Merge pull request #276 from bshaffer/developv1.1

Create Tag v1.1

29 files changed, 699 insertions, 45 deletions

diff --git a/src/OAuth2/Autoloader.php b/src/OAuth2/Autoloader.php
index eff8461..24ac68b 100644
--- a/src/OAuth2/Autoloader.php
+++ b/src/OAuth2/Autoloader.php
@@ -31,7 +31,7 @@ class Autoloader
     /**
      * Handles autoloading of classes.
      *
-     * @param  string  $class  A class name.
+     * @param string $class A class name.
      *
      * @return boolean Returns true if the class has been loaded
      */
diff --git a/src/OAuth2/ClientAssertionType/HttpBasic.php b/src/OAuth2/ClientAssertionType/HttpBasic.php
index a42dea0..2e8c89d 100644
--- a/src/OAuth2/ClientAssertionType/HttpBasic.php
+++ b/src/OAuth2/ClientAssertionType/HttpBasic.php
@@ -38,11 +38,13 @@ class HttpBasic implements ClientAssertionTypeInterface
 
         if ($this->storage->checkClientCredentials($clientData['client_id'], $clientData['client_secret']) === false) {
             $response->setError(400, 'invalid_client', 'The client credentials are invalid');
+
             return false;
         }
 
         if (!$this->storage->checkRestrictedGrantType($clientData['client_id'], $request->request('grant_type'))) {
             $response->setError(400, 'unauthorized_client', 'The grant type is unauthorized for this client_id');
+
             return false;
         }
 
@@ -89,6 +91,7 @@ class HttpBasic implements ClientAssertionTypeInterface
                  * client_secret can be null if the client's password is an empty string
                  * @see http://tools.ietf.org/html/rfc6749#section-2.3.1
                  */
+
                 return array('client_id' => $request->request('client_id'), 'client_secret' => $request->request('client_secret', ''));
             }
         }
@@ -99,4 +102,4 @@ class HttpBasic implements ClientAssertionTypeInterface
 
         return null;
     }
-}
\ No newline at end of file
+}
diff --git a/src/OAuth2/Controller/AuthorizeController.php b/src/OAuth2/Controller/AuthorizeController.php
index 7a66443..93ecf30 100644
--- a/src/OAuth2/Controller/AuthorizeController.php
+++ b/src/OAuth2/Controller/AuthorizeController.php
@@ -81,6 +81,7 @@ class AuthorizeController implements AuthorizeControllerInterface
         if ($is_authorized === false) {
             $redirect_uri = $this->redirect_uri ?: $registered_redirect_uri;
             $response->setRedirect($this->config['redirect_status_code'], $redirect_uri, $this->state, 'access_denied', "The user denied access to your application");
+
             return;
         }
 
@@ -113,12 +114,14 @@ class AuthorizeController implements AuthorizeControllerInterface
         if (!$client_id = $request->query("client_id")) {
             // We don't have a good URI to use
             $response->setError(400, 'invalid_client', "No client id supplied");
+
             return false;
         }
 
         // Get client details
         if (!$clientData = $this->clientStorage->getClientDetails($client_id)) {
             $response->setError(400, 'invalid_client', 'The client id supplied is invalid');
+
             return false;
         }
 
@@ -133,12 +136,14 @@ class AuthorizeController implements AuthorizeControllerInterface
             $parts = parse_url($supplied_redirect_uri);
             if (isset($parts['fragment']) && $parts['fragment']) {
                 $response->setError(400, 'invalid_uri', 'The redirect URI must not contain a fragment');
+
                 return false;
             }
 
             // validate against the registered redirect uri(s) if available
             if ($registered_redirect_uri && !$this->validateRedirectUri($supplied_redirect_uri, $registered_redirect_uri)) {
                 $response->setError(400, 'redirect_uri_mismatch', 'The redirect URI provided is missing or does not match', '#section-3.1.2');
+
                 return false;
             }
             $redirect_uri = $supplied_redirect_uri;
@@ -146,11 +151,13 @@ class AuthorizeController implements AuthorizeControllerInterface
             // use the registered redirect_uri if none has been supplied, if possible
             if (!$registered_redirect_uri) {
                 $response->setError(400, 'invalid_uri', 'No redirect URI was supplied or stored');
+
                 return false;
             }
 
             if (count(explode(' ', $registered_redirect_uri)) > 1) {
                 $response->setError(400, 'invalid_uri', 'A redirect URI must be supplied when multiple redirect URIs are registered', '#section-3.1.2.3');
+
                 return false;
             }
             $redirect_uri = $registered_redirect_uri;
@@ -166,19 +173,23 @@ class AuthorizeController implements AuthorizeControllerInterface
         // type and client_id are required
         if (!$response_type || !in_array($response_type, array(self::RESPONSE_TYPE_AUTHORIZATION_CODE, self::RESPONSE_TYPE_ACCESS_TOKEN))) {
             $response->setRedirect($this->config['redirect_status_code'], $redirect_uri, $state, 'invalid_request', 'Invalid or missing response type', null);
+
             return false;
         }
         if ($response_type == self::RESPONSE_TYPE_AUTHORIZATION_CODE) {
             if (!isset($this->responseTypes['code'])) {
                 $response->setRedirect($this->config['redirect_status_code'], $redirect_uri, $state, 'unsupported_response_type', 'authorization code grant type not supported', null);
+
                 return false;
             }
             if (!$this->clientStorage->checkRestrictedGrantType($client_id, 'authorization_code')) {
                 $response->setRedirect($this->config['redirect_status_code'], $redirect_uri, $state, 'unauthorized_client', 'The grant type is unauthorized for this client_id', null);
+
                 return false;
             }
             if ($this->responseTypes['code']->enforceRedirect() && !$redirect_uri) {
                 $response->setError(400, 'redirect_uri_mismatch', 'The redirect URI is mandatory and was not supplied');
+
                 return false;
             }
         }
@@ -186,10 +197,12 @@ class AuthorizeController implements AuthorizeControllerInterface
         if ($response_type == self::RESPONSE_TYPE_ACCESS_TOKEN) {
             if (!$this->config['allow_implicit']) {
                 $response->setRedirect($this->config['redirect_status_code'], $redirect_uri, $state, 'unsupported_response_type', 'implicit grant type not supported', null);
+
                 return false;
             }
             if (!$this->clientStorage->checkRestrictedGrantType($client_id, 'implicit')) {
                 $response->setRedirect($this->config['redirect_status_code'], $redirect_uri, $state, 'unauthorized_client', 'The grant type is unauthorized for this client_id', null);
+
                 return false;
             }
         }
@@ -197,17 +210,20 @@ class AuthorizeController implements AuthorizeControllerInterface
         // Validate that the requested scope is supported
         if (false === $scope) {
             $response->setRedirect($this->config['redirect_status_code'], $redirect_uri, $state, 'invalid_client', 'This application requires you specify a scope parameter', null);
+
             return false;
         }
 
         if (!is_null($scope) && !$this->scopeUtil->scopeExists($scope, $client_id)) {
             $response->setRedirect($this->config['redirect_status_code'], $redirect_uri, $state, 'invalid_scope', 'An unsupported scope was requested', null);
+
             return false;
         }
 
         // Validate state parameter exists (if configured to enforce this)
         if ($this->config['enforce_state'] && !$state) {
             $response->setRedirect($this->config['redirect_status_code'], $redirect_uri, null, 'invalid_request', 'The state parameter is required');
+
             return false;
         }
 
@@ -240,7 +256,7 @@ class AuthorizeController implements AuthorizeControllerInterface
         $parse_url = parse_url($uri);
 
         // Add our params to the parsed uri
-        foreach ( $params as $k => $v ) {
+        foreach ($params as $k => $v) {
             if (isset($parse_url[$k])) {
                 $parse_url[$k] .= "&" . http_build_query($v);
             } else {
@@ -293,6 +309,7 @@ class AuthorizeController implements AuthorizeControllerInterface
                 }
             }
         }
+
         return false;
     }
 
diff --git a/src/OAuth2/Controller/ResourceController.php b/src/OAuth2/Controller/ResourceController.php
index e407b54..862e364 100644
--- a/src/OAuth2/Controller/ResourceController.php
+++ b/src/OAuth2/Controller/ResourceController.php
@@ -38,7 +38,7 @@ class ResourceController implements ResourceControllerInterface
 
     public function verifyResourceRequest(RequestInterface $request, ResponseInterface $response, $scope = null)
     {
-        $token = $this->getAccessTokenData($request, $response, $scope);
+        $token = $this->getAccessTokenData($request, $response);
 
