OAuth2KtorClient
Parameters
the app's ktor client, i.e. with its engine, cookie storage (advised to be persistent, to keep the session at the authorization server alive after receiving the auth code) and logging. This class sends its requests with a copy that does not follow redirects (see HttpClient.config), setting content type and status handling per request. Plugins must not re-send requests or react to error statuses, e.g. by caching failures: retries after a use_dpop_nonce error re-send the same request, and DPoP proofs and client attestation PoPs are single-use.
implements the OAuth 2.0 protocol, redirectUrl needs to be registered by the OS for this application, so redirection back from browser works
authenticates the client with OAuth 2.0 Attestation-Based Client Authentication, e.g. with a Wallet Instance Attestation (WIA), or null to not use it
the key material the access tokens and refresh tokens get bound to, used for calculating DPoP proofs; by default the key of clientAttestation, as EUDI TS3 requires, so that refresh tokens remain usable after the app restarts, else an ephemeral key
source for random bytes, i.e., nonces for proof-of-possession of key material for sender-constrained tokens
verifies the signature of JWT responses of token introspection (RFC 9701) against the keys of the authorization server; when set, token introspection requests and accepts only JWT responses, when null (the default) plain JSON responses
Deprecated
Pass the app's HttpClient instead of engine, cookiesStorage and httpClientConfig, and the instance attestation loader together with its key material as ClientAttestation; the DPoP key then defaults to the attested key
Parameters
ktor engine to use to make requests to issuing service.
Callers are advised to implement a persistent cookie storage, to keep the session at the issuing service alive after receiving the auth code.
Additional configuration for building the HTTP client, e.g. callers may enable logging.
Used to prove possession of the key material for the instance attestation, see loadInstanceAttestation.
The key material the access tokens and refresh tokens get bound to, used for calculating DPoP proofs.
Implements OAuth2 protocol, redirectUrl needs to be registered by the OS for this application, so redirection back from browser works
Source for random bytes, i.e., nonces for proof-of-possession of key material for sender-constrained tokens.
verifies the signature of JWT responses of token introspection (RFC 9701) against the keys of the authorization server; when set, token introspection requests and accepts only JWT responses, when null (the default) plain JSON responses
Return a new Wallet Instance Attestation (WIA) to authenticate the Wallet App to the Authorization Service with OAuth Attestation Based Client Auth. Returned JWT MUST reference keyMaterial in JsonWebToken.confirmationClaim.