AttestoPhoenix.ClientAuthentication.Policy (AttestoPhoenix v2.7.0)

The per-caller policy for AttestoPhoenix.ClientAuthentication.

See the parent module for the meaning of each field. Expressed as data so a caller passes its policy rather than toggling a behaviour flag inside the core.

Summary

Functions

for_endpoint(config, endpoint)

Build the client-authentication policy for an endpoint.

Types

endpoint()

@type endpoint() ::
  :token
  | :par
  | :introspection
  | :device_authorization
  | :backchannel_authentication
  | :revocation

method()

@type method() ::
  :client_secret_basic
  | :client_secret_post
  | :private_key_jwt
  | :attest_jwt_client_auth
  | :none

t()

@type t() :: %AttestoPhoenix.ClientAuthentication.Policy{
  allow_public: boolean(),
  allowed_methods: [method()],
  assertion_audiences: [String.t()],
  assertion_enforce_fapi_alg_policy: boolean() | nil,
  assertion_max_lifetime: pos_integer(),
  assertion_signing_algs: [String.t()],
  basic_precedence: boolean(),
  honor_configured_methods: boolean()
}

Functions

for_endpoint(config, endpoint)

@spec for_endpoint(AttestoPhoenix.Config.t(), endpoint()) :: t()

Build the client-authentication policy for an endpoint.

This is the authoritative endpoint matrix. The client-authentication methods themselves remain the configured Basic, post-body, and private_key_jwt methods; allow_public controls whether the none method is admitted. Revocation uses the same service with its RFC 7009 Basic/post-only policy and Basic precedence over body credentials.