omniauth/google API reference

Omniauth\Google

GoogleFactory class

final class GoogleFactory implements ProviderFactory GoogleFactory.php:20

Google from a host's configuration, for omniauth's Providers::configured(): an entry named "google", or of "type: google".

google: { client_id: …, client_secret: …, redirect_uri: /login/google/callback, scopes: [openid, email, profile], hosted_domain: ~ }

redirect_uri is an absolute address or a path (each trip's host completes it); scopes default to GoogleProvider::SCOPES; hosted_domain is a Google Workspace domain the account must belong to, "*" for any.

GoogleFactory::__construct()

public function __construct(readonly ?ClockInterface $clock = null, readonly array $collaborators = [])

$collaborators

league's, for every provider it makes (an "httpClient": tests, proxies)

GoogleFactory::create()

public function create(string $name, array $entry): ?Provider

GoogleProvider class

final class GoogleProvider extends LeagueProvider GoogleProvider.php:29

Google, over league/oauth2-google, as an OpenID Connect provider: scopes "openid email profile", a nonce in the authorization address, and the person read from the ID token the exchange returns - its issuer (accounts.google.com), its audience (this client; azp when there are several), its lifetime, its nonce and, when a hosted domain is set, its "hd" checked. The token comes straight from Google's token endpoint over TLS: OpenID Connect Core §3.1.3.7 (6) lets the TLS server validation stand in for its signature then, so no key set is fetched. With no ID token (or one without the address), the userinfo endpoint is read through the access token, and its subject must be the token's.

"email_verified" is what says whether an account may be linked by its address (QA3): a JSON boolean, or the string "true" Google once sent.

const SCOPES = ['openid', 'email', 'profile']

const ISSUERS = ['https://accounts.google.com', 'accounts.google.com']

const LEEWAY = 60

Seconds of clock difference tolerated on exp and iat.

GoogleProvider::__construct()

public function __construct(readonly string $clientId, string $clientSecret, string $redirectUri, array $scopes = self::SCOPES, readonly ?string $hostedDomain = null, ?ClockInterface $clock = null, array $collaborators = [], string $name = 'google')

$redirectUri

the return address (https://…/login/google/callback), or its path (/login/google/callback) on the host each trip begins at

$hostedDomain

a Google Workspace domain the account must belong to ("hd"), or "*" for any

$collaborators

league's: an "httpClient" (Guzzle) for tests and proxies