Authorization Server

Authorization Server is an instance which issues access tokens after successfully authenticating a client and resource owner, and authorizing the request (applied in CodeIgniter's Controller (opens in a new tab)).

This instance is also known as HeimdallAuthorizationServer.

bootstrap()

This method is used to set up the HeimdallAuthorizationServer with the current CodeIgniter request & response. We strongly recommended to be call this method right after you get the HeimdallAuthorizationServer instance or before you access other Heimdall's method (eg. validateAuth).

class Authorization extends BaseController implements AuthorizationController
{
 
    private $heimdall;
 
    function __construct()
    {
        // get a new instance of HeimdallAuthorizationServer
        $this->heimdall = OAuthServer::createAuthorizationServer();
 
        // bootrap heimdall with the codeigniter's request & response
        $this->heimdall->bootstrap($this->request, $this->response);
    }
 
    ...
}

validateAuth()

This method is only used for Authorization Code & Implicit grant.

This method is used to verify the authorization request from the client. If success, this method will return a AuthorizationRequest instance that will be used to generate an authorization code in completeAuth method.

function authorize()
{
    try {
        $authRequest = $this->heimdall->validateAuth();
        $authRequest->setUser(new UserEntity());
        ...
    } catch (Exception $exception) {
        $this->heimdall->handleException($exception);
    }
}

completeAuth()

This method is only used for Authorization Code & Implicit grant.

This method is used to generate authorization code based on AuthorizationRequest instance that created in validateAuth method. If success, it will return an authorization code as JSON response to client.

function authorize()
{
    try {
        ...
        $this->heimdall->completeAuth($authRequest);
    } catch (Exception $exception) {
        $this->heimdall->handleException($exception);
    }
}

createToken()

If you apply an Authorization Code or Implicit grant, the client MUST give a valid authorization code in the request body in order to exchange it with access token.

This method is used to generate access token based on the grant type. If success, it will return an access token as JSON response to client.

function token()
{
  try {
    $this->heimdall->createToken();
  } catch (Exception $exception) {
    $this->heimdall->handleException($exception);
  }
}

handleException()

This method is used to handle an Exception thrown by Heimdall. It will automatically generate a JSON output for the client based on the error message from Exception, with the appropriate HTTP status code.

try {
    ...
} catch (Exception $exception) {
    $this->heimdall->handleException($exception);
}