OpenID Connect sign-in decisions: provider config, the authorization URL, state and id-token claim checks, and which account a sign-in belongs to.
Pure. Fetching documents, verifying signatures and writing sessions is wagoe.user.shell.oidc. Failures are values: {:error {:type … :message …}}.
OpenID Connect sign-in decisions: provider config, the authorization URL,
state and id-token claim checks, and which account a sign-in belongs to.
Pure. Fetching documents, verifying signatures and writing sessions is
wagoe.user.shell.oidc. Failures are values: {:error {:type … :message …}}.(authorization-url discovery
provider
{:keys [redirect-uri state nonce code-verifier]})Where to send the browser to start the code flow.
Where to send the browser to start the code flow.
(check-callback pending provider-id params now-epoch)Match the callback's query params against the pending sign-in.
pending is what start stored: {:provider :state :nonce :code-verifier :exp}.
Returns {:ok {:code … :pending …}} or an :oidc/* error.
Match the callback's query params against the pending sign-in.
`pending` is what start stored: {:provider :state :nonce :code-verifier :exp}.
Returns {:ok {:code … :pending …}} or an :oidc/* error.(check-discovery doc issuer)The discovery document, if it is for issuer and names the endpoints the
code flow needs. A document claiming another issuer is refused (OIDC
Discovery §4.3).
The discovery document, if it is for `issuer` and names the endpoints the code flow needs. A document claiming another issuer is refused (OIDC Discovery §4.3).
Tolerance on exp and iat for clocks that disagree with the provider's.
Tolerance on exp and iat for clocks that disagree with the provider's.
(login-buttons providers)The providers to offer on the login page, as [{:id :label}] in name order.
The providers to offer on the login page, as [{:id :label}] in name order.
(normalize-provider id
{:keys [issuer client-id scopes default-role] :as settings})Check one provider's settings and fill in defaults.
Returns {:ok provider} or an error of type :configuration-error.
Check one provider's settings and fill in defaults.
Returns {:ok provider} or an error of type :configuration-error.(normalize-settings {:keys [base-url providers] :as settings})The :oidc block of :wagoe/user, checked.
Returns {:ok {:base-url … :providers {"google" provider}}} or the first :configuration-error.
The `:oidc` block of `:wagoe/user`, checked.
Returns {:ok {:base-url … :providers {"google" provider}}} or the first
:configuration-error.(pkce-challenge verifier)S256 code challenge for verifier (RFC 7636 §4.2).
S256 code challenge for `verifier` (RFC 7636 §4.2).
(resolve-account {:keys [linked-user email-user email-user-linked? claims
provider]})Which account this sign-in is.
In order: the account already linked to (iss, sub); the account with the token's verified email, when the provider allows linking by email and that account has no link at this issuer yet — a second subject for the same email is the address changing hands, and never an administrator; a new account, when it allows creating one. Nothing else — an unverified email never selects or creates an account.
Returns one of {:action :login :user u} {:action :link :user u} {:action :create :user-data {…}} {:error {:type :oidc/no-account …}}
Which account this sign-in is.
In order: the account already linked to (iss, sub); the account with the
token's verified email, when the provider allows linking by email and that
account has no link at this issuer yet — a second subject for the same email
is the address changing hands, and never an administrator; a new account,
when it allows creating one. Nothing else — an unverified email never
selects or creates an account.
Returns one of
{:action :login :user u}
{:action :link :user u}
{:action :create :user-data {…}}
{:error {:type :oidc/no-account …}}(select-jwk jwks {:keys [alg kid]})The key in jwks that the id token's header names.
The header's alg must be asymmetric; a key's own alg, when it states one, must agree. Returns {:ok jwk} or {:error {:type :oidc/unknown-key …}}, the one a caller answers by refetching the key set.
The key in `jwks` that the id token's `header` names.
The header's alg must be asymmetric; a key's own alg, when it states one,
must agree. Returns {:ok jwk} or {:error {:type :oidc/unknown-key …}}, the
one a caller answers by refetching the key set.Asymmetric algorithms an id token may be signed with. No HS* (the client
secret is not a signing key here) and no none.
Asymmetric algorithms an id token may be signed with. No HS* (the client secret is not a signing key here) and no `none`.
(validate-claims claims {:keys [issuer client-id nonce now-epoch skew-seconds]})Check a signature-verified id token's claims (OIDC Core §3.1.3.7).
opts: {:issuer :client-id :nonce :now-epoch :skew-seconds}. Returns {:ok claims} or {:error {:type :oidc/invalid-token :reason …}}.
Check a signature-verified id token's claims (OIDC Core §3.1.3.7).
opts: {:issuer :client-id :nonce :now-epoch :skew-seconds}.
Returns {:ok claims} or {:error {:type :oidc/invalid-token :reason …}}.(verified-email claims provider)The token's email, lower-cased, when the provider says it is verified — or when the provider is configured with :trust-email?, for issuers such as Entra that send no email_verified.
The token's email, lower-cased, when the provider says it is verified — or when the provider is configured with :trust-email?, for issuers such as Entra that send no email_verified.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |