MtlsEndpointAliases
in package
RFC 8705 §5 `mtls_endpoint_aliases` — the seven endpoints re-based on the host that performs the mutual-TLS handshake (wire schema `MtlsEndpointAliases`, contract 1.40; the seventh, CIBA's `backchannel_authentication_endpoint`, contract 1.58 — CONTRACT.md §21.3.1 as amended by §33).
A TLS listener decides whether to request a client certificate during the handshake,
before it has seen any HTTP, so "ask for a certificate on /oauth2/token but not on
/oauth2/authorize" is not something one listener can do. A deployment wanting both
runs two, and this object names the second.
Only these seven are ever aliased. authorization_endpoint and end_session_endpoint are
front-channel and jwks_uri is public key material, so CONTRACT.md §21.3 rule 2 forbids
synthesising an alias for any of them — sending a browser to an mTLS host raises a native
certificate-chooser dialog most users cannot answer. issuer is not an endpoint and does
not move either: §12.4 rule 3 still compares iss against it by exact string.
Every property is nullable, though the server's schema marks them required. AXIAM
builds them from one path through a shared macro and so always publishes the complete
set, but RFC 8705 §5 permits an OP to alias fewer, and the shape of this member must
never be why a client stops working — the same principle rule 2 point 1 states for the
object as a whole, one level in. A null entry falls back to the top-level endpoint of
the same name, exactly as an absent object does.
Table of Contents
Properties
- $backchannel_authentication_endpoint : string|null
- $device_authorization_endpoint : string|null
- $introspection_endpoint : string|null
- $pushed_authorization_request_endpoint : string|null
- $revocation_endpoint : string|null
- $token_endpoint : string|null
- $userinfo_endpoint : string|null
Methods
- __construct() : mixed
- fromWire() : self|null
- Build a {@see MtlsEndpointAliases} from the decoded `mtls_endpoint_aliases` object, or `null` when the document carries none.
Properties
$backchannel_authentication_endpoint read-only
public
string|null
$backchannel_authentication_endpoint
= null
$device_authorization_endpoint read-only
public
string|null
$device_authorization_endpoint
= null
$introspection_endpoint read-only
public
string|null
$introspection_endpoint
= null
$pushed_authorization_request_endpoint read-only
public
string|null
$pushed_authorization_request_endpoint
= null
$revocation_endpoint read-only
public
string|null
$revocation_endpoint
= null
$token_endpoint read-only
public
string|null
$token_endpoint
= null
$userinfo_endpoint read-only
public
string|null
$userinfo_endpoint
= null
Methods
__construct()
public
__construct([string|null $token_endpoint = null ][, string|null $userinfo_endpoint = null ][, string|null $revocation_endpoint = null ][, string|null $introspection_endpoint = null ][, string|null $device_authorization_endpoint = null ][, string|null $pushed_authorization_request_endpoint = null ][, string|null $backchannel_authentication_endpoint = null ]) : mixed
Parameters
- $token_endpoint : string|null = null
-
RFC 8705 §2 client authentication, and §3 the mint of a certificate-bound token.
- $userinfo_endpoint : string|null = null
-
OIDC Core §5.3, reached with an access token that may carry
cnf. - $revocation_endpoint : string|null = null
-
RFC 7009 §2.1 — authenticates the client.
- $introspection_endpoint : string|null = null
-
RFC 7662 §2.1 — authenticates the caller.
- $device_authorization_endpoint : string|null = null
-
RFC 8628 §3.1 — authenticates the client.
- $pushed_authorization_request_endpoint : string|null = null
-
RFC 9126 §2 — authenticates the client.
- $backchannel_authentication_endpoint : string|null = null
-
CIBA Core §7 — authenticates the client (contract 1.58): a
tls_client_authCIBA client presents its certificate here as at the token endpoint.
fromWire()
Build a {@see MtlsEndpointAliases} from the decoded `mtls_endpoint_aliases` object, or `null` when the document carries none.
public
static fromWire(mixed $wire) : self|null
Absence is never an error: it means "no separate mTLS host", not "mTLS unsupported". Each member is read independently, so a partial object — which RFC 8705 §5 permits — aliases what it names and leaves the rest falling back to the top-level entries, rather than failing the whole document.
Parameters
- $wire : mixed