NAME

       WebAuth::Token::Cred - WebAuth cred tokens

SYNOPSIS

           my $token = WebAuth::Token::Cred->new;
           $token->subject ('user');
           $token->type ('krb5');
           $token->service ('service/foo@EXAMPLE.COM');
           $token->data ($ticket);
           $token->creation (time);
           $token->expiration (time + 3600);
           print $token->encode ($keyring), "\n";

DESCRIPTION

       A WebAuth cred token, which holds a credential for some other service, usually a Kerberos service ticket.
       It is sent back by the WebKDC to a WebAuth Application Server when requested using a proxy token, and the
       WAS also uses it to store the credentials in cookies.

CLASS METHODS

       new ()
           Create a new, empty WebAuth::Token::Cred.  At least some attributes will have to be set using the
           accessor methods described below before the token can be used.

INSTANCE METHODS

       As with WebAuth module functions, failures are signaled by throwing WebAuth::Exception rather than by
       return status.

General Methods

       encode (KEYRING)
           Generate the encoded and encrypted form of this token using the provided KEYRING.  The encryption key
           used will be the one returned by the best_key() method of WebAuth::Keyring on that KEYRING.

Accessor Methods

       subject ([SUBJECT])
           Get or set the subject, which holds the identity of the user for which this token contains
           credentials.

       type ([TYPE])
           Get or set the type of credential stored in this token.  Currently, this is always "krb5" (but still
           must be explicitly set if creating a new token).

       service ([SERVICE])
           Get or set the service for which this token stores a credential.  For tokens of type "krb5", this is
           the fully-qualified principal name of the service ticket stored in this token.

       data ([CREDENTIAL])
           Get or set the credential stored in this token.  This is currently always a Kerberos ticket in the
           form created by the export_cred() method of the WebAuth::Krb5 module.

       creation ([TIMESTAMP])
           Get or set the creation timestamp for this token in seconds since epoch.  If not set, the encoded
           token will have a creation time set to the time of encoding.

       expiration ([TIMESTAMP])
           Get or set the expiration timestamp for this token in seconds since epoch.

AUTHOR

       Russ Allbery <rra@stanford.edu>

SEE ALSO

       WebAuth(3), WebAuth::Keyring(3), WebAuth::Krb5(3), WebAuth::Token(3)

       This module is part of WebAuth.  The current version is available from <http://webauth.stanford.edu/>.