Repository navigation
Troubleshooting
A login crosses the application, the browser and the provider. When something goes wrong, following those boundaries usually makes the cause easier to find.
SessionNotStartedException means the default container could not find $_SESSION. Load Composer's autoloader, start the PHP session, then construct Authenticator. If the application manages session storage itself, pass a compatible GT\Session\SessionContainer.
Check that the return endpoint constructs Authenticator with the actual request path and query string. Then check that the browser sent the same application session cookie and that the server can read the stored SessionData.
A response arriving without stored session data is removed from the URI without creating an authenticated user. A token-only session represents a login in progress, not a completed login.
The client can redirect from its constructor as well as from login() and logout(). Move the shared setup before HTML output, debug output and accidental whitespace. The default redirect handler ends the request, so code after the constructor may not execute on a return request.
Check that the client key belongs to this provider deployment and that the session contains the token from the same login exchange. Starting another exchange can replace that token. A changed key or lost session will prevent the original response from being used correctly.
Cipher failures can originate in the Cipher dependency. The declared ResponseCipherDecryptionException is not currently used to wrap failures in Authenticator; do not rely on catching only that type. Log failures through the application's error handling without logging client secrets or encrypted authentication URLs, and offer a fresh login.
Check the deployment's configured return URI at the provider as well as any setReturnUri() call in the application. The client sends the requested path, but the provider selects the eventual destination. See Provider configuration and return URIs.
Restoring a user from a session does not invoke onAuthenticated. The callback is also marked before execution, so a thrown exception does not cause it to be retried when the same response is processed again. See Responding to a new authentication.
These helpers have current client/provider integration limitations. See Logging out and Provider links before treating the failure as a configuration problem.
For method names, arguments and return types, see the API reference.
Authwave’s PHP client connects your application to an Authwave provider.