OpenID Connect

A standards-driven implementation of the OpenID Connect 1.0 message family. More...

Classes
struct	sourcemeta::core::OIDCAuthenticationRequest
struct	sourcemeta::core::OIDCClaimRequest
struct	sourcemeta::core::OIDCWebFingerRequest
class	sourcemeta::core::OIDCMetadataParseError
class	sourcemeta::core::OIDCRegistrationParseError
struct	sourcemeta::core::OIDCIdentity
struct	sourcemeta::core::OIDCValidationOptions
struct	sourcemeta::core::OIDCIdTokenClaims
struct	sourcemeta::core::OIDCLogoutRequest
class	sourcemeta::core::OIDCProviderMetadata
struct	sourcemeta::core::OIDCProviderMetadataConfig
class	sourcemeta::core::OIDCClientMetadata

Enumerations
enum class	sourcemeta::core::OIDCAuthenticationError : std::uint8_t {   OIDCAuthenticationError::InteractionRequired , OIDCAuthenticationError::LoginRequired , OIDCAuthenticationError::AccountSelectionRequired , OIDCAuthenticationError::ConsentRequired ,   OIDCAuthenticationError::InvalidRequestURI , OIDCAuthenticationError::InvalidRequestObject , OIDCAuthenticationError::RequestNotSupported , OIDCAuthenticationError::RequestURINotSupported ,   OIDCAuthenticationError::RegistrationNotSupported }
enum class	sourcemeta::core::OIDCProfile : std::uint8_t { OIDCProfile::Strict , OIDCProfile::Legacy }
enum class	sourcemeta::core::OIDCSubjectType : std::uint8_t { OIDCSubjectType::Public , OIDCSubjectType::Pairwise }

Functions
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_nonce () -> std::array< char, 43 >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_build_authentication_url (const std::string_view endpoint, const OIDCAuthenticationRequest &request, std::string &sink, const OIDCProfile profile=OIDCProfile::Strict) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_authorization_url (const std::string_view authorization_endpoint, const std::string_view client_id, const std::string_view redirect_uri, const std::string_view state, const std::string_view code_challenge, const std::string_view nonce) -> std::optional< std::string >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_parse_authentication_request (const std::string_view query, std::string &storage, OIDCAuthenticationRequest &result, const OIDCProfile profile=OIDCProfile::Strict) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_is_standard_claim (const std::string_view name) noexcept -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_scope_to_claims (const std::string_view scopes, const std::function< void(std::string_view)> &on_claim) -> void
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_claim_to_scope (const std::string_view claim) noexcept -> std::optional< std::string_view >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_build_claims_parameter (const std::span< const OIDCClaimRequest > userinfo_claims, const std::span< const OIDCClaimRequest > id_token_claims) -> JSON
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_claims_parameter_requests (const JSON &claims, const std::string_view target, const std::string_view claim) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_claims_parameter_is_essential (const JSON &claims, const std::string_view target, const std::string_view claim) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_claims_parameter_value (const JSON &claims, const std::string_view target, const std::string_view claim) -> const JSON *
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_claims_parameter_accepts (const JSON &claims, const std::string_view target, const std::string_view claim, const JSON &value) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_claim_request_accepts (const JSON &request, const JSON &value) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_discovery_url (const std::string_view issuer) -> std::optional< std::string >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_webfinger_request (const std::string_view identifier) -> std::optional< OIDCWebFingerRequest >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_webfinger_issuer (const JSON &descriptor) -> std::optional< std::string_view >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_decrypt_nested_jwt (const std::string_view compact, const JWKPrivate &key) -> std::optional< std::string >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_error_code (const OIDCAuthenticationError error) noexcept -> std::string_view
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::to_oidc_authentication_error (const std::string_view code) noexcept -> std::optional< OIDCAuthenticationError >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_token_hash (const std::string_view token, const JWSAlgorithm algorithm) -> std::optional< std::string >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_verify_token_hash (const std::string_view token, const JWSAlgorithm algorithm, const std::string_view claim) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_parse_id_token (const JSON &token_response) -> std::optional< std::string >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_validate_id_token (const JWT &token, const JWKS &keys, const std::span< const JWSAlgorithm > allowed_algorithms, const std::string_view issuer, const std::string_view client_id, const std::chrono::system_clock::time_point now, const OIDCValidationOptions &options={}, const JWTClockSkew clock_skew={}) -> std::optional< OIDCIdentity >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_validate_id_token (JWKSProvider &provider, const JWT &token, const std::span< const JWSAlgorithm > allowed_algorithms, const std::string_view issuer, const std::string_view client_id, const OIDCValidationOptions &options={}) -> std::optional< OIDCIdentity >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_mint_id_token (const OIDCIdTokenClaims &claims, const JWKPrivate &key, const JWSAlgorithm algorithm) -> std::optional< std::string >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_build_logout_url (const std::string_view end_session_endpoint, const OIDCLogoutRequest &request, std::string &sink) -> void
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_validate_logout_token (const JWT &token, const JWKS &keys, const std::span< const JWSAlgorithm > allowed_algorithms, const std::string_view issuer, const std::string_view client_id, const std::chrono::system_clock::time_point now, const JWTClockSkew clock_skew={}) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_front_channel_pairing_is_valid (const std::string_view issuer, const std::string_view session_id) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_session_state (const std::string_view client_id, const std::string_view origin, const std::string_view provider_browser_state, const std::string_view salt) -> std::string
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_make_provider_metadata (const OIDCProviderMetadataConfig &config) -> std::optional< JSON >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_sector_identifier_contains (const JSON &sector_document, const std::span< const std::string_view > redirect_uris) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_request_object_pairing_is_valid (const std::string_view request, const std::string_view request_uri) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_build_request_object (const JSON &parameters, const JWKPrivate &key, const JWSAlgorithm algorithm) -> std::optional< std::string >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_verify_request_object (const JWT &token, const JWKS &keys, const std::span< const JWSAlgorithm > allowed_algorithms, const std::string_view client_id, const std::string_view provider_issuer) -> std::optional< JSON >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_subject_type_name (const OIDCSubjectType type) noexcept -> std::string_view
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::to_oidc_subject_type (const std::string_view name) noexcept -> std::optional< OIDCSubjectType >
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_pairwise_subject (const std::string_view sector_identifier, const std::string_view local_account_identifier, const std::string_view provider_secret) -> std::string
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_build_userinfo (const std::string_view subject, const JSON &additional_claims) -> JSON
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_userinfo_matches_subject (const JSON &userinfo, const std::string_view expected_subject) -> bool
SOURCEMETA_CORE_OIDC_EXPORT auto	sourcemeta::core::oidc_verify_userinfo (const JWT &token, const JWKS &keys, const std::span< const JWSAlgorithm > allowed_algorithms, const std::string_view expected_subject, const std::string_view expected_issuer, const std::string_view expected_client_id) -> std::optional< JSON >

