kernel/private/rest/classes/oauth/utility.php
inherited
Classes
File containing the ezpOuathUtility class
- Copyright
- Copyright (C) 1999-2011 eZ Systems AS. All rights reserved.
- License
- eZ Business Use License Agreement Version 2.0
- Package
- kernel
- Version
- 4.6.0
\ezpOauthUtility
Functionality for working against the draft 10 of the oauth2 spec.
- Parent(s)
- \ezpRestModel
Constants
Methods
doRefreshToken(
string $clientId, string $clientSecret, string $refreshToken
)
:
\ezpRestTokenHandles a refresh_token request.
Returns the new token object as ezpRestToken
| Name | Type | Description |
|---|---|---|
| $clientId | string | Client identifier |
| $clientSecret | string | Client secret key |
| $refreshToken | string | Refresh token |
| Type | Description |
|---|---|
| \ezpRestToken |
| Exception | Description |
|---|---|
| \ezpOauthInvalidRequestException |
doRefreshTokenWithAuthorizationCode(
string $clientId, string $clientSecret, string $authCode, string $redirectUri
)
:
\ezpRestTokenGenerates a new token against an authorization_code Auth code is checked against clientId, clientSecret and redirectUri as registered for client in admin Auth code is for one-use only and will be removed once the access token generated
| Name | Type | Description |
|---|---|---|
| $clientId | string | Client identifier |
| $clientSecret | string | Client secret key |
| $authCode | string | Authorization code provided by the client |
| $redirectUri | string | Redirect URI. Must be the same as registered in admin |
| Type | Description |
|---|---|
| \ezpRestToken |
| Exception | Description |
|---|---|
| \ezpOauthInvalidRequestException | |
| \ezpOauthInvalidTokenException | |
| \ezpOauthExpiredTokenException |
getToken(
$request
)
:
voidRetrieving token as per section 5 of draft-ietf-oauth-v2-10
Token can be present inside the Authorize header, inside a URI query parameter, or in the HTTP body.
According to section 5.1 the header is the preferred way, and the query component and HTTP body are only looked at if no such header can be found.
| Name | Type | Description |
|---|---|---|
| $request |
- TODO
- A configuration mechanism should alternatively let us select which method to use: 1. header, 2. query component, 3. http body, in other words to override the default behaviour according to spec.
getTokenFromAuthorizationHeader(
)
:
stringExtracts the OAuth token from the HTTP header, Authorization.
The token is transmitted via the OAuth Authentication scheme ref. Section 5.1.1.
PHP does not expose the Authorization header unless it uses the 'Basic' or 'Digest' schemes, and it is therefore extracted from the raw Apache headers.
On systems running CGI or Fast-CGI PHP makes this header available via the HTTP_AUTHORIZATION header.
| Type | Description |
|---|---|
| string | The access token string. |
| Exception | Description |
|---|---|
| \ezpOauthInvalidRequestException |
getTokenFromHttpBody(
\ezpRestRequest $request
)
:
stringExtracts OAuth token fro HTTP Post body.
For more information see section 5.1.3 oauth2.0 v10
| Name | Type | Description |
|---|---|---|
| $request | \ezpRestRequest |
| Type | Description |
|---|---|
| string | The access token string |
getTokenFromQueryComponent(
\ezcMvcRequest $request
)
:
stringExtracts OAuth token query component aka GET parameter.
For more information See section 5.1.2 of oauth2.0 v10
| Name | Type | Description |
|---|---|---|
| $request | \ezcMvcRequest |
| Type | Description |
|---|---|
| string | The access token string |
| Exception | Description |
|---|---|
| \ezpOauthInvalidRequestException |