Question on protecting an API using AbstractRestfulController with OAuth2 about api-tools-oauth2 HOT 3 OPEN

hi,
i have the same problem, have you solved it and can give me a hint?

Originally posted by @gnomium at zfcampus/zf-oauth2#130 (comment)

from api-tools-oauth2.

Well, detailing a thorough answer on OAuth2 workflows and architecture would take ages, and here is definitely not the right place.

Briefly, AuthController is not meant to be extended for "business controllers". Its purpose is to handle authentication requests:

• generating / revoking tokens
• handling authorization code...

and upon success, redirect to the requested routes (controller/action).

What you can do indeed, as referred in https://github.com/zfcampus/zf-oauth2#how-to-protect-your-api-using-oauth2, is to inject the server instance (OAuth2\Server) into your controller from its factory and call its methods from your actions ($this->server->verifyResourceRequest...)

Note: forget about this ugly 'onDispatch' call within your controller. Its location should be in a dedicated listener and called from you 'onBootstrap' callback in your module class ;)

Originally posted by @jguittard at zfcampus/zf-oauth2#130 (comment)

from api-tools-oauth2.

@jguittard

Can you please share any code example for injecting the server instance (OAuth2\Server) into controller from its factory and call its methods from actions ?

Originally posted by @fahadonline at zfcampus/zf-oauth2#130 (comment)

from api-tools-oauth2.