vck-openid-ktor/at.asitplus.wallet.lib.ktor.openid/OAuth2KtorClient

OAuth2KtorClient

Implements the client side of OAuth2 with ktor, by sending the requests of OAuth2ProtocolClient, which implements the protocol.

Supported features:

Constructors

OAuth2KtorClient

constructor(httpClient: HttpClient, oAuth2Client: OAuth2Client, clientAttestation: ClientAttestation? = null, dpopKeyMaterial: KeyMaterial = clientAttestation?.keyMaterial ?: EphemeralKeyWithoutCert(), randomSource: RandomSource = RandomSource.Secure, verifyTokenIntrospectionJwt: VerifyJwsObjectFun? = null)

constructor(engine: HttpClientEngine, cookiesStorage: CookiesStorage? = null, httpClientConfig: HttpClientConfig<*>.() -> Unit? = null, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), dpopKeyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), oAuth2Client: OAuth2Client, randomSource: RandomSource = RandomSource.Secure, verifyTokenIntrospectionJwt: VerifyJwsObjectFun? = null, loadInstanceAttestation: suspend (OAuth2ProtocolClient.LoadInstanceAttestationInput) -> KmmResult<JwsCompactTyped<JsonWebToken>>? = null)

Types

LoadInstanceAttestationInput

typealias ~~LoadInstanceAttestationInput~~ = OAuth2ProtocolClient.LoadInstanceAttestationInput

OpenUrlForAuthnRequest

typealias ~~OpenUrlForAuthnRequest~~ = OAuth2ProtocolClient.OpenUrlForAuthnRequest

Properties

clientAttestation

val clientAttestation: ClientAttestation?

Authenticates the client with OAuth 2.0 Attestation-Based Client Authentication, if not null.

loadInstanceAttestation

val ~~loadInstanceAttestation~~: suspend (OAuth2ProtocolClient.LoadInstanceAttestationInput) -> KmmResult<JwsCompactTyped<JsonWebToken>>?

Returns a new Wallet Instance Attestation (WIA), see ClientAttestation.loadInstanceAttestation.

oAuth2Client

val oAuth2Client: OAuth2Client

Implements OAuth2 protocol, redirectUrl needs to be registered by the OS for this application, so redirection back from browser works

Functions

applyToken

suspend fun applyToken(tokenResponse: TokenResponseParameters, resourceUrl: String, httpMethod: HttpMethod, dpopNonce: String? = null): HttpRequestBuilder.() -> Unit

Sets the appropriate headers when accessing resourceUrl, by reading data from tokenResponse, i.e. HttpHeaders.Authorization and probably DPoP, see OAuth2ProtocolClient.accessTokenHeaders.

callTokenIntrospection

suspend fun callTokenIntrospection(oauthMetadata: OAuth2AuthorizationServerMetadata, request: TokenIntrospectionRequest, popAudience: String, issuerMetadata: IssuerMetadata? = null): TokenIntrospectionResponse

suspend fun ~~callTokenIntrospection~~(oauthMetadata: OAuth2AuthorizationServerMetadata, request: TokenIntrospectionRequest, token: String, popAudience: String, retryCount: Int = 0, issuerMetadata: IssuerMetadata? = null): TokenIntrospectionResponse

Calls the token introspection endpoint (OAuth2AuthorizationServerMetadata.introspectionEndpoint) to check whether the given token is active, returns the response on success, otherwise throws InvalidToken.

requestTokenWithAuthCode

suspend fun requestTokenWithAuthCode(oauthMetadata: OAuth2AuthorizationServerMetadata, url: String, authorizationServer: String, state: String, scope: String? = null, authorizationDetails: Set<OpenIdAuthorizationDetails>? = null, issuerMetadata: IssuerMetadata? = null): KmmResult<TokenResponseWithDpopNonce>

Uses the auth code to request an access token.

requestTokenWithPreAuthorizedCode

suspend fun requestTokenWithPreAuthorizedCode(oauthMetadata: OAuth2AuthorizationServerMetadata, authorizationServer: String, preAuthorizedCode: String, transactionCode: String?, scope: String?, authorizationDetails: Set<OpenIdAuthorizationDetails>, issuerMetadata: IssuerMetadata? = null): KmmResult<TokenResponseWithDpopNonce>

Uses a pre-authorized code from the authorization server to request an access token.

requestTokenWithRefreshToken

suspend fun requestTokenWithRefreshToken(oauthMetadata: OAuth2AuthorizationServerMetadata, credentialIssuer: String, refreshToken: String, scope: String?, authorizationDetails: Set<OpenIdAuthorizationDetails>, issuerMetadata: IssuerMetadata? = null): KmmResult<TokenResponseWithDpopNonce>

Uses the refresh token to request a new access token.

requestTokenWithTokenExchange

suspend fun requestTokenWithTokenExchange(oauthMetadata: OAuth2AuthorizationServerMetadata, authorizationServer: String, subjectToken: String, resource: String?, issuerMetadata: IssuerMetadata? = null): KmmResult<TokenResponseWithDpopNonce>

Uses an access token from another client to request a new access token, see RFC8693 OAuth 2.0 Token Exchange.

startAuthorization

suspend fun startAuthorization(oauthMetadata: OAuth2AuthorizationServerMetadata, authorizationServer: String, state: String = uuid4().toString(), issuerState: String? = null, authorizationDetails: Set<OpenIdAuthorizationDetails>? = null, scope: String? = null, issuerMetadata: IssuerMetadata? = null): KmmResult<OAuth2ProtocolClient.OpenUrlForAuthnRequest>

Builds the authorization request (AuthenticationRequestParameters) to start authentication at the authorization server.