XIMA OAuth2 Extended

This repository contains additional provider for league/oauth2-client. When installed as TYPO3 extension, it is possible to extend the waldhacker/ext-oauth2-client for on-the-fly user creation.

New resource provider

• MicrosoftResourceProvider
• AuthentikResourceProvider

TYPO3 user creation

To create frontend or backend users from OAuth2 authentication, you can create your own ResourceResolver by implementing the ResourceResolverInterface and register it in the extension configuration:

'EXTENSIONS' => [
    // your existing configuration of waldhacker/ext-oauth2-client
    'oauth2_client' => [
        'providers' => [
            'yourProviderId' => [
                'description' => 'Your provider',
                'implementationClassName' => 'Xima\XimaOauth2Extended\ResourceProvider\MicrosoftResourceProvider',
                ...
            ],
            'secondProviderId' => [
                'description' => 'Another provider'
                ...
            ]
        ]
    ],

    'xima_oauth2_extended' => [
        'oauth2_client_providers' => [
            // provider of waldhacker/ext-oauth2-client you want to extend
            'yourProviderId' => [
                'resolverClassName' => \Xima\XimaOauth2Extended\ResourceResolver\MicrosoftResourceResolver::class,
                'createBackendUser' => true,
                'createFrontendUser' => false,
                'defaultBackendUsergroup' => '1,3',
                'defaultFrontendUsergroup' => '',
                'imageStorageBackendIdentifier' => '1:/user_upload/oauth',
            ],
            'secondProviderId' => [
                'resolverClassName' => \Xima\XimaOauth2Extended\ResourceResolver\GenericResolver::class,
                'createBackendUser' => true,
                'createFrontendUser' => true,
                'defaultBackendUsergroup' => '',
                'defaultFrontendUsergroup' => '',
            ],
        ],
    ],
]

Available resource resolver

This TYPO3 extension provides a resource resolver to facilitate the creation and updating of TYPO3 users through OAuth2 login. The resource resolver serves as a mapping tool for data retrieval from various OAuth resources. While the default resolver, GenericResolver, covers most OAuth endpoints, each endpoint's unique API for extended user information might require specific handling, leading to variations in features.

Resolver	User Creation	Profile picture	Group Creation
GenericResourceResolver	✅	🚫	🚫
MicrosoftResourceResolver	✅	✅ (BE only)	✅ (BE only)
AuthentikResourceResolver	✅	✅ (BE only)	🚫
GitlabResourceResolver	✅	🚫	🚫

Extended resource resolver options

The extension provides customizable options to tailor the resolver's behavior:

Option	Description	Default
resolverClassName	Class name of the resource resolver. See above for list of available resolver	GenericResourceResolver::class
createBackendUser	If set, create a new TYPO3 backend user if no existing user is authenticated	false
createFrontendUser	If set, create a new TYPO3 frontend user if no existing user is authenticated	false
defaultBackendUsergroup	List of be_group UIDs the created user will be assigned to
defaultFrontendUsergroup	List of fe_group UIDs the created user will be assigned to
createBackendUsergroups	If set, create backend user groups based on those of the remote user	false
createFrontendUsergroups	If set, create frontend user groups based on those of the remote user	false
requireBackendUsergroup	If set, require the remote user to be in at least one user group with matching oauth2_id	false
requireFrontendUsergroup	If set, require the remote user to be in at least one user group with matching oauth2_id	false
imageStorageBackendIdentifier	Storage identifier for downloaded backend user profile images	1:/user_upload/oauth
imageStorageFrontendIdentifier	Storage identifier for downloaded frontend user profile images	1:/user_upload/oauth
defaultBackendLanguage	Language identifier for created backend users	default
defaultBackendAdminGroups	Comma separated list of remote oauth2_ids that will become Admin during login. Special value all.

FAQ

Register Return-URLs

For the backend login the return url looks like this:

https://domain.de/typo3/login?loginProvider=1616569531&oauth2-provider=yourProviderId&login_status=login&commandLI=attempt

Replace domain.de and yourProviderId with your data!

Login not working

Make sure cookieSameSite is set to lax.

$GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite'] = 'lax';
$GLOBALS['TYPO3_CONF_VARS']['FE']['cookieSameSite'] = 'lax';

Order of login provider

To change the order of provider displayed at the /typo3 login page (OAuth login over classic username/password), use the following snippet:

$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['backend']['loginProviders']['1616569531']['sorting'] = 75;

Usage in TYPO3v12

The TYPO3 extension waldhacker/ext-oauth2-client is not yet ready for v12. However, there is a feature branch that is almost working - this fork makes the trick. To use it, adjust your composer.json:

{
  "repositories": [
    {
      "url": "https://github.com/maikschneider/ext-oauth2-client.git",
      "type": "git"
    }
  ],
  "require": {
    "waldhacker/typo3-oauth2-client": "dev-feature/v12-compatibility-1"
  }
}