NAME¶
WebAuth::Token::Proxy - WebAuth proxy tokens
SYNOPSIS¶
my $token = WebAuth::Token::Proxy->new;
$token->subject ('user');
$token->type ('krb5');
$token->webkdc_proxy ($raw);
$token->expiration (time + 3600);
print $token->encode ($keyring), "\n";
DESCRIPTION¶
A WebAuth proxy token, used by a WebAuth Application Server to request other
tokens from the WebKDC. This is returned by the WebKDC to a WebAuth
Application Server if the WAS may need to request various tokens (particularly
credential tokens).
CLASS METHODS¶
- new ()
- Create a new, empty WebAuth::Token::Proxy. At least some
attributes will have to be set using the accessor methods described below
before the token can be used.
INSTANCE METHODS¶
As with WebAuth module functions, failures are signaled by throwing
WebAuth::Exception rather than by return status.
General Methods¶
- encode (KEYRING)
- Generate the encoded and encrypted form of this token using
the provided KEYRING. The encryption key used will be the one returned by
the best_key() method of WebAuth::Keyring on that KEYRING.
Accessor Methods¶
- subject ([SUBJECT])
- Get or set the subject, which holds the authenticated
identity of the user whose credentials and id tokens can be retrieved
using this token.
- authz_subject ([SUBJECT])
- Get or set the authorization subject, which holds the
asserted authorization identity of the user holding this token. The
authorization identity may not match the authenticated identity. It
represents a request to use the authorization identity instead of the
authentication subject when applying ACLs or determining identity in the
application.
- type ([TYPE])
- Get or set the type of proxy token, which specifies the
type of webkdc-proxy token is included in it. This is currently always
"krb5".
- webkdc_proxy ([DATA])
- Get or set the embedded webkdc-proxy token. This is an
opaque blob of data from the perspective of the WebAuth Application
Server. It is decrypted and used by the WebKDC to fulfill a token request
and consists of a webkdc-proxy token without the base64 encoding.
- initial_factors ([FACTORS])
- Get or set a comma-separated list of authentication factors
used by the user during initial authentication (the single sign-on
transaction). For a list of possible factors and their meaning, see the
WebAuth protocol specification.
- session_factors ([FACTORS])
- Get or set a comma-separated list of authentication factors
used by the user to authenticate this session (this particular visit to
this WebAuth Application Server). For a list of possible factors and their
meaning, see the WebAuth protocol specification.
- loa ([LOA])
- Get or set the level of assurance established for this user
authentication. This is a number whose values are site-defined but for
which increasing numbers represent increasing assurance for the
authentication.
- creation ([TIMESTAMP])
- Get or set the creation timestamp for this token in seconds
since epoch. If not set, the encoded token will have a creation time set
to the time of encoding.
- expiration ([TIMESTAMP])
- Get or set the expiration timestamp for this token in
seconds since epoch.
AUTHOR¶
Russ Allbery <eagle@eyrie.org>
SEE ALSO¶
WebAuth(3),
WebAuth::Keyring(3),
WebAuth::Token(3)
This module is part of WebAuth. The current version is available from
<
http://webauth.stanford.edu/>.