AXIAM PHP SDK

OidcConfiguration
in package

FinalYes

The OIDC Discovery 1.0 metadata document served by `GET /.well-known/openid-configuration` (wire schema `OidcDiscoveryDocument`, CONTRACT.md §12.1). Every field is required by the server's schema.

Field names deliberately keep the wire's snake_case spelling rather than PHP's usual camelCase (contract 1.4 port-brief judgment call 3): this type IS a protocol document, and a caller cross-references these names against OIDC Discovery 1.0 / RFC 8414.

issuer is the authoritative issuer for ID-token validation (§12.4 rule 3). It may legitimately differ from the client's base URL when AXIAM runs behind a proxy, so this SDK never rejects a document on an issuer/base-URL mismatch (§12.3 rule 6). Likewise jwks_uri is read from here rather than hardcoded.

Table of Contents

Properties

$authorization_endpoint  : string
$backchannel_logout_session_supported  : bool
$backchannel_logout_supported  : bool
$claims_supported  : array<string|int, mixed>
$device_authorization_endpoint  : string|null
$end_session_endpoint  : string|null
$grant_types_supported  : array<string|int, mixed>
$id_token_signing_alg_values_supported  : array<string|int, mixed>
$introspection_endpoint  : string
$issuer  : string
$jwks_uri  : string
$pushed_authorization_request_endpoint  : string|null
$response_types_supported  : array<string|int, mixed>
$revocation_endpoint  : string
$scopes_supported  : array<string|int, mixed>
$subject_types_supported  : array<string|int, mixed>
$token_endpoint  : string
$token_endpoint_auth_methods_supported  : array<string|int, mixed>
$userinfo_endpoint  : string

Methods

__construct()  : mixed
fromWire()  : self
Build a {@see OidcConfiguration} from the decoded `GET /.well-known/openid-configuration` JSON body, raising {@see NetworkError} on a malformed document (missing/mistyped required field) rather than letting a confusing `TypeError` escape from the constructor.

Properties

$backchannel_logout_session_supported read-only

public bool $backchannel_logout_session_supported = false

$backchannel_logout_supported read-only

public bool $backchannel_logout_supported = false

$claims_supported read-only

public array<string|int, mixed> $claims_supported

$device_authorization_endpoint read-only

public string|null $device_authorization_endpoint = null

$end_session_endpoint read-only

public string|null $end_session_endpoint = null

$grant_types_supported read-only

public array<string|int, mixed> $grant_types_supported

$id_token_signing_alg_values_supported read-only

public array<string|int, mixed> $id_token_signing_alg_values_supported

$pushed_authorization_request_endpoint read-only

public string|null $pushed_authorization_request_endpoint = null

$response_types_supported read-only

public array<string|int, mixed> $response_types_supported

$scopes_supported read-only

public array<string|int, mixed> $scopes_supported

$subject_types_supported read-only

public array<string|int, mixed> $subject_types_supported

$token_endpoint_auth_methods_supported read-only

public array<string|int, mixed> $token_endpoint_auth_methods_supported

Methods

__construct()

public __construct(string $issuer, string $authorization_endpoint, string $token_endpoint, string $userinfo_endpoint, string $jwks_uri, string $revocation_endpoint, string $introspection_endpoint, array<int, string> $response_types_supported, array<int, string> $subject_types_supported, array<int, string> $id_token_signing_alg_values_supported, array<int, string> $scopes_supported, array<int, string> $token_endpoint_auth_methods_supported, array<int, string> $claims_supported, array<int, string> $grant_types_supported[, string|null $device_authorization_endpoint = null ][, string|null $pushed_authorization_request_endpoint = null ][, string|null $end_session_endpoint = null ][, bool $backchannel_logout_supported = false ][, bool $backchannel_logout_session_supported = false ]) : mixed
Parameters
$issuer : string

The authorization server's issuer identifier — the value an ID token's iss claim must equal exactly.

$authorization_endpoint : string

The authorization endpoint oidcBegin builds its redirect URL from.

$token_endpoint : string

The token endpoint used by oidcExchange, oidcRefresh and loginClientCredentials.

$userinfo_endpoint : string

The userinfo endpoint. Advertised by the server but deliberately NOT called by this SDK (§12.3 rule 5).

$jwks_uri : string

URI of the JWKS document whose keys verify ID-token signatures (§12.4 rule 2).

$revocation_endpoint : string

The RFC 7009 revocation endpoint used by revoke.

$introspection_endpoint : string

The RFC 7662 introspection endpoint used by introspect.

$response_types_supported : array<int, string>

OAuth2 response_type values the server supports.

$subject_types_supported : array<int, string>

Subject identifier types the server supports.

$id_token_signing_alg_values_supported : array<int, string>

ID-token signing algorithms the server advertises. Informational only: §12.4 rule 1 pins verification to EdDSA regardless of what appears here.

$scopes_supported : array<int, string>

Scopes the server supports.

$token_endpoint_auth_methods_supported : array<int, string>

Client-authentication methods the token endpoint supports (client_secret_post, §12.1 note 3).

$claims_supported : array<int, string>

Claims the server may include in an ID token.

$grant_types_supported : array<int, string>

Grant types the token endpoint supports.

$device_authorization_endpoint : string|null = null

RFC 8628 device authorization endpoint, used by deviceAuthorize (§14.1). null when the server does not implement the device grant, or when the document came from a non-AXIAM OP — its absence is an error at call time, never a cue to build the URL by concatenation.

$pushed_authorization_request_endpoint : string|null = null

RFC 9126 pushed authorization request endpoint, used by oidcPar (§26.1). null when the server does not implement PAR — its absence is an error at call time, never a cue to build the URL by concatenation, and for a FAPI 2.0 client it is fatal rather than a fallback since §21.1 refuses a fapi2 registration that does not set require_par.

$end_session_endpoint : string|null = null

OIDC RP-Initiated Logout 1.0 endpoint, used by logoutUrl (§12.7.2 rule 1). null for the same reason, and the rule is stricter here: §12.7.2 rule 1 forbids synthesising this URL from the issuer.

$backchannel_logout_supported : bool = false

Whether the OP sends back-channel logout tokens.

$backchannel_logout_session_supported : bool = false

Whether those logout tokens carry sid. AXIAM always sends it.

fromWire()

Build a {@see OidcConfiguration} from the decoded `GET /.well-known/openid-configuration` JSON body, raising {@see NetworkError} on a malformed document (missing/mistyped required field) rather than letting a confusing `TypeError` escape from the constructor.

public static fromWire(ResponseInterface $response) : self
Parameters
$response : ResponseInterface
Return values
self
On this page

Search results