ///表单准备
        $auth_params = $this -> oauth -> getAuthorizeParams();
        $this->assign("auth_params",$auth_params);
        $this->display();
    }
    public function addclient() {
        echo 'jack';
        if (IS_POST) {
            echo 'pd';
            $res = $this -> oauth -> addClient($_POST["client_id"], $_POST["client_secret"], $_POST["redirect_uri"]);
            if($res){
                $this->redirect("/home/Oauth/clientlist");
                die;
            }
        }
        $this->display();
    }
    public function clientlist(){
        $res = M()->table("oauth_client")->select();
        $this->assign("clients",$res);
        var_dump($res);
        $this->display();
    }
}

顺便我将用到的模板文件（server.ruanwenwu.cn\Application\Home\View\oauth目录下）也贴出来给大家参考一下：

addclient.html

<!doctype html>
    <head>
        <meta charset="utf-8" />
        <title>这里是添加客户端界面</title>
    </head>
    <body>
        <h1>添加客户端</h1>
        <form action="" method="post" >
            clientId:<input type="text" name="client_id" />
            <br />
            client_secrete:<input type="text" name="client_secret" />
            <br />
            callbackUrl:<input type="text" name="redirect_uri" />
            <br />
            <input type="submit" value="submit" />
        </form>
    </body>
</html>

authorize.html

<!doctype html>
<html>
    <form action="" method="post">
        用户名：<input type="text" name="username" />
        <br />
        密码：<input type="text" name="pwd" />
        <input type="hidden" name="response_type" value="code" />
        <input type="hidden" name="client_id" value="{$auth_params['client_id']}" />
        <input type="hidden" name="redirect_uri" value="{$auth_params['redirect_uri']}" />
        <input type="submit" value="submit" />
    </form>
</html>

注意：我这里用到了几个隐藏域。这个是必须的，在post提交验证时会用到。

5-4-5、创建oauth2.0用户。

打 开server.ruanwenwu.cn/index.php/home/oauth/addcient,输入client_id和 client_secrete还有redirect_uri创建一个oauth2.0用户。其中redirect_uri是用户授权后需要跳转的地方。

