Google Single Sign-On implementation with PHP

Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems using a single set of credentials (typically a username and password). Once authenticated, the user is granted access to all linked resources without needing to re-enter their login information for each individual application. This simplifies user experience, enhances security by reducing the number of passwords to manage, and streamlines administrative tasks for organizations.

To implement Google Single Sign-On (SSO) in PHP, you typically use the Google API client library. Below is a basic step-by-step guide and code example to integrate Google SSO:

Step 1: Set up a Google API project

1. Go to the Google Cloud Console.
2. Create a new project (or use an existing one).
3. Navigate to APIs & Services > Credentials.
4. Click Create Credentials > OAuth 2.0 Client ID.
5. Set up the OAuth consent screen and configure your app.
6. Under "Authorized redirect URIs," add the URL where your application will handle Google's callback, e.g., http://localhost/callback.php.

Step 2: Install the Google API Client Library

Install the PHP Google Client Library using Composer:

composer require google/apiclient:^2.0

Step 3: Implement the PHP code

Here’s a basic example:

index.php - Login page

<?php
require_once 'vendor/autoload.php';

session_start();

// Initialize Google Client
$client = new Google_Client();
$client->setClientId('YOUR_CLIENT_ID');
$client->setClientSecret('YOUR_CLIENT_SECRET');
$client->setRedirectUri('http://localhost/callback.php');
$client->addScope("email");
$client->addScope("profile");

// Generate the login URL
$login_url = $client->createAuthUrl();
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <title>Google SSO</title>
</head>
<body>
    <a href="<?= htmlspecialchars($login_url) ?>">Login with Google</a>
</body>
</html>

callback.php - Handle the Google callback

<?php
require_once 'vendor/autoload.php';

session_start();

$client = new Google_Client();
$client->setClientId('YOUR_CLIENT_ID');
$client->setClientSecret('YOUR_CLIENT_SECRET');
$client->setRedirectUri('http://localhost/callback.php');

if (isset($_GET['code'])) {
    $token = $client->fetchAccessTokenWithAuthCode($_GET['code']);
    $client->setAccessToken($token);

    // Get user information
    $google_oauth = new Google_Service_Oauth2($client);
    $google_account_info = $google_oauth->userinfo->get();

    // Save user information in session or database
    $_SESSION['user'] = [
        'id' => $google_account_info->id,
        'name' => $google_account_info->name,
        'email' => $google_account_info->email,
        'picture' => $google_account_info->picture,
    ];

    // Redirect to a logged-in page
    header('Location: profile.php');
    exit();
} else {
    echo "Failed to authenticate with Google!";
}

profile.php - Display user information

<?php
session_start();

if (!isset($_SESSION['user'])) {
    header('Location: index.php');
    exit();
}

$user = $_SESSION['user'];
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <title>User Profile</title>
</head>
<body>
    <h1>Welcome, <?= htmlspecialchars($user['name']) ?></h1>
    <p>Email: <?= htmlspecialchars($user['email']) ?></p>
    <img src="<?= htmlspecialchars($user['picture']) ?>" alt="Profile Picture">
    <br>
    <a href="logout.php">Logout</a>
</body>
</html>

logout.php - Logout

<?php
session_start();
session_destroy();
header('Location: index.php');
exit();

Key Notes

1. Redirect URI: Ensure that the redirect URI in your Google Cloud Console matches the one in your setRedirectUri method.
2. Security: Avoid hardcoding client credentials in production. Use environment variables or configuration files.
3. HTTPS: Use HTTPS in production environments to secure the OAuth flow.
4. Token Validation: Validate the token to prevent misuse in production applications.

This implementation allows users to log in using Google, fetch their profile information, and manage sessions accordingly.