         // Check if we have token data
         if (is_null($token)) {
@@ -61,6 +61,7 @@ class ResourceController implements ResourceControllerInterface
                     $response->getParameter('error_description')
                 )
             ));
+
             return false;
         }
 
@@ -79,9 +80,9 @@ class ResourceController implements ResourceControllerInterface
             // Check token expiration (expires is a mandatory paramter)
             if (!$token = $this->tokenStorage->getAccessToken($token_param)) {
                 $response->setError(401, 'invalid_token', 'The access token provided is invalid');
-            } else if (!isset($token["expires"]) || !isset($token["client_id"])) {
+            } elseif (!isset($token["expires"]) || !isset($token["client_id"])) {
                 $response->setError(401, 'invalid_token', 'Malformed token (missing "expires" or "client_id")');
-            } else if (time() > $token["expires"]) {
+            } elseif (time() > $token["expires"]) {
                 $response->setError(401, 'invalid_token', 'The access token provided has expired');
             } else {
                 return $token;
@@ -98,6 +99,7 @@ class ResourceController implements ResourceControllerInterface
         }
 
         $response->addHttpHeaders(array('WWW-Authenticate' => $authHeader));
+
         return null;
     }
 
diff --git a/src/OAuth2/Controller/TokenController.php b/src/OAuth2/Controller/TokenController.php
index 3419f6f..a615354 100644
--- a/src/OAuth2/Controller/TokenController.php
+++ b/src/OAuth2/Controller/TokenController.php
@@ -74,6 +74,7 @@ class TokenController implements TokenControllerInterface
         if (strtolower($request->server('REQUEST_METHOD')) != 'post') {
             $response->setError(405, 'invalid_request', 'The request method must be POST when requesting an access token', '#section-3.2');
             $response->addHttpHeaders(array('Allow' => 'POST'));
+
             return null;
         }
 
@@ -82,11 +83,13 @@ class TokenController implements TokenControllerInterface
          */
         if (!$grantTypeIdentifier = $request->request('grant_type')) {
             $response->setError(400, 'invalid_request', 'The grant type was not specified in the request');
+
             return null;
         }
         if (!isset($this->grantTypes[$grantTypeIdentifier])) {
             /* TODO: If this is an OAuth2 supported grant type that we have chosen not to implement, throw a 501 Not Implemented instead */
             $response->setError(400, 'unsupported_grant_type', sprintf('Grant type "%s" not supported', $grantTypeIdentifier));
+
             return null;
         }
 
@@ -121,6 +124,7 @@ class TokenController implements TokenControllerInterface
             // validate the Client ID (if applicable)
             if (!is_null($storedClientId = $grantType->getClientId()) && $storedClientId != $clientId) {
                 $response->setError(400, 'invalid_grant', sprintf('%s doesn\'t exist or is invalid for the client', $grantTypeIdentifier));
+
                 return null;
             }
         }
@@ -136,6 +140,7 @@ class TokenController implements TokenControllerInterface
             if (!$availableScope) {
                 if (false === $defaultScope = $this->scopeUtil->getDefaultScope($clientId)) {
                     $response->setError(400, 'invalid_scope', 'This application requires you specify a scope parameter');
+
                     return null;
                 }
             }
@@ -145,6 +150,7 @@ class TokenController implements TokenControllerInterface
         if (($requestedScope && !$this->scopeUtil->scopeExists($requestedScope, $clientId))
             || ($availableScope && !$this->scopeUtil->checkScope($requestedScope, $availableScope))) {
             $response->setError(400, 'invalid_scope', 'An unsupported scope was requested');
+
             return null;
         }
 
diff --git a/src/OAuth2/Encryption/EncryptionInterface.php b/src/OAuth2/Encryption/EncryptionInterface.php
new file mode 100644
index 0000000..dc8e0d2
--- /dev/null
+++ b/src/OAuth2/Encryption/EncryptionInterface.php
@@ -0,0 +1,9 @@
+<?php
+
+namespace OAuth2\Encryption;
+
+interface EncryptionInterface
+{
+    public function encode($payload, $key, $algorithm = null);
+    public function decode($payload, $key, $algorithm = null);
+}
diff --git a/src/OAuth2/Encryption/Jwt.php b/src/OAuth2/Encryption/Jwt.php
index 67a137e..641a2e9 100644
--- a/src/OAuth2/Encryption/Jwt.php
+++ b/src/OAuth2/Encryption/Jwt.php
@@ -6,7 +6,7 @@ namespace OAuth2\Encryption;
  * @link https://github.com/F21/jwt
  * @author F21
  */
-class Jwt
+class Jwt implements EncryptionInterface
 {
     public function encode($payload, $key, $algo = 'HS256')
     {
@@ -60,7 +60,7 @@ class Jwt
 
     private function verifySignature($signature, $input, $key, $algo = 'HS256')
     {
-        switch($algo){
+        switch ($algo) {
             case'HS256':
             case'HS384':
             case'HS512':
@@ -82,7 +82,7 @@ class Jwt
 
     private function sign($input, $key, $algo = 'HS256')
     {
-        switch($algo){
+        switch ($algo) {
             case 'HS256':
                 return hash_hmac('sha256', $input, $key, true);
 
@@ -121,6 +121,7 @@ class Jwt
         $b64 = str_replace(array('+', '/', '\r', '\n', '='),
                 array('-', '_'),
                 $b64);
+
         return $b64;
     }
 
@@ -129,6 +130,7 @@ class Jwt
         $b64 = str_replace(array('-', '_'),
                 array('+', '/'),
                 $b64);
+
         return base64_decode($b64);
     }
 }
diff --git a/src/OAuth2/GrantType/AuthorizationCode.php b/src/OAuth2/GrantType/AuthorizationCode.php
index b0c3d5f..60d80cb 100644
--- a/src/OAuth2/GrantType/AuthorizationCode.php
+++ b/src/OAuth2/GrantType/AuthorizationCode.php
@@ -30,12 +30,14 @@ class AuthorizationCode implements GrantTypeInterface
     {
         if (!$request->request('code')) {
             $response->setError(400, 'invalid_request', 'Missing parameter: "code" is required');
+
             return false;
         }
 
         $code = $request->request('code');
         if (!$authCode = $this->storage->getAuthorizationCode($code)) {
             $response->setError(400, 'invalid_grant', 'Authorization code doesn\'t exist or is invalid for the client');
+
             return false;
         }
 
@@ -46,6 +48,7 @@ class AuthorizationCode implements GrantTypeInterface
         if (isset($authCode['redirect_uri']) && $authCode['redirect_uri']) {
             if (!$request->request('redirect_uri') || urldecode($request->request('redirect_uri')) != $authCode['redirect_uri']) {
                 $response->setError(400, 'redirect_uri_mismatch', "The redirect URI is missing or do not match", "#section-4.1.3");
+
                 return false;
             }
         }
@@ -56,6 +59,7 @@ class AuthorizationCode implements GrantTypeInterface
 
         if ($authCode["expires"] < time()) {
             $response->setError(400, 'invalid_grant', "The authorization code has expired");
+
             return false;
         }
 
diff --git a/src/OAuth2/GrantType/ClientCredentials.php b/src/OAuth2/GrantType/ClientCredentials.php
index ea0122d..0a73e53 100644
--- a/src/OAuth2/GrantType/ClientCredentials.php
+++ b/src/OAuth2/GrantType/ClientCredentials.php
@@ -12,6 +12,8 @@ use OAuth2\ResponseType\AccessTokenInterface;
  */
 class ClientCredentials extends HttpBasic implements GrantTypeInterface
 {
+    private $clientData;
+
     public function getQuerystringIdentifier()
     {
         return 'client_credentials';
@@ -19,12 +21,16 @@ class ClientCredentials extends HttpBasic implements GrantTypeInterface
 
     public function getScope()
     {
-        return null;
+        $this->loadClientData();
+
+        return isset($this->clientData['scope']) ? $this->clientData['scope'] : null;
     }
 
     public function getUserId()
     {
-        return null;
+        $this->loadClientData();
+
+        return isset($this->clientData['user_id']) ? $this->clientData['user_id'] : null;
     }
 
     public function createAccessToken(AccessTokenInterface $accessToken, $client_id, $user_id, $scope)
@@ -34,6 +40,14 @@ class ClientCredentials extends HttpBasic implements GrantTypeInterface
          * @see http://tools.ietf.org/html/rfc6749#section-4.4.3
          */
         $includeRefreshToken = false;
+
         return $accessToken->createAccessToken($client_id, $user_id, $scope, $includeRefreshToken);
     }
+
+    private function loadClientData()
+    {
+        if (!$this->clientData) {
+            $this->clientData = $this->storage->getClientDetails($this->getClientId());
+        }
+    }
 }
diff --git a/src/OAuth2/GrantType/JwtBearer.php b/src/OAuth2/GrantType/JwtBearer.php
index 62823df..38fdc8b 100644
--- a/src/OAuth2/GrantType/JwtBearer.php
+++ b/src/OAuth2/GrantType/JwtBearer.php
@@ -72,6 +72,7 @@ class JwtBearer implements GrantTypeInterface, ClientAssertionTypeInterface
     {
         if (!$request->request("assertion")) {
             $response->setError(400, 'invalid_request', 'Missing parameters: "assertion" required');
+
             return null;
         }
 
