Skip to content

Latest commit

 

History

History
189 lines (115 loc) · 5.59 KB

Client.md

File metadata and controls

189 lines (115 loc) · 5.59 KB
Raw

Interface: Client

💗 Help the project

Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by becoming a sponsor.

Recognized Client Metadata that have an effect on the exposed functionality.

See

IANA OAuth Client Registration Metadata registry

Indexable

[metadata: string]: JsonValue | undefined

Properties

client_id

• client_id: string

Client identifier.

[clockSkew]?

• optional [clockSkew]: number

See clockSkew.

[clockTolerance]?

• optional [clockTolerance]: number

See clockTolerance.

[jweDecrypt]?

• optional [jweDecrypt]: JweDecryptFunction

See jweDecrypt.

authorization_signed_response_alg?

• optional authorization_signed_response_alg: JWSAlgorithm

JWS alg algorithm required for signing authorization responses. When not configured the default is to allow only supported algorithms listed in as.authorization_signing_alg_values_supported and fall back to RS256 when the authorization server metadata is not set.

client_secret?

• optional client_secret: string

Client secret.

default_max_age?

• optional default_max_age: number

Default Maximum Authentication Age.

id_token_signed_response_alg?

• optional id_token_signed_response_alg: string

JWS alg algorithm required for signing the ID Token issued to this Client. When not configured the default is to allow only algorithms listed in as.id_token_signing_alg_values_supported and fall back to RS256 when the authorization server metadata is not set.

introspection_signed_response_alg?

• optional introspection_signed_response_alg: string

JWS alg algorithm REQUIRED for signed introspection responses. When not configured the default is to allow only algorithms listed in as.introspection_signing_alg_values_supported and fall back to RS256 when the authorization server metadata is not set.

require_auth_time?

• optional require_auth_time: boolean

Boolean value specifying whether the auth_time Claim in the ID Token is REQUIRED. Default is false.

token_endpoint_auth_method?

• optional token_endpoint_auth_method: ClientAuthenticationMethod

Client authentication method for the client's authenticated requests. Default is client_secret_basic.

use_mtls_endpoint_aliases?

• optional use_mtls_endpoint_aliases: boolean

Indicates the requirement for a client to use mutual TLS endpoint aliases defined by the AS where present. Default is false.

When combined with customFetch (to use a Fetch API implementation that supports client certificates) this can be used to target FAPI 2.0 profiles that utilize Mutual-TLS for either client authentication or sender constraining. FAPI 1.0 Advanced profiles that use PAR and JARM can also be targetted.

Examples

(Node.js) Using nodejs/undici for Mutual-TLS Client Authentication and Certificate-Bound Access Tokens support.

import * as undici from 'undici'
import * as oauth from 'oauth4webapi'

// Prerequisites
let as!: oauth.AuthorizationServer
let client!: oauth.Client & { use_mtls_endpoint_aliases: true }
let params!: URLSearchParams
let key!: string // PEM-encoded key
let cert!: string // PEM-encoded certificate

const agent = new undici.Agent({ connect: { key, cert } })

const response = await oauth.pushedAuthorizationRequest(as, client, params, {
  [oauth.customFetch]: (...args) =>
    undici.fetch(args[0], { ...args[1], dispatcher: agent }),
})

(Deno) Using Deno.createHttpClient API for Mutual-TLS Client Authentication and Certificate-Bound Access Tokens support.

import * as oauth from 'oauth4webapi'

// Prerequisites
let as!: oauth.AuthorizationServer
let client!: oauth.Client & { use_mtls_endpoint_aliases: true }
let params!: URLSearchParams
let key!: string // PEM-encoded key
let cert!: string // PEM-encoded certificate

const agent = Deno.createHttpClient({ key, cert })

const response = await oauth.pushedAuthorizationRequest(as, client, params, {
  [oauth.customFetch]: (...args) => fetch(args[0], { ...args[1], client: agent }),
})

See

RFC 8705 - OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens

userinfo_signed_response_alg?

• optional userinfo_signed_response_alg: string

JWS alg algorithm REQUIRED for signing UserInfo Responses. When not configured the default is to allow only algorithms listed in as.userinfo_signing_alg_values_supported and fall back to RS256 when the authorization server metadata is not set.