Lemonldap::NG::Portal::Lib::OIDCTokenExchange - Base class for building OpenID Connect token exchange

       •   LemonLDAP::NG team <http://lemonldap-ng.org/team>

       Use        OW2        system       to       report       bug       or       ask       for       features:
       <https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues>

       See COPYING file for details.

       This library is free software; you can redistribute it and/or modify  it  under  the  terms  of  the  GNU
       General  Public  License  as  published  by  the  Free Software Foundation; either version 2, or (at your
       option) any later version.

       This program is distributed in the hope that it will be useful, but WITHOUT ANY  WARRANTY;  without  even
       the  implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
       License for more details.

       You should have received a copy of the GNU General Public License along with this program.  If  not,  see
       <http://www.gnu.org/licenses/>.

perl v5.40.1                                       2025-05-01              Lemonldap::NG:...DCTokenExchange(3pm)

       When Lemonldap::NG <https://lemonldap-ng.org> detects a Oauth2 token exchange
       <https://datatracker.ietf.org/doc/html/rfc8693> request, it searches for a plugin able to respond. If no
       one returns a valid response, it rejects the requests.

       Lemonldap::NG::Portal::Lib::OIDCTokenExchange permits one to build such plugin by just writing two
       methods. Of course you need then to load the module for example using Enabling custom plugin
       <https://lemonldap-ng.org/documentation/latest/plugincustom.html#enabling-your-plugin>.

   MethodstowritevalidateAudience

       The goal of validateAudience() is to validate the requested audience.

       If a non-null value is returned, then the request is accepted and Lemonldap::NG will build new
       "access_token", "id_token" and "refresh_token" using the values included into $target hash.

       If a null value is returned, Lemonldap::NG will try the next plugin.

       Parameters:

       •   $req, the Lemonldap::NG::Portal::Main::Request object

       •   $rp, the internal LLNG name of the Relying Party which pushed the request

       •   $target, a hash value with 2 keys:

           •   audience, the requested audience

           •   rp: if Lemonldap::NG found a known Relying Party which Client-ID matches with requested audience,
               its name is put here, else this value is undefined.

           This  value  can  be  modified  inside  "validateAudience"  and  will  be  used  to  generate the new
           "access_token".

       •   $requestedTokenType, the type of the requested token. This value is always one of:

           •   access_token

           •   refresh_token

           •   id_token

           •   saml1

           •   saml2

           •   undefgetUid

       getUid() is a boolean method to validate the token given in the request.

       If a non-null value is returned, then the request is accepted.  Else  Lemonldap::NG  will  try  the  next
       plugin.

       Parameters:

       •   $req, the Lemonldap::NG::Portal::Main::Request object

       •   $rp, the internal LLNG name of the Relying Party which pushed the request

       •   $subjectToken, the token given in the request

       •   $subjectTokenType, the type of the given token. This value is always one of:

           •   access_token

           •   refresh_token

           •   id_token

           •   saml1

           •   saml2

           •   undef

       Lemonldap::NG is available at <https://lemonldap-ng.org/download>

       Lemonldap::NG::Portal::Lib::OIDCTokenExchange - Base class for building OpenID Connect token exchange
       systems.

         use Mouse
         extends 'Lemonldap::NG::Portal::Lib::OIDCTokenExchange';

         sub validateAudience {
           my ( $self, $req, $rp, $target, $requestedTokenType ) = @_;
           #
           # verify and update if needed:
           # * $target->{audience}
           # * $target->{rp}
           #
           return 1;
         }

         sub getUid {
           my ( $self, $req, $rp, $subjectToken, $subjectTokenType ) = @_;
           #
           # verify subjectToken
           #
           return 1;
         }