vck-openid-ktor/at.asitplus.wallet.lib.ktor.openid/OAuth2KtorClient

OAuth2KtorClient

class OAuth2KtorClient(engine: HttpClientEngine, cookiesStorage: CookiesStorage? = null, httpClientConfig: HttpClientConfig<*>.() -> Unit? = null, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), signDpop: SignJwtFun<JsonWebToken> = SignJwt(EphemeralKeyWithoutCert(), JwsHeaderCertOrJwk()), val oAuth2Client: OAuth2Client, randomSource: RandomSource = RandomSource.Secure, verifyTokenIntrospectionJwt: suspend (JwsCompactTyped<TokenIntrospectionResponse>) -> Boolean = { true }, val loadInstanceAttestation: suspend (OAuth2KtorClient.LoadInstanceAttestationInput) -> KmmResult<JwsCompactTyped<JsonWebToken>>? = null)(source)

Implements the client side of OAuth2

Supported features:

Constructors

OAuth2KtorClient

constructor(engine: HttpClientEngine, cookiesStorage: CookiesStorage? = null, httpClientConfig: HttpClientConfig<*>.() -> Unit? = null, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), signDpop: SignJwtFun<JsonWebToken> = SignJwt(EphemeralKeyWithoutCert(), JwsHeaderCertOrJwk()), oAuth2Client: OAuth2Client, randomSource: RandomSource = RandomSource.Secure, verifyTokenIntrospectionJwt: suspend (JwsCompactTyped<TokenIntrospectionResponse>) -> Boolean = { true }, loadInstanceAttestation: suspend (OAuth2KtorClient.LoadInstanceAttestationInput) -> KmmResult<JwsCompactTyped<JsonWebToken>>? = null)

Types

LoadInstanceAttestationInput

data class LoadInstanceAttestationInput(val authorizationServer: String, val credentialIssuer: String, val preferredClientStatusPeriod: Duration?)

Used in OAuth2KtorClient.loadInstanceAttestation to provide information about the authorization server.

OpenUrlForAuthnRequest

data class OpenUrlForAuthnRequest(val url: String, val state: String)

Open the url in a browser (so the user can authenticate at the AS), and store state to use in next call.

Properties

loadInstanceAttestation

val loadInstanceAttestation: suspend (OAuth2KtorClient.LoadInstanceAttestationInput) -> KmmResult<JwsCompactTyped<JsonWebToken>>?

Return a new Wallet Instance Attestation (WIA) to authenticate the Wallet App to the Authorization Service with OAuth Attestation Based Client Auth. Returned JWT MUST reference keyMaterial in JsonWebToken.confirmationClaim.

oAuth2Client

val oAuth2Client: OAuth2Client

Implements OAuth2 protocol, redirectUrl needs to be registered by the OS for this application, so redirection back from browser works

Functions

applyToken

suspend fun applyToken(tokenResponse: TokenResponseParameters, resourceUrl: String, httpMethod: HttpMethod, dpopNonce: String? = null): HttpRequestBuilder.() -> Unit

Sets the appropriate headers when accessing resourceUrl, by reading data from tokenResponse, i.e. HttpHeaders.Authorization and probably HttpHeaders.DPoP.

callTokenIntrospection

suspend fun callTokenIntrospection(oauthMetadata: OAuth2AuthorizationServerMetadata, request: TokenIntrospectionRequest, token: String, popAudience: String, retryCount: Int = 0, issuerMetadata: IssuerMetadata? = null): TokenIntrospectionResponse

Calls the token introspection endpoint (OAuth2AuthorizationServerMetadata.introspectionEndpoint) to check whether the given token is active, returns TokenInfo on success, otherwise throws InvalidToken.

requestTokenWithAuthCode

suspend fun requestTokenWithAuthCode(oauthMetadata: OAuth2AuthorizationServerMetadata, url: String, authorizationServer: String, state: String, scope: String? = null, authorizationDetails: Set<OpenIdAuthorizationDetails>? = null, issuerMetadata: IssuerMetadata? = null): KmmResult<TokenResponseWithDpopNonce>

Uses the auth code to request an access token.

requestTokenWithPreAuthorizedCode

suspend fun requestTokenWithPreAuthorizedCode(oauthMetadata: OAuth2AuthorizationServerMetadata, authorizationServer: String, preAuthorizedCode: String, transactionCode: String?, scope: String?, authorizationDetails: Set<OpenIdAuthorizationDetails>, issuerMetadata: IssuerMetadata? = null): KmmResult<TokenResponseWithDpopNonce>

Uses a pre-authorized code from the authorization server to request an access token.

requestTokenWithRefreshToken

suspend fun requestTokenWithRefreshToken(oauthMetadata: OAuth2AuthorizationServerMetadata, credentialIssuer: String, refreshToken: String, scope: String?, authorizationDetails: Set<OpenIdAuthorizationDetails>, issuerMetadata: IssuerMetadata? = null): KmmResult<TokenResponseWithDpopNonce>

Uses the refresh token to request a new access token.

requestTokenWithTokenExchange

suspend fun requestTokenWithTokenExchange(oauthMetadata: OAuth2AuthorizationServerMetadata, authorizationServer: String, subjectToken: String, resource: String?, issuerMetadata: IssuerMetadata? = null): KmmResult<TokenResponseWithDpopNonce>

Uses an access token from another client to request a new access token, see RFC8693 OAuth 2.0 Token Exchange.

startAuthorization

suspend fun startAuthorization(oauthMetadata: OAuth2AuthorizationServerMetadata, authorizationServer: String, state: String = uuid4().toString(), issuerState: String? = null, authorizationDetails: Set<OpenIdAuthorizationDetails>? = null, scope: String? = null, issuerMetadata: IssuerMetadata? = null): KmmResult<OAuth2KtorClient.OpenUrlForAuthnRequest>

Builds the authorization request (AuthenticationRequestParameters) to start authentication at the authorization server.