Refs #2369 - initial add of OAuth2 server files to tree

src/oauth2-server/lmce_oauth2_db.sql

+-- MySQL dump 10.13  Distrib 5.6.31, for debian-linux-gnu (x86_64)
+--
+-- Host: localhost    Database: lmce_oauth2_db
+-- ------------------------------------------------------
+-- Server version	5.6.31-0ubuntu0.15.10.1
+
+/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
+/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
+/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
+/*!40101 SET NAMES utf8 */;
+/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
+/*!40103 SET TIME_ZONE='+00:00' */;
+/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
+/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
+/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
+/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
+
+--
+-- Table structure for table `oauth_access_tokens`
+--
+
+DROP TABLE IF EXISTS `oauth_access_tokens`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!40101 SET character_set_client = utf8 */;
+CREATE TABLE `oauth_access_tokens` (
+  `access_token` varchar(40) NOT NULL,
+  `client_id` varchar(80) NOT NULL,
+  `user_id` varchar(255) DEFAULT NULL,
+  `expires` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `scope` varchar(2000) DEFAULT NULL,
+  PRIMARY KEY (`access_token`)
+) ENGINE=InnoDB DEFAULT CHARSET=latin1;
+/*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Dumping data for table `oauth_access_tokens`
+--
+
+LOCK TABLES `oauth_access_tokens` WRITE;
+/*!40000 ALTER TABLE `oauth_access_tokens` DISABLE KEYS */;
+/*!40000 ALTER TABLE `oauth_access_tokens` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Table structure for table `oauth_authorization_codes`
+--
+
+DROP TABLE IF EXISTS `oauth_authorization_codes`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!40101 SET character_set_client = utf8 */;
+CREATE TABLE `oauth_authorization_codes` (
+  `authorization_code` varchar(40) NOT NULL,
+  `client_id` varchar(80) NOT NULL,
+  `user_id` varchar(255) DEFAULT NULL,
+  `redirect_uri` varchar(2000) DEFAULT NULL,
+  `expires` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `scope` varchar(2000) DEFAULT NULL,
+  PRIMARY KEY (`authorization_code`)
+) ENGINE=InnoDB DEFAULT CHARSET=latin1;
+/*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Dumping data for table `oauth_authorization_codes`
+--
+
+LOCK TABLES `oauth_authorization_codes` WRITE;
+/*!40000 ALTER TABLE `oauth_authorization_codes` DISABLE KEYS */;
+/*!40000 ALTER TABLE `oauth_authorization_codes` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Table structure for table `oauth_clients`
+--
+
+DROP TABLE IF EXISTS `oauth_clients`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!40101 SET character_set_client = utf8 */;
+CREATE TABLE `oauth_clients` (
+  `client_id` varchar(80) NOT NULL,
+  `client_secret` varchar(80) DEFAULT NULL,
+  `redirect_uri` varchar(2000) NOT NULL,
+  `grant_types` varchar(80) DEFAULT NULL,
+  `scope` varchar(100) DEFAULT NULL,
+  `user_id` varchar(80) DEFAULT NULL,
+  PRIMARY KEY (`client_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=latin1;
+/*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Dumping data for table `oauth_clients`
+--
+
+LOCK TABLES `oauth_clients` WRITE;
+/*!40000 ALTER TABLE `oauth_clients` DISABLE KEYS */;
+/*!40000 ALTER TABLE `oauth_clients` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Table structure for table `oauth_jwt`
+--
+
+DROP TABLE IF EXISTS `oauth_jwt`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!40101 SET character_set_client = utf8 */;
+CREATE TABLE `oauth_jwt` (
+  `client_id` varchar(80) NOT NULL,
+  `subject` varchar(80) DEFAULT NULL,
+  `public_key` varchar(2000) DEFAULT NULL,
+  PRIMARY KEY (`client_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=latin1;
+/*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Dumping data for table `oauth_jwt`
+--
+
+LOCK TABLES `oauth_jwt` WRITE;
+/*!40000 ALTER TABLE `oauth_jwt` DISABLE KEYS */;
+/*!40000 ALTER TABLE `oauth_jwt` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Table structure for table `oauth_refresh_tokens`
+--
+
+DROP TABLE IF EXISTS `oauth_refresh_tokens`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!40101 SET character_set_client = utf8 */;
+CREATE TABLE `oauth_refresh_tokens` (
+  `refresh_token` varchar(40) NOT NULL,
+  `client_id` varchar(80) NOT NULL,
+  `user_id` varchar(255) DEFAULT NULL,
+  `expires` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `scope` varchar(2000) DEFAULT NULL,
+  PRIMARY KEY (`refresh_token`)
+) ENGINE=InnoDB DEFAULT CHARSET=latin1;
+/*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Dumping data for table `oauth_refresh_tokens`
+--
+
+LOCK TABLES `oauth_refresh_tokens` WRITE;
+/*!40000 ALTER TABLE `oauth_refresh_tokens` DISABLE KEYS */;
+/*!40000 ALTER TABLE `oauth_refresh_tokens` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Table structure for table `oauth_scopes`
+--
+
+DROP TABLE IF EXISTS `oauth_scopes`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!40101 SET character_set_client = utf8 */;
+CREATE TABLE `oauth_scopes` (
+  `scope` text,
+  `is_default` tinyint(1) DEFAULT NULL
+) ENGINE=InnoDB DEFAULT CHARSET=latin1;
+/*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Dumping data for table `oauth_scopes`
+--
+
+LOCK TABLES `oauth_scopes` WRITE;
+/*!40000 ALTER TABLE `oauth_scopes` DISABLE KEYS */;
+/*!40000 ALTER TABLE `oauth_scopes` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Table structure for table `oauth_users`
+--
+
+DROP TABLE IF EXISTS `oauth_users`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!40101 SET character_set_client = utf8 */;
+CREATE TABLE `oauth_users` (
+  `username` varchar(255) NOT NULL,
+  `password` varchar(2000) DEFAULT NULL,
+  `first_name` varchar(255) DEFAULT NULL,
+  `last_name` varchar(255) DEFAULT NULL,
+  PRIMARY KEY (`username`)
+) ENGINE=InnoDB DEFAULT CHARSET=latin1;
+/*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Dumping data for table `oauth_users`
+--
+
+LOCK TABLES `oauth_users` WRITE;
+/*!40000 ALTER TABLE `oauth_users` DISABLE KEYS */;
+/*!40000 ALTER TABLE `oauth_users` ENABLE KEYS */;
+UNLOCK TABLES;
+/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;
+
+/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
+/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
+/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
+/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
+/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
+/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
+/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
+
+-- Dump completed on 2016-11-22 13:40:07

