| public verifyAccessToken ( string $tokenParam, string $scope = null ) : OAuth2\Model\IOAuth2AccessToken | ||
| $tokenParam | string | |
| $scope | string | A space-separated string of required scope(s), if you want to check for scope. |
| return | OAuth2\Model\IOAuth2AccessToken | Token |
public function verifyAccessToken($tokenParam, $scope = null)
{
$tokenType = $this->getVariable(self::CONFIG_TOKEN_TYPE);
$realm = $this->getVariable(self::CONFIG_WWW_REALM);
if (!$tokenParam) {
// Access token was not provided
throw new OAuth2AuthenticateException(self::HTTP_BAD_REQUEST, $tokenType, $realm, self::ERROR_INVALID_REQUEST, 'The request is missing a required parameter, includes an unsupported parameter or parameter value, repeats the same parameter, uses more than one method for including an access token, or is otherwise malformed.', $scope);
}
// Get the stored token data (from the implementing subclass)
$token = $this->storage->getAccessToken($tokenParam);
if (!$token) {
throw new OAuth2AuthenticateException(self::HTTP_UNAUTHORIZED, $tokenType, $realm, self::ERROR_INVALID_GRANT, 'The access token provided is invalid.', $scope);
}
// Check token expiration (expires is a mandatory paramter)
if ($token->hasExpired()) {
throw new OAuth2AuthenticateException(self::HTTP_UNAUTHORIZED, $tokenType, $realm, self::ERROR_INVALID_GRANT, 'The access token provided has expired.', $scope);
}
// Check scope, if provided
// If token doesn't have a scope, it's null/empty, or it's insufficient, then throw an error
if ($scope && (!$token->getScope() || !$this->checkScope($scope, $token->getScope()))) {
throw new OAuth2AuthenticateException(self::HTTP_FORBIDDEN, $tokenType, $realm, self::ERROR_INSUFFICIENT_SCOPE, 'The request requires higher privileges than provided by the access token.', $scope);
}
return $token;
} /**
* {@inheritdoc}
*/
public function authenticate(TokenInterface $token)
{
if (!$this->supports($token)) {
return null;
}
try {
$tokenString = $token->getToken();
if ($accessToken = $this->serverService->verifyAccessToken($tokenString)) {
$scope = $accessToken->getScope();
$user = $accessToken->getUser();
$roles = null !== $user ? $user->getRoles() : array();
if (!empty($scope)) {
foreach (explode(' ', $scope) as $role) {
$roles[] = 'ROLE_' . strtoupper($role);
}
}
$token = new OAuthToken($roles);
$token->setAuthenticated(true);
$token->setToken($tokenString);
if (null !== $user) {
$token->setUser($user);
}
return $token;
}
} catch (OAuth2ServerException $e) {
throw new AuthenticationException('OAuth2 authentication failed', null, 0, $e);
}
throw new AuthenticationException('OAuth2 authentication failed');
}