@@ -83,6 +84,7 @@ class JwtBearer implements GrantTypeInterface, ClientAssertionTypeInterface
 
         if (!$jwt) {
             $response->setError(400, 'invalid_request', "JWT is malformed");
+
             return null;
         }
 
@@ -102,16 +104,19 @@ class JwtBearer implements GrantTypeInterface, ClientAssertionTypeInterface
 
         if (!isset($jwt['iss'])) {
             $response->setError(400, 'invalid_grant', "Invalid issuer (iss) provided");
+
             return null;
         }
 
         if (!isset($jwt['sub'])) {
             $response->setError(400, 'invalid_grant', "Invalid subject (sub) provided");
+
             return null;
         }
 
         if (!isset($jwt['exp'])) {
             $response->setError(400, 'invalid_grant', "Expiration (exp) time must be present");
+
             return null;
         }
 
@@ -119,10 +124,12 @@ class JwtBearer implements GrantTypeInterface, ClientAssertionTypeInterface
         if (ctype_digit($jwt['exp'])) {
             if ($jwt['exp'] <= time()) {
                 $response->setError(400, 'invalid_grant', "JWT has expired");
+
                 return null;
             }
         } else {
             $response->setError(400, 'invalid_grant', "Expiration (exp) time must be a unix time stamp");
+
             return null;
         }
 
@@ -131,10 +138,12 @@ class JwtBearer implements GrantTypeInterface, ClientAssertionTypeInterface
             if (ctype_digit($notBefore)) {
                 if ($notBefore > time()) {
                     $response->setError(400, 'invalid_grant', "JWT cannot be used before the Not Before (nbf) time");
+
                     return null;
                 }
             } else {
                 $response->setError(400, 'invalid_grant', "Not Before (nbf) time must be a unix time stamp");
+
                 return null;
             }
         }
@@ -142,19 +151,37 @@ class JwtBearer implements GrantTypeInterface, ClientAssertionTypeInterface
         // Check the audience if required to match
         if (!isset($jwt['aud']) || ($jwt['aud'] != $this->audience)) {
             $response->setError(400, 'invalid_grant', "Invalid audience (aud)");
+
             return null;
         }
 
+        // Check the jti (nonce)
+        // @see http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-13#section-4.1.7
+        if (isset($jwt['jti'])) {
+            $jti = $this->storage->getJti($jwt['iss'], $jwt['sub'], $jwt['aud'], $jwt['exp'], $jwt['jti']);
+
+            //Reject if jti is used and jwt is still valid (exp parameter has not expired).
+            if ($jti && $jti['expires'] > time()) {
+                $response->setError(400, 'invalid_grant', "JSON Token Identifier (jti) has already been used");
+                
+                return null;
+            } else {
+                $this->storage->setJti($jwt['iss'], $jwt['sub'], $jwt['aud'], $jwt['exp'], $jwt['jti']);
+            }
+        }
+
         // Get the iss's public key
         // @see http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-06#section-4.1.1
         if (!$key = $this->storage->getClientKey($jwt['iss'], $jwt['sub'])) {
             $response->setError(400, 'invalid_grant', "Invalid issuer (iss) or subject (sub) provided");
+
             return null;
         }
 
         // Verify the JWT
         if (!$this->jwtUtil->decode($undecodedJWT, $key, true)) {
             $response->setError(400, 'invalid_grant', "JWT failed signature verification");
+
             return null;
         }
 
@@ -187,6 +214,7 @@ class JwtBearer implements GrantTypeInterface, ClientAssertionTypeInterface
     public function createAccessToken(AccessTokenInterface $accessToken, $client_id, $user_id, $scope)
     {
         $includeRefreshToken = false;
+
         return $accessToken->createAccessToken($client_id, $user_id, $scope, $includeRefreshToken);
     }
 }
diff --git a/src/OAuth2/GrantType/RefreshToken.php b/src/OAuth2/GrantType/RefreshToken.php
index e7de5ea..c866a80 100644
--- a/src/OAuth2/GrantType/RefreshToken.php
+++ b/src/OAuth2/GrantType/RefreshToken.php
@@ -35,16 +35,19 @@ class RefreshToken implements GrantTypeInterface
     {
         if (!$request->request("refresh_token")) {
             $response->setError(400, 'invalid_request', 'Missing parameter: "refresh_token" is required');
+
             return null;
         }
 
         if (!$refreshToken = $this->storage->getRefreshToken($request->request("refresh_token"))) {
             $response->setError(400, 'invalid_grant', 'Invalid refresh token');
+
             return null;
         }
 
         if ($refreshToken["expires"] < time()) {
             $response->setError(400, 'invalid_grant', 'Refresh token has expired');
+
             return null;
         }
 
diff --git a/src/OAuth2/GrantType/UserCredentials.php b/src/OAuth2/GrantType/UserCredentials.php
index e2557c5..526fdbd 100644
--- a/src/OAuth2/GrantType/UserCredentials.php
+++ b/src/OAuth2/GrantType/UserCredentials.php
@@ -31,11 +31,13 @@ class UserCredentials implements GrantTypeInterface
     {
         if (!$request->request("password") || !$request->request("username")) {
             $response->setError(400, 'invalid_request', 'Missing parameters: "username" and "password" required');
+
             return null;
         }
 
         if (!$this->storage->checkUserCredentials($request->request("username"), $request->request("password"))) {
             $response->setError(400, 'invalid_grant', 'Invalid username and password combination');
+
             return null;
         }
 
@@ -43,6 +45,7 @@ class UserCredentials implements GrantTypeInterface
 
         if (empty($userInfo)) {
             $response->setError(400, 'invalid_grant', 'Unable to retrieve user information');
+
             return null;
         }
 
diff --git a/src/OAuth2/Response.php b/src/OAuth2/Response.php
index 858446e..271bc4e 100644
--- a/src/OAuth2/Response.php
+++ b/src/OAuth2/Response.php
@@ -181,6 +181,7 @@ class Response implements ResponseInterface
                 // this only works for single-level arrays
                 $xml = new \SimpleXMLElement('<response/>');
                 array_walk($this->parameters, array($xml, 'addChild'));
+
                 return $xml->asXML();
         }
 
diff --git a/src/OAuth2/ResponseInterface.php b/src/OAuth2/ResponseInterface.php
index 2548dc7..61da477 100644
--- a/src/OAuth2/ResponseInterface.php
+++ b/src/OAuth2/ResponseInterface.php
@@ -21,4 +21,4 @@ interface ResponseInterface
     public function setRedirect($statusCode = 302, $url, $state = null, $error = null, $errorDescription = null, $errorUri = null);
 
     public function getParameter($name);
-}
\ No newline at end of file
+}
diff --git a/src/OAuth2/ResponseType/AccessToken.php b/src/OAuth2/ResponseType/AccessToken.php
index 1c4fa2d..c82d9ed 100644
--- a/src/OAuth2/ResponseType/AccessToken.php
+++ b/src/OAuth2/ResponseType/AccessToken.php
@@ -13,6 +13,7 @@ class AccessToken implements AccessTokenInterface
 {
     protected $tokenStorage;
     protected $refreshStorage;
+    protected $config;
 
     public function __construct(AccessTokenStorageInterface $tokenStorage, RefreshTokenInterface $refreshStorage = null, array $config = array())
     {
@@ -102,11 +103,12 @@ class AccessToken implements AccessTokenInterface
     protected function generateAccessToken()
     {
         $tokenLen = 40;
-        if (file_exists('/dev/urandom')) { // Get 100 bytes of random data
+        if (@file_exists('/dev/urandom')) { // Get 100 bytes of random data
             $randomData = file_get_contents('/dev/urandom', false, null, 0, 100) . uniqid(mt_rand(), true);
         } else {
             $randomData = mt_rand() . mt_rand() . mt_rand() . mt_rand() . microtime(true) . uniqid(mt_rand(), true);
         }
+
         return substr(hash('sha512', $randomData), 0, $tokenLen);
     }
 
diff --git a/src/OAuth2/ResponseType/AuthorizationCode.php b/src/OAuth2/ResponseType/AuthorizationCode.php
index b439637..c39d6a0 100644
--- a/src/OAuth2/ResponseType/AuthorizationCode.php
+++ b/src/OAuth2/ResponseType/AuthorizationCode.php
@@ -22,7 +22,6 @@ class AuthorizationCode implements AuthorizationCodeInterface
         ), $config);
     }
 
