OAuth2OLD\Role\Client\Type\ConfidentialClient

Complexity

Total Complexity

4

Size/Duplication

Total Lines	73
Duplicated Lines	0 %

Test Coverage

Coverage

0%

Importance

Changes

0

4 Methods

Rating	Name	Duplication	Size	Complexity
A	getPassword()	0	3	1
A	setPassword()	0	3	1
A	supportHTTPBasicAuthenticationScheme()	0	2	1
A	hasCredentials()	0	3	1

<?php
/**
 * Created by PhpStorm.
 * User: Alexandre
 * Date: 30/12/2017
 * Time: 18:42
 */

namespace OAuth2OLD\Role\Client\Type;

use OAuth2OLD\Role\Client\RegisteredClient;


/**
 * Class ClientPassword
 * @package OAuth2\roles\clients
 *
 * @see https://tools.ietf.org/html/rfc6749#section-2.1
 *
 * Client Types
 *
 *     Clients capable of maintaining the confidentiality of their
 * credentials (e.g., client implemented on a secure server with
 * restricted access to the client credentials), or capable of secure
 * client authentication using other means.
 *
 *
 * @see https://tools.ietf.org/html/rfc6749#section-2.3
 *
 * Client Authentication
 *
 *     If the client type is confidential, the client and authorization
 * server establish a client authentication method suitable for the
 * security requirements of the authorization server.  The authorization
 * server MAY accept any form of client authentication meeting its
 * security requirements.
 *
 * Confidential clients are typically issued (or establish) a set of
 * client credentials used for authenticating with the authorization
 * server (e.g., password, public/private key pair).
 *
 * The authorization server MAY establish a client authentication method
 * with public clients.  However, the authorization server MUST NOT rely
 * on public client authentication for the purpose of identifying the
 * client.
 *
 * The client MUST NOT use more than one authentication method in each
 * request.
 */
abstract class ConfidentialClient extends RegisteredClient implements ClientTypeInterface
{
    /**
     * @var string
     *
     * @see https://tools.ietf.org/html/rfc6749#section-2.3.1
     *
     * Client Password
     *
     *     Clients in possession of a client password MAY use the HTTP Basic
     * authentication scheme as defined in [RFC2617] to authenticate with
     * the authorization server.  The client identifier is encoded using the
     * "application/x-www-form-urlencoded" encoding algorithm per
     * Appendix B, and the encoded value is used as the username; the client
     * password is encoded using the same algorithm and used as the
     * password.  The authorization server MUST support the HTTP Basic
     * authentication scheme for authenticating clients that were issued a
     * client password.
     *
     * For example (with extra line breaks for display purposes only):
     *
     * Authorization: Basic czZCaGRSa3F0Mzo3RmpmcDBaQnIxS3REUmJuZlZkbUl3
     *
     * Alternatively, the authorization server MAY support including the
     * client credentials in the request-body using the following parameters:
     *
     * client_id
     * REQUIRED.  The client identifier issued to the client during
     * the registration process described by Section 2.2.
     *
     * client_secret
     * REQUIRED.  The client secret.  The client MAY omit the
     * parameter if the client secret is an empty string.
     *
     * Including the client credentials in the request-body using the two
     * parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
     * to directly utilize the HTTP Basic authentication scheme (or other
     * password-based HTTP authentication schemes).  The parameters can only
     * be transmitted in the request-body and MUST NOT be included in the
     * request URI.
     *
     * The authorization server MUST require the use of TLS as described in
     * Section 1.6 when sending requests using password authentication.
     *
     * Since this client authentication method involves a password, the
     * authorization server MUST protect any endpoint utilizing it against
     * brute force attacks.
     */
    protected $password;

    /**
     * @return string
     */
    public function getPassword(): string
    {
        return $this->password;
    }

    /**
     * @param string $password
     */
    public function setPassword(string $password): void
    {
        $this->password = $password;
    }

    public function hasCredentials(): bool
    {
        return true;
    }

    public function supportHTTPBasicAuthenticationScheme() : bool {
        return true;
    }
}