$clientId,
'clientSecret' => $clientSecret,
'redirectUri' => $redirectUri,
'accessType' => 'offline'
];
$options = [];
$providerName = read_config_option('settings_oauth2_provider');
if ($providerName == 'azure') {
$params['tenantId'] = $tenantId;
}
$provider = CactiOAuth::getProvider($providerName, $params);
$options = CactiOAuth::getDefaultOptions($providerName);
if ($provider === null) {
cacti_log('ERROR: Unknown OAuth2 provider');
die('Provider missing');
}
if (!isrv('code')) { // If we don't have an authorization code then get one
$authUrl = $provider->getAuthorizationUrl($options);
$_SESSION['oauth2state'] = $provider->getState();
header('Location: ' . $authUrl);
exit;
// Check given state against previously stored one to mitigate CSRF attack
}
if (isempty_request_var('state') || empty($_SESSION['oauth2state']) ||
!hash_equals((string) $_SESSION['oauth2state'], (string) grv('state'))) {
unset($_SESSION['oauth2state']);
exit('Invalid state');
} else { // Try to get an access token (using the authorization code grant)
unset($_SESSION['oauth2state']);
$token = $provider->getAccessToken(
'authorization_code',
[
'code' => grv('code')
]
);
// Use this to interact with an API on the users behalf
// Use this to get a new access token if the old one expires
print __('Refresh Token: ') . htmle((string) $token->getRefreshToken());
print '
' . __('Store this token in Settings -> Mail/Reporting/DNS -> Oauth2 refresh token. ');
print '
' . __('If the token is empty, it means it stays the same. The Oatuh2 provider will not resend it in that case. ');
}