Detailed Description

A standards-driven implementation of the OpenID Connect 1.0 message family.

This functionality is included as follows:

#include <sourcemeta/core/oidc.h>

---

Class Documentation

sourcemeta::core::OIDCAuthenticationRequest

struct sourcemeta::core::OIDCAuthenticationRequest

An OpenID Connect authentication request, the OAuth authorization request extended with the OpenID Connect parameters (OpenID Connect Core 1.0 Section 3.1.2.1). Each field is a non-owning view.

Public Attributes
std::string_view	client_id
	The client identifier (OpenID Connect Core 1.0 Section 3.1.2.1), REQUIRED.
std::string_view	redirect_uri
	The redirection URI (OpenID Connect Core 1.0 Section 3.1.2.1), REQUIRED.
std::string_view	scope
std::string_view	response_type
std::string_view	state
	The opaque CSRF state value (OpenID Connect Core 1.0 Section 3.1.2.1).
std::string_view	code_challenge
	The PKCE code challenge (RFC 7636 Section 4.3).
std::string_view	code_challenge_method
	The PKCE code challenge method (RFC 7636 Section 4.3).
std::string_view	nonce
std::string_view	display
std::string_view	prompt
std::string_view	max_age
std::string_view	ui_locales
std::string_view	id_token_hint
std::string_view	login_hint
std::string_view	acr_values
std::string_view	claims
std::string_view	request
std::string_view	request_uri
std::string_view	response_mode

Member Data Documentation

acr_values

std::string_view sourcemeta::core::OIDCAuthenticationRequest::acr_values

The space-delimited requested authentication context class references (OpenID Connect Core 1.0 Section 3.1.2.1).

claims

std::string_view sourcemeta::core::OIDCAuthenticationRequest::claims

The serialized claims request parameter (OpenID Connect Core 1.0 Section 5.5).

display

std::string_view sourcemeta::core::OIDCAuthenticationRequest::display

How the provider displays the authentication interface (OpenID Connect Core 1.0 Section 3.1.2.1).

id_token_hint

std::string_view sourcemeta::core::OIDCAuthenticationRequest::id_token_hint

The ID Token previously issued, hinting the session (OpenID Connect Core 1.0 Section 3.1.2.1).

login_hint

std::string_view sourcemeta::core::OIDCAuthenticationRequest::login_hint

A hint about the login identifier (OpenID Connect Core 1.0 Section 3.1.2.1).

max_age

std::string_view sourcemeta::core::OIDCAuthenticationRequest::max_age

The maximum authentication age in seconds (OpenID Connect Core 1.0 Section 3.1.2.1).

