OpenID Connect sign-in: authorization code flow with PKCE.
The pending sign-in (state, nonce, code verifier) travels in an encrypted, short-lived cookie rather than server state, so any replica can finish what another started. Discovery documents and key sets are cached per process.
Every step returns {:ok …} or {:error {:type :oidc/… :message …}}; only a bad configuration throws, at boot.
OpenID Connect sign-in: authorization code flow with PKCE.
The pending sign-in (state, nonce, code verifier) travels in an encrypted,
short-lived cookie rather than server state, so any replica can finish what
another started. Discovery documents and key sets are cached per process.
Every step returns {:ok …} or {:error {:type :oidc/… :message …}}; only a
bad configuration throws, at boot.(callback client provider-id params pending-cookie login-context)Finish a sign-in from the provider's redirect.
params are the callback's query params, pending-cookie the value start
set. Returns {:ok {:outcome :signed-in :user … :session … :return-to …}},
{:ok {:outcome :mfa-required :cookie …}}, or an error.
Finish a sign-in from the provider's redirect.
`params` are the callback's query params, `pending-cookie` the value start
set. Returns {:ok {:outcome :signed-in :user … :session … :return-to …}},
{:ok {:outcome :mfa-required :cookie …}}, or an error.(complete-mfa client mfa-cookie code login-context)Finish a sign-in that stopped for the second factor.
Finish a sign-in that stopped for the second factor.
(create-oidc-client {:keys [settings secret auth-service audit-repository
identity-repository]})Build the client. Throws :configuration-error on bad settings or no secret.
secret keys the sealed cookies; the wiring passes JWT_SECRET unless the
settings carry :state-secret.
Build the client. Throws :configuration-error on bad settings or no secret. `secret` keys the sealed cookies; the wiring passes JWT_SECRET unless the settings carry :state-secret.
(discovery client provider)The provider's discovery document, cached for an hour.
The provider's discovery document, cached for an hour.
How long a browser has at the provider, or at the MFA prompt.
How long a browser has at the provider, or at the MFA prompt.
(seal client typ claims ttl)Encrypt claims for a cookie of kind typ that expires in ttl seconds.
Encrypt `claims` for a cookie of kind `typ` that expires in `ttl` seconds.
(start client provider-id return-to)Begin a sign-in. Returns {:ok {:location url :cookie sealed-pending}}.
Begin a sign-in. Returns {:ok {:location url :cookie sealed-pending}}.
(unseal client typ value)The claims of a sealed cookie of kind typ, or nil when it is absent,
forged, expired, or sealed for another step — a pending sign-in is not an
MFA ticket.
The claims of a sealed cookie of kind `typ`, or nil when it is absent, forged, expired, or sealed for another step — a pending sign-in is not an MFA ticket.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |