Tiki implements OAuth in multiple ways, both as a consumer (client) connecting to external OAuth providers, and as an OAuth 2.0 server (provider) allowing external applications to authenticate and access Tiki's API.

OAuth (Open Authorization) is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites without giving them the passwords.

Tiki supports multiple OAuth implementations to accommodate different provider requirements. The system implements OAuth 1.0 for Zotero integration, which uses the older but still widely supported OAuth 1.0 protocol. For modern providers like Twitter and Vimeo, as well as for Tiki's own OAuth server functionality, the system uses OAuth 2.0, which provides improved security and user experience. Additionally, Tiki includes custom OAuth flows specifically tailored for Facebook and LinkedIn, which have unique requirements that don't fit neatly into the standard OAuth 1.0 or 2.0 specifications.

Tiki uses the PHP League OAuth libraries for OAuth 2.0 implementation, which was added in Tiki20 for use with Converse (XMPP chat).

Zotero integration enables researchers and academics to seamlessly access their bibliographic references stored in Zotero libraries directly from Tiki. Users can retrieve references by tag, access individual library items, and format citations in various academic styles including BibTeX. This integration uses OAuth 1.0, which is Zotero's supported authentication method.

Configuration
Zotero

Usage:

$zoterolib = TikiLib::lib('zotero');

// Check authorization
if ($zoterolib->is_authorized()) {
    // Get references by tag
    $references = $zoterolib->get_references($tag, $limit);
    
    // Get first entry
    $entry = $zoterolib->get_first_entry($tag);
    
    // Get formatted references (BibTeX)
    $bibtex = $zoterolib->get_formatted_references($tag);
}

Zotero uses OAuth 1.0, which requires a three-step authentication process. The request token is obtained from https://www.zotero.org/oauth/request, followed by user authorization at https://www.zotero.org/oauth/authorize, and finally token exchange at https://www.zotero.org/oauth/access. Once authenticated, API requests are made to https://api.zotero.org to retrieve bibliographic data.

Facebook integration provides multiple capabilities including allowing users to log in using their Facebook credentials and retrieving Facebook feeds for display within Tiki. The integration can also automatically create Tiki user accounts when users first log in via Facebook, streamlining the registration process. Unlike the other providers, Facebook uses a custom OAuth implementation rather than the standard OAuthLib class, which provides more flexibility for Facebook's specific requirements.

Configuration:
Module-facebook

Usage:

$socialnetworkslib = TikiLib::lib('socialnetworks');

// Start OAuth flow
$socialnetworkslib->getFacebookRequestToken();

// After callback, login
$socialnetworkslib->facebookLoginPre();

// Publish to wall
$socialnetworkslib->facebookWallPublish($user, $message, $url);

// Get wall feed
$feed = $socialnetworkslib->facebookGetWall($user);

Vimeo integration lets users upload videos to their Vimeo account from Tiki’s file gallery, the Vimeo wiki plugin, or tracker fields configured for Vimeo. Users must authorize Tiki with Vimeo once; thereafter the integration can request quota, create upload tickets, complete uploads, and manage video metadata (title, delete). This integration uses OAuth 2.0.

Configuration:
Step 1: Enable Vimeo Upload in Tiki
Go to:
Admin → File Gallery → Enhancement section

In the Enhancement section, enable:

• vimeo_upload : Allows users to upload videos to Vimeo from Tiki.

Then set the following values:

• vimeo_consumer_key : Your Vimeo application Client ID
• vimeo_consumer_secret : Your Vimeo application Client Secret

These credentials are obtained from your Vimeo Developer application.

Step 2: Create a Vimeo Application
Create a new application in your Vimeo Developer dashboard: https://developer.vimeo.com/apps/new
After creating the application:

• Open your Vimeo application.
• Locate the OAuth Redirect URLs section.
• Add your Tiki OAuth callback URL.

The callback URL format must be:

https://your-tiki-site.tld/tiki-ajax_services.php?controller=oauth&action=callback&oauth_callback=vimeo

Replace your-tiki-site.tld with your actual domain name.

