oauth2-server-php | A library for implementing an OAuth2 Server in php | OAuth library

Usage of ID Token is intended for the client application. Client uses it to authenticate the end user. All this is made possible through claims ID Token transfer. And these claims are built into an JWT. In simple terms, ID Token is a self-contained token.

Now, sharing of ID Token outside of client is okay if you control all intended parties. Think about a scenario in which you leak sensitive user information through ID Token. For example if ID Token contain a claim about gender which only intended for client to use. But when you share ID Token with a third party, you expose those sensitive information. It could be a crime if there are legal barriers.

Another point is on ID Token validation. Hence ID Token targets the client, important claims such as aud is set accordingly. When you pass ID Token to a backend to be used, such validation could fail.

There are two solutions. First is to use self contained access tokens. These days it is common to use JWT based access tokens. With them, you get the same solution. It will contain end user identity, scope values as well as token validation information. Azure AD use such approach - check this link.

Second one is to use ID Token. Given that you control both front end and backend, my opinion is you are okay to use it. But be mindful about future extensions. Specially not to expose it to other parties.

There's no build-in system to make this. You will create a listener which's listens MvcEvent::Event_ROUTE and place it after router then check if there's a routematch. If there's one, check if it's protected route. If it's apply authentication logic.

I didn't read the complete source off bshaffer oauth server.
But want you can try is to create your own class by extending from class Server.
And use the __destruct() function to be executed when the object customServer is destroyed by PHP

IF I understand your desire, the OpenID Provider can provide anything for the Subject as long as it is Unique at that OpenID Provider for a specific relying party.

OpenID Connect Identity Token Sub is a Subject Identifier is a locally unique and never re-assigned identifier within the Issuer for the Authenticated Entity, which is intended to be consumed by the OAuth Client.

Two Subject Identifier types (subject_types_supported) are defined by OpenID Connect and are Required to be present in the OpenID Provider Metadata:

public - provides the same sub (subject) value to all OAuth Client. It is the default if the provider has no subject_types_supported element in its discovery document.

pairwise - provides a different Sub value to each OAuth Client, so as not to enable OAuth Client to correlate the End-User's activities without permission.

The OpenID Connect Provider's OpenID Connect Discovery document SHOULD list its supported Subject Identifier types in the subject_types_supported element.

If there is more than one type listed in the array, the OAuth Client MAY elect to provide its preferred identifier type using the subject_type parameter during Registration.

Sub MUST NOT exceed 255 ASCII characters in length.

Sub Sub value is a Case-sensitive string.

I was able to achieve desired functionality following this guide: https://bshaffer.github.io/oauth2-server-php-docs/grant-types/jwt-bearer/

You must specify accessType: 'offline' in the OAuth2 options to receive a refresh token. If the former does not work try access_type: 'offline'.