Oidc
Table of Contents
Interfaces
- OidcStateStoreInterface
- Optional server-side store for in-flight `oidcBegin` state (CONTRACT.md §12.3 rule 1).
Classes
- AuthorizationRequest
- The result of `oidcBegin` — everything the caller needs to start an
authorization-code + PKCE login (CONTRACT.md §12.1).
- DeviceAuthorization
- The `DeviceAuthorizationResponse` — what the device shows its user, plus the
`device_code` it polls with (CONTRACT.md §14.1).
- ExchangedToken
- The result of an RFC 8693 exchange (wire schema `TokenExchangeResponse`,
CONTRACT.md §15.1).
- FederationProvider
- One sign-in button (wire schema `PublicFederationProvider`, CONTRACT.md §12.1,
contract 1.38).
- FederationProviderList
- The result of `ssoProviders` (wire schema `PublicFederationProvidersResponse`,
CONTRACT.md §12.1).
- IdTokenValidator
- ID-token claim validation — CONTRACT.md §12.4, OIDC Core §3.1.3.7.
- IntrospectionResult
- The RFC 7662 introspection result (wire schema `IntrospectionResponse`, CONTRACT.md
§12.1). Only `$active` is guaranteed; the server omits the metadata fields for an
inactive token.
- MemoryOidcStateStore
- In-memory reference implementation of {@see OidcStateStoreInterface} (CONTRACT.md
§12.3 rule 1).
- OidcClient
- The OIDC / SSO relying-party engine (CONTRACT.md §12) behind {@see
\Axiam\Sdk\AxiamClient}'s nine public `oidc*`/`introspect`/`revoke`/`sso*` methods.
- OidcConfiguration
- The OIDC Discovery 1.0 metadata document served by
`GET /.well-known/openid-configuration` (wire schema `OidcDiscoveryDocument`,
CONTRACT.md §12.1). Every field is required by the server's schema.
- OidcLoginFlow
- Shared "Login with AXIAM" core (CONTRACT.md §12) — the ONE begin/complete +
state-store + error-mapping path BOTH {@see \Axiam\Sdk\Laravel\OidcLoginController}/
{@see \Axiam\Sdk\Laravel\OidcCallbackController} and
{@see \Axiam\Sdk\Symfony\OidcLoginController}/{@see \Axiam\Sdk\Symfony\OidcCallbackController}
call, mirroring the TypeScript reference's `middleware/oidcLoginCore.ts` (the ONE §12
path, exactly as `AccessEnforcer` is the one §11 path shared by both framework
bridges in this SDK).
- OidcLoginOutcome
- What a login/callback handler should do next — one shape per outcome kind. Framework
controllers ({@see \Axiam\Sdk\Laravel\OidcLoginController}/`OidcCallbackController`,
{@see \Axiam\Sdk\Symfony\OidcLoginController}/`OidcCallbackController`) translate this
into their own framework's redirect/JSON response and add nothing of their own, so
Laravel and Symfony cannot drift (mirrors the TypeScript reference's
`OidcLoginOutcome` discriminated union).
- OidcStateEntry
- The tuple an {@see OidcStateStoreInterface} holds for one in-flight login.
- OidcTokenSet
- A token set returned by the OAuth2 token endpoint (wire schema `TokenResponse`),
returned by `oidcExchange`, `oidcRefresh` and `loginClientCredentials` (CONTRACT.md
§12.1).
- Pkce
- PKCE + CSPRNG primitives for the OIDC relying-party flow (CONTRACT.md §12.1
"`oidc_begin` inputs and construction", RFC 7636).
- PushedAuthorizationRequest
- The result of `AxiamClient::oidcPar()` (CONTRACT.md §26.1).
- RequestedPermission
- One `(resource, scopes)` pair a resource server requires (CONTRACT.md §20.1).
- RequestingPartyToken
- The result of the UMA ticket grant (CONTRACT.md §20.1).
- ResourceSet
- A UMA resource set — an AXIAM resource seen through the Protection API
(CONTRACT.md §20.1).
- RptPermission
- One entry of an RPT's `permissions` claim (CONTRACT.md §20.1).
- SsoCompleteResult
- The result of `ssoComplete` (wire schema `SsoLoginSuccessResponse`, CONTRACT.md
§12.1). Carries **no token material** — the session arrives as `Set-Cookie`, so the §4
cookie jar (shared by every `AxiamClient` Guzzle transport) is what actually captures
it (§12.1 note 6).
- SsoStartResult
- The result of `ssoStart` (wire schema `OidcStartResponse`, CONTRACT.md §12.1).
- UmaChallenge
- A parsed `WWW-Authenticate: UMA` challenge (UMA 2.0 §3.2, CONTRACT.md §20.3).
- VerifiedLogoutToken
- What a verified back-channel logout token names (CONTRACT.md §12.7.3).