-
     public function getAuthorizeResponse($params, $user_id = null)
     {
         // build the URL to redirect to
@@ -59,6 +58,7 @@ class AuthorizationCode implements AuthorizationCodeInterface
     {
         $code = $this->generateAuthorizationCode();
         $this->storage->setAuthorizationCode($code, $client_id, $user_id, $redirect_uri, time() + $this->config['auth_code_lifetime'], $scope);
+
         return $code;
     }
 
@@ -90,6 +90,7 @@ class AuthorizationCode implements AuthorizationCodeInterface
         } else {
             $randomData = mt_rand() . mt_rand() . mt_rand() . mt_rand() . microtime(true) . uniqid(mt_rand(), true);
         }
+
         return substr(hash('sha512', $randomData), 0, $tokenLen);
     }
 }
diff --git a/src/OAuth2/ResponseType/CryptoToken.php b/src/OAuth2/ResponseType/CryptoToken.php
new file mode 100644
index 0000000..dd6896c
--- /dev/null
+++ b/src/OAuth2/ResponseType/CryptoToken.php
@@ -0,0 +1,114 @@
+<?php
+
+namespace OAuth2\ResponseType;
+
+use OAuth2\Encryption\EncryptionInterface;
+use OAuth2\Encryption\Jwt;
+use OAuth2\Storage\AccessTokenInterface as AccessTokenStorageInterface;
+use OAuth2\Storage\RefreshTokenInterface;
+use OAuth2\Storage\PublicKeyInterface;
+use OAuth2\Storage\Memory;
+
+/**
+ *
+ * @author Brent Shaffer <bshafs at gmail dot com>
+ */
+class CryptoToken extends AccessToken
+{
+    protected $publicKeyStorage;
+    protected $encryptionUtil;
+
+    /**
+     * @param $config
+     *  - store_encrypted_token_string (bool true)
+     *       whether the entire encrypted string is stored,
+     *       or just the token ID is stored
+     */
+    public function __construct(PublicKeyInterface $publicKeyStorage = null, AccessTokenStorageInterface $tokenStorage = null, RefreshTokenInterface $refreshStorage = null, array $config = array(), EncryptionInterface $encryptionUtil = null)
+    {
+        $this->publicKeyStorage = $publicKeyStorage;
+        $config = array_merge(array(
+            'store_encrypted_token_string' => true,
+        ), $config);
+        if (is_null($tokenStorage)) {
+            // a pass-thru, so we can call the parent constructor
+            $tokenStorage = new Memory();
+        }
+        if (is_null($encryptionUtil)) {
+            $encryptionUtil = new Jwt();
+        }
+        $this->encryptionUtil = $encryptionUtil;
+        parent::__construct($tokenStorage, $refreshStorage, $config);
+    }
+
+    /**
+     * Handle the creation of access token, also issue refresh token if supported / desirable.
+     *
+     * @param $client_id
+     * Client identifier related to the access token.
+     * @param $user_id
+     * User ID associated with the access token
+     * @param $scope
+     * (optional) Scopes to be stored in space-separated string.
+     * @param bool $includeRefreshToken
+     * If true, a new refresh_token will be added to the response
+     *
+     * @see http://tools.ietf.org/html/rfc6749#section-5
+     * @ingroup oauth2_section_5
+     */
+    public function createAccessToken($client_id, $user_id, $scope = null, $includeRefreshToken = true)
+    {
+        // token to encrypt
+        $expires = time() + $this->config['access_lifetime'];
+        $cryptoToken = array(
+            'id'         => $this->generateAccessToken(),
+            'client_id'  => $client_id,
+            'user_id'    => $user_id,
+            'expires'    => $expires,
+            'token_type' => $this->config['token_type'],
+            'scope'      => $scope
+        );
+
+        /*
+         * Issue a refresh token also, if we support them
+         *
+         * Refresh Tokens are considered supported if an instance of OAuth2_Storage_RefreshTokenInterface
+         * is supplied in the constructor
+         */
+        if ($includeRefreshToken && $this->refreshStorage) {
+            $cryptoToken["refresh_token"] = $this->generateRefreshToken();
+            $this->refreshStorage->setRefreshToken($cryptoToken['refresh_token'], $client_id, $user_id, time() + $this->config['refresh_token_lifetime'], $scope);
+        }
+
+        /*
+         * Encode the token data into a single access_token string
+         */
+        $access_token = $this->encodeToken($cryptoToken, $client_id);
+
+        /*
+         * Save the token to a secondary storage.  This is implemented on the
+         * OAuth2\Storage\CryptoToken side, and will not actually store anything,
+         * if no secondary storage has been supplied
+         */
+        $token_to_store = $this->config['store_encrypted_token_string'] ? $access_token : $cryptoToken['id'];
+        $this->tokenStorage->setAccessToken($token_to_store, $client_id, $user_id, $this->config['access_lifetime'] ? time() + $this->config['access_lifetime'] : null, $scope);
+
+        // token to return to the client
+        $token = array(
+            'access_token' => $access_token,
+            'expires_in' => $this->config['access_lifetime'],
+            'token_type' => $this->config['token_type'],
+            'scope' => $scope
+        );
+
+        return $token;
+    }
+
+    protected function encodeToken(array $token, $client_id = null)
+    {
+        $private_key = $this->publicKeyStorage->getPrivateKey($client_id);
+        $algorithm   = $this->publicKeyStorage->getEncryptionAlgorithm($client_id);
+
+        return $this->encryptionUtil->encode($token, $private_key, $algorithm);
+    }
+}
diff --git a/src/OAuth2/Scope.php b/src/OAuth2/Scope.php
index a8119ba..6639346 100644
--- a/src/OAuth2/Scope.php
+++ b/src/OAuth2/Scope.php
@@ -47,6 +47,7 @@ class Scope implements ScopeInterface
     {
         $required_scope = explode(' ', trim($required_scope));
         $available_scope = explode(' ', trim($available_scope));
+
         return (count(array_diff($required_scope, $available_scope)) == 0);
     }
 
diff --git a/src/OAuth2/Server.php b/src/OAuth2/Server.php
index 87e34e7..2d12c5b 100644
--- a/src/OAuth2/Server.php
+++ b/src/OAuth2/Server.php
@@ -103,6 +103,7 @@ class Server implements ResourceControllerInterface,
             'require_exact_redirect_uri' => true,
             'allow_implicit'           => false,
             'allow_credentials_in_request_body' => true,
+            'always_issue_new_refresh_token' => false,
         ), $config);
 
         foreach ($grantTypes as $key => $grantType) {
@@ -121,6 +122,7 @@ class Server implements ResourceControllerInterface,
         if (is_null($this->authorizeController)) {
             $this->authorizeController = $this->createDefaultAuthorizeController();
         }
+
         return $this->authorizeController;
     }
 
@@ -129,6 +131,7 @@ class Server implements ResourceControllerInterface,
         if (is_null($this->tokenController)) {
             $this->tokenController = $this->createDefaultTokenController();
         }
+
         return $this->tokenController;
     }
 
@@ -137,6 +140,7 @@ class Server implements ResourceControllerInterface,
         if (is_null($this->resourceController)) {
             $this->resourceController = $this->createDefaultResourceController();
         }
+
         return $this->resourceController;
     }
 
@@ -188,6 +192,7 @@ class Server implements ResourceControllerInterface,
     {
         $this->response = is_null($response) ? new Response() : $response;
         $this->getTokenController()->handleTokenRequest($request, $this->response);
+
         return $this->response;
     }
 
@@ -195,6 +200,7 @@ class Server implements ResourceControllerInterface,
     {
         $this->response = is_null($response) ? new Response() : $response;
         $value = $this->getTokenController()->grantAccessToken($request, $this->response);
+
         return $value;
     }
 
@@ -230,6 +236,7 @@ class Server implements ResourceControllerInterface,
     {
         $this->response = $response;
         $this->getAuthorizeController()->handleAuthorizeRequest($request, $this->response, $is_authorized, $user_id);
+
         return $this->response;
     }
 
@@ -256,6 +263,7 @@ class Server implements ResourceControllerInterface,
     {
         $this->response = is_null($response) ? new Response() : $response;
         $value = $this->getAuthorizeController()->validateAuthorizeRequest($request, $this->response);
+
         return $value;
     }
 
