NAME

       WebAuth::Token::Id - WebAuth id tokens

SYNOPSIS

           my $token = WebAuth::Token::Id->new;
           $token->subject ('user');
           $token->auth ('webkdc');
           $token->creation (time);
           $token->expiration (time + 3600);
           print $token->encode ($keyring), "\n";

DESCRIPTION

       A WebAuth id token, which identifies a user to a WebAuth Authentication Server.  This
       token is sent from the WebKDC to the WAS following a user authentication to communicate
       the authentication information.

CLASS METHODS

       new ()
           Create a new, empty WebAuth::Token::Id.  At least some attributes will have to be set
           using the accessor methods described below before the token can be used.

INSTANCE METHODS

       As with WebAuth module functions, failures are signaled by throwing WebAuth::Exception
       rather than by return status.

General Methods

       encode (KEYRING)
           Generate the encoded and encrypted form of this token using the provided KEYRING.  The
           encryption key used will be the one returned by the best_key() method of
           WebAuth::Keyring on that KEYRING.

Accessor Methods

       subject ([SUBJECT])
           Get or set the subject, which holds the authenticated identity of the user holding
           this token.  This is set for tokens of authenticator type "webkdc", but not for tokens
           of authenticator type "krb5".

       authz_subject ([SUBJECT])
           Get or set the authorization subject, which holds the asserted authorization identity
           of the user holding this token.  The authorization identity may not match the
           authenticated identity.  It represents a request to use the authorization identity
           instead of the authentication subject when applying ACLs or determining identity in
           the application.

       auth ([TYPE])
           Get or set the authentication type, which describes what type of authenticator is
           included in this token.  Currently will be one of the values "webkdc", indicating a
           bearer token, and "krb5", indicating that the token contains a Kerberos authenticator.

       auth_data ([DATA])
           Get or set the authentication data.  If the authenticator type is "krb5", this will
           hold a Kerberos authenticator such as is created by the make_auth() function of the
           WebAuth::Krb5 module.  It is raw binary data.

       initial_factors ([FACTORS])
           Get or set a comma-separated list of authentication factors used by the user during
           initial authentication (the single sign-on transaction).  For a list of possible
           factors and their meaning, see the WebAuth protocol specification.

       session_factors ([FACTORS])
           Get or set a comma-separated list of authentication factors used by the user to
           authenticate this session (this particular visit to this WebAuth Application Server).
           For a list of possible factors and their meaning, see the WebAuth protocol
           specification.

       loa ([LOA])
           Get or set the level of assurance established for this user authentication.  This is a
           number whose values are site-defined but for which increasing numbers represent
           increasing assurance for the authentication.

       creation ([TIMESTAMP])
           Get or set the creation timestamp for this token in seconds since epoch.  If not set,
           the encoded token will have a creation time set to the time of encoding.

       expiration ([TIMESTAMP])
           Get or set the expiration timestamp for this token in seconds since epoch.

AUTHOR

       Russ Allbery <rra@stanford.edu>

SEE ALSO

       WebAuth(3), WebAuth::Keyring(3), WebAuth::Krb5(3), WebAuth::Token(3)

       This module is part of WebAuth.  The current version is available from
       <http://webauth.stanford.edu/>.