AXIAM PHP SDK

TokenIntrospection
in package
uses TokenBindingSupport

FinalYes

The result of `AxiamClient::introspectToken()` — the RFC 7662 set, every field of the wire `IntrospectTokenResponse` (CONTRACT.md §1.1.1 rule 3, contract 1.51).

$active is not permission to proceed. Call self::status(), or self::verifyPossession(); see TokenStatus's own doc for why.

Table of Contents

Properties

$active  : bool
$clientId  : string
$cnf  : array<string|int, mixed>|null
$exp  : int
$extExchangeIss  : string
$iat  : int
$iss  : string
$jti  : string
$orgId  : string
$permissions  : array<string|int, mixed>
$scope  : string
$sub  : string
$tenantId  : string
$tokenType  : string

Methods

__construct()  : mixed
fromWire()  : self
Decodes the wire {@see IntrospectTokenResponse} into this typed value.
status()  : TokenStatus
Which of the §10.1 rule 9 cases this is, decided from `$active` and `$cnf` — never from `$tokenType`.
verifyPossession()  : void
Whether the PRESENTER may use this token: `$active`, and every sender constraint `$cnf` names satisfied by `$proofs` (§10.1 rule 9, §10.3 rule 2).

Properties

Methods

__construct()

public __construct(bool $active, string $sub, string $tenantId, string $orgId, string $iss, int $iat, int $exp, string $jti, string $scope, string $clientId, string $tokenType, array{'x5t#S256': ?string, jkt: ?string}|null $cnf, array<int, RptPermission> $permissions, string $extExchangeIss) : mixed
Parameters
$active : bool

Whether the token is active (valid and not expired).

$sub : string

Subject UUID.

$tenantId : string

Tenant UUID.

$orgId : string

Organization UUID.

$iss : string

Issuer.

$iat : int

Issued-at, seconds since the epoch.

$exp : int

Expiry, seconds since the epoch.

$jti : string

Unique token id.

$scope : string

Space-separated granted scopes (RFC 7662 §2.2). Empty when the token carries no scope claim.

$clientId : string

The client the token was issued to, when it was issued to one.

$tokenType : string

"Bearer" or "DPoP". Does not say whether the token is bound — use self::status().

$cnf : array{'x5t#S256': ?string, jkt: ?string}|null

The RFC 7800/8705/9449 confirmation. null means unbound; a present array with both members null is an empty confirmation, refused rather than read as unbound (§10.3 rule 3).

$permissions : array<int, RptPermission>

UMA 2.0 (§20) permissions — present only on an RPT.

$extExchangeIss : string

X4 cross-domain provenance: the foreign issuer whose subject token bought this one, when there was one. Empty otherwise.

fromWire()

Decodes the wire {@see IntrospectTokenResponse} into this typed value.

public static fromWire(IntrospectTokenResponse $wire) : self
Parameters
$wire : IntrospectTokenResponse
Return values
self

verifyPossession()

Whether the PRESENTER may use this token: `$active`, and every sender constraint `$cnf` names satisfied by `$proofs` (§10.1 rule 9, §10.3 rule 2).

public verifyPossession(PresentedProofs $proofs) : void
Parameters
$proofs : PresentedProofs
Tags
throws
AuthError

when the token is not active, or its cnf is not satisfied — including a present-but-empty cnf, which nothing satisfies.

On this page

Search results