@@ -263,6 +271,7 @@ class Server implements ResourceControllerInterface,
     {
         $this->response = is_null($response) ? new Response() : $response;
         $value = $this->getResourceController()->verifyResourceRequest($request, $this->response, $scope);
+
         return $value;
     }
 
@@ -270,6 +279,7 @@ class Server implements ResourceControllerInterface,
     {
         $this->response = is_null($response) ? new Response() : $response;
         $value = $this->getResourceController()->getAccessTokenData($request, $this->response);
+
         return $value;
     }
 
@@ -352,6 +362,7 @@ class Server implements ResourceControllerInterface,
             $storage = isset($this->storages['scope']) ? $this->storages['scope'] : null;
             $this->scopeUtil = new Scope($storage);
         }
+
         return $this->scopeUtil;
     }
 
@@ -372,6 +383,7 @@ class Server implements ResourceControllerInterface,
             $this->responseTypes = $this->getDefaultResponseTypes();
         }
         $config = array_intersect_key($this->config, array_flip(explode(' ', 'allow_implicit enforce_state require_exact_redirect_uri')));
+
         return new AuthorizeController($this->storages['client'], $this->responseTypes, $config, $this->getScopeUtil());
     }
 
@@ -407,12 +419,14 @@ class Server implements ResourceControllerInterface,
             $this->tokenType = $this->getDefaultTokenType();
         }
         $config = array_intersect_key($this->config, array('www_realm' => ''));
+
         return new ResourceController($this->tokenType, $this->storages['access_token'], $config, $this->getScopeUtil());
     }
 
     protected function getDefaultTokenType()
     {
         $config = array_intersect_key($this->config, array_flip(explode(' ', 'token_param_name token_bearer_header_name')));
+
         return new Bearer($config);
     }
 
@@ -449,7 +463,8 @@ class Server implements ResourceControllerInterface,
         }
 
         if (isset($this->storages['refresh_token'])) {
-            $grantTypes['refresh_token'] = new RefreshToken($this->storages['refresh_token']);
+            $config = array_intersect_key($this->config, array('always_issue_new_refresh_token' => ''));
+            $grantTypes['refresh_token'] = new RefreshToken($this->storages['refresh_token'], $config);
         }
 
         if (isset($this->storages['authorization_code'])) {
diff --git a/src/OAuth2/Storage/ClientInterface.php b/src/OAuth2/Storage/ClientInterface.php
index 671025e..e9d0c72 100644
--- a/src/OAuth2/Storage/ClientInterface.php
+++ b/src/OAuth2/Storage/ClientInterface.php
@@ -28,6 +28,7 @@ interface ClientInterface
      *     "redirect_uri" => REDIRECT_URI,      // REQUIRED redirect_uri registered for the client
      *     "client_id"    => CLIENT_ID,         // OPTIONAL the client id
      *     "grant_types"  => GRANT_TYPES,       // OPTIONAL an array of restricted grant types
+     *     "user_id"      => USER_ID,           // OPTIONAL the user identifier associated with this client
      * );
      * @endcode
      *
diff --git a/src/OAuth2/Storage/CryptoToken.php b/src/OAuth2/Storage/CryptoToken.php
new file mode 100644
index 0000000..3883c7b
--- /dev/null
+++ b/src/OAuth2/Storage/CryptoToken.php
@@ -0,0 +1,77 @@
+<?php
+
+namespace OAuth2\Storage;
+
+use OAuth2\Encryption\EncryptionInterface;
+use OAuth2\Encryption\Jwt;
+
+/**
+ *
+ * @author Brent Shaffer <bshafs at gmail dot com>
+ */
+class CryptoToken implements AccessTokenInterface
+{
+    protected $publicKeyStorage;
+    protected $tokenStorage;
+    protected $encryptionUtil;
+
+    /**
+     * @param string $publicKey
+     * the public key encryption to use
+     *
+     * @param string $privateKey (optional)
+     * (optional) the private key to use to sign tokens
+     * this is only required for token granting, and can be omitted for resource servers,
+     * as only the publc key is required for crypto token verification
+     *
+     * @param array $config
+     * (optional) configuration array. Valid parameters are
+     * - encryption_algorithm
+     *  the algorithm to use for encryption. This is passed to the
+     *  EncryptionInterface object.
+     *  @see OAuth2\Encryption\Jwt::verifySignature
+     *
+     * @param OAuth2\Storage\AccessTokenInterface $tokenStorage
+     * (optional) persist the access token to another storage. This is useful if
+     * you want to retain access token grant information somewhere, but
+     * is not necessary when using this grant type.
+     *
+     * @param OAuth2\Encryption\EncryptionInterface $encryptionUtil
+     * (optional) class to use for "encode" and "decode" functions.
+     */
+    public function __construct(PublicKeyInterface $publicKeyStorage, AccessTokenInterface $tokenStorage = null, EncryptionInterface $encryptionUtil = null)
+    {
+        $this->publicKeyStorage = $publicKeyStorage;
+        $this->tokenStorage = $tokenStorage;
+        if (is_null($encryptionUtil)) {
+            $encryptionUtil = new Jwt;
+        }
+        $this->encryptionUtil = $encryptionUtil;
+    }
+
+    public function getAccessToken($oauth_token)
+    {
+        // just decode the token, don't verify
+        if (!$tokenData = $this->encryptionUtil->decode($oauth_token, null, false)) {
+            return false;
+        }
+
+        $client_id  = isset($tokenData['client_id']) ? $tokenData['client_id'] : null;
+        $public_key = $this->publicKeyStorage->getPublicKey($client_id);
+        $algorithm  = $this->publicKeyStorage->getEncryptionAlgorithm($client_id);
+
+        // now that we have the client_id, verify the token
+        if (false === $this->encryptionUtil->decode($oauth_token, $public_key, $algorithm)) {
+            return false;
+        }
+
+        return $tokenData;
+    }
+
+    public function setAccessToken($oauth_token, $client_id, $user_id, $expires, $scope = null)
+    {
+        if ($this->tokenStorage) {
+            return $this->tokenStorage->setAccessToken($oauth_token, $client_id, $user_id, $expires, $scope);
+        }
+    }
+}
diff --git a/src/OAuth2/Storage/JwtBearerInterface.php b/src/OAuth2/Storage/JwtBearerInterface.php
index 6b9dc3a..fcb1fe2 100644
--- a/src/OAuth2/Storage/JwtBearerInterface.php
+++ b/src/OAuth2/Storage/JwtBearerInterface.php
@@ -18,11 +18,58 @@ interface JwtBearerInterface
      * Get the public key associated with a client_id
      *
      * @param $client_id
-     * Client identifier to be check with.
+     * Client identifier to be checked with.
      *
      * @return
      * STRING Return the public key for the client_id if it exists, and MUST return FALSE if it doesn't.
-     * @endcode
      */
     public function getClientKey($client_id, $subject);
+
+    /**
+     * Get a jti (JSON token identifier)by matching against the client_id, subject, audience and expiration.
+     *
+     * @param $client_id
+     * Client identifier to match.
+     *
+     * @param $subject
+     * The subject to match.
+     *
+     * @param $audience
+     * The audience to match.
+     *
+     * @param $expiration
+     * The expiration of the jti.
+     *
+     * @param $jti
+     * The jti to match.
+     *
+     * @return
+     * An associative array as below, and return NULL if the jti does not exist.
+     * - issuer: Stored client identifier.
+     * - subject: Stored subject.
+     * - audience: Stored audience.
+     * - expires: Stored expiration in unix timestamp.
+     * - jti: The stored jti.
+     */
+    public function getJti($client_id, $subject, $audience, $expiration, $jti);
+
+    /**
+     * Store a used jti so that we can check against it to prevent replay attacks.
+
+     * @param $client_id
+     * Client identifier to insert.
+     *
+     * @param $subject
+     * The subject to insert.
+     *
+     * @param $audience
+     * The audience to insert.
+     *
+     * @param $expiration
+     * The expiration of the jti.
+     *
+     * @param $jti
+     * The jti to insert.
+     */
+    public function setJti($client_id, $subject, $audience, $expiration, $jti);
 }
diff --git a/src/OAuth2/Storage/Memory.php b/src/OAuth2/Storage/Memory.php
index 45df708..7f5a0c7 100644
--- a/src/OAuth2/Storage/Memory.php
+++ b/src/OAuth2/Storage/Memory.php
@@ -16,7 +16,8 @@ class Memory implements AuthorizationCodeInterface,
     ClientCredentialsInterface,
     RefreshTokenInterface,
     JwtBearerInterface,
-    ScopeInterface
+    ScopeInterface,
+    PublicKeyInterface
 {
     private $authorizationCodes;
     private $userCredentials;
@@ -24,10 +25,12 @@ class Memory implements AuthorizationCodeInterface,
     private $refreshTokens;
     private $accessTokens;
     private $jwt;
+    private $jti;
     private $supportedScopes;
     private $clientSupportedScopes;
     private $clientDefaultScopes;
     private $defaultScope;
+    private $keys;
 
     public function __construct($params = array())
     {
@@ -38,10 +41,12 @@ class Memory implements AuthorizationCodeInterface,
             'refresh_tokens' => array(),
             'access_tokens' => array(),
             'jwt' => array(),
+            'jti' => array(),
             'default_scope' => null,
             'client_supported_scopes' => array(),
             'client_default_scopes' => array(),
             'supported_scopes' => array(),
+            'keys' => array(),
         ), $params);
 
