vck-openid/at.asitplus.wallet.lib.oauth2/JwtTokenService

JwtTokenService

class JwtTokenService(val generation: JwtTokenGenerationService, val verification: JwtTokenVerificationService, val dpopSigningAlgValuesSupportedStrings: Set<String>?, val supportsRefreshTokens: Boolean) : TokenService(source)

Combines sender-constrained JWT tokens from JwtTokenGenerationService and JwtTokenVerificationService.

Constructors

JwtTokenService

constructor(generation: JwtTokenGenerationService, verification: JwtTokenVerificationService, dpopSigningAlgValuesSupportedStrings: Set<String>?, supportsRefreshTokens: Boolean)

Properties

dpopSigningAlgValuesSupportedStrings

open override val dpopSigningAlgValuesSupportedStrings: Set<String>?

generation

open override val generation: JwtTokenGenerationService

supportsRefreshTokens

open override val supportsRefreshTokens: Boolean

verification

open override val verification: JwtTokenVerificationService

Functions

dpopNonce

open suspend fun dpopNonce(): String?

readUserInfo

open suspend override fun readUserInfo(authorizationHeader: String, request: RequestInfo?): ValidatedAccessToken

Provides information about the access token from authorizationHeader, if it has been issued by generation. Access token needs to be validated before (see TokenVerificationService.validateAccessToken)

tokenExchange

open suspend fun tokenExchange(request: TokenRequestParameters, expectedResource: String, httpRequest: RequestInfo?): TokenResponseParameters

OAuth 2.0 Token Exchange: Validate the received token from TokenRequestParameters.subjectToken and issue a fresh access token. Callers need to make sure that the client has been authenticated before calling this method.

validateTokenForTokenExchange

open suspend override fun validateTokenForTokenExchange(subjectToken: String): ValidatedAccessToken

Validates the subject token (that is a token sent by a third party) for token exchange) is one issued from generation, and that the client presented a valid proof-of-possession for the key the token is bound to. Callers need to authenticate the client before calling this method.