src/oauth2-server/mkr_postinst.sh

+#!/bin/bash
+
+
+mysql lmce_oauth2_db -e "show tables;" >/dev/null 2>/dev/null
+RET="$?"
+
+if [[ "$RET" != "0" ]]; then
+	mysql -e "create database lmce_oauth2_db"
+	mysql lmce_oauth2_db < /usr/pluto/database/lmce_oauth2_db.sql
+fi

src/oauth2-server/oauth2-server-php/.gitignore

+# Test Files #
+test/config/test.sqlite
+vendor
+composer.lock
+.idea

src/oauth2-server/oauth2-server-php/.travis.yml

+language: php
+sudo: false
+php:
+- 5.3
+- 5.4
+- 5.5
+- 5.6
+- hhvm
+env:
+  global:
+  - SKIP_MONGO_TESTS=1
+  - secure: Bc5ZqvZ1YYpoPZNNuU2eCB8DS6vBYrAdfBtTenBs5NSxzb+Vjven4kWakbzaMvZjb/Ib7Uph7DGuOtJXpmxnvBXPLd707LZ89oFWN/yqQlZKCcm8iErvJCB5XL+/ONHj2iPdR242HJweMcat6bMCwbVWoNDidjtWMH0U2mYFy3M=
+  - secure: R3bXlymyFiY2k2jf7+fv/J8i34wtXTkmD4mCr5Ps/U+vn9axm2VtvR2Nj+r7LbRjn61gzFE/xIVjYft/wOyBOYwysrfriydrnRVS0owh6y+7EyOyQWbRX11vVQMf8o31QCQE5BY58V5AJZW3MjoOL0FVlTgySJiJvdw6Pv18v+E=
+services:
+- mongodb
+- redis-server
+- cassandra
+before_script:
+- psql -c 'create database oauth2_server_php;' -U postgres
+- composer require predis/predis:dev-master
+- composer require thobbs/phpcassa:dev-master
+- composer require 'aws/aws-sdk-php:~2.8'
+- composer require 'firebase/php-jwt:~2.2'
+after_script:
+- php test/cleanup.php

