Merge branch 'development' into lukeshu/oidc-development

[bookstack] / app / Access / Oidc / OidcService.php

diff --git a/app/Access/Oidc/OidcService.php b/app/Access/Oidc/OidcService.php
index 244957991953510aa4f647c31d7f829b143c621e..467e31417704931412ef4100b11ed03154a5d566 100644 (file)
--- a/app/Access/Oidc/OidcService.php
+++ b/app/Access/Oidc/OidcService.php
@@ -33,6 +33,8 @@ class OidcService
 
     /**
      * Initiate an authorization flow.
 
     /**
      * Initiate an authorization flow.

+     * Provides back an authorize redirect URL, in addition to other
+     * details which may be required for the auth flow.

      *
      * @throws OidcException
      *
      *
      * @throws OidcException
      *


@@ -42,8 +44,12 @@ class OidcService
     {
         $settings = $this->getProviderSettings();
         $provider = $this->getProvider($settings);
     {
         $settings = $this->getProviderSettings();
         $provider = $this->getProvider($settings);

+
+        $url = $provider->getAuthorizationUrl();
+        session()->put('oidc_pkce_code', $provider->getPkceCode() ?? '');
+

         return [
         return [

-            'url'   => $provider->getAuthorizationUrl(),
+            'url'   => $url,

             'state' => $provider->getState(),
         ];
     }
             'state' => $provider->getState(),
         ];
     }


@@ -63,6 +69,10 @@ class OidcService
         $settings = $this->getProviderSettings();
         $provider = $this->getProvider($settings);
 
         $settings = $this->getProviderSettings();
         $provider = $this->getProvider($settings);
 

+        // Set PKCE code flashed at login
+        $pkceCode = session()->pull('oidc_pkce_code', '');
+        $provider->setPkceCode($pkceCode);
+

         // Try to exchange authorization code for access token
         $accessToken = $provider->getAccessToken('authorization_code', [
             'code' => $authorizationCode,
         // Try to exchange authorization code for access token
         $accessToken = $provider->getAccessToken('authorization_code', [
             'code' => $authorizationCode,