Oauth2 Server Public Client Bundle Laravel Package

Getting Started

This bundle is an add-on to spomky-labs/oauth2-server-bundle. It does not implement OAuth2 itself; it registers the "public client" (no client secret) client type and the supporting manager so the parent bundle can issue tokens to mobile apps, SPAs, and CLIs that cannot safely store a secret.

Minimal steps:

1. Require the parent bundle first, then this one:

   composer require spomky-labs/oauth2-server-bundle
   composer require spomky-labs/oauth2-server-public-client-bundle
   

2. Register it in app/AppKernel.php after the parent bundle, since it decorates/extends services the parent declares:

   new SpomkyLabs\Bundle\OAuth2ServerBundle\OAuth2ServerBundle(),
   new SpomkyLabs\Bundle\OAuth2ServerPublicClientBundle\OAuth2ServerPublicClientBundle(),
   

3. There is little to configure in config.yml. The bundle mostly exposes a service (a public-client manager / client type) via DependencyInjection/ and Resources/config/services.xml. Run app/console container:debug | grep -i oauth2 to see the exact service IDs and aliases rather than trusting the README naming.
4. First use case: create a client with an empty secret, allow only authorization_code (plus refresh_token), and point your SPA/mobile app at the parent bundle's /oauth/v2/auth and /oauth/v2/token endpoints.

Implementation Patterns

Pair it with the parent bundle's config. Grants, scopes, and storage live in spomky-labs/oauth2-server-bundle. This bundle only changes how clients authenticate (by client_id + redirect_uri instead of client_id/client_secret).

Client definitions. Public clients should be stored with a null/empty secret and flagged as public in your client manager. Keep the allowed-grant list per client, not global — a public client must never be allowed client_credentials or password.

Typical authorization-code flow (public client):

GET /oauth/v2/auth?response_type=code
   &client_id=mobile-app
   &redirect_uri=https://app.example/cb
   &scope=read
   [&code_challenge=...&code_challenge_method=S256]   // if PKCE support is present

POST /oauth/v2/token
   grant_type=authorization_code
   &client_id=mobile-app
   &code=...
   &redirect_uri=https://app.example/cb
   // no client_secret

If the parent library version is old enough that PKCE is unavailable, fall back to strict exact-match redirect URIs.

Custom client manager. The most common integration is replacing the default manager with your own (Doctrine entity, config-driven array, etc.) and decorating it to assert isPublic() semantics. Alias your implementation over the service ID the bundle registers.

API protection stays unchanged. Resource-server firewalls and token validation are the parent bundle's job; tokens from public clients are validated identically. In tests, hit the auth and token endpoints with a public client and assert the absence of client_secret succeeds and that passing one is ignored/rejected consistently.

Gotchas and Tips

• This is Symfony 2-era and effectively abandoned. Symfony 2 is EOL, and the underlying OAuth2 stack has been superseded by league/oauth2-server with oauth2-server-bundle/FOSOAuthServerBundle. Use this only to maintain a legacy app; do not start new work on it.
• Public client is not "insecure client." Without PKCE or exact redirect-URI matching, the authorization code can be intercepted. Prefer implicit only if PKCE genuinely isn't supported, and lock redirect_uri to a whitelist.
• Invalid client errors (invalid_client) usually mean the client manager is still requiring a secret or the client record lacks the public flag. Check the manager, not the bundle config.
• Service naming is inconsistent across the Spomky-Labs bundles (spomky_labs_*, oauth2_server_*). Always confirm with container:debug; the docs and the actual IDs drift between versions.
• Clear the cache after editing client definitions — managers may cache client lookups, and stale config is the usual cause of "client not found."
• Extension point is decoration: wrap the parent's client manager to add validation (e.g., reject public clients with a non-empty secret, enforce grant restrictions) rather than forking the bundle.