nonce

std::string_view sourcemeta::core::OIDCAuthenticationRequest::nonce

The string bound to the session and returned in the ID Token (OpenID Connect Core 1.0 Section 3.1.2.1).

prompt

std::string_view sourcemeta::core::OIDCAuthenticationRequest::prompt

The space-delimited prompt values, where none must appear alone (OpenID Connect Core 1.0 Section 3.1.2.1).

request

std::string_view sourcemeta::core::OIDCAuthenticationRequest::request

The request object carried by value as a signed JWT (OpenID Connect Core 1.0 Section 6.1).

request_uri

std::string_view sourcemeta::core::OIDCAuthenticationRequest::request_uri

The request object carried by reference (OpenID Connect Core 1.0 Section 6.2).

response_mode

std::string_view sourcemeta::core::OIDCAuthenticationRequest::response_mode

The response mode override (OAuth 2.0 Multiple Response Type Encoding Practices).

response_type

std::string_view sourcemeta::core::OIDCAuthenticationRequest::response_type

The response type, defaulting to code (OpenID Connect Core 1.0 Section 3.1.2.1).

scope

std::string_view sourcemeta::core::OIDCAuthenticationRequest::scope

The space-delimited scope, which must contain openid (OpenID Connect Core 1.0 Section 3.1.2.1), REQUIRED.

ui_locales

std::string_view sourcemeta::core::OIDCAuthenticationRequest::ui_locales

The space-delimited preferred UI locales (OpenID Connect Core 1.0 Section 3.1.2.1).

sourcemeta::core::OIDCClaimRequest

struct sourcemeta::core::OIDCClaimRequest

A claim requested through the claims request parameter (OpenID Connect Core 1.0 Section 5.5).

Public Attributes
std::string_view	name
	The requested claim name.
bool	essential {false}
	Whether the claim is essential (OpenID Connect Core 1.0 Section 5.5.1).
const JSON *	value {nullptr}
std::span< const JSON >	values {}

Member Data Documentation

value

const JSON* sourcemeta::core::OIDCClaimRequest::value {nullptr}

A specific value the claim is requested to have, or no value (OpenID Connect Core 1.0 Section 5.5.1).

values

std::span<const JSON> sourcemeta::core::OIDCClaimRequest::values {}

A set of values the claim is requested to have one of, in order of preference (OpenID Connect Core 1.0 Section 5.5.1).

sourcemeta::core::OIDCWebFingerRequest

struct sourcemeta::core::OIDCWebFingerRequest

A WebFinger issuer discovery request (OpenID Connect Discovery 1.0 Section 2), owning the normalized resource and the request URL.

Public Attributes
std::string	resource
std::string	url

Member Data Documentation

resource

std::string sourcemeta::core::OIDCWebFingerRequest::resource

The normalized resource identifier, an acct: URI or an https URL (OpenID Connect Discovery 1.0 Section 2.1).

url

std::string sourcemeta::core::OIDCWebFingerRequest::url

The WebFinger request URL to retrieve (OpenID Connect Discovery 1.0 Section 2).

sourcemeta::core::OIDCMetadataParseError

class sourcemeta::core::OIDCMetadataParseError

An error that occurs when parsing an invalid OpenID Provider metadata document.

Inheritance diagram for sourcemeta::core::OIDCMetadataParseError:

sourcemeta::core::OIDCRegistrationParseError

class sourcemeta::core::OIDCRegistrationParseError

An error that occurs when parsing an invalid OpenID Connect client registration document.

Inheritance diagram for sourcemeta::core::OIDCRegistrationParseError:

sourcemeta::core::OIDCIdentity

struct sourcemeta::core::OIDCIdentity

The identity a validated ID Token asserts, owning its strings so it outlives the token it was extracted from (OpenID Connect Core 1.0 Section 2).

Public Attributes
std::string	subject
std::string	issuer
	The issuer that produced the token (OpenID Connect Core 1.0 Section 2).
std::optional< std::string >	authentication_context_class
std::optional< std::chrono::system_clock::time_point >	authentication_time

Member Data Documentation

authentication_context_class

std::optional<std::string> sourcemeta::core::OIDCIdentity::authentication_context_class

The authentication context class reference, when present (OpenID Connect Core 1.0 Section 2).

authentication_time

std::optional<std::chrono::system_clock::time_point> sourcemeta::core::OIDCIdentity::authentication_time

The time the end user authenticated, when present (OpenID Connect Core 1.0 Section 2).

subject

std::string sourcemeta::core::OIDCIdentity::subject

The subject identifier, locally unique and never reassigned at the issuer (OpenID Connect Core 1.0 Section 2).

sourcemeta::core::OIDCValidationOptions

struct sourcemeta::core::OIDCValidationOptions

The OpenID Connect specific checks a Relying Party layers on top of the base JSON Web Token verification when validating an ID Token (OpenID Connect Core 1.0 Section 3.1.3.7).

