vck-openid/at.asitplus.wallet.lib.oauth2/AttestationBasedClientAuthenticationService

AttestationBasedClientAuthenticationService

class AttestationBasedClientAuthenticationService @JvmOverloads constructor(acceptedPopMethods: Set<OpenIdConstants.ClientAttestationPopMethod> = setOf(AttestationPopJwt), clientAttestationValidator: ClientAttestationValidator = ClientAttestationValidator(), verifyJwsSignatureWithCnf: VerifyJwsSignatureWithCnfFun = VerifyJwsSignatureWithCnf(), clock: Clock = Clock.System, timeLeeway: Duration = 5.minutes, maxAgePoP: Duration = 10.minutes, issuerIdentifier: String? = null, supportedSigningAlgorithms: Set<JwsAlgorithm.Signature> = DEFAULT_WALLET_ATTESTATION_ALGORITHMS, nonceService: NonceService = DefaultNonceService()) : ClientAuthenticationService(source)

Client authentication service for an OAuth2.0 AS, based on Attestation-Based Client Authentication, see validate.

Implemented from:

Constructors

@JvmOverloads

constructor(acceptedPopMethods: Set<OpenIdConstants.ClientAttestationPopMethod> = setOf(AttestationPopJwt), clientAttestationValidator: ClientAttestationValidator = ClientAttestationValidator(), verifyJwsSignatureWithCnf: VerifyJwsSignatureWithCnfFun = VerifyJwsSignatureWithCnf(), clock: Clock = Clock.System, timeLeeway: Duration = 5.minutes, maxAgePoP: Duration = 10.minutes, issuerIdentifier: String? = null, supportedSigningAlgorithms: Set<JwsAlgorithm.Signature> = DEFAULT_WALLET_ATTESTATION_ALGORITHMS, nonceService: NonceService = DefaultNonceService())

Properties

supportedAuthMethods

open override val supportedAuthMethods: Set<String>

supportedPopMethods

open override val supportedPopMethods: Set<OpenIdConstants.ClientAttestationPopMethod>

supportedPopSigningAlgs

open override val supportedPopSigningAlgs: Set<String>

supportedSigningAlgs

open override val supportedSigningAlgs: Set<String>

Functions

authenticateClient

open suspend override fun authenticateClient(httpRequest: RequestInfo?, clientId: String?, validatedClientKey: JsonWebKey?): KmmResult<AuthenticatedClient>

Authenticates the client as defined from a client attestation JWT, with validate under the checks it has always been authenticated with, failing with the first rejection.

getAttestationChallenge

open suspend override fun getAttestationChallenge(): String

Provide a fresh challenge for attestation PoPs.

validate

suspend fun validate(httpRequest: RequestInfo?, clientId: String?, validatedClientKey: JsonWebKey?, policy: ValidationPolicy): ClientAttestationValidation

Validates the client attestation and its proof of possession in httpRequest under policy, see ClientAttestationValidator.validate and ClientAttestationChecks: with a client attestation PoP JWT (draft-ietf-oauth-attestation-based-client-auth-10, 5.2), or, if DpopCombined is accepted, with the DPoP proof whose key is validatedClientKey (6). The challenge is consumed only if the client attestation is accepted, so it is not usable again. The clock is read once, all checks use that time.