# CompositeAuth

> CompositeAuth is an action filter that supports multiple authentication methods at the same time.

[API reference](/docs/api/index.md) › [yii](/docs/api/yii/index.md) › [filters](/docs/api/yii/filters/index.md) › [auth](/docs/api/yii/filters/auth/index.md) › CompositeAuth

| class | `yii\filters\auth\CompositeAuth` |
| --- | --- |
| Extends | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) » [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) » [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) » [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| Implements | [`AuthInterface`](/docs/api/yii/filters/auth/authinterface/index.md), [`yii\base\Configurable`](/docs/api/yii/base/configurable/index.md) |
| Since | 2.0 |
| Source | [`framework/filters/auth/CompositeAuth.php`](https://github.com/yiisoft/yii2/blob/22.0/framework/filters/auth/CompositeAuth.php#L46) |

CompositeAuth is an action filter that supports multiple authentication methods at the same time.

The authentication methods contained by CompositeAuth are configured via [`$authMethods`](/docs/api/yii/filters/auth/compositeauth/index.md#property-authMethods),
which is a list of supported authentication class configurations.

The following example shows how to support three authentication methods:

```
public function behaviors()
{
    return [
        'compositeAuth' => [
            'class' => \yii\filters\auth\CompositeAuth::class,
            'authMethods' => [
                \yii\filters\auth\HttpBasicAuth::class,
                \yii\filters\auth\QueryParamAuth::class,
            ],
        ],
    ];
}
```

## Properties

| Property | Type | Description | Defined by |
| --- | --- | --- | --- |
| [`$authMethods`](#property-authMethods) | `list<class-string<`[`AuthInterface`](/docs/api/yii/filters/auth/authinterface/index.md)`>\|array{class: class-string<`[`AuthInterface`](/docs/api/yii/filters/auth/authinterface/index.md)`>}>` | The supported authentication methods. Default: `[]`. | `CompositeAuth` |
| <span id="property-except"></span>[`$except`](/docs/api/yii/base/actionfilter/index.md#property-except) | `array` | List of action IDs that this filter should not apply to. Default: `[]`. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="property-only"></span>[`$only`](/docs/api/yii/base/actionfilter/index.md#property-only) | `array` | List of action IDs that this filter should apply to. Default: `[]`. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="property-optional"></span>[`$optional`](/docs/api/yii/filters/auth/authmethod/index.md#property-optional) | `array` | List of action IDs that this filter will be applied to, but auth failure will not lead to error. Default: `[]`. Available since 2.0.7. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="property-owner"></span>[`$owner`](/docs/api/yii/base/behavior/index.md#property-owner) | `yii\base\T\|null` | The owner of this behavior Default: `null`. | [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) |
| <span id="property-request"></span>[`$request`](/docs/api/yii/filters/auth/authmethod/index.md#property-request) | [`yii\web\Request`](/docs/api/yii/web/request/index.md)`\|null` | The current request. Default: `null`. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="property-response"></span>[`$response`](/docs/api/yii/filters/auth/authmethod/index.md#property-response) | [`yii\web\Response`](/docs/api/yii/web/response/index.md)`\|null` | The response to be sent. Default: `null`. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="property-user"></span>[`$user`](/docs/api/yii/filters/auth/authmethod/index.md#property-user) | [`yii\web\User`](/docs/api/yii/web/user/index.md)`\|null` | The user object representing the user authentication status. Default: `null`. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |

