AXIAM PHP SDK

CibaInitiateRequest
in package

FinalYes

Arguments to {@see OidcClient::cibaInitiate()} — `CibaInitiateRequest` (CONTRACT.md §33.2).

Exactly one hint: loginHint (a username, then an e-mail address, within the tenant) or idTokenHint (an ID token this deployment issued to this client). binding_message and login_hint can be personal data: the SDK never logs them. There is no parameter for login_hint_token, user_code or request_uri — AXIAM refuses each (§33.3 rule 3).

Every member set is sent, and nothing else; the server's bounds (§33.3 rule 5) are the server's to check, so none is pre-validated here. With a signer, every member travels inside one signed request JWT instead (§33.2's signed form).

Table of Contents

Properties

$acrValues  : string|null
$bindingMessage  : string|null
$clientNotificationToken  : Sensitive|null
$delivery  : CibaDeliveryMode
$idTokenHint  : string|null
$loginHint  : string|null
$requestedExpiry  : int|null
$resource  : string|null
$scope  : string
$signer  : CibaRequestSigner|null

Methods

__construct()  : mixed
members()  : array<string, string|int|Sensitive>
The authentication-request members this request sets, exactly — the wire spelling, with `requested_expiry` as an integer (the form sends it as a string, a signed request as a number).

Properties

Methods

__construct()

public __construct(string $scope[, string|null $loginHint = null ][, string|null $idTokenHint = null ][, string|null $bindingMessage = null ][, int|null $requestedExpiry = null ][, string|null $acrValues = null ][, string|null $resource = null ][, CibaDeliveryMode $delivery = CibaDeliveryMode::Poll ][, Sensitive|null $clientNotificationToken = null ][, CibaRequestSigner|null $signer = null ]) : mixed
Parameters
$scope : string

Space-separated; must include openid.

$loginHint : string|null = null

Whom to authenticate — exactly one of this and $idTokenHint.

$idTokenHint : string|null = null

An ID token this deployment issued to this client.

$bindingMessage : string|null = null

Shown to the user on the approval page — what lets them tell the request they started from one an attacker did. Required for a fapi2 client.

$requestedExpiry : int|null = null

The requested lifetime, 30–600 s (absent: 300). Sent as a string on the form, as a number inside a signed request.

$acrValues : string|null = null

Space-separated authentication context classes.

$resource : string|null = null

An RFC 8707 resource indicator.

$delivery : CibaDeliveryMode = CibaDeliveryMode::Poll

Poll or ping, as the client registered.

$clientNotificationToken : Sensitive|null = null

Ping mode only, and required there: the bearer AXIAM presents at the ping. Keep it to check the ping with OidcClient::cibaHandlePing(); AXIAM never returns it.

$signer : CibaRequestSigner|null = null

Sends the request as one signed JWT (request) — required of a client that registered a signing algorithm, refused from one that did not.

Tags
throws
ValidationError

locally: both hints or neither; a ping request without a non-empty notification token; a poll request with one.

members()

The authentication-request members this request sets, exactly — the wire spelling, with `requested_expiry` as an integer (the form sends it as a string, a signed request as a number).

public members() : array<string, string|int|Sensitive>
Return values
array<string, string|int|Sensitive>
On this page

Search results