Ueberauth.Strategy.Authify.JWTValidator (Ueberauth Authify v0.1.0)

Validates OpenID Connect ID tokens issued by Authify.

Verifies the RS256 signature against the signing keys published at the organization's JWKS endpoint (refetching on a kid miss), and the standard ID token claims: iss, sub, aud, exp, iat, auth_time (when max_age applies) and nonce.

Options:

:client_id - the expected aud value
:issuer - the expected iss value
:jwks_uri - the organization's JWKS endpoint URL
:nonce - the per-login nonce bound to the authorization request
:leeway - seconds of slack for time-based claims (defaults to 60)
:max_age - when set, requires a fresh auth_time claim

Summary

Functions

decode(token, opts \\ [])

Decodes an ID token, verifying its signature (refetching the JWKS on a kid miss) but skipping all claim checks.

verify(token, opts \\ [])

Decodes an ID token and verifies its signature and claims.

Functions

decode(token, opts \\ [])

@spec decode(
  binary(),
  keyword()
) :: {:ok, map(), map()} | {:error, binary()}

Decodes an ID token, verifying its signature (refetching the JWKS on a kid miss) but skipping all claim checks.

verify(token, opts \\ [])

@spec verify(
  binary() | nil,
  keyword()
) :: {:ok, map()} | {:error, binary()}

Decodes an ID token and verifies its signature and claims.

Returns {:ok, claims} on success or {:error, message} describing the first failed check.