I want to use Keycloak as an identity provider (IdP) which secure access to my application written in PHP. Because Keycloak have no supported Client Adapters for PHP, I researched a litte bit. There are different ways to integrate the Relying Party (RP) into client application:
- Keycloak have mod_auth_openidc. So this is a module for a Apache server as Relying Party. (It blocks the request before reaching the service )
- Over things like PHP Clients or Laravel --> Authlete Laravel
I am completely new to this area and prefer number 2,3. I have set up an Keycloak server and wrote a ServiceProviderInterface (SPI) for my User DB in the Keycloak server. This works fine and with Postman I am able to request the endpoints. Next step is to build an example PHP application to secure with Keycloak. Are there any basic step by step tutorials out there?
How do i authenticate my user against the IdP? And how do I authorize later with the scopes and claims of Keycloak? And are there any better tutorials out there? I found AUTHENTICATE KEYCLOAK ACCESS TOKEN IN LARAVEL, Apereo CAS - Securing PHP with OpenID Connect, PHP OpenID Connect Basic Client but they did not really help me setting things up.