How to get ipaddr from $resourceOwner;

[adolf94]

Hi All,

Would like to seek help getting ipaddr from access_token;

I cant seem to get the ipaddr with $resourceOwner -> claim("ipaddr");

our company is using API Gateways which is why I cannot use the client IP for IP Address;

here's the print_r($resourceowner);
TheNetworg\OAuth2\Client\Provider\AzureResourceOwner Object ( [data:protected] => Array ( [aud] => 73b99a0d-33db-4f60-9428-246ab79ad7a1 [iss] => https://login.microsoftonline.com/f3211d0e-125b-42c3-86db-322b19a65a22/v2.0 [iat] => 1654196670 [nbf] => 1654196670 [exp] => 1654200570 [auth_time] => 1653645878 [email] => adolf.rey.a.along@domain.com [name] => Along, AR [oid] => a3d7f1ef-4b90-40bb-bb98-0b231fc3190c [preferred_username] => adolf.rey.a.along@domain.com [rh] => 0.ASYADh0h81sSw0KG2zIrGaZaIg2auXPbM2BPlCgkarea16EmAFA. [sub] => 7nrl5r4ZBgwsywvLVuRMiKCj40P_ABRbbh8Qg0WRJR4 [tid] => f3211d0e-125b-42c3-86db-322b19a65a22 [uti] => x-Nzcykiq0a1zqiW2sAAAA [ver] => 2.0 ) )

here is what I get from jwt.io with the access token:
{
"aud": "https://graph.microsoft.com",
"iss": "https://sts.windows.net/f3211d0e-125b-42c3-86db-322b19a65a22/",
"iat": 1654192709,
"nbf": 1654192709,
"exp": 1654198372,
"acct": 0,
"acr": "1",
"acrs": [
"urn:user:registersecurityinfo",
"c1",
"c2"
],
"aio": "AVQAq/8TAAAAx1MCI+PyDFrMZwtwqaEKGKzGscUtn9R3OhpGGaZozsW7yPFJMfadAR4UgOc485j73E38OdNa3wu7FwLqxBeiZBnC7E3wXAX4Y1//zzZK6D4=",
"amr": [
"pwd",
"mfa"
],
"app_displayname": "7107_MYAPP_LEGACY_PHP_Staging_ESOPortal",
"appid": "73b99a0d-33db-4f60-9428-246ab79ad7a1",
"appidacr": "1",
"family_name": "Along",
"given_name": "Adolf Rey",
"idtyp": "user",
"ipaddr": "112.202.179.1",
"name": "Along, AR",
"oid": "a3d7f1ef-4b90-40bb-bb98-0b231fc3190c",
"onprem_sid": "S-1-5-21-861567501-413027322-1801674531-3036785",
"platf": "3",
"puid": "1003BFFD8DC81D0E",
"rh": "0.ASYADh0h81sSw0KG2zIrGaZaIgMAAAAAAAAAwAAAAAAAAAAmAFA.",
"scp": "email openid profile User.Read",
"signin_state": [
"kmsi"
],
"sub": "-ePe17Ssg1rFUWAE_u1Sn5_7Kr5IYaCnccVRtaU1euE",
"tenant_region_scope": "NA",
"tid": "f3211d0e-125b-42c3-86db-322b19a65a22",
"unique_name": "adolf.rey.a.along@domain.om",
"upn": "adolf.rey.a.along@domain.com",
"uti": "cycwWq1hrEK3gjBdx03IAA",
"ver": "1.0",
"wids": [
"b79fbf4d-3ef9-4689-8143-76b194e85509"
],
"xms_st": {
"sub": "7nrl5r4ZBgwsywvLVuRMiKCj40P_ABRbbh8Qg0WRJR4"
},
"xms_tcdt": 1403205942
}

[hajekj]

Does it return anything? An error or just an empty value?

[adolf94]

Thanks for your response @hajekj

What is used for the above
$token = $provider->getAccessToken('authorization_code', [
'scope' => $provider->scope,
'code' => $_GET['code'],
]);
$resourceOwner = $provider -> getResourceOwner($token);

print_r($resourceowner);
TheNetworg\OAuth2\Client\Provider\AzureResourceOwner Object ( [data:protected] => Array ( [aud] => 73b99a0d-33db-4f60-9428-246ab79ad7a1 [iss] => https://login.microsoftonline.com/f3211d0e-125b-42c3-86db-322b19a65a22/v2.0 [iat] => 1654196670 [nbf] => 1654196670 [exp] => 1654200570 [auth_time] => 1653645878 [email] => [adolf.rey.a.along@domain.com](mailto:adolf.rey.a.along@domain.com) [name] => Along, AR [oid] => a3d7f1ef-4b90-40bb-bb98-0b231fc3190c [preferred_username] => [adolf.rey.a.along@domain.com](mailto:adolf.rey.a.along@domain.com) [rh] => 0.ASYADh0h81sSw0KG2zIrGaZaIg2auXPbM2BPlCgkarea16EmAFA. [sub] => 7nrl5r4ZBgwsywvLVuRMiKCj40P_ABRbbh8Qg0WRJR4 [tid] => f3211d0e-125b-42c3-86db-322b19a65a22 [uti] => x-Nzcykiq0a1zqiW2sAAAA [ver] => 2.0 ) )

which results to

getUpn() | | NULL
getId() | a3d7f1ef-4b90-40bb-bb98-0b231fc3190c | string
claim('email') | adolf.rey.a.along@domain.com | string
claim(aud) | 73b99a0d-33db-4f60-9428-246ab79ad7a1 | string
claim(iss) | https://login.microsoftonline.com/f3211d0e-125b-42c3-86db-322b19a65a22/v2.0 | string
claim(iat) | 1654249738 | integer
**claim(ipaddr) | | NULL**

seems like $resourceOwner is the result for id_token below..
with $token -> getValues();
Array ( [token_type] => Bearer [scope] => 73b99a0d-33db-4f60-9428-246ab79ad7a1/User.Read 73b99a0d-33db-4f60-9428-246ab79ad7a1/user_impersonation [ext_expires_in] => 4500 [id_token] => eyJ0eXAiOiJKV1QiLCJhbGciOiJ........vRUZ2sVTCRH0Bs8QeT0qnVLu4ersq_mM5Hc_pw)

not sure if im doing the right approach. but the ipaddr is contained in $token -> getToken();
eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImpTMVhvMU9XRGpfNT.............................mwfldZniew3ymA8XtxR1I4Io90fiHeL0SAVj_C2zWXH0hdarvtqlkOxTFNw
when using jwt.io as shown on my initial post.

[hajekj]

That is correct, $resourceOwner comes from the id_token, which probably doesn't contain the information. I believe you would need to obtain the access_token and parse it via $claims = $provider->validateAccessToken($accessToken); and take it from the claims.