CibaRequestSigner
in package
implements
JsonSerializable
The key and algorithm for CIBA's signed authentication request (CONTRACT.md §33.2, CIBA Core §7.1.1). Both are the caller's: there is no default for either, and the SDK signs under exactly the algorithm given — the one the client registered as `backchannel_authentication_request_signing_alg`.
The key material is held only behind Sensitive (§33.5): print_r(), var_dump(),
var_export() and json_encode() of a signer show the algorithm and kid, never the key.
Signing uses firebase/php-jwt, this SDK's JOSE library: EdDSA (through ext-sodium) and
ES256 (through ext-openssl). PS256 is refused at construction — the library signs it
only through phpseclib 3, which this SDK does not depend on (see CibaSigningAlg).
Table of Contents
Interfaces
- JsonSerializable
Properties
- $alg : CibaSigningAlg
- $kid : string|null
Methods
- fromPem() : self
- A signer from a PEM private key and the algorithm it signs under: a PKCS#8 (`BEGIN PRIVATE KEY`) Ed25519 key for `EdDSA`, a P-256 EC key (PKCS#8 or SEC1) for `ES256`.
- jsonSerialize() : array{alg: string, kid: string|null, key: string}
- The signer for a log line: the algorithm and `kid` only.
- sign() : Sensitive
- The compact JWS of `$claims`, signed under this signer's algorithm with its `kid`.
Properties
$alg read-only
public
CibaSigningAlg
$alg
$kid read-only
public
string|null
$kid
Methods
fromPem()
A signer from a PEM private key and the algorithm it signs under: a PKCS#8 (`BEGIN PRIVATE KEY`) Ed25519 key for `EdDSA`, a P-256 EC key (PKCS#8 or SEC1) for `ES256`.
public
static fromPem(CibaSigningAlg $alg, Sensitive $privateKeyPem[, string|null $kid = null ]) : self
The key is proved by signing a probe before this returns, so a key that cannot sign
under $alg is refused here, before any request.
Parameters
- $alg : CibaSigningAlg
-
The registered algorithm.
- $privateKeyPem : Sensitive
-
The private key, PEM.
- $kid : string|null = null
-
The
kidto put in the JWS header, if your registered JWKS names one.
Tags
Return values
selfjsonSerialize()
The signer for a log line: the algorithm and `kid` only.
public
jsonSerialize() : array{alg: string, kid: string|null, key: string}
Return values
array{alg: string, kid: string|null, key: string}sign()
The compact JWS of `$claims`, signed under this signer's algorithm with its `kid`.
public
sign(array<string, mixed> $claims) : Sensitive
Parameters
- $claims : array<string, mixed>