src/oauth2-server/oauth2-server-php/CHANGELOG.md

+CHANGELOG for 1.x
+=================
+
+This changelog references the relevant changes (bug and security fixes) done
+in 1.x minor versions.
+
+To see the files changed for a given bug, go to https://github.com/bshaffer/oauth2-server-php/issues/### where ### is the bug number
+To get the diff between two versions, go to https://github.com/bshaffer/oauth2-server-php/compare/v1.0...v1.1
+To get the diff for a specific change, go to https://github.com/bshaffer/oauth2-server-php/commit/XXX where XXX is the change hash
+
+* 1.8.0 (2015-09-18)
+
+  PR: https://github.com/bshaffer/oauth2-server-php/pull/643
+
+  * bug #594 - adds jti
+  * bug #598 - fixes lifetime configurations for JWTs
+  * bug #634 - fixes travis builds, upgrade to containers
+  * bug #586 - support for revoking tokens
+  * bug #636 - Adds FirebaseJWT bridge
+  * bug #639 - Mongo HHVM compatibility
+
+* 1.7.0 (2015-04-23)
+
+  PR: https://github.com/bshaffer/oauth2-server-php/pull/572
+
+  * bug #500 - PDO fetch mode changed from FETCH_BOTH to FETCH_ASSOC
+  * bug #508 - Case insensitive for Bearer token header name  ba716d4
+  * bug #512 - validateRedirectUri is now public
+  * bug #530 - Add PublicKeyInterface, UserClaimsInterface to Cassandra Storage
+  * bug #505 - DynamoDB storage fixes
+  * bug #556 - adds "code id_token" return type to openid connect
+  * bug #563 - Include "issuer" config key for JwtAccessToken
+  * bug #564 - Fixes JWT vulnerability
+  * bug #571 - Added unset_refresh_token_after_use option
+
+* 1.6 (2015-01-16)
+
+  PR: https://github.com/bshaffer/oauth2-server-php/pull/496
+
+  * bug 437 - renames CryptoToken to JwtAccessToken / use_crypto_tokens to use_jwt_access_tokens
+  * bug 447 - Adds a Couchbase storage implementation
+  * bug 460 - Rename JWT claims to match spec
+  * bug 470 - order does not matter for multi-valued response types
+  * bug 471 - Make validateAuthorizeRequest available for POST in addition to GET
+  * bug 475 - Adds JTI table definitiion
+  * bug 481 - better randomness for generating access tokens
+  * bug 480 - Use hash_equals() for signature verification (prevents remote timing attacks)
+  * bugs 489, 491, 498 - misc other fixes
+
+* 1.5 (2014-08-27)
+
+  PR: https://github.com/bshaffer/oauth2-server-php/pull/446
+
+  * bug #399 - Add DynamoDB Support
+  * bug #404 - renamed error name for malformed/expired tokens
+  * bug #412 - Openid connect: fixes for claims with more than one scope / Add support for the prompt parameter ('consent' and 'none')
+  * bug #411 - fixes xml output
+  * bug #413 - fixes invalid format error
+  * bug #401 - fixes code standards / whitespace
+  * bug #354 - bundles PDO SQL with the library
+  * [BC] bug #397 - refresh tokens should not be encrypted
+  * bug #423 - makes "scope" optional for refresh token storage
+
+* 1.4 (2014-06-12)
+
+  PR: https://github.com/bshaffer/oauth2-server-php/pull/392
+
+  * bug #189 Storage\PDO - allows DSN string in constructor
+  * bug #233 Bearer Tokens - allows token in request body for PUT requests
+  * bug #346 Fixes open_basedir warning
+  * bug #351 Adds OpenID Connect support
+  * bug #355 Adds php 5.6 and HHVM to travis.ci testing
+  * [BC] bug #358 Adds `getQuerystringIdentifier()` to the GrantType interface
+  * bug #363 Encryption\JWT - Allows for subclassing JWT Headers
+  * bug #349 Bearer Tokens - adds requestHasToken method for when access tokens are optional
+  * bug #301 Encryption\JWT - fixes urlSafeB64Encode(): ensures newlines are replaced as expected
+  * bug #323 ResourceController - client_id is no longer required to be returned when calling getAccessToken
+  * bug #367 Storage\PDO - adds Postgres support
+  * bug #368 Access Tokens - use mcrypt_create_iv or openssl_random_pseudo_bytes to create token string
+  * bug #376 Request - allows case insensitive headers
+  * bug #384 Storage\PDO - can pass in PDO options in constructor of PDO storage
+  * misc fixes #361, #292, #373, #374, #379, #396
+* 1.3 (2014-02-27)
+