         $this->authorizationCodes = $params['authorization_codes'];
@@ -50,10 +55,12 @@ class Memory implements AuthorizationCodeInterface,
         $this->refreshTokens = $params['refresh_tokens'];
         $this->accessTokens = $params['access_tokens'];
         $this->jwt = $params['jwt'];
+        $this->jti = $params['jti'];
         $this->supportedScopes = $params['supported_scopes'];
         $this->clientSupportedScopes = $params['client_supported_scopes'];
         $this->clientDefaultScopes = $params['client_default_scopes'];
         $this->defaultScope = $params['default_scope'];
+        $this->keys = $params['keys'];
     }
 
     /* AuthorizationCodeInterface */
@@ -89,6 +96,7 @@ class Memory implements AuthorizationCodeInterface,
     public function checkUserCredentials($username, $password)
     {
         $userDetails = $this->getUserDetails($username);
+
         return $userDetails && $userDetails['password'] && $userDetails['password'] === $password;
     }
 
@@ -150,9 +158,17 @@ class Memory implements AuthorizationCodeInterface,
         return true;
     }
 
-    public function setClientCredentials($client_credentials)
+    public function setClientDetails($client_id, $client_secret = null, $redirect_uri = null, $grant_types = null, $user_id = null)
     {
-        $this->clientCredentials = $client_credentials;
+        $this->clientCredentials[$client_id] = array(
+            'client_id'     => $client_id,
+            'client_secret' => $client_secret,
+            'redirect_uri'  => $redirect_uri,
+            'grant_types'   => $grant_types,
+            'user_id'       => $user_id,
+        );
+
+        return true;
     }
 
     /* RefreshTokenInterface */
@@ -208,7 +224,7 @@ class Memory implements AuthorizationCodeInterface,
     {
         if ($client_id && array_key_exists($client_id, $this->clientDefaultScopes)) {
            return implode(' ', $this->clientDefaultScopes[$client_id]);
-        }else{
+        } else {
            return $this->defaultScope;
         }
     }
@@ -227,4 +243,68 @@ class Memory implements AuthorizationCodeInterface,
 
         return false;
     }
+
+    public function getJti($client_id, $subject, $audience, $expires, $jti)
+    {
+        foreach ($this->jti as $storedJti) {
+            if ($storedJti['issuer'] == $client_id && $storedJti['subject'] == $subject && $storedJti['audience'] == $audience && $storedJti['expires'] == $expires && $storedJti['jti'] == $jti) {
+                return array('issuer' => $storedJti['issuer'],
+                             'subject' => $storedJti['subject'],
+                             'audience' => $storedJti['audience'],
+                             'expires' => $storedJti['expires'],
+                             'jti' => $storedJti['jti']
+                );
+            }
+        }
+
+        return null;
+    }
+
+    public function setJti($client_id, $subject, $audience, $expires, $jti)
+    {
+        $this->jti[] = array('issuer' => $client_id, 'subject' => $subject, 'audience' => $audience, 'expires' => $expires, 'jti' => $jti);
+    }
+
+    /*PublicKeyInterface */
+    public function getPublicKey($client_id = null)
+    {
+        if (isset($this->keys[$client_id])) {
+            return $this->keys[$client_id]['public_key'];
+        }
+
+        // use a global encryption pair
+        if (isset($this->keys['public_key'])) {
+            return $this->keys['public_key'];
+        }
+
+        return false;
+    }
+
+    public function getPrivateKey($client_id = null)
+    {
+        if (isset($this->keys[$client_id])) {
+            return $this->keys[$client_id]['private_key'];
+        }
+
+        // use a global encryption pair
+        if (isset($this->keys['private_key'])) {
+            return $this->keys['private_key'];
+        }
+
+        return false;
+    }
+
+    public function getEncryptionAlgorithm($client_id = null)
+    {
+        if (isset($this->keys[$client_id]['encryption_algorithm'])) {
+            return $this->keys[$client_id]['encryption_algorithm'];
+        }
+
+        // use a global encryption algorithm
+        if (isset($this->keys['encryption_algorithm'])) {
+            return $this->keys['encryption_algorithm'];
+        }
+
+        return 'RS256';
+    }
 }
diff --git a/src/OAuth2/Storage/Mongo.php b/src/OAuth2/Storage/Mongo.php
index 0ada22d..3cc70c6 100644
--- a/src/OAuth2/Storage/Mongo.php
+++ b/src/OAuth2/Storage/Mongo.php
@@ -5,8 +5,12 @@ namespace OAuth2\Storage;
 /**
  * Simple MongoDB storage for all storage types
  *
- * NOTE: This class should never be used in production, and is
- * a stub class for example use only
+ * NOTE: This class is meant to get users started
+ * quickly. If your application requires further
+ * customization, extend this class or create your own.
+ *
+ * NOTE: Passwords are stored in plaintext, which is never
+ * a good idea.  Be sure to override this for your application
  *
  * @author Julien Chaumond <chaumond@gmail.com>
  */
@@ -24,8 +28,7 @@ class Mongo implements AuthorizationCodeInterface,
     {
         if ($connection instanceof \MongoDB) {
             $this->db = $connection;
-        }
-        else {
+        } else {
             if (!is_array($connection)) {
                 throw new \InvalidArgumentException('First argument to OAuth2_Storage_Mongo must be an instance of MongoDB or a configuration array');
             }
@@ -60,6 +63,7 @@ class Mongo implements AuthorizationCodeInterface,
         if ($result = $this->collection('client_table')->findOne(array('client_id' => $client_id))) {
             return $result['client_secret'] == $client_secret;
         }
+
         return false;
     }
 
@@ -70,6 +74,33 @@ class Mongo implements AuthorizationCodeInterface,
         return is_null($result) ? false : $result;
     }
 
+    public function setClientDetails($client_id, $client_secret = null, $redirect_uri = null, $grant_types = null, $user_id = null)
+    {
+        if ($this->getClientDetails($client_id)) {
+            $this->collection('client_table')->update(
+                array('client_id' => $client_id),
+                array('$set' => array(
+                    'client_secret' => $client_secret,
+                    'redirect_uri'  => $redirect_uri,
+                    'grant_types'   => $grant_types,
+                    'user_id'       => $user_id,
+                ))
+            );
+        } else {
+            $this->collection('client_table')->insert(
+                array(
+                    'client_id'     => $client_id,
+                    'client_secret' => $client_secret,
+                    'redirect_uri'  => $redirect_uri,
+                    'grant_types'   => $grant_types,
+                    'user_id'       => $user_id,
+                )
+            );
+        }
+
+        return true;
+    }
+
     public function checkRestrictedGrantType($client_id, $grant_type)
     {
         $details = $this->getClientDetails($client_id);
@@ -172,6 +203,7 @@ class Mongo implements AuthorizationCodeInterface,
         if ($user = $this->getUser($username)) {
             return $this->checkPassword($user, $password);
         }
+
         return false;
     }
 
@@ -262,4 +294,16 @@ class Mongo implements AuthorizationCodeInterface,
 
         return $result;
     }
+
+    public function getJti($client_id, $subject, $audience, $expiration, $jti)
+    {
+        //TODO: Needs mongodb implementation.
+        throw new \Exception('getJti() for the MongoDB driver is currently unimplemented.');
+    }
+
+    public function setJti($client_id, $subject, $audience, $expiration, $jti)
+    {
+        //TODO: Needs mongodb implementation.
+    	throw new \Exception('setJti() for the MongoDB driver is currently unimplemented.');
+    }
 }
diff --git a/src/OAuth2/Storage/Pdo.php b/src/OAuth2/Storage/Pdo.php
index 49f977a..cd19b4c 100644
--- a/src/OAuth2/Storage/Pdo.php
+++ b/src/OAuth2/Storage/Pdo.php
@@ -19,7 +19,9 @@ class Pdo implements AuthorizationCodeInterface,
     ClientCredentialsInterface,
     UserCredentialsInterface,
     RefreshTokenInterface,
-    JwtBearerInterface
+    JwtBearerInterface,
+    ScopeInterface,
+    PublicKeyInterface
 {
     protected $db;
     protected $config;
@@ -51,7 +53,9 @@ class Pdo implements AuthorizationCodeInterface,
             'refresh_token_table' => 'oauth_refresh_tokens',
             'code_table' => 'oauth_authorization_codes',
             'user_table' => 'oauth_users',
-            'jwt_table' => 'oauth_jwt',
+            'jwt_table'  => 'oauth_jwt',
+            'scope_table'  => 'oauth_scopes',
+            'public_key_table'  => 'oauth_public_keys',
         ), $config);
     }
 