Usage:

$vimeolib = TikiLib::lib('vimeo');

// Check authorization
if ($vimeolib->isAuthorized()) {
// Get upload quota (space and SD/HD limits)
$quota = $vimeolib->getQuota();

// Get an upload ticket (for resumable upload)
$ticket = $vimeolib->getTicket();

// Complete upload (DELETE to the complete_uri from the ticket)
$vimeolib->complete($completeUri);

// Set video title
$vimeolib->setTitle($videoId, $title);

// Delete a video
$vimeolib->deleteVideo($videoId);
}

Vimeo OAuth 2.0 uses https://api.vimeo.com/oauth/authorize for authorization and https://api.vimeo.com/oauth/access_token for the token exchange. API requests are made to https://api.vimeo.com (e.g. /me, /me/videos, /videos/{id}). The token is stored in the user preference oauth_token_vimeo.

When XMPP is enabled and the authentication method is set to: xmpp_auth_method = 'oauth'
The ConverseJS chat client uses Tiki as its OAuth provider.
How It Works

• The user is already logged in to Tiki.
• When the chat needs to authenticate to the XMPP server, it redirects the user to Tiki’s OAuth authorize URL (implicit flow).
• After authorization, Tiki redirects back to a fixed redirect page.
• The access token is returned in the URL fragment.
• ConverseJS reads the access token.
• The token is then used for XMPP authentication (for example using OAUTHBEARER).

Configuration
Go to:
Admin → Chat (XMPP)

Configure the following:

• Set the XMPP server
• Set the HTTP Bind (BOSH) URL or WebSocket URL
• Set the authentication method to OAuth

OAuth Client Details
No manual client registration is required. Tiki automatically creates an OAuth client with:

• client_id = org.tiki.rtc.internal-conversejs-id
• redirect_uri → lib/xmpp/html/redirect.html

This internal client is used by ConverseJS for OAuth authentication.

PeerTube integration allows Tiki to upload and manage videos on a PeerTube instance, including listing channels, uploading videos, and retrieving video lists. PeerTube authentication in Tiki is based on OAuth 2.0 using the Resource Owner Password Credentials grant.

Unlike Vimeo or other OAuth providers, Tiki does not use a user-facing "connect your account" flow. There is no redirect or consent screen. Instead, the administrator configures a single PeerTube account (username and password) in Tiki.

When an authenticated request is required, Tiki retrieves the public local OAuth client from the PeerTube instance and performs a server-side token exchange using the configured credentials. This means OAuth 2.0 is used internally, but entirely without browser redirection.

Configuration
Go to:
Admin → Video → PeerTube tab
Set the following preferences:
peertube_service_url
peertube_username
peertube_password
No Client ID or Client Secret needs to be entered manually. Tiki automatically retrieves the public local OAuth client from:

{peertube_service_url}/api/v1/oauth-clients/local

The retrieved client configuration is cached in the session.

Token Exchange Process
PeerTube provides an OAuth 2.0 token endpoint at:

{peertube_service_url}/api/v1/users/token

Tiki sends a server-side request with:
grant_type=password
client_id and client_secret (from the local client)
username and password (from Tiki preferences)
PeerTube responds with an access_token. This token is then included in all API requests using:

Authorization: Bearer {access_token}

Usage Example

$peertubelib = new \Tiki\Videogals\PeerTubeLib();

if ($peertubelib->testSetup()) {
    $channels = $peertubelib->getMyChannels();
    // uploadVideo($file, $metadata);
    // listVideos();
}

The local OAuth client belongs to the PeerTube instance and is intended for trusted or server-to-server usage. It is independent from Tiki’s own OAuth server and different from the OAuth flows used for providers such as Vimeo or Zotero.

https://oauth2.thephpleague.com/ was added for use with Converse in Tiki20. Some related commits:

• http://sourceforge.net/p/tikiwiki/code/68703
• http://sourceforge.net/p/tikiwiki/code/68713