Creating login for user/Sending Resource owner data

[ogi77gr]

I am new to creating oauth2 server and I would really appreciate some help. I have studied the auth code flow and I understand it. Can you please tell me some things according to the code bellow // Validate the HTTP request and return an AuthorizationRequest object. // The auth request object can be serialized into a user's session $authRequest = $server->validateAuthorizationRequest($request);

// // Once the user has logged in set the user on the AuthorizationRequest $authRequest->setUser(new UserEntity()); //return var_dump($authRequest); // Once the user has approved or denied the client update the status // (true = approved, false = denied) $authRequest->setAuthorizationApproved(true); First of all what kind of code should I use here to send it to the login page. I understand that this implementation takes user login for granted Secondly what is the link to access the Resource owner data after the access token is send by the client. Is there a paradigm that could help my implementation (actually what is the call the client does when it gets the access token)? So a paradigm of redirection to login page and sending data (what is in the scope) will help Maybe the things I ask are trivial, but not for me. Thank you in advance

[Sephster]

Typically the user will click on a link to be taken to the login page. It is the login page's responsibility to redirect the client to the auth server after authorisation has been successful. You might use the header() function to achieve this.

There is no paradigm that I'm aware of for the resource owner data. Typically I see /api or /resource but it is entirely up to you.

I would highly recommend reading through OAuth 2.0 Simplified if you need further assistance. Hope this helps you and thanks for using the library.

[ogi77gr]

Sorry for the question but after a lot of reading I understood that first the authorization server checks if the client is valid and then it redirects to login and then if the login is successful it redirects to scopes and then it produces the authorization code. Then the authorization code is used by the client who asks for an access token etc. Are you suggesting that we first go to the login page of the authorization server and then the login page sends the clients credentials (when the user is logged in) to the authorization server and then redirects again for the scopes? Sorry but for me is not exactly very clear. Thank you in advance.