focal (3) WebAuth::Token::Proxy.3pm.gz

NAME

       WebAuth::Token::Proxy - WebAuth proxy tokens

SYNOPSIS

           my $token = WebAuth::Token::Proxy->new;
           $token->subject ('user');
           $token->type ('krb5');
           $token->webkdc_proxy ($raw);
           $token->expiration (time + 3600);
           print $token->encode ($keyring), "\n";

DESCRIPTION

       A WebAuth proxy token, used by a WebAuth Application Server to request other tokens from the WebKDC.
       This is returned by the WebKDC to a WebAuth Application Server if the WAS may need to request various
       tokens (particularly credential tokens).

CLASS METHODS

       new ()
           Create a new, empty WebAuth::Token::Proxy.  At least some attributes will have to be set using the
           accessor methods described below before the token can be used.

INSTANCE METHODS

       As with WebAuth module functions, failures are signaled by throwing WebAuth::Exception rather than by
       return status.

General Methods

       encode (KEYRING)
           Generate the encoded and encrypted form of this token using the provided KEYRING.  The encryption key
           used will be the one returned by the best_key() method of WebAuth::Keyring on that KEYRING.

Accessor Methods

       subject ([SUBJECT])
           Get or set the subject, which holds the authenticated identity of the user whose credentials and id
           tokens can be retrieved using this token.

       authz_subject ([SUBJECT])
           Get or set the authorization subject, which holds the asserted authorization identity of the user
           holding this token.  The authorization identity may not match the authenticated identity.  It
           represents a request to use the authorization identity instead of the authentication subject when
           applying ACLs or determining identity in the application.

       type ([TYPE])
           Get or set the type of proxy token, which specifies the type of webkdc-proxy token is included in it.
           This is currently always "krb5".

       webkdc_proxy ([DATA])
           Get or set the embedded webkdc-proxy token.  This is an opaque blob of data from the perspective of
           the WebAuth Application Server.  It is decrypted and used by the WebKDC to fulfill a token request
           and consists of a webkdc-proxy token without the base64 encoding.

       initial_factors ([FACTORS])
           Get or set a comma-separated list of authentication factors used by the user during initial
           authentication (the single sign-on transaction).  For a list of possible factors and their meaning,
           see the WebAuth protocol specification.

       session_factors ([FACTORS])
           Get or set a comma-separated list of authentication factors used by the user to authenticate this
           session (this particular visit to this WebAuth Application Server).  For a list of possible factors
           and their meaning, see the WebAuth protocol specification.

       loa ([LOA])
           Get or set the level of assurance established for this user authentication.  This is a number whose
           values are site-defined but for which increasing numbers represent increasing assurance for the
           authentication.

       creation ([TIMESTAMP])
           Get or set the creation timestamp for this token in seconds since epoch.  If not set, the encoded
           token will have a creation time set to the time of encoding.

       expiration ([TIMESTAMP])
           Get or set the expiration timestamp for this token in seconds since epoch.

AUTHOR

       Russ Allbery <eagle@eyrie.org>

SEE ALSO

       WebAuth(3), WebAuth::Keyring(3), WebAuth::Token(3)

       This module is part of WebAuth.  The current version is available from <http://webauth.stanford.edu/>.