到这里服务端的部署就差不多结束了。现在开始部署客户端。

三、oauth2.0客户端搭建。

1、同服务端一样搭建client.ruanwenwu.cn。（也是用thinkphp)。

2、能正常访问后。在类库中加入oauth2.0客户端类。

在\client.ruanwenwu.cn\ThinkPHP\Library\Org\Util目录下建立Oauth2.class.php，代码如下：

<?php
namespace Org\Util;
/**
 * 与 OAuth2 服务器 通讯验证 核心类 (PHP版)
 *
 * @description OAuth2 说明请大家参考 木蚂蚁接口文档
 *
 *
 * @author   Mumayi-Team (zhaopan赵攀)
 * @version  1.0
 * @datetime 2013-12-31
 */
class Oauth2
{
    /*
     * 以下几个参数 具体作用和用法 详见 木蚂蚁接口文档
     */
    //分配的客户端 ID
    public $client_id;
    //分配的客户端 密匙
    public $client_secret;
    //获得的 用户授权 访问令牌
    public $access_token;
    //刷新 访问令牌 (过期时使用)
    public $refresh_token;
    // 最后一个收到的HTTP代码 (用于调试，忽略)
    public $http_code;
    //预留字段 (忽略)
    public $url;
    //设置 基础链接
    public $host = "http://server.ruanwenwu.cn/index.php/home/oauth/";
    //请求超时时间
    public $timeout = 30;
    //链接超时时间
    public $connecttimeout = 30;
    //是否验证 SSL 证书
    public $ssl_verifypeer = FALSE;
    //请求结果处理格式
    public $format = 'json';
    //以 JSON_DECODE 方式解析
    public $decode_json = TRUE;
    //预留字段 (忽略)
    public $http_info;
    //CURL 函数使用 (验证使用， 忽略)
    public $useragent = 'Mumayi Team OAuth2 v1.0';
    //是否 开启 请求调试 (开启时 将输出 详细的请求结果)
    public $debug = FALSE;
    //边界 (CURL使用 写入在Header的分界线, 忽略)
    public static $boundary = '';
    //返回 OAuth 令牌 请求地址
    function accessTokenURL()  { return $this->host.'access_token'; }
    //返回 OAuth 自动授权 请求地址
    function authorizeURL()    { return $this->host.'authorize'; }
    //构造函数 赋值 一些必要参数
    function __construct($client_id, $client_secret, $access_token = NULL, $refresh_token = NULL) {
        $this->client_id = $client_id;
        $this->client_secret = $client_secret;
        $this->access_token = $access_token;
        $this->refresh_token = $refresh_token;
        // $this->debug = true;
    }
    /**
     * authorize接口
     *
     * 对应API：{@link http://u.mumayi.com/oauth/authorize Oauth2/authorize}
     *
     * @param string $url 授权后的回调地址,站外应用需与回调地址一致,站内应用需要填写canvas page的地址
     * @param string $response_type 支持的值包括 code 和token 默认值为code
     * @param string $state 用于保持请求和回调的状态。在回调时,会在Query Parameter中回传该参数
     * @param string $display 授权页面类型 可选范围:
     *  - default        默认授权页面
     *  - mobile        支持html5的手机
     *  - popup            弹窗授权页
     *  - wap1.2        wap1.2页面
     *  - wap2.0        wap2.0页面
     *  - js            js-sdk 专用 授权页面是弹窗，返回结果为js-sdk回掉函数
     *  - apponweibo    站内应用专用,站内应用不传display参数,并且response_type为token时,默认使用改display.授权后不会返回access_token，只是输出js刷新站内应用父框架
     * @return array
     */
    function getAuthorizeURL( $url, $response_type = 'code', $state = NULL, $display = NULL ) {
        $params = array();
        $params['client_id'] = $this->client_id;
        $params['redirect_uri'] = $url;
        $params['response_type'] = $response_type;
        $params['state'] = $state;
        $params['display'] = $display;
        return $this->authorizeURL() . "&" . http_build_query($params);
    }
    /**
     * access_token接口
     *
     * 对应API：{@link http://open.weibo.com/wiki/OAuth2/access_token OAuth2/access_token}
     *
     * @param string $type 请求的类型,可以为:code, password, token
     * @param array $keys 其他参数：
     *  - 当$type为code时： array('code'=>..., 'redirect_uri'=>...)
     *  - 当$type为password时： array('username'=>..., 'password'=>...)
     *  - 当$type为token时： array('refresh_token'=>...)
     * @return array
     */
    function getAccessToken( $type = 'code', $keys ) {
        $params = array();
        $params['client_id'] = $this->client_id;
        $params['client_secret'] = $this->client_secret;
        if ( $type === 'token' ) {
            $params['grant_type'] = 'refresh_token';
            $params['refresh_token'] = $keys['refresh_token'];
        } elseif ( $type === 'code' ) {
            $params['grant_type'] = 'authorization_code';
            $params['code'] = $keys['code'];
            $params['redirect_uri'] = $keys['redirect_uri'];
        } elseif ( $type === 'password' ) {
            $params['grant_type'] = 'password';
            $params['username'] = $keys['username'];
            $params['password'] = $keys['password'];
        } else {
            echo json_encode(array('error' => '错误的授权类型['.$type.'(token, code)]'));
            die;
        }
        $response = $this->oAuthRequest($this->accessTokenURL(), 'POST', $params);
        //var_dump($response);die;
        $token = json_decode($response, true);
        if ( is_array($token) && !isset($token['error']) ) {
            $this->access_token = $token['access_token'];
