AuthPlugin | Registers the authentication foundation: a default PasswordHasherInterface, an empty (no-op) default FirewallMap, and two AuthenticationMiddleware placements (StatelessAuthenticationMiddleware before Quiote\Middleware\SessionMiddleware, so a machine token can flip a request to sessionless before session startup; SessionAuthenticationMiddleware before Quiote\Middleware\SecurityMiddleware, so a successful login is visible to the same request’s authorization decision). |
AuthenticationException | Thrown by an AuthenticatorInterface when a presented credential (password, Basic header, bearer token, …) fails to establish an identity. |
AuthenticationManager | Runs a firewall’s authenticator chain against a request and, on success, populates the request’s SecurityUser/RbacSecurityUser. |
AuthorizationHeader | Parses an Authorization header into its scheme and credential, the way RFC 9110 §11.6.2 actually specifies it rather than the way the wire format usually looks. |
BearerTokenAuthenticator | Validates an Authorization: Bearer token via a TokenValidatorInterface (JWS verify + iss/aud), derives its ClientType via a ClientTypeResolverInterface, and resolves the identity via UserProviderInterface::loadByToken(). |
ClientAddress | The connecting peer’s address, for use as a throttle key. |
ClientCredentialsClient | Outbound M2M: fetches an access token via the Client Credentials grant for the app to present to another service. |
ClientTypeResolver | The default ClientTypeResolverInterface: applies the RFC 9068 rule — service when the token’s sub equals its client_id/azp (the authority mints machine/client-credentials tokens this way), otherwise user. |
Firewall | A named, path-matched set of authenticators plus the entry point that handles a failed authentication attempt for that path — the runtime counterpart of a security.xml <firewall> element. |
FirewallMap | An ordered list of Firewall definitions, matched by request path. |
IntrospectionClient | A ~30-line RFC 7662 (OAuth 2.0 Token Introspection) POST helper — league/oauth2-client has none. |
JwtAuthPlugin | Registers the default ClientTypeResolverInterface (the RFC 9068 rule — see ClientTypeResolver). |
JwtTokenValidator | Verifies a JWS via firebase/php-jwt (JWKS + rotation via CachedKeySet for RS256/ES256, or a single Key for a shared HS256 secret) and enforces iss/aud — the library itself only checks exp/nbf/iat. |
OidcAuthenticator | The callback leg of the OIDC Authorization Code + PKCE flow: verifies state (exact, constant-time comparison), exchanges the code for tokens via OidcClient, validates the ID token (signature/iss/ aud via the injected TokenValidatorInterface, plus our own nonce check — at_hash is intentionally not checked: it is only REQUIRED by OIDC core when an access token is returned from the authorization endpoint (implicit/hybrid flows), and OPTIONAL for a pure Authorization Code exchange at the token endpoint, which is the only flow this class implements), then maps the claims to a UserIdentity via UserProviderInterface::loadByToken() — the same seam packages/auth-jwt’s BearerTokenAuthenticator uses. |
OidcAuthorizationRequest | The result of OidcClient::buildAuthorizationRequest(): the URL to redirect the browser to, plus the state/PKCE-verifier/nonce the caller must persist (e.g. |
OidcAuthorizationState | The per-attempt secrets an OIDC auth-code + PKCE flow must round-trip through the user’s session between the authorization redirect and the callback: the CSRF-style state, the PKCE code_verifier, and the OIDC nonce (replay/injection protection for the ID token). |
OidcClient | Wraps league/oauth2-client’s generic provider (via SpaceDelimitedScopeProvider, which fixes the library’s comma-delimited scope parameter) for the OIDC Authorization Code flow. |
OidcDiscoveryClient | Fetches an OpenID provider’s metadata from {issuer}/.well-known/openid-configuration (OpenID Connect Discovery 1.0 §4) so an app can wire OidcClient, ClientCredentialsClient, IntrospectionClient and auth-jwt’s JWKS key set from one issuer URL instead of five hand-copied endpoint strings that silently rot when the provider moves them. |
OidcDiscoveryDocument | An immutable OpenID Provider metadata document (OpenID Connect Discovery 1.0 §3, a superset of RFC 8414 authorization-server metadata), as fetched by OidcDiscoveryClient. |
OidcStateStorage | Persists a single in-flight OidcAuthorizationState in the session-backed Context storage, keyed by its own state value so a concurrent second login attempt in another tab doesn’t clobber the first. |
Passport | The resolved outcome of a successful AuthenticatorInterface::authenticate() call: the identity plus the credentials/roles to grant, and whether the identity is stateless (re-derived from the credential every request rather than read back from the session). |
SpaceDelimitedScopeProvider | league/oauth2-client’s AbstractProvider::getScopeSeparator() returns a comma and GenericProvider does not override it, so a multi-scope authorization request comes out as scope=openid%2Cprofile%2Cemail. |
TokenClaims | Validated claims from a bearer/JWT/OIDC token, plus the ClientType derived from them by a ClientTypeResolverInterface. |