Public Attributes
std::optional< std::string_view >	nonce
std::span< const std::string_view >	acceptable_authentication_context_classes
std::span< const std::string_view >	trusted_audiences
std::optional< std::chrono::seconds >	maximum_authentication_age
std::optional< std::chrono::seconds >	maximum_issued_at_age
std::optional< std::string_view >	access_token
std::optional< std::string_view >	code
bool	require_access_token_hash {false}
bool	require_code_hash {false}

Member Data Documentation

acceptable_authentication_context_classes

std::span<const std::string_view> sourcemeta::core::OIDCValidationOptions::acceptable_authentication_context_classes

The acceptable authentication context class references, checked when non-empty (OpenID Connect Core 1.0 Section 3.1.3.7 step 12).

access_token

std::optional<std::string_view> sourcemeta::core::OIDCValidationOptions::access_token

The access token to bind through at_hash, verified against the claim when both are present (OpenID Connect Core 1.0 Section 3.1.3.6).

code

std::optional<std::string_view> sourcemeta::core::OIDCValidationOptions::code

The authorization code to bind through c_hash, verified against the claim when both are present (OpenID Connect Core 1.0 Section 3.3.2.11).

maximum_authentication_age

std::optional<std::chrono::seconds> sourcemeta::core::OIDCValidationOptions::maximum_authentication_age

The maximum authentication age, requiring a fresh auth_time when set (OpenID Connect Core 1.0 Section 3.1.3.7 step 13).

maximum_issued_at_age

std::optional<std::chrono::seconds> sourcemeta::core::OIDCValidationOptions::maximum_issued_at_age

The maximum age of the iat claim, checked when set (OpenID Connect Core 1.0 Section 3.1.3.7 step 10).

nonce

std::optional<std::string_view> sourcemeta::core::OIDCValidationOptions::nonce

The nonce sent in the authentication request, which the token must echo when supplied (OpenID Connect Core 1.0 Section 3.1.3.7 step 11).

require_access_token_hash

bool sourcemeta::core::OIDCValidationOptions::require_access_token_hash {false}

Whether the at_hash claim is required, the case for the implicit and hybrid flows that return an access token from the authorization endpoint. When set, the claim must be present and verified against access_token, which must also be supplied (OpenID Connect Core 1.0 Sections 3.2.2.10 and 3.3.2.11).

require_code_hash

bool sourcemeta::core::OIDCValidationOptions::require_code_hash {false}

Whether the c_hash claim is required, the case for the hybrid code id_token flow. When set, the claim must be present and verified against code, which must also be supplied (OpenID Connect Core 1.0 Section 3.3.2.11).

trusted_audiences

std::span<const std::string_view> sourcemeta::core::OIDCValidationOptions::trusted_audiences

The additional audiences beyond the client that the caller trusts. Every aud value that is not the client must appear in this set, so an empty set rejects any additional audience (OpenID Connect Core 1.0 Section 3.1.3.7 step 3).

sourcemeta::core::OIDCIdTokenClaims

struct sourcemeta::core::OIDCIdTokenClaims

The claims an OpenID Provider mints into an ID Token (OpenID Connect Core 1.0 Section 2). The access token and code, when supplied, are hashed into the at_hash and c_hash claims under the signing algorithm.

Public Attributes
std::string_view	issuer
	The issuer identifier (OpenID Connect Core 1.0 Section 2), REQUIRED.
std::string_view	subject
	The subject identifier (OpenID Connect Core 1.0 Section 2), REQUIRED.
std::string_view	audience
std::chrono::system_clock::time_point	issued_at
std::chrono::system_clock::time_point	expiration
	The time the token expires (OpenID Connect Core 1.0 Section 2), REQUIRED.
std::optional< std::string_view >	nonce
std::optional< std::string_view >	authorized_party
std::optional< std::string_view >	authentication_context_class
std::optional< std::chrono::system_clock::time_point >	authentication_time
	The time the end user authenticated (OpenID Connect Core 1.0 Section 2).
std::optional< std::string_view >	access_token
std::optional< std::string_view >	code

Member Data Documentation

access_token

std::optional<std::string_view> sourcemeta::core::OIDCIdTokenClaims::access_token

The access token to bind through at_hash (OpenID Connect Core 1.0 Section 3.1.3.6).

audience

std::string_view sourcemeta::core::OIDCIdTokenClaims::audience

The audience, the client the token is for (OpenID Connect Core 1.0 Section 2), REQUIRED.

authentication_context_class

std::optional<std::string_view> sourcemeta::core::OIDCIdTokenClaims::authentication_context_class

