-spec client_credentials(ClientContext, Opts) -> {ok, t()} | {error, error()}
                      when
                          ClientContext :: oidcc_client_context:authenticated_t(),
                          Opts :: client_credentials_opts().

Retrieve Client Credential Token

See https://datatracker.ietf.org/doc/html/rfc6749#section-1.3.4

For a high level interface using oidcc_provider_configuration_worker see oidcc:client_credentials_token/4.

Examples

  {ok, ClientContext} =
    oidcc_client_context:from_configuration_worker(provider_name,
                                                   <<"client_id">>,
                                                   <<"client_secret">>),
 
  {ok, #oidcc_token{}} =
    oidcc_token:client_credentials(ClientContext,
                                   #{scope => [<<"scope">>]}).

-spec jwt_profile(Subject, ClientContext, Jwk, Opts) -> {ok, t()} | {error, error()}
               when
                   Subject :: binary(),
                   ClientContext :: oidcc_client_context:t(),
                   Jwk :: jose_jwk:key(),
                   Opts :: jwt_profile_opts().

Retrieve JSON Web Token (JWT) Profile Token

See https://datatracker.ietf.org/doc/html/rfc7523#section-4

For a high level interface using oidcc_provider_configuration_worker see oidcc:jwt_profile_token/6.

Examples

  {ok, ClientContext} =
    oidcc_client_context:from_configuration_worker(provider_name,
                                                   <<"client_id">>,
                                                   <<"client_secret">>),
 
  {ok, KeyJson} = file:read_file("jwt-profile.json"),
  KeyMap = jose:decode(KeyJson),
  Key = jose_jwk:from_pem(maps:get(<<"key">>, KeyMap)),
 
  {ok, #oidcc_token{}} =
    oidcc_token:jwt_profile(<<"subject">>,
                            ClientContext,
                            Key,
                            #{scope => [<<"scope">>],
                              kid => maps:get(<<"keyId">>, KeyMap)}).

-spec refresh(RefreshToken, ClientContext, Opts) -> {ok, t()} | {error, error()}
           when
               RefreshToken :: binary(),
               ClientContext :: oidcc_client_context:t(),
               Opts :: refresh_opts();
       (Token, ClientContext, Opts) -> {ok, t()} | {error, error()}
           when
               Token :: oidcc_token:t(),
               ClientContext :: oidcc_client_context:t(),
               Opts :: refresh_opts_no_sub().

Refresh Token

For a high level interface using oidcc_provider_configuration_worker see oidcc:refresh_token/5.

Examples

  {ok, ClientContext} =
    oidcc_client_context:from_configuration_worker(provider_name,
                                                   <<"client_id">>,
                                                   <<"client_secret">>),
 
  %% Get AuthCode from Redirect
 
  {ok, Token} =
    oidcc_token:retrieve(AuthCode, ClientContext, #{
      redirect_uri => <<"https://example.com/callback">>}).
 
  %% Later
 
  {ok, #oidcc_token{}} =
    oidcc_token:refresh(Token,
                        ClientContext,
                        #{expected_subject => <<"sub_from_initial_id_token>>}).

-spec retrieve(AuthCode, ClientContext, Opts) -> {ok, t()} | {error, error()}
            when
                AuthCode :: binary(),
                ClientContext :: oidcc_client_context:t(),
                Opts :: retrieve_opts().

retrieve the token using the authcode received before and directly validate the result.

the authcode was sent to the local endpoint by the OpenId Connect provider, using redirects

For a high level interface using oidcc_provider_configuration_worker see oidcc:retrieve_token/5.

Examples

  {ok, ClientContext} =
    oidcc_client_context:from_configuration_worker(provider_name,
                                                   <<"client_id">>,
                                                   <<"client_secret">>),
 
  %% Get AuthCode from Redirect
 
  {ok, #oidcc_token{}} =
    oidcc:retrieve(AuthCode, ClientContext, #{
      redirect_uri => <<"https://example.com/callback">>}).

-spec validate_id_token(IdToken, ClientContext, Nonce) -> {ok, Claims} | {error, error()}
                     when
                         IdToken :: binary(),
                         ClientContext :: oidcc_client_context:t(),
                         Nonce :: binary() | any,
                         Claims :: oidcc_jwt_util:claims().

Validate ID Token

Usually the id token is validated using retrieve/3. If you gget the token passed from somewhere else, this function can validate it.

Examples

  {ok, ClientContext} =
    oidcc_client_context:from_configuration_worker(provider_name,
                                                   <<"client_id">>,
                                                   <<"client_secret">>),
 
  %% Get IdToken from somewhere
 
  {ok, Claims} =
    oidcc:validate_id_token(IdToken, ClientContext, ExpectedNonce).