Lemonldap::NG::Portal::Lib::OIDCTokenExchange(3pm)

NAME
Lemonldap::NG::Portal::Lib::OIDCTokenExchange - Base class for building OpenID Connect token exchange systems.

SYNOPSIS
  use Mouse
  extends 'Lemonldap::NG::Portal::Lib::OIDCTokenExchange';

  sub validateAudience {
    my ( $self, $req, $rp, $target, $requestedTokenType ) = @_;
    #
    # verify and update if needed:
    # * $target->{audience}
    # * $target->{rp}
    #
    return 1;
  }

  sub getUid {
    my ( $self, $req, $rp, $subjectToken, $subjectTokenType ) = @_;
    #
    # verify subjectToken
    #
    return 1;
  }

DESCRIPTION
When Lemonldap::NG <https://lemonldap-ng.org> detects a Oauth2 token exchange <https://datatracker.ietf.org/doc/html/rfc8693> request, it searches for a plugin able to respond. If no one returns a valid response, it rejects the requests.

Lemonldap::NG::Portal::Lib::OIDCTokenExchange permits one to build such plugin by just writing two methods. Of course you need then to load the module for example using Enabling custom plugin <https://lemonldap-ng.org/documentation/latest/plugincustom.html#enabling-your-plugin>.

  Methods to write
validateAudience

The goal of validateAudience() is to validate the requested audience.

If a non-null value is returned, then the request is accepted and Lemonldap::NG will build new "access_token", "id_token" and "refresh_token" using the values included into $target hash.

If a null value is returned, Lemonldap::NG will try the next plugin.

Parameters:

•   $req, the Lemonldap::NG::Portal::Main::Request object

•   $rp, the internal LLNG name of the Relying Party which pushed the request

•   $target, a hash value with 2 keys:

    •   audience, the requested audience

    •   rp: if Lemonldap::NG found a known Relying Party which Client-ID matches with requested audience, its name is put here, else this value is undefined.

    This value can be modified inside "validateAudience" and will be used to generate the new "access_token".

•   $requestedTokenType, the type of the requested token. This value is always one of:

    •   access_token

    •   refresh_token

    •   id_token

    •   saml1

    •   saml2

    •   undef

getUid

getUid() is a boolean method to validate the token given in the request.

If a non-null value is returned, then the request is accepted. Else Lemonldap::NG will try the next plugin.

Parameters:

•   $req, the Lemonldap::NG::Portal::Main::Request object

•   $rp, the internal LLNG name of the Relying Party which pushed the request

•   $subjectToken, the token given in the request

•   $subjectTokenType, the type of the given token. This value is always one of:

    •   access_token

    •   refresh_token

    •   id_token

    •   saml1

    •   saml2

    •   undef

AUTHORS

•   LemonLDAP::NG team <http://lemonldap-ng.org/team>

BUG REPORT
Use OW2 system to report bug or ask for features: <https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues>

DOWNLOAD
Lemonldap::NG is available at <https://lemonldap-ng.org/download>

COPYRIGHT AND LICENSE
See COPYING file for details.

This library is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.