Include Client ID (kid) parameter in the JWT header

composer.json

@@ -21,7 +21,7 @@
     "require-dev": {
         "phpunit/phpunit": "^4.0",
         "aws/aws-sdk-php": "~2.8",
-        "firebase/php-jwt": "~2.2",
+        "firebase/php-jwt": "~3.0",
         "predis/predis": "dev-master",
         "thobbs/phpcassa": "dev-master",
         "mongodb/mongodb": "^1.1"
@@ -30,7 +30,7 @@
         "predis/predis": "Required to use Redis storage",
         "thobbs/phpcassa": "Required to use Cassandra storage",
         "aws/aws-sdk-php": "~2.8 is required to use DynamoDB storage",
-        "firebase/php-jwt": "~2.2 is required to use JWT features",
+        "firebase/php-jwt": "~3.0 is required to use JWT features",
         "mongodb/mongodb": "^1.1 is required to use MongoDB storage"
     }
 }

src/OAuth2/Encryption/EncryptionInterface.php

@@ -10,7 +10,7 @@ interface EncryptionInterface
      * @param null $algorithm
      * @return mixed
      */
-    public function encode($payload, $key, $algorithm = null);
+    public function encode($payload, $key, $algorithm = null, $keyId = null);
 
     /**
      * @param $payload

src/OAuth2/Encryption/FirebaseJwt.php

@@ -10,14 +10,14 @@ class FirebaseJwt implements EncryptionInterface
 {
     public function __construct()
     {
-        if (!class_exists('\JWT')) {
+        if (!class_exists('\Firebase\JWT\JWT')) {
             throw new \ErrorException('firebase/php-jwt must be installed to use this feature. You can do this by running "composer require firebase/php-jwt"');
         }
     }
 
     public function encode($payload, $key, $alg = 'HS256', $keyId = null)
     {
-        return \JWT::encode($payload, $key, $alg, $keyId);
+        return \Firebase\JWT\JWT::encode($payload, $key, $alg, $keyId);
     }
 
     public function decode($jwt, $key = null, $allowedAlgorithms = null)
@@ -29,19 +29,19 @@ public function decode($jwt, $key = null, $allowedAlgorithms = null)
                 $key = null;
             }
 
-            return (array)\JWT::decode($jwt, $key, $allowedAlgorithms);
+            return (array)\Firebase\JWT\JWT::decode($jwt, $key, $allowedAlgorithms);
         } catch (\Exception $e) {
             return false;
         }
     }
 
     public function urlSafeB64Encode($data)
     {
-        return \JWT::urlsafeB64Encode($data);
+        return \Firebase\JWT\JWT::urlsafeB64Encode($data);
     }
 
     public function urlSafeB64Decode($b64)
     {
-        return \JWT::urlsafeB64Decode($b64);
+        return \Firebase\JWT\JWT::urlsafeB64Decode($b64);
     }
 }

src/OAuth2/Encryption/Jwt.php

@@ -17,9 +17,9 @@ class Jwt implements EncryptionInterface
      * @param string $algo
      * @return string
      */
-    public function encode($payload, $key, $algo = 'HS256')
+    public function encode($payload, $key, $algo = 'HS256', $keyId = null)
     {
-        $header = $this->generateJwtHeader($payload, $algo);
+        $header = $this->generateJwtHeader($payload, $algo, $keyId);
 
         $segments = array(
             $this->urlSafeB64Encode(json_encode($header)),
@@ -195,12 +195,16 @@ public function urlSafeB64Decode($b64)
     /**
      * Override to create a custom header
      */
-    protected function generateJwtHeader($payload, $algorithm)
+    protected function generateJwtHeader($payload, $algorithm, $keyId = null)
     {
-        return array(
+        $header = array(
             'typ' => 'JWT',
             'alg' => $algorithm,
         );
+        if (!is_null($keyId)) {
+            $header['kid'] = $keyId;
+        }
+        return $header;
     }
 
     /**

src/OAuth2/OpenID/ResponseType/IdToken.php

@@ -144,7 +144,7 @@ protected function encodeToken(array $token, $client_id = null)
         $private_key = $this->publicKeyStorage->getPrivateKey($client_id);
         $algorithm = $this->publicKeyStorage->getEncryptionAlgorithm($client_id);
 
-        return $this->encryptionUtil->encode($token, $private_key, $algorithm);
+        return $this->encryptionUtil->encode($token, $private_key, $algorithm, $client_id);
     }
 
     /**

src/OAuth2/ResponseType/JwtAccessToken.php

@@ -111,7 +111,7 @@ protected function encodeToken(array $token, $client_id = null)
         $private_key = $this->publicKeyStorage->getPrivateKey($client_id);
         $algorithm   = $this->publicKeyStorage->getEncryptionAlgorithm($client_id);
 
-        return $this->encryptionUtil->encode($token, $private_key, $algorithm);
+        return $this->encryptionUtil->encode($token, $private_key, $algorithm, $client_id);
     }
 
     /**