+  PR: https://github.com/bshaffer/oauth2-server-php/pull/325
+
+  * bug #311 adds cassandra storage
+  * bug #298 fixes response code for user credentials grant type
+  * bug #318 adds 'use_crypto_tokens' config to Server class for better DX
+  * [BC] bug #320 pass client_id to getDefaultScope
+  * bug #324 better feedback when running tests
+  * bug #335 adds support for non-expiring refresh tokens
+  * bug #333 fixes Pdo storage for getClientKey
+  * bug #336 fixes Redis storage for expireAuthorizationCode
+
+* 1.3 (2014-02-27)
+
+  PR: https://github.com/bshaffer/oauth2-server-php/pull/325
+
+  * bug #311 adds cassandra storage
+  * bug #298 fixes response code for user credentials grant type
+  * bug #318 adds 'use_crypto_tokens' config to Server class for better DX
+  * bug #320 pass client_id to getDefaultScope
+  * bug #324 better feedback when running tests
+  * bug #335 adds support for non-expiring refresh tokens
+  * bug #333 fixes Pdo storage for getClientKey
+  * bug #336 fixes Redis storage for expireAuthorizationCode
+
+* 1.2 (2014-01-03)
+
+  PR: https://github.com/bshaffer/oauth2-server-php/pull/288
+
+  * bug #285 changed response header from 200 to 401 when empty token received
+  * bug #286 adds documentation and links to spec for not including error messages when no token is supplied
+  * bug #280 ensures PHP warnings do not get thrown as a result of an invalid argument to $jwt->decode()
+  * bug #279 predis wrong number of arguments
+  * bug #277 Securing JS WebApp client secret w/ password grant type
+
+* 1.1 (2013-12-17)
+
+  PR: https://github.com/bshaffer/oauth2-server-php/pull/276
+
+  * bug #278 adds refresh token configuration to Server class
+  * bug #274 Supplying a null client_id and client_secret grants API access
+  * bug #244 [MongoStorage] More detailed implementation info
+  * bug #268 Implement jti for JWT Bearer tokens to prevent replay attacks.
+  * bug #266 Removing unused argument to getAccessTokenData
+  * bug #247 Make Bearer token type consistent
+  * bug #253 Fixing CryptoToken refresh token lifetime
+  * bug #246 refactors public key logic to be more intuitive
+  * bug #245 adds support for JSON crypto tokens
+  * bug #230 Remove unused columns in oauth_clients
+  * bug #215 makes Redis Scope Storage obey the same paradigm as PDO
+  * bug #228 removes scope group
+  * bug #227 squelches open basedir restriction error
+  * bug #223 Updated docblocks for RefreshTokenInterface.php
+  * bug #224 Adds protected properties
+  * bug #217 Implement ScopeInterface for PDO, Redis
+
+* 1.0 (2013-08-12)
+
+  * bug #203 Add redirect\_status_code config param for AuthorizeController
+  * bug #205 ensures unnecessary ? is not set when  ** bug
+  * bug #204 Fixed call to LogicException
+  * bug #202 Add explode to checkRestrictedGrant in PDO Storage
+  * bug #197 adds support for 'false' default scope  ** bug
+  * bug #192 reference errors and adds tests
+  * bug #194 makes some appropriate properties  ** bug
+  * bug #191 passes config to HttpBasic
+  * bug #190 validates client credentials before  ** bug
+  * bug #171 Fix wrong redirect following authorization step
+  * bug #187 client_id is now passed to getDefaultScope().
+  * bug #176 Require refresh_token in getRefreshToken response
+  * bug #174 make user\_id not required for refresh_token grant
+  * bug #173 Duplication in JwtBearer Grant
+  * bug #168 user\_id not required for authorization_code grant
+  * bug #133 hardens default security for user object
+  * bug #163 allows redirect\_uri on authorization_code to be NULL in docs example
+  * bug #162 adds getToken on ResourceController for convenience
+  * bug #161 fixes fatal error
+  * bug #163 Invalid redirect_uri handling
+  * bug #156 user\_id in OAuth2\_Storage_AuthorizationCodeInterface::getAuthorizationCode() response
+  * bug #157 Fix for extending access and refresh tokens
+  * bug #154 ResponseInterface: getParameter method is used in the library but not defined in the interface
+  * bug #148 Add more detail to examples in Readme.md

