oidcc_jwt_util (Oidcc v3.9.0)

Copy Markdown View Source

JWT Utilities

Summary

Types

claims()
error()
refresh_jwks_for_unknown_kid_fun()

How to fetch a key set when a token names a kid the current one lacks.

Types

claims()

(since 3.0.0) 
-type claims() :: #{binary() => term()}.

error()

(since 3.0.0) 
-type error() ::
          {unsupported_signing_alg, Alg :: atom()} |
          no_matching_key | invalid_jwt_token |
          {no_matching_key_with_kid, Kid :: binary()} |
          none_alg_used | signature_required |
          {none_alg_used,
           Jwt :: #jose_jwt{fields :: map()},
           Jws ::
               #jose_jws{alg :: undefined | {module(), any()},
                         b64 :: undefined | boolean(),
                         fields :: map()}} |
          not_encrypted.

refresh_jwks_for_unknown_kid_fun()

(since 3.0.0) 
-type refresh_jwks_for_unknown_kid_fun() ::
          fun((Jwks :: jose_jwk:key(), Kid :: binary()) ->
                  {ok, jose_jwk:key()} | {ok, jose_jwk:key(), Info :: term()} | {error, term()}).

How to fetch a key set when a token names a kid the current one lacks.

The three element return reports something back to whoever started the operation, reachable through oidcc_token:retrieve_with_refresh/3. oidcc does not interpret it. Without it, a function that fetched the key set has no way to hand the document or its expiry back to its own caller, because oidcc calls it and consumes the result.