The authentication context class reference (OpenID Connect Core 1.0 Section 2).

authorized_party

std::optional<std::string_view> sourcemeta::core::OIDCIdTokenClaims::authorized_party

The authorized party, set when the audience carries more than one value (OpenID Connect Core 1.0 Section 2).

code

std::optional<std::string_view> sourcemeta::core::OIDCIdTokenClaims::code

The authorization code to bind through c_hash (OpenID Connect Core 1.0 Section 3.3.2.11).

issued_at

std::chrono::system_clock::time_point sourcemeta::core::OIDCIdTokenClaims::issued_at

The time the token was issued (OpenID Connect Core 1.0 Section 2), REQUIRED.

nonce

std::optional<std::string_view> sourcemeta::core::OIDCIdTokenClaims::nonce

The nonce echoed from the authentication request (OpenID Connect Core 1.0 Section 2).

sourcemeta::core::OIDCLogoutRequest

struct sourcemeta::core::OIDCLogoutRequest

An RP-Initiated Logout request (OpenID Connect RP-Initiated Logout 1.0 Section 2). Each field is a non-owning view.

Public Attributes
std::string_view	id_token_hint
std::string_view	logout_hint
std::string_view	client_id
	The client identifier (OpenID Connect RP-Initiated Logout 1.0 Section 2).
std::string_view	post_logout_redirect_uri
std::string_view	state
std::string_view	ui_locales

Member Data Documentation

id_token_hint

std::string_view sourcemeta::core::OIDCLogoutRequest::id_token_hint

The ID Token previously issued, hinting which session to end (OpenID Connect RP-Initiated Logout 1.0 Section 2).

logout_hint

std::string_view sourcemeta::core::OIDCLogoutRequest::logout_hint

A hint about the end user, when no ID Token hint is available (OpenID Connect RP-Initiated Logout 1.0 Section 2).

post_logout_redirect_uri

std::string_view sourcemeta::core::OIDCLogoutRequest::post_logout_redirect_uri

Where to redirect after logout, matched against the registered set (OpenID Connect RP-Initiated Logout 1.0 Section 2).

state

std::string_view sourcemeta::core::OIDCLogoutRequest::state

The opaque state echoed back to the client (OpenID Connect RP-Initiated Logout 1.0 Section 2).

ui_locales

std::string_view sourcemeta::core::OIDCLogoutRequest::ui_locales

The space-delimited preferred UI locales (OpenID Connect RP-Initiated Logout 1.0 Section 2).

sourcemeta::core::OIDCProviderMetadata

class sourcemeta::core::OIDCProviderMetadata

An OpenID Provider metadata document (OpenID Connect Discovery 1.0), owning its JSON. It is a superset of an OAuth authorization server metadata document, validated on construction against the issuer it was retrieved for: the OAuth checks apply, and in addition jwks_uri, subject_types_supported, and id_token_signing_alg_values_supported are REQUIRED and non-empty, and the signing algorithm list must include RS256. A string accessor returns a view into the owned document, valid for the lifetime of this object. For example:

#include <sourcemeta/core/oidc.h>
#include <sourcemeta/core/json.h>
#include <cassert>
 
auto document{sourcemeta::core::parse_json(
    R"JSON({"issuer":"https://example.com",
           "authorization_endpoint":"https://example.com/authorize",
           "token_endpoint":"https://example.com/token",
           "jwks_uri":"https://example.com/jwks",
           "response_types_supported":["code"],
           "subject_types_supported":["public"],
           "id_token_signing_alg_values_supported":["RS256"]})JSON")};
const auto metadata{sourcemeta::core::OIDCProviderMetadata::from(
    std::move(document), "https://example.com")};
assert(metadata.has_value());
assert(metadata.value().jwks_uri() == "https://example.com/jwks");

