Skip to main content

Authentication & Certification

Certificate​

Install Certificate on server (in shared/jwt):

Create JWT Secret​

$ vendor/bin/generate-defuse-key
cd shared
mkdir jwt
cd jwt
openssl genrsa -out private.pem -aes256 4096 # use jwt secret
openssl rsa -pubout -in private.pem -out public.pem # use jwt secret

Add Variables in Your CI/CD Platform​

JWT_PASSPHRASE=[YOUR_JWT_PASSPHRASE]
JWT_PUBLIC_KEY=/home/www-data/project-path/shared/jwt/public.pem
JWT_SECRET_KEY=/home/www-data/project-path/shared/jwt/private.pem

JWT Authentication​

# .ddev/config.yaml
JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/dev_private.pem
JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/dev_public.pem
JWT_PASSPHRASE=not-a-secure-passphrase-for-development

Authentication​

This Bundle only supports User's which are OpenDXP DataObjects (so far). The default class name is User (which resolves to \OpenDxp\Model\DataObject\User), and is identified by the field loginIdentifier. The user class needs to implement OpenDxp\Bundle\HeadlessBundle\Model\ApiUserInterface.

You can use the class definition from /config/install/class_User_export.json if you want the default User class.
There is also a default class OpenDxp\Bundle\HeadlessBundle\Model\ApiUser, which can be used as parent class for your user class (e.g. App\Model\MyUser extends OpenDxp\Bundle\HeadlessBundle\Model\ApiUser).

Custom User class​

You can override the class name and the identifier field as follows:

opendxp_headless:
    api_user:
        class_name: MyUser
        identity_field: myIdentifierField

Keep in mind, that if you change this config, you need to adjust your user implementation accordingly, to fulfill ApiUserInterface, e.g.

    public function getLoginIdentifier(): ?string
    {
        return $this->getMyIdentifierField();
    }
    // etc.

Login Identifier / Email Address​

By default, the login identifier is also used as the user's email address. In this case, the following validation configuration should be set in the project:

# config/validator/RequestChangeLoginIdentifierTokenCommand.yaml
OpenDxp\Bundle\HeadlessBundle\Domain\Account\Command\RequestChangeLoginIdentifierTokenCommand:
    properties:
        newLoginIdentifier:
            - Email: ~

If the login identifier does not correspond to the email address (e.g., username), make sure to implement the getEmailAddress() method of ApiUserInterface accordingly to return user's email.