            //$this->refresh_token = $token['refresh_token'];
        } else {
            echo json_encode(array('error' => '获取访问令牌失败。['.$token['error'].']'));
            die;
        }
        return $token;
    }
    /**
     * 解析 signed_request
     *
     * @param string $signed_request 应用框架在加载iframe时会通过向Canvas URL post的参数signed_request
     *
     * @return array
     */
    function parseSignedRequest($signed_request) {
        list($encoded_sig, $payload) = explode('.', $signed_request, 2);
        $sig = self::base64decode($encoded_sig) ;
        $data = json_decode(self::base64decode($payload), true);
        if (strtoupper($data['algorithm']) !== 'HMAC-SHA256') return '-1';
        $expected_sig = hash_hmac('sha256', $payload, $this->client_secret, true);
        return ($sig !== $expected_sig)? '-2':$data;
    }
    /**
     * @ignore
     */
    function base64decode($str) {
        return base64_decode(strtr($str.str_repeat('=', (4 - strlen($str) % 4)), '-_', '+/'));
    }
    /**
     * 读取jssdk授权信息，用于和jssdk的同步登录
     *
     * @return array 成功返回array('access_token'=>'value', 'refresh_token'=>'value'); 失败返回false
     */
    function getTokenFromJSSDK() {
        $key = "mumayijs_" . $this->client_id;
        if ( isset($_COOKIE[$key]) && $cookie = $_COOKIE[$key] ) {
            parse_str($cookie, $token);
            if ( isset($token['access_token']) && isset($token['refresh_token']) ) {
                $this->access_token = $token['access_token'];
                $this->refresh_token = $token['refresh_token'];
                return $token;
            } else {
                return false;
            }
        } else {
            return false;
        }
    }
    /**
     * 从数组中读取access_token和refresh_token
     * 常用于从Session或Cookie中读取token，或通过Session/Cookie中是否存有token判断登录状态。
     *
     * @param array $arr 存有access_token和secret_token的数组
     * @return array 成功返回array('access_token'=>'value', 'refresh_token'=>'value'); 失败返回false
     */
    function getTokenFromArray( $arr ) {
        if (isset($arr['access_token']) && $arr['access_token']) {
            $token = array();
            $this->access_token = $token['access_token'] = $arr['access_token'];
            if (isset($arr['refresh_token']) && $arr['refresh_token']) {
                $this->refresh_token = $token['refresh_token'] = $arr['refresh_token'];
            }
            return $token;
        } else {
            return false;
        }
    }
    /**
     * 以 GET 请求方式 请求 OAuth 验证服务器
     *
     * @return mixed
     */
    function get($url, $parameters = array()) {
        $response = $this->oAuthRequest($url, 'GET', $parameters);
        if ($this->format === 'json' && $this->decode_json) {
            return json_decode($response, true);
        }
        return $response;
    }
    /**
     * 以 POST 请求方式 请求 OAuth 验证服务器
     *
     * @return mixed
     */
    function post($url, $parameters = array(), $multi = false) {
        $response = $this->oAuthRequest($url, 'POST', $parameters, $multi );
        if ($this->format === 'json' && $this->decode_json) {
            return json_decode($response, true);
        }
        return $response;
    }
    /**
     * 请求 OAuth 验证服务器 进行验证
     *
     * @return string
     */
    function oAuthRequest($url, $method, $parameters, $multi = false) {
        if (strrpos($url, 'http://') !== 0 && strrpos($url, 'https://') !== 0) {
            $url = "{$this->host}{$url}.{$this->format}";
        }
        switch ($method) {
            case 'GET':
                if(!empty($parameters))
                    $url = $url . '&' . http_build_query($parameters);
                return $this->http($url, 'GET');
            default:
                $headers = array();
                if (!$multi && (is_array($parameters) || is_object($parameters)) ) {
                    $body = http_build_query($parameters);
                } else {
                    $body = self::build_http_query_multi($parameters);
                    $headers[] = "Content-Type: multipart/form-data; boundary=" . self::$boundary;
                }
                //return $this->http($url, $method, $body, $headers);
                return $this->http($url, $method, $body, $headers);
        }
    }
    /**
     * 使用 CURL 模拟一个 HTTP 请求
     *
     * @description (需要开启 CURL 扩展)
     *
     * @return string API results
     *
     */
    function http($url, $method, $postfields = NULL, $headers = array()) {
        $this->http_info = array();
        $ci = curl_init();
        /* Curl settings */
