AXIAM PHP SDK

OidcLoginFlow
in package

FinalYes

Shared "Login with AXIAM" core (CONTRACT.md §12) — the ONE begin/complete + state-store + error-mapping path BOTH {@see \Axiam\Sdk\Laravel\OidcLoginController}/ {@see \Axiam\Sdk\Laravel\OidcCallbackController} and {@see \Axiam\Sdk\Symfony\OidcLoginController}/{@see \Axiam\Sdk\Symfony\OidcCallbackController} call, mirroring the TypeScript reference's `middleware/oidcLoginCore.ts` (the ONE §12 path, exactly as `AccessEnforcer` is the one §11 path shared by both framework bridges in this SDK).

Framework-agnostic on purpose: it takes plain values in and returns a discriminated OidcLoginOutcome out, so each framework controller only has to translate an outcome into that framework's redirect/JSON response. It performs no cookie/session writing of its own and touches no framework request/response object.

The state store is what makes the two HTTP requests of a redirect flow into one login: oidcBegin produces state/nonce/code_verifier on the login request, and only state survives the round trip through the IdP, so the other two must be parked somewhere the callback request can reach (§12.3 rule 1 — the SDK itself stores nothing on its own).

BOTH framework integrations are optional and off by default (CONTRACT.md §12, plan T8 item 2): this class, and the controllers built on it, are only ever required when an application explicitly wires them into its own routing — nothing in AxiamServiceProvider or AxiamBundle registers a route automatically.

Table of Contents

Methods

__construct()  : mixed
begin()  : OidcLoginOutcome
Step 1 — build the authorization request, park its state, and hand back the redirect (CONTRACT.md §12.1 `oidc_begin`).
complete()  : OidcLoginOutcome
Step 2 — validate the callback, consume the stored state, exchange the code, and hand back the post-login response (CONTRACT.md §12.1 `oidc_exchange`).

Methods

__construct()

public __construct(AxiamClient $client, OidcStateStoreInterface $store, string $redirectUri[, string|array<int, string>|null $scope = null ][, LoggerInterface $logger = new NullLogger() ]) : mixed
Parameters
$client : AxiamClient

Client configured with oidcClientId (and, for a confidential client, oidcClientSecret) — see AxiamClient::__construct().

$store : OidcStateStoreInterface

Where in-flight login state is parked between the login redirect and the callback. MemoryOidcStateStore is a ready single-process implementation; a multi-instance deployment needs a shared one.

$redirectUri : string

The relying party's redirect URI — must be the public URL of the callback route, and is replayed verbatim on the token exchange.

$scope : string|array<int, string>|null = null

Requested scope. openid is added automatically when absent (§12.1 rule 4).

$logger : LoggerInterface = new NullLogger()

Debug-only logger. Receives failure reasons, never token material, state, nonce, or the verifier. Defaults to a silent NullLogger.

begin()

Step 1 — build the authorization request, park its state, and hand back the redirect (CONTRACT.md §12.1 `oidc_begin`).

public begin([string|null $returnTo = null ]) : OidcLoginOutcome

Discovery is fetched through oidcDiscover, so its per-origin cache and single-flight de-duplication apply and a busy login route does not hammer the discovery endpoint (§12.3 rule 6).

Parameters
$returnTo : string|null = null

Optional application destination to restore after login; stored with the state entry and used as the post-login redirect when no explicit $successRedirect is given to self::complete().

Return values
OidcLoginOutcome

complete()

Step 2 — validate the callback, consume the stored state, exchange the code, and hand back the post-login response (CONTRACT.md §12.1 `oidc_exchange`).

public complete(string|null $state, string|null $code[, string|null $error = null ][, string|null $errorDescription = null ][, string|null $successRedirect = null ][, callable(OidcTokenSet, OidcStateEntry): void|null $onSuccess = null ]) : OidcLoginOutcome

Failure mapping (port-brief addendum item 19):

  • IdP returned $error instead of a code → 401 authentication_failed;
  • $state or $code missing → 400 invalid_request;
  • $state unknown, already consumed, or expired → 401 authentication_failed (all three are deliberately indistinguishable to the client);
  • any §12.4 ID-token failure or OAuthProtocolError (an AuthError sub-type) → 401 authentication_failed;
  • NetworkError → 503 oidc_unavailable, never a silent success.

$onSuccess, when given, runs with the validated OidcTokenSet and the consumed OidcStateEntry — the hook where an application establishes its OWN session (sign a cookie, write a session row, …). This SDK deliberately does NOT do this for you: what a session means is the application's decision. $returnTo is stored but is explicitly the caller's own open-redirect responsibility (port-brief addendum item 19) — this class never validates it.

Parameters
$state : string|null
$code : string|null
$error : string|null = null
$errorDescription : string|null = null
$successRedirect : string|null = null
$onSuccess : callable(OidcTokenSet, OidcStateEntry): void|null = null
Return values
OidcLoginOutcome
On this page

Search results