Public Member Functions
	OIDCProviderMetadata (JSON &&data, const std::string_view issuer)
	OIDCProviderMetadata (OAuthServerMetadata &&oauth)
auto	issuer () const -> std::string_view
	The issuer identifier (OpenID Connect Discovery 1.0 Section 3).
auto	authorization_endpoint () const -> std::optional< std::string_view >
	The authorization endpoint (OpenID Connect Discovery 1.0 Section 3).
auto	token_endpoint () const -> std::optional< std::string_view >
	The token endpoint (OpenID Connect Discovery 1.0 Section 3).
auto	userinfo_endpoint () const -> std::optional< std::string_view >
	The UserInfo endpoint (OpenID Connect Discovery 1.0 Section 3).
auto	registration_endpoint () const -> std::optional< std::string_view >
auto	jwks_uri () const -> std::string_view
auto	end_session_endpoint () const -> std::optional< std::string_view >
auto	check_session_iframe () const -> std::optional< std::string_view >
auto	supports_subject_type (const std::string_view value) const -> bool
auto	supports_id_token_signing_alg (const std::string_view value) const -> bool
auto	supports_response_type (const std::string_view value) const -> bool
auto	supports_token_endpoint_auth_method (const std::string_view value) const -> bool
auto	supports_scope (const std::string_view value) const -> bool
	Whether a scope is supported (OpenID Connect Discovery 1.0 Section 3).
auto	supports_claim (const std::string_view value) const -> bool
	Whether a claim is supported (OpenID Connect Discovery 1.0 Section 3).
auto	supports_claims_parameter () const -> bool
auto	oauth () const -> const OAuthServerMetadata &
auto	data () const -> const JSON &
	The underlying document, for reaching members without a typed accessor.
Static Public Member Functions
static auto	from (JSON &&data, const std::string_view issuer) -> std::optional< OIDCProviderMetadata >
static auto	from (OAuthServerMetadata &&oauth) -> std::optional< OIDCProviderMetadata >

Constructor & Destructor Documentation

OIDCProviderMetadata() [1/2]

sourcemeta::core::OIDCProviderMetadata::OIDCProviderMetadata	(	JSON &&	data,
		const std::string_view	issuer )

Construct and validate a metadata document for an expected issuer, throwing when it is invalid. The document is moved in.

OIDCProviderMetadata() [2/2]

sourcemeta::core::OIDCProviderMetadata::OIDCProviderMetadata ( OAuthServerMetadata && oauth )

explicit

Apply the OpenID Connect layer to a document already parsed and validated as OAuth authorization server metadata, throwing when the OpenID Connect requirements are not met. The document is moved in and the OAuth checks are not repeated.

Member Function Documentation

check_session_iframe()

auto sourcemeta::core::OIDCProviderMetadata::check_session_iframe ( ) const -> std::optional< std::string_view >

nodiscard

The Session Management check session iframe (OpenID Connect Session Management 1.0 Section 2.1).

end_session_endpoint()

auto sourcemeta::core::OIDCProviderMetadata::end_session_endpoint ( ) const -> std::optional< std::string_view >

nodiscard

The RP-Initiated Logout end session endpoint (OpenID Connect RP-Initiated Logout 1.0 Section 2).

from() [1/2]

auto sourcemeta::core::OIDCProviderMetadata::from ( JSON && data, const std::string_view issuer ) -> std::optional< OIDCProviderMetadata >

staticnodiscard

Construct and validate a metadata document for an expected issuer, returning no value when it is invalid. The document is moved in.

from() [2/2]

auto sourcemeta::core::OIDCProviderMetadata::from ( OAuthServerMetadata && oauth ) -> std::optional< OIDCProviderMetadata >

staticnodiscard

Apply the OpenID Connect layer to a document already parsed and validated as OAuth authorization server metadata, returning no value when the OpenID Connect requirements are not met. This is what a caching resolver hands back, so lifting it costs no reparse and no repeated OAuth validation. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
auto document{sourcemeta::core::parse_json(R"JSON({
  "issuer":"https://example.com",
  "jwks_uri":"https://example.com/jwks",
  "response_types_supported":[ "code" ],
  "subject_types_supported":[ "public" ],
  "id_token_signing_alg_values_supported":[ "RS256" ]
})JSON")};
auto oauth{sourcemeta::core::OAuthServerMetadata::from(
    std::move(document), "https://example.com")};
assert(oauth.has_value());
const auto metadata{
    sourcemeta::core::OIDCProviderMetadata::from(std::move(oauth).value())};
assert(metadata.has_value());

jwks_uri()

auto sourcemeta::core::OIDCProviderMetadata::jwks_uri ( ) const -> std::string_view

nodiscard

The JWK Set document location, REQUIRED by OpenID Connect (OpenID Connect Discovery 1.0 Section 3).

oauth()

auto sourcemeta::core::OIDCProviderMetadata::oauth ( ) const -> const OAuthServerMetadata &

nodiscard

The underlying OAuth authorization server metadata this document is a superset of, for reaching the OAuth typed accessors.

registration_endpoint()

auto sourcemeta::core::OIDCProviderMetadata::registration_endpoint ( ) const -> std::optional< std::string_view >

nodiscard

The dynamic client registration endpoint (OpenID Connect Discovery 1.0 Section 3).

supports_claims_parameter()

auto sourcemeta::core::OIDCProviderMetadata::supports_claims_parameter ( ) const -> bool

nodiscard

Whether the claims request parameter is supported, absent meaning false (OpenID Connect Discovery 1.0 Section 3).