src/oauth2-server/oauth2-server-php/LICENSE

+The MIT License
+
+Copyright (c) 2014 Brent Shaffer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

src/oauth2-server/oauth2-server-php/README.md

+oauth2-server-php
+=================
+
+[![Build Status](https://travis-ci.org/bshaffer/oauth2-server-php.svg?branch=develop)](https://travis-ci.org/bshaffer/oauth2-server-php)
+
+[![Total Downloads](https://poser.pugx.org/bshaffer/oauth2-server-php/downloads.png)](https://packagist.org/packages/bshaffer/oauth2-server-php)
+
+View the [complete documentation](http://bshaffer.github.io/oauth2-server-php-docs/)
\ No newline at end of file

src/oauth2-server/oauth2-server-php/composer.json

+{
+    "name": "bshaffer/oauth2-server-php",
+    "description":"OAuth2 Server for PHP",
+    "keywords":["oauth","oauth2","auth"],
+    "type":"library",
+    "license":"MIT",
+    "authors":[
+        {
+            "name":"Brent Shaffer",
+            "email": "bshafs@gmail.com",
+            "homepage":"http://brentertainment.com"
+        }
+    ],
+    "homepage": "http://github.com/bshaffer/oauth2-server-php",
+    "require":{
+        "php":">=5.3.9"
+    },
+    "autoload": {
+        "psr-0": { "OAuth2": "src/" }
+    },
+    "suggest": {
+        "predis/predis": "Required to use the Redis storage engine",
+        "thobbs/phpcassa": "Required to use the Cassandra storage engine",
+        "aws/aws-sdk-php": "~2.8 is required to use the DynamoDB storage engine",
+        "firebase/php-jwt": "~2.2 is required to use JWT features"
+    }
+}

