Référence de la classe Token

Graphe d'héritage de Token:

Fonctions membres publiques
	__construct (DispatcherInterface $dispatcher, array $config, UserFactoryInterface $userFactory, InputFilter $filter)
	onUserAuthenticate ($credentials, $options, &$response)
Fonctions membres publiques hérités de CMSPlugin
	__construct (&$subject, $config=array())
	loadLanguage ($extension='', $basePath=JPATH_ADMINISTRATOR)
	setApplication (CMSApplicationInterface $application)
Fonctions membres publiques hérités de DispatcherAwareInterface
	setDispatcher (DispatcherInterface $dispatcher)
Fonctions membres publiques hérités de PluginInterface
	registerListeners ()

Fonctions membres privées
	getTokenSeedForUser (int $userId)
	isTokenEnabledForUser (int $userId)
	getAllowedUserGroups ()
	isInAllowedUserGroup ($userId)

Attributs privés
	$profileKeyPrefix = 'joomlatoken'
	$allowedAlgos = ['sha256', 'sha512']
	$userFactory
	$filter

Membres hérités additionnels
Champs de données hérités de CMSPlugin
	$params = null
Fonctions membres protégées hérités de CMSPlugin
	registerLegacyListener (string $methodName)
	registerListener (string $methodName)
	getApplication ()
Attributs protégés hérités de CMSPlugin
	$_name = null
	$_type = null
	$autoloadLanguage = false
	$allowLegacyListeners = true

Description détaillée

Joomla Token Authentication plugin

Depuis

4.0.0

Documentation des constructeurs et destructeur

__construct()

__construct	(	DispatcherInterface	$dispatcher,
		array	$config,
		UserFactoryInterface	$userFactory,
		InputFilter	$filter
	)

Constructor.

Paramètres

DispatcherInterface	$dispatcher	The dispatcher
array	$config	An optional associative array of configuration settings
UserFactoryInterface	$userFactory	The user factory
InputFilter	$filter	The input filter

Depuis

4.2.0

Références $config, Joomla\CMS\Application\$userFactory, et Symfony\Contracts\Service\__construct().

Documentation des fonctions membres

getAllowedUserGroups()

getAllowedUserGroups ( )

private

Get the configured user groups which are allowed to have access to tokens.

Renvoie

int[]

Depuis

4.0.0

getTokenSeedForUser()

getTokenSeedForUser ( int  $userId )

private

Retrieve the token seed string for the given user ID.

Paramètres

int

$userId

The numeric user ID to return the token seed string for.

Renvoie

string|null Null if there is no token configured or the user doesn't exist.

Depuis

4.0.0

Références $db, $query, $userId, Joomla\Database\getDatabase(), ParameterType\INTEGER, null, et ParameterType\STRING.

isInAllowedUserGroup()

isInAllowedUserGroup (   $userId )

private

Is the user with the given ID in the allowed User Groups with access to tokens?

Paramètres

int

$userId

The user ID to check

Renvoie

boolean False when doesn't belong to allowed user groups, user not found, or guest

Depuis

4.0.0

Références $groups, $user, et $userId.

isTokenEnabledForUser()

isTokenEnabledForUser ( int  $userId )

private

Is the token enabled for a given user ID? If the user does not exist or has no token it returns false.

Paramètres

int

$userId

The User ID to check whether the token is enabled on their account.

Renvoie

boolean

Depuis

4.0.0

Références $db, $query, $userId, $value, Joomla\Database\getDatabase(), ParameterType\INTEGER, et ParameterType\STRING.

onUserAuthenticate()

onUserAuthenticate	(		$credentials,
			$options,
		&	$response
	)

This method should handle any authentication and report back to the subject

Paramètres

array	$credentials	Array holding the user credentials
array	$options	Array of extra options
object	$response	Authentication response object

Renvoie

void

Depuis

4.0.0

First look for an HTTP Authorization header with the following format: Authorization: Bearer <token> Do keep in mind that Bearer is case-sensitive. Whitespace between Bearer and the token, as well as any whitespace following the token is discarded.

Deconstruct the decoded token string to its three discrete parts: algorithm, user ID and HMAC of the token string saved in the database.

Verify the HMAC algorithm requested in the token string is allowed

Make sure the user ID is an integer

Calculate the reference token data HMAC

Can we log in?

DO NOT concatenate in a single line. Due to boolean short-circuit evaluation it might make timing attacks possible. Using separate lines of code with the previously calculated boolean value to the right hand side forces PHP to evaluate the conditions in approximately constant time.

DO NOT try to be smart and do an early return when either of the individual conditions are not met. There's a reason we only return after checking all three conditions: it prevents timing attacks.

Références $enabled, $parts, $user, $userId, Authentication\STATUS_DENIED, Authentication\STATUS_FAILURE, Authentication\STATUS_SUCCESS, et Crypt\timingSafeCompare().

Documentation des champs

$allowedAlgos

$allowedAlgos = ['sha256', 'sha512']

private

$filter

$filter

private

$profileKeyPrefix

$profileKeyPrefix = 'joomlatoken'

private

$userFactory

$userFactory

private

---

La documentation de cette classe a été générée à partir du fichier suivant :

• plugins/api-authentication/token/src/Extension/Token.php