In this example, we are going to authenticate ourselves by using two methods at the same time: HTTPBasicAuth and QueryParamAuth. When using QueryParamAuth with an access token, we will first call a publically accessible action to get an access token that the user will pass to all the other actions as the query URL parameter.

We will start by creating a new model from the Customer database table and putting it into the common/models folder. Then, we will create a new user in the User database table using, for example, foo as the username and $2a$12$xzGZB29iqBHva4sEYbJeT.pq9g1/VdjoD0S67ciDB30EWSCE18sW6 as the password (this is equivalent to the hashed bar text).

Create a new controller in api/controllers/CustomersController.php that only extends the behaviors() method to implement HTTPBasicAuth and QueryParamAuth:

<?php
namespace apicontrollers;

use yii
estActiveController;
use yiifiltersauthCompositeAuth;
use yiifiltersauthHttpBasicAuth;
use yiifiltersauthQueryParamAuth;

class CustomersController extends ActiveController
{
  public $modelClass = 'commonmodelsCustomer';

  public function behaviors()
  {
    $behaviors = parent::behaviors();

    $behaviors['authenticator'] = [
      'class' => CompositeAuth::className(),
      'authMethods' => [
        [
          'class' => HttpBasicAuth::className(),
          'auth' => function($username, $password)
          {
            $out = null;
            $user = commonmodelsUser::findByUsername($username);
            if($user!=null)
            {
              if($user->validatePassword($password)) $out = $user;
            }
            return $out;
          }
        ],
        [
           'class' => QueryParamAuth::className(),
        ]
      ]
    ];
      
   return $behaviors;
  }
}

In HTTPBasicAuth, we implement the auth property inside the configuration array by checking $username and then validating the password. If the username and password match each other, it will return the user found or will otherwise be null.

QueryParamAuth, instead, does not need any property other than the class, since we will use access-token as the query parameter name. Nevertheless, to complete this task, we need an action that will return the related user's access token after passing both the username and password.

For this purpose, we will add the actionAccessTokenByUser() method, which looks for the user with the $username and $password parameters passed. If the user already exists, its access_token property will be updated with a random string, so every time we call this action, access_token will change and the previous one will be cancelled:

    public function actionAccessTokenByUser($username, $passwordHash)
    {
        $accessToken = null;
        
        $user = commonmodelsUser::findOne(['username' => $username, 'password_hash' => $passwordHash]);
        if($user!=null)
        {
            $user->access_token = Yii::$app->security->generateRandomString();
            $user->save();
            $accessToken = $user->access_token;
        }        
        return [ 'access-token' => $accessToken ];
    }

Finally, to test HTTPBasicAuth, we need to pass the WWW-Authentication header by calling the http://hostname/yiiadv/api/web/customers/index URL.

If we want to use QueryParamAuth, we need to:

QueryParamAuth calls the findIdentityByAccessToken() function of IdentityInterfaces(the user mode ). So, check that the method is implemented, and if it's not, implement it as follows:

public static function findIdentityByAccessToken($token, $type = null)
    {
    return User::findOne(['access_token' => $token]);
    }

Pay attention, as this way of using access tokens allows the use of the REST API with the same credentials for only one client at a time. This is because any time an access-token-by-user is called, a new access-token will be created. Therefore, it should be created a relation one-to-many between users and access-token in order to provide multiple clients with access using the same username/password credentials.