# Zf3, apigility and oauth2 together don't works

**URL:** <https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163>\
**Category:** API Tools\
**Created:** [August 24, 2019, 9:35am UTC](https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163 "2019-08-24T09:35:55Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![testuser](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@testuser](https://discourse.laminas.dev/u/testuser)\
**Post date:** [August 24, 2019, 9:35am UTC](https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163/1 "2019-08-24T09:35:55Z")

</div>

Accordingly to this docs [https://apigility.org/documentation/auth/user-differentiation](https://apigility.org/documentation/auth/user-differentiation) we should have this config:

```
return [
    'zf-mvc-auth' => [
        'authentication' => [
            'map' => [
                'DbApi\\V1' => 'oauth2',
                'ZF\\OAuth2' => 'session',
            ],

```

where “session” is session adapter which checks if user is logged in. But xdebug shows that ‘ZF\OAuth2’ controller never calls. What have I done wrong? I have done all accordingly to that documentation but oauth2 with apigility doesnot works. I still getting “403 Forbidden” at my rest api pages. Have somebody the working example of zf3, apigility and oauth2? I want to make all my ajax calls to the apigility. Also, I want to make ajax call to the apaigility from the admin panel, which assumed that user is “admin”.

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [August 30, 2019, 1:06pm UTC](https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163/2 "2019-08-30T13:06:10Z")

</div>

> [@testuser](#):
>
> But xdebug shows that ‘ZF\OAuth2’ controller never calls.

Use Xdebug and check the method `__invoke` of the class `ZF\MvcAuth\Authentication\DefaultAuthenticationListener` instead. That should help you find your problem.

---

<div class="post-metadata">

**Author:** ![testuser](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@testuser](https://discourse.laminas.dev/u/testuser)\
**Post date:** [August 30, 2019, 2:49pm UTC](https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163/3 "2019-08-30T14:49:35Z")

</div>

DefaultAuthenticationListener doesn’t help me much. When I open /api/rest/status in browser xdebug shows me that my ‘oauth2’ adapter is calling and it doesn’t call ‘ZF\OAuth2’ cantroller. It calls bshaffer’s getAccessTokenData() method directrly.

---

<div class="post-metadata">

**Author:** ![testuser](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@testuser](https://discourse.laminas.dev/u/testuser)\
**Post date:** [August 30, 2019, 2:52pm UTC](https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163/4 "2019-08-30T14:52:38Z")

</div>

Maybe, I need call ‘ZF\OAuth2’ controller right after sending data from login form? And only after should I be able to open rest urls like /api/rest/status ?

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [September 6, 2019, 3:11pm UTC](https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163/5 "2019-09-06T15:11:47Z")

</div>

> [@testuser](#):
>
> DefaultAuthenticationListener doesn’t help me much. When I open /api/rest/status in browser xdebug shows me that my ‘oauth2’ adapter is calling and it doesn’t call ‘ZF\OAuth2’ cantroller.

Ignore everything after the listener. It should be helpful if you know and understand which data is used in the listener and what the result is. Use Xdebug to follow the processing.

---

<div class="post-metadata">

**Author:** ![testuser](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@testuser](https://discourse.laminas.dev/u/testuser)\
**Post date:** [September 6, 2019, 6:02pm UTC](https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163/6 "2019-09-06T18:02:47Z")

</div>

Last time I’ve misunderstood how zf-oauth2 works. I thought there is also oauth2 client implementation within zf-oauth2 and was trying to find it with xDebug. I understand now why I am getting “403 Forbidden” but don’t know yet how to fix it. I would like to continue discussion about DefaultAuthenticationListener at the new post.

---

<div class="post-metadata">

**Author:** ![testuser](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@testuser](https://discourse.laminas.dev/u/testuser)\
**Post date:** [September 6, 2019, 6:09pm UTC](https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163/7 "2019-09-06T18:09:18Z")

</div>

> [@froschdesign](#):
>
> Ignore everything after the listener.

What do you mean? How exactly to ignore?

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [September 7, 2019, 5:57am UTC](https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163/8 "2019-09-07T05:57:02Z")

</div>

> [@testuser](#):
>
> What do you mean? How exactly to ignore?

Debugging your application and go step by step through the listener. Watch the values and the results. Understanding the processing within the listener is important. Everything after that is irrelevant for now.

I guess your problem is a misconfiguration or a misunderstanding of the operation. Therefore my recommendation to debug the class `ZF\MvcAuth\Authentication\DefaultAuthenticationListener`.  
Then you should find your problem or a way to a possible solution.

---

<div class="post-metadata">

**Author:** ![testuser](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@testuser](https://discourse.laminas.dev/u/testuser)\
**Post date:** [September 7, 2019, 9:35am UTC](https://discourse.laminas.dev/t/zf3-apigility-and-oauth2-together-dont-works/1163/9 "2019-09-07T09:35:07Z")

</div>

As I said, last time I have some expectation from zf-oauth2 which was related to misunderstanding of it work (since I thought zf-oauth2 also implement client part). zf-oauth2 and apigility works as I expected now. But there is some trouble with DefaultAuthenticationListener as I have mentioned in hijacked topics. The question in this topic is outdated now. Thank you.

> [@froschdesign](#):
>
> Debugging your application and go step by step through the listener.

That is exactly what I am doing.