Implement basic OIDC core server handling

Allow Nextcloud to be used as a OpenID Connect server. CLients can authenticate against it.

Signed-off-by: Markus Heberling <markus.heberling@hengsbeck.de>

apps/oauth2/lib/Controller/OauthApiController.php

@@ -172,13 +172,53 @@ public function getToken($grant_type, $code, $refresh_token, $client_id, $client
 
 		$this->throttler->resetDelay($this->request->getRemoteAddress(), 'login', ['user' => $appToken->getUID()]);
 
+		// The id token needs to be correctly build as JWT. Taken from https://dev.to/robdwaller/how-to-create-a-json-web-token-using-php-3gml
+
+		// Create token header as a JSON string
+		$header = json_encode(['typ' => 'JWT', 'alg' => 'HS256']);
+
+		// We need the user to fill in name and email in the id_token
+		$user = \OC::$server->getUserManager()->get($appToken->getUID());
+
+		// Create token payload as a JSON string
+		$payload = json_encode([
+			// required for OIDC
+			'iss' => \OC::$server->getURLGenerator()->getBaseUrl(),
+			'sub' => $appToken->getUID(),
+			'aud' => $client_id,
+			'exp' => $appToken->getExpires(),
+			'iat' => $this->time->getTime(),
+			'auth_time' => $this->time->getTime(),
+
+			// optional, can be requested by claims, we don't support requesting claims as of now, so we just send them always
+			'email' => $user->getEMailAddress(),
+			'name' => $user->getDisplayName(),
+
+		]);
+
+		// Encode Header to Base64Url String
+		$base64UrlHeader = str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($header));
+
+		// Encode Payload to Base64Url String
+		$base64UrlPayload = str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($payload));
+
+		// Create Signature Hash
+		$signature = hash_hmac('sha256', $base64UrlHeader . "." . $base64UrlPayload, $client->getSecret(), true);
+
+		// Encode Signature to Base64Url String
+		$base64UrlSignature = str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($signature));
+
+		// Create JWT
+		$jwt = $base64UrlHeader . "." . $base64UrlPayload . "." . $base64UrlSignature;
+
 		return new JSONResponse(
 			[
 				'access_token' => $newToken,
 				'token_type' => 'Bearer',
 				'expires_in' => 3600,
 				'refresh_token' => $newCode,
 				'user_id' => $appToken->getUID(),
+				'id_token' => $jwt,
 			]
 		);
 	}