The JWKS authentication and authorization backend.
The JWKS authentication and authorization backend.
(discover-jwks-url issuer)(discover-jwks-url issuer fetch-json)Fetch the OIDC discovery document and return its jwks_uri.
The two-argument form accepts a fetch function for callers that provide their own HTTP transport or for isolated testing.
Fetch the OIDC discovery document and return its `jwks_uri`. The two-argument form accepts a fetch function for callers that provide their own HTTP transport or for isolated testing.
(jwks-backend {:keys [authfn unauthorized-handler options token-name on-error
bearer-challenge]
:as opts
:or {authfn identity options {} token-name "Bearer"}})Create a JWKS authentication backend.
:options must contain :algs or :alg to declare the expected JWT algorithm. For example, pass :options {:algs #{:rs256}}.
Create a JWKS authentication backend.
:options must contain :algs or :alg to declare the expected JWT algorithm.
For example, pass :options {:algs #{:rs256}}.(oidc-backend {:keys [issuer audience nonce discovery-fn options]
:as opts
:or {options {}}})Create a JWKS backend from an OIDC issuer.
Discovery is performed when no :source or :jwks-url is supplied. The
expected audience is required and is configured with :audience (or
:options {:aud ...}), and an expected nonce with :nonce.
Audience validation stops a token the issuer minted for a different relying
party from authenticating here (OIDC Core 3.1.3.7). Pass the explicit
:audience :any sentinel to opt out of it.
exp is required on every token, so a token without one is rejected instead
of authenticating forever (OIDC Core section 2). Any :options {:required [...]} the caller supplies is kept alongside it.
Create a JWKS backend from an OIDC issuer.
Discovery is performed when no `:source` or `:jwks-url` is supplied. The
expected audience is required and is configured with `:audience` (or
`:options {:aud ...}`), and an expected nonce with `:nonce`.
Audience validation stops a token the issuer minted for a different relying
party from authenticating here (OIDC Core 3.1.3.7). Pass the explicit
`:audience :any` sentinel to opt out of it.
`exp` is required on every token, so a token without one is rejected instead
of authenticating forever (OIDC Core section 2). Any `:options {:required
[...]}` the caller supplies is kept alongside it.cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |