Laravel Passportを使ったOauthサーバその２

認証設定

今回はクライアント認証するようにします。

クライアント認証利用設定

★追記★の１行をapp/Http/Kernel.phpに追加します。

    /**
     * The application's route middleware.
     *
     * These middleware may be assigned to groups or used individually.
     *
     * @var array
     */
    protected $routeMiddleware = [
        'auth' => \App\Http\Middleware\Authenticate::class,
        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
        'auth.session' => \Illuminate\Session\Middleware\AuthenticateSession::class,
        'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,
        'can' => \Illuminate\Auth\Middleware\Authorize::class,
        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
        'password.confirm' => \Illuminate\Auth\Middleware\RequirePassword::class,
        'signed' => \App\Http\Middleware\ValidateSignature::class,
        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
        'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
        'client' => \Laravel\Passport\Http\Middleware\CheckClientCredentials::class, ★追記★
    ];

ルーティングの設定

どの機能（URL）に認証を掛けるのかをroutes/api.phpに設定します。
今回はグループ設定でやってみました。

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use App\Http\Controllers\ApplicantController;  ★追加 

/*
|--------------------------------------------------------------------------
| API Routes
|--------------------------------------------------------------------------
|
| Here is where you can register API routes for your application. These
| routes are loaded by the RouteServiceProvider within a group which
| is assigned the "api" middleware group. Enjoy building your API!
|
*/

Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
    return $request->user();
});

★以下追加
Route::group(['middleware' => 'auth'], function () {
    Route::get('/applicant/{id}', [ApplicantController::class, 'show']);
});

テスト用のサーバ機能の作成

簡単な機能を作って認証が動くか確かめてみます。
今回はREST APIを想定してGETでもらったIDを返却するだけの簡単な機能を実装します。

テンプレートの作成

まずController作ります。

$ php artisan make:controller ApplicantController

実装

テンプレートに実装します。

namespace App\Http\Controllers;

use Illuminate\Http\Request;
#use App\Applicant;

class ApplicantController extends Controller
{
    # ID表示
    public function show(Int $id)
    {
        $post = "id:$id";
        return response()->json($post);
    }
}

使ってみる

curlで動くか試してみます。
tokenは前回取得したtokenを使います。
tokenはどうやって送るかというとヘッダ情報の中に入れて送ります。
無事に認証が通ってURLの最後に入れたID（3）が表示されました。

$ curl -verbose -X GET -H 'Content-Type: application/json' -H 'Accept: application/json' -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiIyIiwianRpIjoiN........' http://localhost:8000/api/applicant/3
Note: Unnecessary use of -X or --request, GET is already inferred.
*   Trying 127.0.0.1:8000...
* Connected to localhost (127.0.0.1) port 8000 (#0)
> GET /api/applicant/ HTTP/1.1
> Host: localhost:8000
> User-Agent: curl/7.79.1
> Referer: rbose
> Content-Type: application/json
> Accept: application/json
> Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiIyIiwianRpIjoiN........
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Host: localhost:8000
< Date: Wed, 12 Oct 2022 03:34:51 GMT
< Connection: close
< X-Powered-By: PHP/8.0.20
< Cache-Control: no-cache, private
< Date: Wed, 12 Oct 2022 03:34:51 GMT
< Content-Type: application/json
< X-RateLimit-Limit: 60
< X-RateLimit-Remaining: 59
< Access-Control-Allow-Origin: *
<
* Closing connection 0
"id:3"

ここでtokenが間違っていて認証が失敗すると401が帰ってきます。

* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< Host: localhost:8000
< Date: Mon, 24 Oct 2022 06:06:00 GMT
< Connection: close
< X-Powered-By: PHP/8.0.20
< Cache-Control: no-cache, private
< Date: Mon, 24 Oct 2022 06:06:00 GMT
< Content-Type: application/json
< X-RateLimit-Limit: 60
< X-RateLimit-Remaining: 57
< Access-Control-Allow-Origin: *
<
* Closing connection 0
{"message":"Unauthenticated."}

何を設定するかがわかれば後は本当に簡単。皆様もお試しください。