NewAcccessToken creates a new AccessTokenClaims with passed data and returns a signed token and claims.

NewForwardedOpenIDProvider tries to establish the issuer from the request Host. Deprecated: use [NewProvider] with an issuer function direct.

NewIDToken creates a new IDTokenClaims with passed data and returns a signed token and claims.

NewJWTProfileGrantRequest creates an oauth2 `JSON Web Token (JWT) Profile` Grant `urn:ietf:params:oauth:grant-type:jwt-bearer` sending a self-signed j

NewJWTProfileTokenSourceFromKeyFile returns an implementation of TokenSource It will request a token using the OAuth2 JWT Profile Grant, therefore sen

NewJWTProfileTokenSourceFromKeyFileData returns an implementation of oauth2.TokenSource It will request a token using the OAuth2 JWT Profile Grant, th

NewMockDiscoverStorage creates a new mock instance.

NewMockKey creates a new mock instance.

NewMockKeyProvider creates a new mock instance.

ParseAccessTokenRequest parsed the http request into an oidc.AccessTokenRequest

ParseClientCredentialsRequest parsed the http request into a oidc.ClientCredentialsRequest

ParseRefreshTokenRequest parsed the http request into an oidc.RefreshTokenRequest

ParseTokenExchangeRequest parses the http request into oidc.TokenExchangeRequest

RedirectGlobsClient wraps the client in an op.HasRedirectGlobs only if DevMode is enabled.

RefreshToken returns new Tokens after verifying a Refresh token. It is called by the Token endpoint handler when grant_type has the value refresh_toke

RefreshTokenExchange handles the OAuth 2.0 refresh_token grant, including parsing, validating, authorizing the client and finally exchanging the refre

RefreshTokenRequestFromBusiness will simply wrap the storage RefreshToken to implement the op.RefreshTokenRequest interface

Revocation handles token revocation using an access or refresh token. https://datatracker.ietf.org/doc/html/rfc7009 There are no response requirements

RevokeToken requires a RelyingParty that is also a client.RevokeCaller. The RelyingParty returned by NewRelyingPartyOIDC() meets that criteria, but t

SetUserinfoFromTokenExchangeRequest will be called during id token creation. Claims evaluation can be based on all validated request data available, i

Deprecated: use [SignerFromKeyAndKeyID] instead. The function will be removed in the next major release.

SubjectCheck sets a custom function to check the subject. Defaults to SubjectIsIssuer()

TokenExchange handles the OAuth 2.0 token exchange grant ("urn:ietf:params:oauth:grant-type:token-exchange")

TokenExchange handles the OAuth 2.0 token exchange grant It is called by the Token endpoint handler when grant_type has the value urn:ietf:params:oaut

UnauthorizedHandler returns the handler used for unauthorized errors

UnmarshalJSON overrides the default jose.JSONWebKeySet method to ignore any error which might occur because of unknown key types (kty)

UnmarshalJSON implements the [json.Unmarshaler] interface. It decodes a json array or a space separated string into Locales. Undefined language tags i

UnmarshalText implements the [encoding.TextUnmarshaler] interface. It decodes an unquoted space separated string into Locales. Undefined language tags

UserInfo handles the UserInfo endpoint and returns Claims about the authenticated End-User. https://openid.net/specs/openid-connect-core-1_0.html#User

UserinfoEndpoint returns the userinfo

ValidateAccessTokenRequest validates the token request parameters including authorization check of the client and returns the previous created auth re

ValidateAuthRequest validates the authorize parameters and returns the userID of the id_token_hint if passed. Deprecated: Use [ValidateAuthRequestCli

ValidateClientCredentialsRequest validates the client_credentials request parameters including authorization check of the client and returns a TokenRe

ValidateRefreshTokenRequest validates the refresh_token request parameters including authorization check of the client and returns the data representi

ValidateTokenExchangeRequest validates the token exchange request parameters including authorization check of the client, subject_token and actor_toke

ValidateTokenExchangeRequest will be called to validate parsed (including tokens) Token Exchange Grant request. Important validations can include: -

VerifyAuthRequest verifies the Auth Request and adds the Client to the request. When the `request` field is populated with a "Request Object" JWT, it

VerifyClient is called on most oauth/token handlers to authenticate, using either a secret (POST, Basic) or assertion (JWT). If no secrets are provide

VerifySignature verifies the signature with the given keyset and returns the raw payload

VerifyTokens implement the Token Response Validation as defined in OIDC specification https://openid.net/specs/openid-connect-core-1_0.html#TokenRespo

WithACRVerifier sets the verifier for the acr claim

WithAZPVerifier sets the verifier for the azp claim

WithAccessTokenKeySet allows passing a KeySet with public keys for Access Token verification. The default KeySet uses the [Storage] interface