OpaqueEnrollment.php
Table of Contents
Classes
- OpaqueEnrollment
- The client-supplied half of an OPAQUE enrolment, as it appears inside registration /
change-password / reset-completion / bootstrap request bodies. There is no standalone
`register/finish` endpoint, deliberately. A record can only be created at a moment when the
plaintext password legitimately exists on the client, and every one of those moments is
already an endpoint that takes a password. A free-standing finish would be an endpoint whose
only job is to attach a credential to an account, which is a thing worth not having. Kept
separate from [`CreateOpaqueCredential`] because the tenant, the user and the credential
identifier are all decided by the server — a client that could name them could enrol a
record against somebody else's account.