@@ -63,7 +67,7 @@ class Pdo implements AuthorizationCodeInterface,
         $result = $stmt->fetch();
 
         // make this extensible
-        return $result['client_secret'] == $client_secret;
+        return $result && $result['client_secret'] == $client_secret;
     }
 
     public function getClientDetails($client_id)
@@ -74,6 +78,18 @@ class Pdo implements AuthorizationCodeInterface,
         return $stmt->fetch();
     }
 
+    public function setClientDetails($client_id, $client_secret = null, $redirect_uri = null, $grant_types = null, $user_id = null)
+    {
+        // if it exists, update it.
+        if ($this->getClientDetails($client_id)) {
+            $stmt = $this->db->prepare($sql = sprintf('UPDATE %s SET client_secret=:client_secret, redirect_uri=:redirect_uri, grant_types=:grant_types, user_id=:user_id where client_id=:client_id', $this->config['client_table']));
+        } else {
+            $stmt = $this->db->prepare(sprintf('INSERT INTO %s (client_id, client_secret, redirect_uri, grant_types, user_id) VALUES (:client_id, :client_secret, :redirect_uri, :grant_types, :user_id)', $this->config['client_table']));
+        }
+
+        return $stmt->execute(compact('client_id', 'client_secret', 'redirect_uri', 'grant_types', 'user_id'));
+    }
+
     public function checkRestrictedGrantType($client_id, $grant_type)
     {
         $details = $this->getClientDetails($client_id);
@@ -112,6 +128,7 @@ class Pdo implements AuthorizationCodeInterface,
         } else {
             $stmt = $this->db->prepare(sprintf('INSERT INTO %s (access_token, client_id, expires, user_id, scope) VALUES (:access_token, :client_id, :expires, :user_id, :scope)', $this->config['access_token_table']));
         }
+
         return $stmt->execute(compact('access_token', 'client_id', 'user_id', 'expires', 'scope'));
     }
 
@@ -140,6 +157,7 @@ class Pdo implements AuthorizationCodeInterface,
         } else {
             $stmt = $this->db->prepare(sprintf('INSERT INTO %s (authorization_code, client_id, user_id, redirect_uri, expires, scope) VALUES (:code, :client_id, :user_id, :redirect_uri, :expires, :scope)', $this->config['code_table']));
         }
+
         return $stmt->execute(compact('code', 'client_id', 'user_id', 'redirect_uri', 'expires', 'scope'));
     }
 
@@ -156,6 +174,7 @@ class Pdo implements AuthorizationCodeInterface,
         if ($user = $this->getUser($username)) {
             return $this->checkPassword($user, $password);
         }
+
         return false;
     }
 
@@ -227,15 +246,103 @@ class Pdo implements AuthorizationCodeInterface,
         } else {
             $stmt = $this->db->prepare(sprintf('INSERT INTO %s (username, password, first_name, last_name) VALUES (:username, :password, :firstName, :lastName)', $this->config['user_table']));
         }
+
         return $stmt->execute(compact('username', 'password', 'firstName', 'lastName'));
     }
 
-    /* OAuth2_Storage_JWTBearerInterface */
+    /* ScopeInterface */
+    public function scopeExists($scope, $client_id = null)
+    {
+        $scope = explode(' ', $scope);
+        $stmt = $this->db->prepare($sql = sprintf('SELECT scope FROM %s WHERE type="supported" AND (client_id=:client_id OR client_id IS NULL) ORDER BY client_id IS NOT NULL DESC', $this->config['scope_table']));
+        $stmt->execute(compact('client_id'));
+
+        if ($result = $stmt->fetch()) {
+            $supportedScope = explode(' ', $result['scope']);
+        } else {
+            $supportedScope = array();
+        }
+
+        return (count(array_diff($scope, $supportedScope)) == 0);
+    }
+
+    public function getDefaultScope($client_id = null)
+    {
+        $stmt = $this->db->prepare($sql = sprintf('SELECT scope FROM %s WHERE type="default" AND (client_id=:client_id OR client_id IS NULL) ORDER BY client_id IS NOT NULL DESC', $this->config['scope_table']));
+        $stmt->execute(compact('client_id'));
+
+        if ($result = $stmt->fetch()) {
+            return $result['scope'];
+        }
+
+        return null;
+    }
+
+    /* JWTBearerInterface */
     public function getClientKey($client_id, $subject)
     {
         $stmt = $this->db->prepare($sql = sprintf('SELECT public_key from %s where client_id=:client_id AND subject=:subject', $this->config['jwt_table']));
 
         $stmt->execute(array('client_id' => $client_id, 'subject' => $subject));
+
         return $stmt->fetch();
     }
+
+    public function getJti($client_id, $subject, $audience, $expires, $jti)
+    {
+        $stmt = $this->db->prepare($sql = sprintf('SELECT* FROM %s WHERE issuer=:client_id AND subject=:subject AND audience=:audience AND expires=:expires AND jti=:jti', $this->config['jti_table']));
+
+        $stmt->execute(compact('client_id', 'subject', 'audience', 'expires', 'jti'));
+
+        if ($result = $stmt->fetch()) {
+            return array('issuer' => $result['issuer'],
+                         'subject' => $result['subject'],
+                         'audience' => $result['audience'],
+                         'expires' => $result['expires'],
+                         'jti' => $result['jti']
+                );
+        }
+
+        return null;
+    }
+
+    public function setJti($client_id, $subject, $audience, $expires, $jti)
+    {
+        $stmt = $this->db->prepare(sprintf('INSERT INTO %s (issuer, subject, audience, expires, jti) VALUES (:client_id, :subject, :audience, :expires, :jti)', $this->config['jti_table']));
+
+        return $stmt->execute(compact('client_id', 'subject', 'audience', 'expires', 'jti'));
+    }
+
+    /* PublicKeyInterface */
+    public function getPublicKey($client_id = null)
+    {
+        $stmt = $this->db->prepare($sql = sprintf('SELECT public_key FROM %s WHERE client_id=:client_id OR client_id IS NULL ORDER BY client_id IS NOT NULL DESC', $this->config['public_key_table']));
+
+        $stmt->execute(compact('client_id'));
+        if ($result = $stmt->fetch()) {
+            return $result['public_key'];
+        }
+    }
+
+    public function getPrivateKey($client_id = null)
+    {
+        $stmt = $this->db->prepare($sql = sprintf('SELECT private_key FROM %s WHERE client_id=:client_id OR client_id IS NULL ORDER BY client_id IS NOT NULL DESC', $this->config['public_key_table']));
+
+        $stmt->execute(compact('client_id'));
+        if ($result = $stmt->fetch()) {
+            return $result['private_key'];
+        }
+    }
+
+    public function getEncryptionAlgorithm($client_id = null)
+    {
+        $stmt = $this->db->prepare($sql = sprintf('SELECT encryption_algorithm FROM %s WHERE client_id=:client_id OR client_id IS NULL ORDER BY client_id IS NOT NULL DESC', $this->config['public_key_table']));
+
+        $stmt->execute(compact('client_id'));
+        if ($result = $stmt->fetch()) {
+            return $result['encryption_algorithm'];
+        }
+
+        return 'RS256';
+    }
 }
diff --git a/src/OAuth2/Storage/PublicKeyInterface.php b/src/OAuth2/Storage/PublicKeyInterface.php
new file mode 100644
index 0000000..108418d
--- /dev/null
+++ b/src/OAuth2/Storage/PublicKeyInterface.php
@@ -0,0 +1,16 @@
+<?php
+
+namespace OAuth2\Storage;
+
+/**
+ * Implement this interface to specify where the OAuth2 Server
+ * should get public/private key information
+ *
+ * @author Brent Shaffer <bshafs at gmail dot com>
+ */
+interface PublicKeyInterface
+{
+    public function getPublicKey($client_id = null);
+    public function getPrivateKey($client_id = null);
+    public function getEncryptionAlgorithm($client_id = null);
+}
diff --git a/src/OAuth2/Storage/Redis.php b/src/OAuth2/Storage/Redis.php
index 440c3a2..55d300c 100644
--- a/src/OAuth2/Storage/Redis.php
+++ b/src/OAuth2/Storage/Redis.php
@@ -8,7 +8,7 @@ namespace OAuth2\Storage;
  * Register client:
  * <code>
  *  $storage = new OAuth2_Storage_Redis($redis);
- *  $storage->registerClient($client_id, $client_secret, $redirect_uri);
+ *  $storage->setClientDetails($client_id, $client_secret, $redirect_uri);
  * </code>
  */
 class Redis implements AuthorizationCodeInterface,
@@ -16,17 +16,23 @@ class Redis implements AuthorizationCodeInterface,
     ClientCredentialsInterface,
     UserCredentialsInterface,
     RefreshTokenInterface,
-    JwtBearerInterface
+    JwtBearerInterface,
+    ScopeInterface
 {
-    private $redis;
-    private $config;
+
     private $cache;
 
