Poweradmin\Application\Service\Auth

The actor of an API request: the owner of the key (or the Basic auth user) that authenticated it. Built once per request after authentication succeeds.

Authenticates API requests by the X-API-Key header and loads the key's user.

Result of an authenticator run: the decision, the login message on failure, and the application path the caller should redirect to when the request was a login post.

Starts or ends a session with a flash message, then redirects to login; API requests get a 401 JSON instead.

Authenticates API requests with HTTP Basic credentials against the users table.

Generates, stores and validates the per-session CSRF token carried by the _token form field.

Re-checks the account behind a session an identity provider established. SQL and LDAP sessions re-verify the account on every request; OIDC and SAML ones would not.

Session login against an LDAP directory, with lockout tracking, a cached bind result and MFA hand-off.

Decides whether a user-supplied password may be sent to an LDAP simple bind.

Records attempts in login_attempts and enforces the password- and MFA-stage lockouts per user and IP.

What the login form posted: the fields SessionAuthenticator reads before handing the attempt to an authenticator.

Renders the MFA verification email through Twig and sends it with MailService.

Reads the oidc provider settings, discovers endpoints and validates the permission template mapping.

Runs the OIDC login flow: builds the authorization redirect and turns the callback into a session.

Verifies reCAPTCHA v2/v3 responses with Google for the login form.

Reads the user the web server or an authenticating proxy signed in, from the remote_user settings. A server variable is set by the web server itself; a header is believed only from an address in remote_user.trusted_proxies.

Keeps the session in step with the user the web server signed in: starts a session for them, ends one whose web server user changed or went away, and leaves sessions started by any other sign-in method alone.

The actor every service of one request shares. It starts as whatever the bootstrap knows (the session user); an API controller rebinds it to the key owner once authentication succeeds, so services built before and after that point agree on who is acting.

Reads the saml provider and SP settings and builds the OneLogin toolkit settings array.

Runs the SAML login flow: builds the IdP redirect, consumes the assertion and handles single logout.

Per-request login pipeline: CSRF and reCAPTCHA on the form, session expiry, then the SQL or LDAP authenticator.

Session login against the users table with lockout checks, hash upgrades and MFA hand-off.

Hashes and verifies user passwords across bcrypt, argon2 and the legacy md5 formats.

Creates or updates the local user for an LDAP, OIDC or SAML login and maps their groups to a permission template.