## Methods

| Method | Description | Defined by |
| --- | --- | --- |
| <span id="method-__construct"></span>[`__construct()`](/docs/api/yii/base/baseobject/index.md#method-__construct) | Constructor. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__call"></span>[`__call()`](/docs/api/yii/base/baseobject/index.md#method-__call) | Calls the named method which is not a class method. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__get"></span>[`__get()`](/docs/api/yii/base/baseobject/index.md#method-__get) | Returns the value of an object property. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__isset"></span>[`__isset()`](/docs/api/yii/base/baseobject/index.md#method-__isset) | Checks if a property is set, i.e. defined and not null. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__set"></span>[`__set()`](/docs/api/yii/base/baseobject/index.md#method-__set) | Sets value of an object property. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__unset"></span>[`__unset()`](/docs/api/yii/base/baseobject/index.md#method-__unset) | Sets an object property to null. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-afterAction"></span>[`afterAction()`](/docs/api/yii/base/actionfilter/index.md#method-afterAction) | This method is invoked right after an action is executed. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-afterFilter"></span>[`afterFilter()`](/docs/api/yii/base/actionfilter/index.md#method-afterFilter) |  | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-attach"></span>[`attach()`](/docs/api/yii/base/actionfilter/index.md#method-attach) | Attaches the behavior object to the component. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| [`authenticate()`](#method-authenticate) | Authenticates the current user. | `CompositeAuth` |
| [`beforeAction()`](#method-beforeAction) | This method is invoked right before an action is to be executed (after all possible filters.) You may override this method to do last-minute preparation for the action. | `CompositeAuth` |
| <span id="method-beforeFilter"></span>[`beforeFilter()`](/docs/api/yii/base/actionfilter/index.md#method-beforeFilter) |  | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-canGetProperty"></span>[`canGetProperty()`](/docs/api/yii/base/baseobject/index.md#method-canGetProperty) | Returns a value indicating whether a property can be read. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-canSetProperty"></span>[`canSetProperty()`](/docs/api/yii/base/baseobject/index.md#method-canSetProperty) | Returns a value indicating whether a property can be set. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| [`challenge()`](#method-challenge) | Generates challenges upon authentication failure. | `CompositeAuth` |
| <span id="method-className"></span>[`className()`](/docs/api/yii/base/baseobject/index.md#method-className) static | Returns the fully qualified name of this class. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-detach"></span>[`detach()`](/docs/api/yii/base/actionfilter/index.md#method-detach) | Detaches the behavior object from the component. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-events"></span>[`events()`](/docs/api/yii/base/behavior/index.md#method-events) | Declares event handlers for the [`$owner`](/docs/api/yii/base/behavior/index.md#property-owner)'s events. | [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) |
| <span id="method-handleFailure"></span>[`handleFailure()`](/docs/api/yii/filters/auth/authmethod/index.md#method-handleFailure) | Handles authentication failure. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="method-hasMethod"></span>[`hasMethod()`](/docs/api/yii/base/baseobject/index.md#method-hasMethod) | Returns a value indicating whether a method is defined. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-hasProperty"></span>[`hasProperty()`](/docs/api/yii/base/baseobject/index.md#method-hasProperty) | Returns a value indicating whether a property is defined. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-init"></span>[`init()`](/docs/api/yii/base/baseobject/index.md#method-init) | Initializes the object. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-getActionId"></span>[`getActionId()`](/docs/api/yii/base/actionfilter/index.md#method-getActionId) protected | Returns an action ID by converting [`Action::$uniqueId`](/docs/api/yii/base/action/index.md#property-uniqueId) into an ID relative to the module. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-isActive"></span>[`isActive()`](/docs/api/yii/base/actionfilter/index.md#method-isActive) protected | Returns a value indicating whether the filter is active for the given action. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-isOptional"></span>[`isOptional()`](/docs/api/yii/filters/auth/authmethod/index.md#method-isOptional) protected | Checks, whether authentication is optional for the given action. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |

## Property details

### $authMethods <span id="property-authMethods"></span>

```php
public list<class-string<yii\filters\auth\AuthInterface>|array{class: class-string<yii\filters\auth\AuthInterface>}> $authMethods = []
```

The supported authentication methods.

This property should take a list of supported
authentication methods, each represented by an authentication class or configuration.

If this property is empty, no authentication will be performed.

Note that an auth method class must implement the [`AuthInterface`](/docs/api/yii/filters/auth/authinterface/index.md) interface.

## Method details

### authenticate() <span id="method-authenticate"></span>

```php
public function authenticate(mixed $user, mixed $request, mixed $response): yii\web\IdentityInterface|null
```

Authenticates the current user.

**Parameters**

| Parameter | Type | Description |
| --- | --- | --- |
| `$user` | `mixed` |  |
| `$request` | `mixed` |  |
| `$response` | `mixed` |  |

**Returns**

[`yii\web\IdentityInterface`](/docs/api/yii/web/identityinterface/index.md)`|null`: The authenticated user identity. If authentication information is not provided, null will be returned.

**Throws**

- [`yii\web\UnauthorizedHttpException`](/docs/api/yii/web/unauthorizedhttpexception/index.md): if authentication information is provided but is invalid.

### beforeAction() <span id="method-beforeAction"></span>

```php
public function beforeAction(mixed $action): bool
```

This method is invoked right before an action is to be executed (after all possible filters.)
You may override this method to do last-minute preparation for the action.

**Parameters**

| Parameter | Type | Description |
| --- | --- | --- |
| `$action` | `mixed` | The action to be executed. |

**Returns**

`bool`: Whether the action should continue to be executed.

### challenge() <span id="method-challenge"></span>

```php
public function challenge(mixed $response): mixed
```

Generates challenges upon authentication failure.

For example, some appropriate HTTP headers may be generated.

**Parameters**

| Parameter | Type | Description |
| --- | --- | --- |
| `$response` | `mixed` |  |

**Returns**

`mixed`