supports_id_token_signing_alg()

auto sourcemeta::core::OIDCProviderMetadata::supports_id_token_signing_alg ( const std::string_view value ) const -> bool

nodiscard

Whether an ID Token signing algorithm is supported (OpenID Connect Discovery 1.0 Section 3).

supports_response_type()

auto sourcemeta::core::OIDCProviderMetadata::supports_response_type ( const std::string_view value ) const -> bool

nodiscard

Whether a response type is supported (OpenID Connect Discovery 1.0 Section 3).

supports_subject_type()

auto sourcemeta::core::OIDCProviderMetadata::supports_subject_type ( const std::string_view value ) const -> bool

nodiscard

Whether a subject identifier type is supported (OpenID Connect Discovery 1.0 Section 3).

supports_token_endpoint_auth_method()

auto sourcemeta::core::OIDCProviderMetadata::supports_token_endpoint_auth_method ( const std::string_view value ) const -> bool

nodiscard

Whether a token endpoint authentication method is supported, defaulting to client_secret_basic when absent (OpenID Connect Discovery 1.0 Section 3).

sourcemeta::core::OIDCProviderMetadataConfig

struct sourcemeta::core::OIDCProviderMetadataConfig

The configuration an OpenID Provider publishes as its metadata (OpenID Connect Discovery 1.0 Section 3), a superset of the OAuth authorization server configuration, each field a non-owning view. An empty scalar and a zero-element array are omitted, and a capability flag is emitted only when it differs from its specification default.

Public Attributes
OAuthServerMetadataConfig	base
std::string_view	userinfo_endpoint
	The UserInfo endpoint (OpenID Connect Discovery 1.0 Section 3).
std::string_view	end_session_endpoint
std::string_view	check_session_iframe
std::span< const std::string_view >	subject_types_supported
std::span< const std::string_view >	id_token_signing_alg_values_supported
std::span< const std::string_view >	id_token_encryption_alg_values_supported
std::span< const std::string_view >	id_token_encryption_enc_values_supported
std::span< const std::string_view >	userinfo_signing_alg_values_supported
std::span< const std::string_view >	userinfo_encryption_alg_values_supported
std::span< const std::string_view >	userinfo_encryption_enc_values_supported
std::span< const std::string_view >	request_object_signing_alg_values_supported
std::span< const std::string_view >	request_object_encryption_alg_values_supported
std::span< const std::string_view >	request_object_encryption_enc_values_supported
std::span< const std::string_view >	claims_supported
	The supported claims (OpenID Connect Discovery 1.0 Section 3).
std::span< const std::string_view >	acr_values_supported
std::span< const std::string_view >	claim_types_supported
	The supported claim types (OpenID Connect Discovery 1.0 Section 3).
std::span< const std::string_view >	display_values_supported
	The supported display values (OpenID Connect Discovery 1.0 Section 3).
std::span< const std::string_view >	claims_locales_supported
	The supported claims locales (OpenID Connect Discovery 1.0 Section 3).
std::span< const std::string_view >	ui_locales_supported
	The supported UI locales (OpenID Connect Discovery 1.0 Section 3).
bool	claims_parameter_supported {false}
bool	request_parameter_supported {false}
bool	request_uri_parameter_supported {true}
bool	require_request_uri_registration {false}

Member Data Documentation

acr_values_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::acr_values_supported

The supported authentication context class references (OpenID Connect Discovery 1.0 Section 3).

base

OAuthServerMetadataConfig sourcemeta::core::OIDCProviderMetadataConfig::base

The OAuth authorization server configuration this is a superset of. Its jwks_uri is REQUIRED for OpenID Connect.

check_session_iframe

std::string_view sourcemeta::core::OIDCProviderMetadataConfig::check_session_iframe

The Session Management check session iframe (OpenID Connect Session Management 1.0 Section 2.1).

claims_parameter_supported

bool sourcemeta::core::OIDCProviderMetadataConfig::claims_parameter_supported {false}

Whether the claims request parameter is supported, default false, so emitted only when true (OpenID Connect Discovery 1.0 Section 3).

end_session_endpoint

std::string_view sourcemeta::core::OIDCProviderMetadataConfig::end_session_endpoint

The RP-Initiated Logout end session endpoint (OpenID Connect RP-Initiated Logout 1.0 Section 3).

id_token_encryption_alg_values_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::id_token_encryption_alg_values_supported

The supported ID Token encryption algorithms (OpenID Connect Discovery 1.0 Section 3).

id_token_encryption_enc_values_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::id_token_encryption_enc_values_supported

The supported ID Token content encryptions (OpenID Connect Discovery 1.0 Section 3).

id_token_signing_alg_values_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::id_token_signing_alg_values_supported

The supported ID Token signing algorithms (OpenID Connect Discovery 1.0 Section 3), REQUIRED, non-empty, and including RS256. The module never advertises none.

