NiloLeon's avatar

Integrate custom API authentication in Laravel

I want to create a webapp using Laravel framework with a sort of custom authentication system. I 've an external API like this

https://xxx.xxx.xxx.xx/subscribers/v1/?source=XXX&licenseplate=AB123AS

and to use this api i need to generate a token that after some period expires.

To generate this token i need to consume this service

https://xxx.xxx.xxx.xx/oauth/v2/accesstoken?grant_type=client_credentials

This Api tells me if the customer is covered or not and has as input parameters: source and license plate.

So my goal is to create a login form with these 2 parameters (source and license plate) input by customer that consume that API and only if it returns covered, customer can access a reserved area and do some stuff.

How can i do this in Laravel? I have to create a new service provider, new user model and guard? How? Some tips?

Thanks

0 likes
4 replies
NiloLeon's avatar

I consume this api like this in the controller

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;

class ApiController extends Controller
{
    public function getToken()
    {
        $curl = curl_init();

        curl_setopt_array($curl, array(
            CURLOPT_URL => 'https://url/oauth/v2/accesstoken?grant_type=client_credentials',
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_ENCODING => '',
            CURLOPT_MAXREDIRS => 10,
            CURLOPT_TIMEOUT => 0,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
            CURLOPT_CUSTOMREQUEST => 'POST',
            CURLOPT_HTTPHEADER => array(
                'Authorization: Basic --HERE IS CODED BASE64 CREDENTIALS--',
                'Content-Type:application/json',
            ),
        ));

        $response = curl_exec($curl);
        $httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);

        if ( $httpCode != 200 ){
            echo "Return code is {$httpCode} \n"
                .curl_error($curl);
        } else {
            $json = json_decode($response, true);
            return $json['access_token'];
        }
        curl_close($curl);
    }

    public function callApi(string $token)
    {
        $curl = curl_init();

        curl_setopt_array($curl, array(
          CURLOPT_URL => 'https://url/subscribers/v2/?source=XXX&licensenumber=AA123AA',
          CURLOPT_RETURNTRANSFER => true,
          CURLOPT_ENCODING => '',
          CURLOPT_MAXREDIRS => 10,
          CURLOPT_TIMEOUT => 0,
          CURLOPT_FOLLOWLOCATION => true,
          CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
          CURLOPT_CUSTOMREQUEST => 'GET',
          CURLOPT_HTTPHEADER => array(
            'Authorization: Bearer '.$token
          ),
        ));
        
        $response = curl_exec($curl);
        $httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);

        if ( $httpCode != 200 ){
            echo "Return code is {$httpCode} \n"
                .curl_error($curl);
        } else {
            $json = json_decode($response, true);
            echo $response;
        }
        curl_close($curl);
    }

    public function check()
    {
        $token = $this->getToken();
        $this->callApi($token);
    }

}

Now I dunno how and where to call this...or i have to implement in service provider?? I dunno how to do all this. No one reply :S

Lumethys's avatar

@NiloLeon protip in building any application: Unless you are a security expert, NEVER make you own authentication system from scratch

Use Laravel Socialize, the official solution to this.

Officially, Laravel support facebook, twitter (OAuth 1.0), twitter-oauth-2 (OAuth 2.0), linkedin, google, github, gitlab, or bitbucket. However, outside of this they also promote Socialize Provider, which add a LOT of Oauth provider support

even if your provider isnt on that list, you can make a custom one

NiloLeon's avatar

@Lumethys Ok yes, I am trying to adapt Laravel Socialize according to my case. Is it a problem if in my external API service doesn't exist url like this

https://www.xxxx.com/oauth/v2/authorization

to define in the MyProvider class

    protected function getAuthUrl($state)
    {
        return $this->buildAuthUrlFromBase('https://www.xxxx.com/oauth/v2/authorization', $state);
    }

Please or to participate in this conversation.