Oauth2-server: Public/Private Key Permissions on Windows

Created on 8 Aug 2017 · 4Comments · Source: thephpleague/oauth2-server

Dear @alexbilbie ,

as you have requested in #778 , I can give some more details about my current development machine.

I am currently running Windows 8.1 (latest patches installed).
As a "development environment" I use XAMPP ( https://www.apachefriends.org/de/index.html ) for Windows 7.1.7 (with PHP 7.1.7)
I work with laravel 5.4
I use laravel/passport 3.*

and then I ran into this error

"Key file "file://C:\Path\To\My\Larvel\Project\storage\oauth-private.key" permissions are not correct, should be 600 or 660 instead of 666",

The problem is, that Windows Users do not have that access/right management that you know from Linux. So we (Windows users) are not able to chmod 660 any specific file. If you try to get the permission when running a PHP script, it tells you that the permission is 666 to somehow simulate this behaviour.

Therefore, the mentioned PR / commit 2aca909d203e8a925da8c3a3f16a803683cecf04 causes heavy problems on windows machines..

Any ideas on this?!
Cheers

Source

johannesschobel

Most helpful comment

Hey @johannesschobel,

According to these lines, you can pass a CryptKey instance. So you can do the following:

<?php 

use League\OAuth2\Server\CryptKey;
use League\OAuth2\Server\AuthorizationServer;

// rest of your code...

$privateKey = new CryptKey($keyPath, null, false);
$server = new AuthorizationServer(
    $clientRepository,
    $accessTokenRepository,
    $scopeRepository,
    $privateKey,
    $encryptiongKey
);

I tried this on my Windows machine and everything works well.

vvasilev- on 11 Aug 2017

👍2

All 4 comments

Hey @johannesschobel,

According to these lines, you can pass a CryptKey instance. So you can do the following:

<?php 

use League\OAuth2\Server\CryptKey;
use League\OAuth2\Server\AuthorizationServer;

// rest of your code...

$privateKey = new CryptKey($keyPath, null, false);
$server = new AuthorizationServer(
    $clientRepository,
    $accessTokenRepository,
    $scopeRepository,
    $privateKey,
    $encryptiongKey
);

I tried this on my Windows machine and everything works well.

vvasilev- on 11 Aug 2017

👍2

Regarding to laravel/passport, they're already doing the same thing here. Just make sure that you're using v3.0.1 of laravel/passport.

vvasilev- on 11 Aug 2017

👍1

Yes, i am using laravel/passport so the problem is fixed for me.. However, other users, that are not using laravel/passport, struggle with this issue..

johannesschobel on 11 Aug 2017

I don't believe there is an issue here as I don't think the library is forcing this permission check to occur. If a developer does not want the permissions to be checked, they can create a CryptKey instance with the third argument set to false as stated above.

The only scenario that I can see where this wouldn't be possible is when passing a key directly into the AuthorizationServer constructor because when the key is converted to a CryptKey instance, it defaults to checking the file permissions. However, you can get around this by passing in a CryptKey instance based on the private key you had originally passed to the AuthorizationServer

I'm closing this issue but if I have made an oversight, please do get back in touch. Thanks