+    /* The redis client */
+    protected $redis;
+
+    /* Configuration array */
+    protected $config;
+
     /**
      * Redis Storage!
      *
      * @param \Predis\Client $redis
-     * @param array $config
+     * @param array          $config
      */
     public function __construct($redis, $config=array())
     {
@@ -38,6 +44,7 @@ class Redis implements AuthorizationCodeInterface,
             'code_key' => 'oauth_authorization_codes:',
             'user_key' => 'oauth_users:',
             'jwt_key' => 'oauth_jwt:',
+            'scope_key' => 'oauth_scopes:',
         ), $config);
     }
 
@@ -58,8 +65,9 @@ class Redis implements AuthorizationCodeInterface,
     {
         $this->cache[$key] = $value;
         $str = json_encode($value);
-        if ( $expire > 0 ) {
+        if ($expire > 0) {
             $seconds = $expire - time();
+
             return $this->redis->setex($key, $seconds, $str);
         } else {
             return $this->redis->set($key, $str);
@@ -69,6 +77,7 @@ class Redis implements AuthorizationCodeInterface,
     protected function expireValue($key)
     {
         unset($this->cache[$key]);
+
         return $this->redis->expire($key);
     }
 
@@ -91,6 +100,7 @@ class Redis implements AuthorizationCodeInterface,
     {
         $key = $this->config['code_key'] . $code;
         unset($this->cache[$key]);
+
         return $this->expireValue($key);
     }
 
@@ -98,6 +108,7 @@ class Redis implements AuthorizationCodeInterface,
     public function checkUserCredentials($username, $password)
     {
         $user = $this->getUserDetails($username);
+
         return $user && $user['password'] === $password;
     }
 
@@ -129,7 +140,10 @@ class Redis implements AuthorizationCodeInterface,
     /* ClientCredentialsInterface */
     public function checkClientCredentials($client_id, $client_secret = null)
     {
-        $client = $this->getClientDetails($client_id);
+        if (!$client = $this->getClientDetails($client_id)) {
+            return false;
+        }
+
         return isset($client['client_secret'])
             && $client['client_secret'] == $client_secret;
     }
@@ -139,6 +153,14 @@ class Redis implements AuthorizationCodeInterface,
         return $this->getValue($this->config['client_key'] . $client_id);
     }
 
+    public function setClientDetails($client_id, $client_secret = null, $redirect_uri = null, $grant_types = null, $user_id = null)
+    {
+        return $this->setValue(
+            $this->config['client_key'] . $client_id,
+            compact('client_id', 'client_secret', 'redirect_uri', 'grant_types', 'user_id')
+        );
+    }
+
     public function checkRestrictedGrantType($client_id, $grant_type)
     {
         $details = $this->getClientDetails($client_id);
@@ -152,14 +174,6 @@ class Redis implements AuthorizationCodeInterface,
         return true;
     }
 
-    public function registerClient($client_id, $client_secret, $redirect_uri)
-    {
-        return $this->setValue(
-            $this->config['client_key'] . $client_id,
-            compact('client_id', 'client_secret', 'redirect_uri')
-        );
-    }
-
     /* RefreshTokenInterface */
     public function getRefreshToken($refresh_token)
     {
@@ -195,6 +209,27 @@ class Redis implements AuthorizationCodeInterface,
         );
     }
 
+    /* ScopeInterface */
+    public function scopeExists($scope, $client_id = null)
+    {
+        $scope = explode(' ', $scope);
+        if (is_null($client_id) || !$result = $this->getValue($this->config['scope_key'].'supported:'.$client_id)) {
+            $result = $this->getValue($this->config['scope_key'].'supported:global');
+        }
+        $supportedScope = explode(' ', (string) $result);
+
+        return (count(array_diff($scope, $supportedScope)) == 0);
+    }
+
+    public function getDefaultScope($client_id = null)
+    {
+        if (is_null($client_id) || !$result = $this->getValue($this->config['scope_key'].'default:'.$client_id)) {
+            $result = $this->getValue($this->config['scope_key'].'default:global');
+        }
+
+        return $result;
+    }
+
     /*JWTBearerInterface */
     public function getClientKey($client_id, $subject)
     {
@@ -202,6 +237,19 @@ class Redis implements AuthorizationCodeInterface,
         if ( isset($jwt['subject']) && $jwt['subject'] == $subject ) {
             return $jwt['key'];
         }
+
         return null;
     }
+
+    public function getJti($client_id, $subject, $audience, $expiration, $jti)
+    {
+        //TODO: Needs redis implementation.
+    	throw new \Exception('getJti() for the Redis driver is currently unimplemented.');
+    }
+
+    public function setJti($client_id, $subject, $audience, $expiration, $jti)
+    {
+        //TODO: Needs redis implementation.
+    	throw new \Exception('setJti() for the Redis driver is currently unimplemented.');
+    }
 }
diff --git a/src/OAuth2/Storage/RefreshTokenInterface.php b/src/OAuth2/Storage/RefreshTokenInterface.php
index 4b04e36..1f0c6c9 100644
--- a/src/OAuth2/Storage/RefreshTokenInterface.php
+++ b/src/OAuth2/Storage/RefreshTokenInterface.php
@@ -26,6 +26,7 @@ interface RefreshTokenInterface
      * invalid:
      * - refresh_token: Stored refresh token identifier.
      * - client_id: Stored client identifier.
+     * - user_id: Stored user identifier.
      * - expires: Stored expiration unix timestamp.
      * - scope: (optional) Stored scope values in space-separated string.
      *
@@ -50,6 +51,8 @@ interface RefreshTokenInterface
      * Refresh token to be stored.
      * @param $client_id
      * Client identifier to be stored.
+     * @param $user_id
+     * User identifier to be stored.
      * @param $expires
      * expires to be stored.
      * @param $scope
diff --git a/src/OAuth2/TokenType/Bearer.php b/src/OAuth2/TokenType/Bearer.php
index 919302f..4355275 100644
--- a/src/OAuth2/TokenType/Bearer.php
+++ b/src/OAuth2/TokenType/Bearer.php
@@ -22,7 +22,7 @@ class Bearer implements TokenTypeInterface
 
     public function getTokenType()
     {
-        return 'bearer';
+        return 'Bearer';
     }
 
     /**
@@ -55,10 +55,12 @@ class Bearer implements TokenTypeInterface
         $methodsUsed = !empty($headers) + !is_null($request->query($this->config['token_param_name'])) + !is_null($request->request($this->config['token_param_name']));
         if ($methodsUsed > 1) {
             $response->setError(400, 'invalid_request', 'Only one method may be used to authenticate at a time (Auth header, GET or POST)');
+
             return null;
         }
         if ($methodsUsed == 0) {
             $response->setStatusCode(401);
+
             return null;
         }
 
@@ -66,8 +68,10 @@ class Bearer implements TokenTypeInterface
         if (!empty($headers)) {
             if (!preg_match('/' . $this->config['token_bearer_header_name'] . '\s(\S+)/', $headers, $matches)) {
                 $response->setError(400, 'invalid_request', 'Malformed auth header');
+
                 return null;
             }
+
             return $matches[1];
         }
 
@@ -75,6 +79,7 @@ class Bearer implements TokenTypeInterface
             // POST: Get the token from POST data
             if (strtolower($request->server('REQUEST_METHOD')) != 'post') {
                 $response->setError(400, 'invalid_request', 'When putting the token in the body, the method must be POST');
+
                 return null;
             }
 
@@ -87,6 +92,7 @@ class Bearer implements TokenTypeInterface
                 // IETF specifies content-type. NB: Not all webservers populate this _SERVER variable
                 // @see http://tools.ietf.org/html/rfc6750#section-2.2
                 $response->setError(400, 'invalid_request', 'The content type for POST requests must be "application/x-www-form-urlencoded"');
+
                 return null;
             }