src/oauth2-server/oauth2-server-php/phpunit.xml

+<?xml version="1.0" encoding="UTF-8"?>
+
+<phpunit backupGlobals="false"
+         backupStaticAttributes="false"
+         colors="true"
+         convertErrorsToExceptions="true"
+         convertNoticesToExceptions="true"
+         convertWarningsToExceptions="true"
+         processIsolation="false"
+         stopOnFailure="false"
+         syntaxCheck="false"
+         bootstrap="test/bootstrap.php"
+>
+  <testsuites>
+    <testsuite name="Oauth2 Test Suite">
+      <directory>./test/OAuth2/</directory>
+    </testsuite>
+  </testsuites>
+
+  <filter>
+    <whitelist>
+      <directory suffix=".php">./src/OAuth2/</directory>
+    </whitelist>
+  </filter>
+</phpunit>

src/oauth2-server/oauth2-server-php/src/OAuth2/Autoloader.php

+<?php
+
+namespace OAuth2;
+
+/**
+ * Autoloads OAuth2 classes
+ *
+ * @author    Brent Shaffer <bshafs at gmail dot com>
+ * @license   MIT License
+ */
+class Autoloader
+{
+    private $dir;
+
+    public function __construct($dir = null)
+    {
+        if (is_null($dir)) {
+            $dir = dirname(__FILE__).'/..';
+        }
+        $this->dir = $dir;
+    }
+    /**
+     * Registers OAuth2\Autoloader as an SPL autoloader.
+     */
+    public static function register($dir = null)
+    {
+        ini_set('unserialize_callback_func', 'spl_autoload_call');
+        spl_autoload_register(array(new self($dir), 'autoload'));
+    }
+
+    /**
+     * Handles autoloading of classes.
+     *
+     * @param string $class A class name.
+     *
+     * @return boolean Returns true if the class has been loaded
+     */
+    public function autoload($class)
+    {
+        if (0 !== strpos($class, 'OAuth2')) {
+            return;
+        }
+
+        if (file_exists($file = $this->dir.'/'.str_replace('\\', '/', $class).'.php')) {
+            require $file;
+        }
+    }
+}

src/oauth2-server/oauth2-server-php/src/OAuth2/ClientAssertionType/ClientAssertionTypeInterface.php

+<?php
+
+namespace OAuth2\ClientAssertionType;
+
+use OAuth2\RequestInterface;
+use OAuth2\ResponseInterface;
+
+/**
+ * Interface for all OAuth2 Client Assertion Types
+ */
+interface ClientAssertionTypeInterface
+{
+    public function validateRequest(RequestInterface $request, ResponseInterface $response);
+    public function getClientId();
+}

src/oauth2-server/oauth2-server-php/src/OAuth2/ClientAssertionType/HttpBasic.php

+<?php
+
+namespace OAuth2\ClientAssertionType;
+
+use OAuth2\Storage\ClientCredentialsInterface;
+use OAuth2\RequestInterface;
+use OAuth2\ResponseInterface;
+
+/**
+ * Validate a client via Http Basic authentication
+ *
+ * @author    Brent Shaffer <bshafs at gmail dot com>
+ */
+class HttpBasic implements ClientAssertionTypeInterface
+{
+    private $clientData;
+
+    protected $storage;
+    protected $config;
+
+    /**
+     * @param OAuth2\Storage\ClientCredentialsInterface $clientStorage REQUIRED Storage class for retrieving client credentials information
+     * @param array                                     $config        OPTIONAL Configuration options for the server
+     *                                                                 <code>
+     *                                                                 $config = array(
+     *                                                                 'allow_credentials_in_request_body' => true, // whether to look for credentials in the POST body in addition to the Authorize HTTP Header
+     *                                                                 'allow_public_clients'  => true              // if true, "public clients" (clients without a secret) may be authenticated
+     *                                                                 );
+     *                                                                 </code>
+     */
+    public function __construct(ClientCredentialsInterface $storage, array $config = array())
+    {
+        $this->storage = $storage;
+        $this->config = array_merge(array(
+            'allow_credentials_in_request_body' => true,
+            'allow_public_clients' => true,
+        ), $config);
+    }