API Platform with external OpenID provider

[carlespibernat]

I'm dealing with a project where I have a frontend build with React, which connects to an API build with API Platform, and uses an external user provider which implements oauth2 and OpenID protocols (Keycloak).

I think that I can configure API platform as an oauth2 client (through oauth configuration section, but I'm not sure if it will be an oauth client or a server), but I also need to get user information from the OpenID server to store information about the user who has created an entity (the owner).

Is there any way to do that? Or is better to not use API Platform and implement my own API which connects to the OpenID server?

Thanks in advance!

[westende]

The following is based on the documentation. I have not implemented this specific use-case. Therefor this might be simplified. However I think you can get a long way with this. Please also take consideration of how and where you store and communicate the JWT. Check OWASP best practices.

https://packagist.org/packages/knpuniversity/oauth2-client-bundle has support for KeyCloak by means of https://packagist.org/packages/stevenmaguire/oauth2-keycloak. You can use this to log the user in. This will result in a JWT.
OpenID Connect makes use of JWT. API Platform has documentation about integrating LexikJWTAuthenticationBundle in order to authenticate using a JWT here: https://api-platform.com/docs/core/jwt/.

I think you can use the JWT user provider to load an identity/user: https://github.com/lexik/LexikJWTAuthenticationBundle/blob/master/Resources/doc/8-jwt-user-provider.md

Please do assess yourself if this can work and if it is up to your requirements.

[soyuka]

Closing per #2987. Questions are best asked on GitHub Discussions or Stack Overflow (api-platform tag). The framework now lives at api-platform/core.