League OAuth2 incompatibility

[gavinservai]

I don't quite understand how this issue came about:
First I'll explain what works:
Using Dingo API version 0.5.0:
I use a POST request to get a client token. Then, immediately after, I pass an access token via GET parameter to a protected API. This works, and I get the appropriate resource.

However, using Dingo API version 0.6.2:
When I make the GET request, I receive an error:
Stack trace:
#0 [internal function]: Illuminate\Exception\Handler->handleError(2, 'call_user_func(...', '/vagrant/www/pl...', 101, Array)
#1 /vagrant/www/planat-app/vendor/dingo/api/src/Auth/LeagueOAuth2Provider.php(101): call_user_func(NULL, '2')
#2 /vagrant/www/planat-app/vendor/dingo/api/src/Auth/LeagueOAuth2Provider.php(84): Dingo\Api\Auth\LeagueOAuth2Provider->resolveResourceOwner()
#3 /vagrant/www/planat-app/vendor/dingo/api/src/Auth/Shield.php(98): Dingo\Api\Auth\LeagueOAuth2Provider->authenticate(Object(Illuminate\Http\Request), Object(Illuminate\Routing\Route))
#4 /vagrant/www/planat-app/vendor/dingo/api/src/Http/Middleware/Authentication.php(127): Dingo\Api\Auth\Shield->authenticate(Object(Illuminate\Http\Request), Object(Illuminate\Routing\Route))
#5 /vagrant/www/planat-app/vendor/dingo/api/src/Http/Middleware/Authentication.php(94): Dingo\Api\Http\Middleware\Authentication->authenticate(Object(Illuminate\Http\Request), Object(Illuminate\Routing\Route))
#6 /vagrant/www/planat-app/vendor/laravel/framework/src/Illuminate/Session/Middleware.php(72): Dingo\Api\Http\Middleware\Authentication->handle(Object(Illuminate\Http\Request), 1, true)
#7 /vagrant/www/planat-app/vendor/laravel/framework/src/Illuminate/Cookie/Queue.php(47): Illuminate\Session\Middleware->handle(Object(Illuminate\Http\Request), 1, true)
#8 /vagrant/www/planat-app/vendor/laravel/framework/src/Illuminate/Cookie/Guard.php(51): Illuminate\Cookie\Queue->handle(Object(Illuminate\Http\Request), 1, true)
#9 /vagrant/www/planat-app/vendor/stack/builder/src/Stack/StackedHttpKernel.php(23): Illuminate\Cookie\Guard->handle(Object(Illuminate\Http\Request), 1, true)
#10 /vagrant/www/planat-app/vendor/laravel/framework/src/Illuminate/Foundation/Application.php(606): Stack\StackedHttpKernel->handle(Object(Illuminate\Http\Request))
#11 /vagrant/www/planat-app/public/index.php(49): Illuminate\Foundation\Application->run()

I'm completely unsure as to why this is occurring.
This is the first Github issue I have ever opened, hopefully I'm doing it right.

[jasonlewis]

Keep an eye on the changes that are being made. Check out v0.6.0 and you'll see the one about OAuth.

[andion]

I wanted to update this on the wiki but I have no permissions to edit.

Can somebody with the appropiate credentials update this change on this wiki page? If you are setting everything up at the same time the error is very confusing.

[philsturgeon]

I've updated the docs for this.

[jasonlewis]

Cheers Phil! Greatly appreciated.
On 9 Jul 2014 20:56, "Phil Sturgeon" notifications@github.com wrote:

I've updated the docs for this.

—
Reply to this email directly or view it on GitHub
#113 (comment).

[sebastiaanluca]

Can anyone carlify what the callbacks are for in the following code block? Because there is no Client model in a fresh Laravel install and I can't somehow find out what the difference is with the User in the other callback.

'auth' => [
    'oauth' => function($app) {
        $provider = new Dingo\Api\Auth\LeagueOAuth2Provider($app['oauth2.resource-server']);

        $provider->setUserCallback(function($id) {
            return User::find($id);
        });

        $provider->setClientCallback(function($id) {
            return Client::find($id);
        });

        return $provider;
    }
]

[philsturgeon]

That class is for you to make.

[andion]

@quagh Those return your specific User & Client model so they can be abstracted by the library. You'll need at least the Client or both depending on the grants you are using.

Reading the docs of the oauth2-server wiki will help to understand, specially about grants.

PS: Maybe is something worth noting on the wiki beside this code?

[sebastiaanluca]

I recommend you do so, because I've read all the wikis and installation guides and had to figure out for myself how it actually works.

Nowhere does it mention you have to create stuff in your database, etc. Only one small line (in the OAuth laravel installation guide) about requesting an access token, but that's just jumping right into it without knowing the requirements and proper setup. But yeah, this is an issue for oauth2-server, not this package.

It works now, but managing the clients, secrets and tokens is going to be a whole other task.

[davidstanley01]

So, just to clarify, if I already have an entity name Client in my db, and I'm going to allow them to have a "registered app", and I have a RegisteredApp model, then I'm going to use that model (RegisteredApp) in the setClientCallback line. I'm going to be using the client_credentials grant-type, but I guess it is just the verbiage (rather, my lack of understanding) that is tripping me up.

Sorry for asking what is probably obvious.

Thanks.

[sebastiaanluca]

I have a table oauth_clients which has an id, name and secret field (those migrations were part of the Laravel oauth2 server Composer package). My Client model is linked to that table. In the setClientCallback I return that Client model.

So I guess it would work if your RegisteredApp model links to a database table which holds at least an id and a secret. Using that "client" id and secret, you request a token. With that token (in the Authorization Header; something like "Bearer 654605465thisismygeneratedoauthaccesstoken04654"), you authorize via OAuth2 to whatever route you have protected.

If I'm correct, that is :)

[jasonlewis]

A client is an app, in OAuth speak. :)
On 15 Jul 2014 08:28, "David Stanley" notifications@github.com wrote:

So, just to clarify, if I already have an entity name Client in my db, and
I'm going to allow them to have a "registered app", and I have a
RegisteredApp model, then I'm going to use that model (RegisteredApp) in
the setClientCallback line. I'm going to be using the client_credentials
grant-type, but I guess it is just the verbiage (rather, my lack of
understanding) that is tripping me up.

Sorry for asking what is probably obvious.

Thanks.

—
Reply to this email directly or view it on GitHub
#113 (comment).

[davidstanley01]

That's what I was looking for, thanks.