AXIAM PHP SDK

__construct()

Constructs a CreateFederationConfigRequest.

Parameters

$clientId : string

OAuth2 client ID registered with the external IdP.

$clientSecret : Sensitive

OAuth2 client secret registered with the external IdP.

$protocol : string

Federation protocol: "OidcConnect" or "Saml".

$provider : string

Display name for the identity provider (e.g., "Google", "Okta").

$allowTenantInheritance : bool|null = null

Whether tenants of this organization may inherit this provider. Only meaningful on a config in the organization-scope tenant. (optional)

$allowedAlgorithms : array<int, string>|null = null

Accepted JWT signing algorithms (OIDC) or signature algorithms (SAML). Defaults to ["RS256"] when not provided (CQ-B40/REQ-14 AC-5). (optional)

$allowedIssuerTenants : array<int, string>|null = null

External IdP tenant identifiers accepted when the provider publishes a templated issuer (Entra ID's {tenantid}). (optional)

$appleKeyId : string|null = null

Apple Key ID of the .p8 signing key (10 characters). With both Apple identifiers set, client_secret is the .p8 key itself and AXIAM mints a fresh five-minute client secret per token exchange. (optional)

$appleTeamId : string|null = null

Apple Team ID (10 characters). (optional)

$attributeMap : mixed = null

Maps external IdP attributes to AXIAM user fields. (optional)

$authorizationEndpoint : string|null = null

OAuth2-variant authorization endpoint. Required for OAuth2. (optional)

$buttonIcon : string|null = null

Sign-in-button icon for a generic provider, as a base64 raster data URL (data:image/png;base64,…), already cropped to PROVIDER_ICON_SIZE_PX square by the client. Refused for the branded kinds: Google, Apple and Microsoft all publish sign-in-button rules that require their own mark, so substituting a picture would produce a button that breaks the guidelines it exists to follow. (optional)

$idpSigningCertPem : string|null = null

PEM-encoded X.509 certificate for verifying SAML assertions or OIDC signatures (CQ-B40/REQ-14 AC-5). Required for SAML configs. (optional)

$metadataUrl : string|null = null

OIDC discovery URL or SAML metadata URL. (optional)

$providerKind : string|null = null

Which provider this is: google, github, facebook, apple, microsoft, generic_oidc, generic_oauth2 or generic_saml. Selects the sign-in button's branding, the per-kind defaults, and the key on which a tenant config overrides an inherited organization one. Omitted ⇒ derived from protocol, which is what every config written before this field existed means. (optional)

$providerSlug : string|null = null

Operator-chosen identifier, required for the generic_* kinds and refused for the branded ones. (optional)

$requirePkce : bool|null = null

Send PKCE on the authorization request. Forced on for OAuth2. (optional)

$scopes : array<int, string>|null = null

Scopes to request. Omitted or empty ⇒ the per-kind default. (optional)

$tokenEndpoint : string|null = null

OAuth2-variant token endpoint. Required for OAuth2. (optional)

$tokenExchange : TokenExchangeTrustRequest|null = null

the server's token_exchange field (optional)

$userinfoEndpoint : string|null = null

OAuth2-variant userinfo endpoint. Required for OAuth2. (optional)

jsonSerialize()

Renders this object for `json_encode()`.

toArray()

Renders this object back to its wire form.