ClientAuthMethod
: string
in package
How a client proves its identity at the token endpoint (RFC 8705 §2, OIDC Core §9 naming).
Only the methods AXIAM actually implements are representable. None — the public-client
value — was deliberately absent until T21.2: adding it before the rest of the server
understood one would have let an operator register a client whose authentication is silently
skipped. The server understands one now (token.rs's authenticate_client_credential has
an arm that accepts no credential and refuses a presented one, the authorization endpoint
derives its PKCE requirement from this enum, and the admin API refuses the method alongside
any grant or binding that contradicts it), so the variant exists — and only that arm may
ever treat a missing credential as success.
An open enum. A value this SDK's copy of the spec does not list decodes to
self::Unknown rather than failing the response it arrived in (CONTRACT.md §27.11 rule 1).
Its own wire spelling is the empty string, which no server value is, so carrying an
unrecognised value back into an update is refused by the server rather than written as a
spelling it never used. A match over these cases needs an Unknown arm.
Table of Contents
Cases
- ClientSecretBasic = 'client_secret_basic'
- The wire value `client_secret_basic`.
- ClientSecretPost = 'client_secret_post'
- The wire value `client_secret_post`.
- None = 'none'
- The wire value `none`.
- PrivateKeyJwt = 'private_key_jwt'
- The wire value `private_key_jwt`.
- SelfSignedTlsClientAuth = 'self_signed_tls_client_auth'
- The wire value `self_signed_tls_client_auth`.
- TlsClientAuth = 'tls_client_auth'
- The wire value `tls_client_auth`.
- Unknown = ''
- A value this SDK's copy of the spec does not list; see the type's summary.
Methods
- fromWire() : self
- Parses a wire value into a ClientAuthMethod, mapping an unrecognised one to {@see self::Unknown}.
- toWire() : string
- The wire spelling of this case, for a request body.
Cases
ClientSecretPost
The wire value `client_secret_post`.
ClientSecretBasic
The wire value `client_secret_basic`.
TlsClientAuth
The wire value `tls_client_auth`.
SelfSignedTlsClientAuth
The wire value `self_signed_tls_client_auth`.
PrivateKeyJwt
The wire value `private_key_jwt`.
None
The wire value `none`.
Unknown
A value this SDK's copy of the spec does not list; see the type's summary.
Methods
fromWire()
Parses a wire value into a ClientAuthMethod, mapping an unrecognised one to {@see self::Unknown}.
public
static fromWire(string $value) : self
Never throws. A parse error here would fail the whole response the value arrived in, so
one unrecognised field of one record would take down the page it was on (§27.11 rule 1).
A match over this enum needs an Unknown arm.
Parameters
- $value : string
Return values
selftoWire()
The wire spelling of this case, for a request body.
public
toWire() : string
self::Unknown has none: it stands for a value this SDK never saw, and sending it
back as the empty string would leave the refusal to the server. It raises a ValidationError here instead, before any request is made
(CONTRACT.md §34.2 P12.2(a)). Use ->value to render for a log line.