Class: Keycardai::OAuth::ClientCredentialsClient

Inherits:
Object
  • Object
show all
Includes:
TokenRequests
Defined in:
lib/keycardai/oauth/client_credentials_client.rb

Overview

OAuth 2.0 client_credentials grant (RFC 6749 §4.4): autonomous workload authentication. The client requests a token for itself, with no user in the loop, and authenticates with a shared secret (HTTP Basic) or a client assertion carried on the request.

The token endpoint is discovered from the issuer on first use and cached. Requests do not retry transparently.

Instance Method Summary collapse

Methods included from TokenRequests

error_for, parse_response

Constructor Details

#initialize(issuer:, credential: nil, client_id: nil, client_secret: nil, http_client: HTTP::NetHTTPClient.new, timeout: nil) ⇒ ClientCredentialsClient

Returns a new instance of ClientCredentialsClient.

Parameters:

  • issuer (String) —

    the zone's issuer URL

  • credential (Object, nil) (defaults to: nil) —

    a Basic-auth credential (ClientSecret); exclusive with client_id/client_secret. Assertion-based credentials supply their assertion through the request fields instead.

  • client_id (String, nil) (defaults to: nil) —

    shared-secret client id (HTTP Basic)

  • client_secret (String, nil) (defaults to: nil) —

    shared-secret client secret; provide both or neither

  • http_client (#get, #post_form) (defaults to: HTTP::NetHTTPClient.new) —

    pluggable transport

  • timeout (Numeric, nil) (defaults to: nil) —

    request timeout in seconds

Raises:

  • (ConfigurationError) —

    when only one of client_id/client_secret is given, or a credential is combined with a raw pair



26
27
28
29
30
 
# File 'lib/keycardai/oauth/client_credentials_client.rb', line 26

def initialize(issuer:, credential: nil, client_id: nil, client_secret: nil,
               http_client: HTTP::NetHTTPClient.new, timeout: nil)
  initialize_token_client(issuer: issuer, credential: credential, client_id: client_id,
                          client_secret: client_secret, http_client: http_client, timeout: timeout)
end

Instance Method Details

#request_token(scope: nil, resource: nil, client_assertion: nil, client_assertion_type: nil, issuer: nil) ⇒ TokenResponse

Request a token for the client itself.

Parameters:

  • scope (String, nil) (defaults to: nil) —

    space-separated scopes for the token

  • resource (String, nil) (defaults to: nil) —

    RFC 8707 resource indicator

  • client_assertion (String, nil) (defaults to: nil) —

    client-authentication assertion, form-encoded in the body

  • client_assertion_type (String, nil) (defaults to: nil)

Returns:

Raises:



43
44
45
46
47
48
49
50
51
52
53
54
55
 
# File 'lib/keycardai/oauth/client_credentials_client.rb', line 43

def request_token(scope: nil, resource: nil, client_assertion: nil, client_assertion_type: nil,
                  issuer: nil)
  post_token_request(
    {
      "grant_type" => GrantType::CLIENT_CREDENTIALS,
      "scope" => scope,
      "resource" => resource,
      "client_assertion" => client_assertion,
      "client_assertion_type" => client_assertion_type
    },
    issuer: issuer || @issuer
  )
end