Skip to main content

TrustedIssuer

@webda/oidc

Interface: TrustedIssuer

Defined in: packages/oidc/src/verifier.service.ts:22

An external issuer whose tokens this application accepts

Properties​

algorithms?​

optional algorithms?: string[]

Defined in: packages/oidc/src/verifier.service.ts:44

Allowed algorithms, never "none" nor HS*

Default​

["RS256","ES256"]

audiences?​

optional audiences?: string[]

Defined in: packages/oidc/src/verifier.service.ts:38

Accepted audiences

Default​

[OIDCVerifier.audience]

claims?​

optional claims?: Record<string, string | string[]>

Defined in: packages/oidc/src/verifier.service.ts:50

Claim conditions, all must match: values are globs (* does not cross /)

Example​

{ "sub": "repo:loopingz/*:ref:refs/heads/main" }

groups?​

optional groups?: string[]

Defined in: packages/oidc/src/verifier.service.ts:61

Extra static groups, IAM sees them as app-group:<group>

issuer​

issuer: string

Defined in: packages/oidc/src/verifier.service.ts:26

Exact issuer string compared to iss (no glob)

jwksUri?​

optional jwksUri?: string

Defined in: packages/oidc/src/verifier.service.ts:32

Override discovery

Default​

${issuer}/.well-known/openid-configuration → jwks_uri

maxTokenAge?​

optional maxTokenAge?: number

Defined in: packages/oidc/src/verifier.service.ts:67

Max token lifetime accepted (exp - iat) in seconds

Default​

OIDCVerifier.maxTokenAge

principal?​

optional principal?: string

Defined in: packages/oidc/src/verifier.service.ts:57

How to build the application principal name, template over claims

A leading app: is removed: a Webda issuer sub of app:orders gives the IAM principal app:orders

Default​

"${sub}"