Skip to main content

TrustedIssuer

@webda/oidc

Interface: TrustedIssuer

Defined in: packages/oidc/src/verifier.service.ts:24

An external issuer whose tokens this application accepts

Properties​

algorithms?​

optional algorithms?: string[]

Defined in: packages/oidc/src/verifier.service.ts:46

Allowed algorithms, never "none" nor HS*

Default​

["RS256","ES256"]

audiences?​

optional audiences?: string[]

Defined in: packages/oidc/src/verifier.service.ts:40

Accepted audiences

Default​

[OIDCVerifier.audience]

claims?​

optional claims?: Record<string, string | string[]>

Defined in: packages/oidc/src/verifier.service.ts:52

Claim conditions, all must match: values are globs (* does not cross /)

Example​

{ "sub": "repo:loopingz/*:ref:refs/heads/main" }

groups?​

optional groups?: string[]

Defined in: packages/oidc/src/verifier.service.ts:63

Extra static groups, IAM sees them as app-group:<group>

issuer​

issuer: string

Defined in: packages/oidc/src/verifier.service.ts:28

Exact issuer string compared to iss (no glob)

jwksUri?​

optional jwksUri?: string

Defined in: packages/oidc/src/verifier.service.ts:34

Override discovery

Default​

${issuer}/.well-known/openid-configuration → jwks_uri

maxTokenAge?​

optional maxTokenAge?: number

Defined in: packages/oidc/src/verifier.service.ts:69

Max token lifetime accepted (exp - iat) in seconds

Default​

OIDCVerifier.maxTokenAge

principal?​

optional principal?: string

Defined in: packages/oidc/src/verifier.service.ts:59

How to build the application principal name, template over claims

A leading app: is removed: a Webda issuer sub of app:orders gives the IAM principal app:orders

Default​

"${sub}"

session?​

optional session?: "application" | "user"

Defined in: packages/oidc/src/verifier.service.ts:79

Session given by a valid token

  • application: a workload token, the caller is the application app:<principal>
  • user: an access token (typ: at+jwt, RFC 9068) of a Webda OAuthServer bound to this application, the caller is its user, restricted to the token scope. The issuer revocations are only seen when the token expires

Default​

"application"