adk_jwt_policy (erlang_adk v0.7.0)

Explicit incoming JWT authentication policy.

Oidcc performs signature and standard claim validation. This module then independently enforces the configured issuer, audience allow-list, clock, subject and scopes, and returns an issuer-bound opaque principal id.

Summary

Types

error_reason/0

identity/0

policy/0

Functions

authenticate(Policy, Headers)

new(Config)

Types

error_reason/0

-type error_reason() ::
          invalid_policy |
          adk_bearer_auth:error_reason() |
          disallowed_signing_algorithm | provider_unavailable | invalid_token | invalid_issuer |
          invalid_audience | invalid_authorized_party | invalid_token_type | token_expired |
          token_lifetime_exceeded | token_not_yet_valid | missing_subject | insufficient_scope.

identity/0

-type identity() ::
          #{principal := binary(),
            subject := binary(),
            issuer := binary(),
            audiences := [binary(), ...],
            scopes := [binary()],
            claims := map()}.

policy/0

-opaque policy()

Functions

authenticate(Policy, Headers)

-spec authenticate(policy(), map() | [{term(), term()}]) -> {ok, identity()} | {error, error_reason()}.

new(Config)

-spec new(map()) -> {ok, policy()} | {error, invalid_policy}.