Oidc
Table of Contents
Interfaces
- CibaClock
- The clock {@see OidcClient::cibaAwait()} waits on — injectable so the §33.7 schedule is
testable without sleeping.
- OidcStateStoreInterface
- Optional server-side store for in-flight `oidcBegin` state (CONTRACT.md §12.3 rule 1).
Classes
- AuthorizationRequest
- The result of `oidcBegin` — everything the caller needs to start an
authorization-code + PKCE login (CONTRACT.md §12.1).
- CibaInitiateRequest
- Arguments to {@see OidcClient::cibaInitiate()} — `CibaInitiateRequest` (CONTRACT.md §33.2).
- CibaInitiateResponse
- `CibaInitiateResponse` (CONTRACT.md §33.2) — what {@see OidcClient::cibaInitiate()} returns.
- CibaRequestSigner
- The key and algorithm for CIBA's signed authentication request (CONTRACT.md §33.2, CIBA
Core §7.1.1). Both are the caller's: there is no default for either, and the SDK signs under
exactly the algorithm given — the one the client registered as
`backchannel_authentication_request_signing_alg`.
- ClientRegistration
- An RFC 7591 §3.2.1 / RFC 7592 §3 client information response — what
{@see \Axiam\Sdk\AxiamClient::readClientRegistration()} and
{@see \Axiam\Sdk\AxiamClient::updateClientRegistration()} return (CONTRACT.md §28.12.1).
- DeviceAuthorization
- The `DeviceAuthorizationResponse` — what the device shows its user, plus the
`device_code` it polls with (CONTRACT.md §14.1).
- ExchangedToken
- The result of an RFC 8693 exchange (wire schema `TokenExchangeResponse`,
CONTRACT.md §15.1).
- FederationProvider
- One sign-in button (wire schema `PublicFederationProvider`, CONTRACT.md §12.1,
contract 1.38).
- FederationProviderList
- The result of `ssoProviders` (wire schema `PublicFederationProvidersResponse`,
CONTRACT.md §12.1).
- IdTokenValidator
- ID-token claim validation — CONTRACT.md §12.4, OIDC Core §3.1.3.7.
- IntrospectionResult
- The RFC 7662 introspection result (wire schema `IntrospectionResponse`, CONTRACT.md
§12.1). Only `$active` is guaranteed; the server omits the metadata fields for an
inactive token.
- MemoryOidcStateStore
- In-memory reference implementation of {@see OidcStateStoreInterface} (CONTRACT.md
§12.3 rule 1).
- MtlsEndpointAliases
- RFC 8705 §5 `mtls_endpoint_aliases` — the seven endpoints re-based on the host that
performs the mutual-TLS handshake (wire schema `MtlsEndpointAliases`, contract 1.40;
the seventh, CIBA's `backchannel_authentication_endpoint`, contract 1.58 — CONTRACT.md §21.3.1
as amended by §33).
- OidcClient
- The OIDC / SSO relying-party engine (CONTRACT.md §12) behind {@see
\Axiam\Sdk\AxiamClient}'s nine public `oidc*`/`introspect`/`revoke`/`sso*` methods.
- OidcConfiguration
- The OIDC Discovery 1.0 metadata document served by
`GET /.well-known/openid-configuration` (wire schema `OidcDiscoveryDocument`,
CONTRACT.md §12.1).
- OidcLoginFlow
- Shared "Login with AXIAM" core (CONTRACT.md §12) — the ONE begin/complete +
state-store + error-mapping path BOTH {@see \Axiam\Sdk\Laravel\OidcLoginController}/
{@see \Axiam\Sdk\Laravel\OidcCallbackController} and
{@see \Axiam\Sdk\Symfony\OidcLoginController}/{@see \Axiam\Sdk\Symfony\OidcCallbackController}
call, mirroring the TypeScript reference's `middleware/oidcLoginCore.ts` (the ONE §12
path, exactly as `AccessEnforcer` is the one §11 path shared by both framework
bridges in this SDK).
- OidcLoginOutcome
- What a login/callback handler should do next — one shape per outcome kind. Framework
controllers ({@see \Axiam\Sdk\Laravel\OidcLoginController}/`OidcCallbackController`,
{@see \Axiam\Sdk\Symfony\OidcLoginController}/`OidcCallbackController`) translate this
into their own framework's redirect/JSON response and add nothing of their own, so
Laravel and Symfony cannot drift (mirrors the TypeScript reference's
`OidcLoginOutcome` discriminated union).
- OidcStateEntry
- The tuple an {@see OidcStateStoreInterface} holds for one in-flight login.
- OidcTokenSet
- A token set returned by the OAuth2 token endpoint (wire schema `TokenResponse`),
returned by `oidcExchange`, `oidcRefresh` and `loginClientCredentials` (CONTRACT.md
§12.1).
- Pkce
- PKCE + CSPRNG primitives for the OIDC relying-party flow (CONTRACT.md §12.1
"`oidc_begin` inputs and construction", RFC 7636).
- PushedAuthorizationRequest
- The result of `AxiamClient::oidcPar()` (CONTRACT.md §26.1).
- RequestedPermission
- One `(resource, scopes)` pair a resource server requires (CONTRACT.md §20.1).
- RequestingPartyToken
- The result of the UMA ticket grant (CONTRACT.md §20.1).
- ResourceSet
- A UMA resource set — an AXIAM resource seen through the Protection API
(CONTRACT.md §20.1).
- RptPermission
- One entry of an RPT's `permissions` claim (CONTRACT.md §20.1).
- SsoCompleteResult
- The result of `ssoComplete` (wire schema `SsoLoginSuccessResponse`, CONTRACT.md
§12.1). Carries **no token material** — the session arrives as `Set-Cookie`, so the §4
cookie jar (shared by every `AxiamClient` Guzzle transport) is what actually captures
it (§12.1 note 6).
- SsoStartResult
- The result of `ssoStart` (wire schema `OidcStartResponse`, CONTRACT.md §12.1).
- SystemCibaClock
- The real {@see CibaClock}: `microtime(true)` and `sleep()`.
- UmaChallenge
- A parsed `WWW-Authenticate: UMA` challenge (UMA 2.0 §3.2, CONTRACT.md §20.3).
- VerifiedLogoutToken
- What a verified back-channel logout token names (CONTRACT.md §12.7.3).
Enums
- CibaDeliveryMode
- How a CIBA client receives the outcome, as it registered (CONTRACT.md §33.3 rule 1). There
is no push mode: AXIAM does not offer it.
- CibaSigningAlg
- The algorithms a signed CIBA authentication request may use (CONTRACT.md §33.2) — the
client's registered `backchannel_authentication_request_signing_alg`.