stormpath/lumen

Build simple, secure web applications with Stormpath and Laravel!

Stormpath is Joining Okta

We are incredibly excited to announce that Stormpath is joining forces with Okta. Please visit the Migration FAQs for a detailed look at what this means for Stormpath users., _(*1)

We're available to answer all questions at support@stormpath.com., _(*2)

, _(*3)

Getting Started

Follow these steps to add Stormpath user authentication to your Lumen app., _(*4)

1. Download Your Key File, _(*5)

   Download your key file from the Stormpath Console., _(*6)

2. Store Your Key As Environment Variables, _(*7)

   Open your key file and grab the API Key ID and API Key Secret, then add this to your .env file in the root of your project:, _(*8)

   You may need to create a .env file if this is a fresh install of lumen., _(*9)

   STORMPATH_CLIENT_APIKEY_ID=<YOUR-ID-HERE>
   STORMPATH_CLIENT_APIKEY_SECRET=<YOUR-SECRET-HERE>
   

3. Get Your Stormpath Application HREF, _(*10)

   Login to the Stormpath Console and grab the HREF (called REST URL in the UI) of your Application. It should look something like this:, _(*11)

   https://api.stormpath.com/v1/applications/q42unYAj6PDLxth9xKXdL, _(*12)

4. Store Your Stormpath App HREF In the .env file, _(*13)

   STORMPATH_APPLICATION_HREF=<YOUR-STORMPATH-APP-HREF>
   

5. Install The Package, _(*14)

   Open your composer.json file and add the following to your require block:, _(*15)

   "stormpath/lumen": "^0.1"
   

6. Include It In Your App, _(*16)

   Open you bootstrap/app.php file and add the following to your providers section, _(*17)

   $app->register(\Stormpath\Lumen\Support\StormpathServiceProvider::class);
   

7. Configure It, _(*18)

   To modify the configuration of the package, you will need to publish the config file. Run the following in your terminal:, _(*19)

   $ php artisan stormpath:config
   

   This will create a stormpath.yaml file in the root of your project with all the options you are able to modify. By default, Login, Logout, OAuth, and Register routes will be enabled. Other routes will be enabled based on your directory settings., _(*20)

8. Login, _(*21)

   Working with an API, we suggest that you work with OAuth tokens. We have created a route for your, /oauth/tokens where you can do client_credentials, password, or refresh grant types., _(*22)

• Client Credentials, _(*23)

  In this workflow, an api key and secret is provisioned for a stormpath account. These credentials can be exchanged for an access token by making a POST request to /oauth/token on the web application. The request must look like this:, _(*24)

  POST /oauth/token
  Authorization: Basic <base64UrlEncoded(apiKeyId:apiKeySecret)>
  
  grant_type=client_credentials
  

• Password Grant, _(*25)

  In this workflow, an account can post their login (username or email) and password to the ``/oauth/token` endpoint, with the following body data:, _(*26)

  POST /oauth/token
  
  grant_type=password
  &username=<username>
  &password=<password>
  

• Refresh Grant, _(*27)

  The refresh grant type is required for clients using the password grant type to refresh their access_token. Thus, it's automatically enabled alongside the password grant type., _(*28)

  An account can post their refresh_token with the following body data:, _(*29)

  POST /oauth/token
  grant_type=refresh_token&
  refresh_token=<refresh token>
  

  The product guide for token management: http://docs.stormpath.com/guides/token-management, _(*30)

1. Register, _(*31)

   To get the model for the registration form, make a GET request to /register. This will return a JSON representation of the form along with the available Account Stores., _(*32)

   {
    "form": {
      "fields": [
        {
          "enabled": true,
          "label": "First Name",
          "placeholder": "First Name",
          "required": true,
          "type": "text"
        },
        {
          "enabled": true,
          "label": "Last Name",
          "placeholder": "Last Name",
          "required": true,
          "type": "text"
        },
        ...
      ]
    },
    "accountStores": [
      {
        "href": "https://api.stormpath.com/v1/directories/6t1orcyGhqLvObgvsohdYu",
        "name": "Test Directory",
        "provider": {
          "href": "https://api.stormpath.com/v1/directories/6t1orcyGhqLvObgvsohdYu/provider",
          "providerId": "stormpath"
        }
      }
    ]
   }
   

   When you want to register a new Account, take the user data from the form model and put into the body of a POST request to the /register endpoint., _(*33)

2. That's It!, _(*34)

   You just added user authentication to your app with Stormpath., _(*35)

Support

If you are having issues with this package, please feel free to submit an issue on this github repository. If it is an issue you are having that needs a little more private attention, please feel free to contact us at support@stormpath.com or visit our support center., _(*36)

Contributing

We welcome anyone to make contributions to this project. Just fork the develop branch of this repository, make your changes, then issue a pull request on the develop branch., _(*37)

Any pull request you make will need to have associated tests with them. If a test is not provided, the pull request will be closed automatically. Also, any pull requests made to a branch other than develop will be closed and a new submission will need to be made to the develop branch., _(*38)

We regularly maintain this repository, and are quick to review pull requests and accept changes!, _(*39)

Copyright

Copyright © 2013-2016 Stormpath, Inc. and contributors., _(*40)

This project is open-source via the Apache 2.0 License., _(*41)