        curl_setopt($ci, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
        curl_setopt($ci, CURLOPT_USERAGENT, $this->useragent);
        curl_setopt($ci, CURLOPT_CONNECTTIMEOUT, $this->connecttimeout);
        curl_setopt($ci, CURLOPT_TIMEOUT, $this->timeout);
        curl_setopt($ci, CURLOPT_RETURNTRANSFER, TRUE);
        curl_setopt($ci, CURLOPT_ENCODING, "");
        curl_setopt($ci, CURLOPT_SSL_VERIFYPEER, $this->ssl_verifypeer);
        curl_setopt($ci, CURLOPT_SSL_VERIFYHOST, 1);
        curl_setopt($ci, CURLOPT_HEADERFUNCTION, array($this, 'getHeader'));
        curl_setopt($ci, CURLOPT_HEADER, FALSE);
        switch ($method) {
            case 'POST':
                curl_setopt($ci, CURLOPT_POST, TRUE);
                if (!empty($postfields)) {
                    curl_setopt($ci, CURLOPT_POSTFIELDS, $postfields);
                    $this->postdata = $postfields;
                }
                break;
            case 'DELETE':
                curl_setopt($ci, CURLOPT_CUSTOMREQUEST, 'DELETE');
                if (!empty($postfields)) {
                    $url = "{$url}?{$postfields}";
                }
        }
        if ( isset($this->access_token) && $this->access_token )
            $headers[] = "Authorization: OAuth2 ".$this->access_token;
        if ( !empty($this->remote_ip) ) {
            if ( defined('SAE_ACCESSKEY') ) {
                $headers[] = "SaeRemoteIP: " . $this->remote_ip;
            } else {
                $headers[] = "API-RemoteIP: " . $this->remote_ip;
            }
        } else {
            if ( !defined('SAE_ACCESSKEY') ) {
                $headers[] = "API-RemoteIP: " . $_SERVER['REMOTE_ADDR'];
            }
        }
        curl_setopt($ci, CURLOPT_URL, $url );
        curl_setopt($ci, CURLOPT_HTTPHEADER, $headers );
        curl_setopt($ci, CURLINFO_HEADER_OUT, TRUE );
        $response = curl_exec($ci);
        $this->http_code = curl_getinfo($ci, CURLINFO_HTTP_CODE);
        $this->http_info = array_merge($this->http_info, curl_getinfo($ci));
        $this->url = $url;
        if ($this->debug) {
            echo "=====post data======\r\n";
            var_dump($postfields);
            echo "=====headers======\r\n";
            print_r($headers);
            echo '=====request info====='."\r\n";
            print_r( curl_getinfo($ci) );
            echo '=====response====='."\r\n";
            print_r( $response );
        }
        curl_close ($ci);
        return $response;
    }
    /**
     * 从结果中 获取 header 参数 (CURL 使用)
     *
     * @return int
     *
     * @ignore (忽略)
     */
    function getHeader($ch, $header) {
        $i = strpos($header, ':');
        if (!empty($i)) {
            $key = str_replace('-', '_', strtolower(substr($header, 0, $i)));
            $value = trim(substr($header, $i + 2));
            $this->http_header[$key] = $value;
        }
        return strlen($header);
    }
    /**
     * 把要传递的参数 重新构造一下 (多维数组)
     *
     * @ignore (忽略)
     */
    public static function build_http_query_multi($params) {
        if (!$params) return '';
        uksort($params, 'strcmp');
        $pairs = array();
        self::$boundary = $boundary = uniqid('------------------');
        $MPboundary = '--'.$boundary;
        $endMPboundary = $MPboundary. '--';
        $multipartbody = '';
        foreach ($params as $parameter => $value) {
            if( in_array($parameter, array('pic', 'image')) && $value{0} == '@' ) {
                $url = ltrim( $value, '@' );
                $content = file_get_contents( $url );
                $array = explode( '?', basename( $url ) );
                $filename = $array[0];
                $multipartbody .= $MPboundary . "\r\n";
                $multipartbody .= 'Content-Disposition: form-data; name="' . $parameter . '"; filename="' . $filename . '"'. "\r\n";
                $multipartbody .= "Content-Type: image/unknown\r\n\r\n";
                $multipartbody .= $content. "\r\n";
            } else {
                $multipartbody .= $MPboundary . "\r\n";
                $multipartbody .= 'content-disposition: form-data; name="' . $parameter . "\"\r\n\r\n";
                $multipartbody .= $value."\r\n";
            }
        }
        $multipartbody .= $endMPboundary;
        return $multipartbody;
    }
      public function get_uid() {
        $hostUrl = 'http://server.ruanwenwu.cn/index.php/home/resource/userinfo?type=mumayi';
        $params = array(
            'access_token' => $this->access_token,
        );
        return $this->get( $hostUrl, $params );
     }
}

