oidc-provider.token — net.carcdr/oidc-provider 0.1.2

Token generation and validation using Nimbus OAuth SDK.

generate-access-token clj

(generate-access-token)

Generates a bearer access token.

Returns: String token value

generate-authorization-code clj

(generate-authorization-code)

Generates a cryptographically random authorization code using the Nimbus SDK AuthorizationCode class, which produces a 256-bit SecureRandom base64url value.

generate-id-token clj

(generate-id-token {:keys [issuer key-set active-signing-key-id
                           id-token-ttl-seconds clock]
                    :as config}
                   user-id
                   client-id
                   claims
                   {:keys [nonce auth-time]})

Generates a signed OIDC ID token.

Args: provider-config: Provider configuration map matching ProviderConfig schema user-id: User identifier (becomes 'sub' claim) client-id: OAuth2 client identifier (becomes 'aud' claim) claims: Additional claims map to include in the token opts: Optional parameters - :nonce - Nonce value for replay protection - :auth-time - Authentication timestamp

Returns: Signed JWT string

generate-refresh-token clj

(generate-refresh-token)

Generates a cryptographically random refresh token using the Nimbus SDK RefreshToken class, which produces a 256-bit SecureRandom base64url value.

generate-rsa-key clj

(generate-rsa-key)

(generate-rsa-key key-size)

Generates an RSA key pair for signing tokens.

Args: key-size: Key size in bits (default 2048)

Returns: RSAKey instance

jwks clj

(jwks {:keys [key-set] :as config})

Returns JWKS (JSON Web Key Set) for token validation.

Args: provider-config: Provider configuration map

Returns: Map with :keys vector containing public key in JWK format

normalize-to-jwk-set clj

(normalize-to-jwk-set key-or-set)

Normalizes a key input to a JWKSet. If the input is already a JWKSet, it passes through unchanged. If it is a single RSAKey, it wraps it in a one-element JWKSet.

ProviderConfig clj

Malli schema for OIDC provider configuration.

validate-id-token clj

(validate-id-token {:keys [issuer key-set] :as config} token expected-client-id)

Validates an ID token signature and claims.

Args: provider-config: Provider configuration map token: ID token string expected-client-id: Expected audience (client-id)

Returns: Validated claims map

Throws: ex-info on validation failure