NAME

       WebAuth::Token::App - WebAuth app tokens

SYNOPSIS

           my $token = WebAuth::Token::App->new;
           $token->subject ('user');
           $token->expiration (time + 3600);
           print $token->encode ($keyring), "\n";

DESCRIPTION

       A WebAuth application token, used by a WebAuth Application Server to store data, such as the identity of
       an authenticated user or the session key for that identity information.

       There are two basic forms of this token: one that contains only the session_key attribute and one that
       contains the other attributes.  The first form is used to communicate the session key for WebKDC
       communication across a pool of WebAuth Application Servers that the user may visit interchangeably while
       accessing the same URL.  The second form is used to record the authenticated identity of the user for a
       session on a WebAuth Application Server.

CLASS METHODS

       new ()
           Create  a  new,  empty  WebAuth::Token::App.   At least some attributes will have to be set using the
           accessor methods described below before the token can be used.

INSTANCE METHODS

       As with WebAuth module functions, failures are signaled by throwing  WebAuth::Exception  rather  than  by
       return status.

General Methods

       encode (KEYRING)
           Generate the encoded and encrypted form of this token using the provided KEYRING.  The encryption key
           used will be the one returned by the best_key() method of WebAuth::Keyring on that KEYRING.

Accessor Methods

       subject ([SUBJECT])
           Get or set the subject, which holds the authenticated identity of the user holding this token.

       authz_subject ([SUBJECT])
           Get  or  set  the  authorization subject, which holds the asserted authorization identity of the user
           holding this token.  The authorization  identity  may  not  match  the  authenticated  identity.   It
           represents  a  request  to  use the authorization identity instead of the authentication subject when
           applying ACLs or determining identity in the application.

       last_used ([TIMESTAMP])
           Get or set the last-used timestamp in seconds since epoch, which is updated each time  the  token  is
           presented to the WebAuth Application Server.  This is used to implement inactivity timeouts.

       session_key ([DATA])
           Get  or set the session key for communication with the WebKDC.  An app token containing a session key
           is used to allow any system in a pool of WebAuth Application Servers sharing the same private key can
           decrypt this app token and then use the key to decrypt the tokens returned from the WebKDC.  The data
           contained in this attribute is only the raw key material, not a WebAuth::Key object.

           If this attribute is present, none of the other attributes will be present.

       initial_factors ([FACTORS])
           Get or set a comma-separated  list  of  authentication  factors  used  by  the  user  during  initial
           authentication  (the  single sign-on transaction).  For a list of possible factors and their meaning,
           see the WebAuth protocol specification.

       session_factors ([FACTORS])
           Get or set a comma-separated list of authentication factors used by the  user  to  authenticate  this
           session  (this  particular visit to this WebAuth Application Server).  For a list of possible factors
           and their meaning, see the WebAuth protocol specification.

       loa ([LOA])
           Get or set the level of assurance established for this user authentication.  This is a  number  whose
           values  are  site-defined  but  for  which  increasing numbers represent increasing assurance for the
           authentication.

       creation ([TIMESTAMP])
           Get or set the creation timestamp for this token in seconds since epoch.  If  not  set,  the  encoded
           token will have a creation time set to the time of encoding.

       expiration ([TIMESTAMP])
           Get or set the expiration timestamp for this token in seconds since epoch.

AUTHOR

       Russ Allbery <eagle@eyrie.org>

SEE ALSO

       WebAuth(3), WebAuth::Keyring(3), WebAuth::Token(3)

       This module is part of WebAuth.  The current version is available from <http://webauth.stanford.edu/>.

perl v5.22.1                                       2015-12-19                           WebAuth::Token::App(3pm)