注意：这个类的加载跟服务端采用的不同的方式。这里用了命名空间。服务端用的vendor。

3、准备访问链接。

我们通过这个url将用户导向server.ruanwenwu.cn进行授权，发送accesss_code操作。

我在client.ruanwenwu.cn的index控制器中实现的这个url。控制器里没有逻辑，我只贴index.html了：

<!doctype html>
<html>
    <head></head>
    <body>
        <a href="http://server.ruanwenwu.cn/index.php/home/oauth/authorize?redirect_uri=http://client.ruanwenwu.cn/index.php/home/login&response_type=code&client_id=10009174&type=123456">登陆</a>
    </body>
</html>

注 意：这个url中redirect_uri,response_type为必选参数。而且这个redirect_uri必须包含我们在服务端添加 oauth服务时写的那个redirect_uri。否则不能通过验证。（也就是说：在我们这个例子里，这个redirect_uri必须包含：

http://client.ruanwenwu.cn/index.php/home/login

4、点击链接，跳转到服务端对应的url。实际上就是server.ruanwenwu.cn的authorize操作。在这里会对用户进行验证，并判断是否授权。

    //权限验证
    public function authorize() {
        if (IS_POST) {
            if(true){
                //这个地方验证成功后要把用户的uid加进来
                $_POST['user_id'] = 1;    //这里是写死的，实际上是从数据库读出来
            $this -> oauth -> finishClientAuthorization(true, $_POST);    //第一个参数很重要，是用户是否授权
            }
            return;
        }
        ///表单准备
        $auth_params = $this -> oauth -> getAuthorizeParams();
        $this->assign("auth_params",$auth_params);
        $this->display();
    }

注意看我在这个操作里写的注释。

验证成功后，页面又跳回到我们之前写的redirect_uri，并带上了code参数，这就是验证服务器向客户端发送的access_code。

5、客户端拿到access_code，向验证服务器请求access_token。

在我的client.ruanwenwu.cn的loginController.class.php中进行：

<?php
namespace Home\Controller;
use Think\Controller;
use Org\Util\Oauth2;
class LoginController extends Controller{
    public function _initialize(){
    }
    public function index(){
        $this->oauth = new Oauth2('10009174','123456');
        $keys = array();
        //keys 数组 赋值 code 值 (换取token, 必须参数)
        $keys['code'] = $_GET['code'];
        //keys 数组 赋值 回调地址信息 (换取token, 必须参数)
        $keys['redirect_uri'] = 'http://client.ruanwenwu.cn/index.php/home/login?type=mumayidev';
        //根据 code 获取 token
        //var_dump( $token = $this->oauth->getAccessToken( 'code', $keys )) ;
        $token = $this->oauth->getAccessToken( 'code', $keys ) ;
        //现在已经得到token，并且将access_token写到对象里了。就可以请求资源了
        var_dump( $this->oauth->get_uid());
        die;
    }
}

   $token = $this->oauth->getAccessToken( 'code', $keys ) ;    //这就是请求代码。code是验证方式。$keys数组里要code和redirect_uri。在服务器端需要验证

服务端的响应是这样的：

验证client.ruanwenwu.cn的client_id和secrete是否合法，还要判读access_code是否过期

    public function access_token() {
        $this -> oauth -> grantAccessToken();    //这个方法里有所有的验证及生成access_token的操作。（会有数据库的写入）
    }

服务端生成access_token之后，会返回给客户端。

客户端拿到access_token之后，向资源服务器请求用户资源：

在这里我的验证服务器和资源服务器都是server.ruanwenwu.cn。我用resourceController.class.php来做资源控制：

<?php
namespace Home\Controller;
use Think\Controller;
class ResourceController extends Controller{
    protected $db;
    public function _initialize(){
        $this->db = M();
    }
    public function userinfo(){
        // $arr = array("username"=>"阮文武","sex"=>1,"img"=>"http://weewrerfdf");
                 // echo json_encode($arr);
                 // die;
         if(isset($_GET['access_token']) && $_GET['access_token']){
              $res = $this->db->table("oauth_token")->where("access_token = '".$_GET['access_token']."'")->find();
             if($res && count($res) > 0){
                 if($res['expires_in'] > time()){
                 $arr = array("username"=>"阮文武d","sex"=>1,"img"=>"http://weewrerfdf");
                 echo json_encode($arr);
                 die;
                 }
             }
         };
    }
}

如果access_token有效，就查到用户id，取出用户的信息。我这里只是做测试，所以就直接自己返回了数据。原本写的很详细，后来因为内容字段是text，没保存完整，这会时间比较赶，就写的简单一点。

再抽时间补充吧。

欢迎大家与我讨论哦。

http://www.tuicool.com/articles/u6beUju