BearerTokenService

class BearerTokenService(val generation: BearerTokenGenerationService, val verification: BearerTokenVerificationService, val dpopSigningAlgValuesSupportedStrings: Set<String>?, val supportsRefreshTokens: Boolean) : TokenService(source)

Constructors

constructor(generation: BearerTokenGenerationService, verification: BearerTokenVerificationService, dpopSigningAlgValuesSupportedStrings: Set<String>?, supportsRefreshTokens: Boolean)

Whether this service can bind a token presented as TokenRequestParameters.subjectToken to the client presenting it, i.e. whether validateAccessToken proves possession of the key that token is bound to.

open suspend fun dpopNonce(): String?

open suspend override fun readUserInfo(authorizationHeader: String, request: RequestInfo?): ValidatedAccessToken

Provides information about the access token from authorizationHeader, if it has been issued by generation.

open suspend fun tokenExchange(request: TokenRequestParameters, expectedResource: String, httpRequest: RequestInfo?, validatedClientKey: JsonWebKey?): KmmResult<TokenResponseParameters>

OAuth 2.0 Token Exchange: Validate the received token from TokenRequestParameters.subjectToken and issue a fresh access token. Callers need to make sure that the client has been authenticated before calling this method.

open suspend fun validateAccessToken(authorizationHeader: String, httpRequest: RequestInfo?, validatedClientKey: JsonWebKey?): KmmResult<ValidatedAccessToken>

Validates the access token from authorizationHeader and returns what it authorizes. Implementations that issued the token themselves also fill ValidatedAccessToken.userInfoExtended, so callers do not need a second lookup with readUserInfo.

open suspend override fun validateTokenForTokenExchange(subjectToken: String, httpRequest: RequestInfo?): KmmResult<ValidatedAccessToken>