request_object_encryption_alg_values_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::request_object_encryption_alg_values_supported

The supported request object encryption algorithms (OpenID Connect Discovery 1.0 Section 3).

request_object_encryption_enc_values_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::request_object_encryption_enc_values_supported

The supported request object content encryptions (OpenID Connect Discovery 1.0 Section 3).

request_object_signing_alg_values_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::request_object_signing_alg_values_supported

The supported request object signing algorithms (OpenID Connect Discovery 1.0 Section 3).

request_parameter_supported

bool sourcemeta::core::OIDCProviderMetadataConfig::request_parameter_supported {false}

Whether the request request parameter is supported, default false, so emitted only when true (OpenID Connect Discovery 1.0 Section 3).

request_uri_parameter_supported

bool sourcemeta::core::OIDCProviderMetadataConfig::request_uri_parameter_supported {true}

Whether the request_uri request parameter is supported, default true, so emitted only when false (OpenID Connect Discovery 1.0 Section 3).

require_request_uri_registration

bool sourcemeta::core::OIDCProviderMetadataConfig::require_request_uri_registration {false}

Whether a request_uri must be pre-registered, default false, so emitted only when true (OpenID Connect Discovery 1.0 Section 3).

subject_types_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::subject_types_supported

The supported subject identifier types (OpenID Connect Discovery 1.0 Section 3), REQUIRED and non-empty.

userinfo_encryption_alg_values_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::userinfo_encryption_alg_values_supported

The supported UserInfo encryption algorithms (OpenID Connect Discovery 1.0 Section 3).

userinfo_encryption_enc_values_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::userinfo_encryption_enc_values_supported

The supported UserInfo content encryptions (OpenID Connect Discovery 1.0 Section 3).

userinfo_signing_alg_values_supported

std::span<const std::string_view> sourcemeta::core::OIDCProviderMetadataConfig::userinfo_signing_alg_values_supported

The supported UserInfo signing algorithms (OpenID Connect Discovery 1.0 Section 3).

sourcemeta::core::OIDCClientMetadata

class sourcemeta::core::OIDCClientMetadata

An OpenID Connect client registration document (OpenID Connect Dynamic Client Registration 1.0), owning its JSON. It is a superset of an OAuth client registration document, validated on construction: the OAuth checks apply, and in addition redirect_uris is REQUIRED and non-empty, which OpenID Connect tightens from the OAuth OPTIONAL. A string accessor returns a view into the owned document, valid for the lifetime of this object. For example:

#include <sourcemeta/core/oidc.h>
#include <sourcemeta/core/json.h>
#include <cassert>
 
auto document{sourcemeta::core::parse_json(
    R"JSON({"redirect_uris":["https://client.example/cb"],
           "subject_type":"public"})JSON")};
const auto metadata{
    sourcemeta::core::OIDCClientMetadata::from(std::move(document))};
assert(metadata.has_value());
assert(metadata.value().application_type() == "web");

Public Member Functions
	OIDCClientMetadata (JSON &&data)
auto	has_redirect_uri (const std::string_view value) const -> bool
auto	application_type () const -> std::string_view
auto	subject_type () const -> std::optional< std::string_view >
auto	sector_identifier_uri () const -> std::optional< std::string_view >
auto	id_token_signed_response_alg () const -> std::string_view
auto	id_token_encrypted_response_alg () const -> std::optional< std::string_view >
auto	userinfo_signed_response_alg () const -> std::optional< std::string_view >
auto	default_max_age () const -> std::optional< std::chrono::seconds >
auto	require_auth_time () const -> bool
auto	initiate_login_uri () const -> std::optional< std::string_view >
auto	has_post_logout_redirect_uri (const std::string_view value) const -> bool
auto	oauth () const -> const OAuthClientMetadata &
	The underlying OAuth client registration this document is a superset of.
auto	data () const -> const JSON &
	The underlying document, for reaching members without a typed accessor.
Static Public Member Functions
static auto	from (JSON &&data) -> std::optional< OIDCClientMetadata >

Constructor & Destructor Documentation

OIDCClientMetadata()

sourcemeta::core::OIDCClientMetadata::OIDCClientMetadata ( JSON && data )

explicit

Construct and validate a client registration document, throwing when it is invalid. The document is moved in.

Member Function Documentation

application_type()

auto sourcemeta::core::OIDCClientMetadata::application_type ( ) const -> std::string_view

nodiscard

The application type, defaulting to web (OpenID Connect Dynamic Client Registration 1.0 Section 2).

default_max_age()

auto sourcemeta::core::OIDCClientMetadata::default_max_age ( ) const -> std::optional< std::chrono::seconds >

nodiscard

The default maximum authentication age (OpenID Connect Dynamic Client Registration 1.0 Section 2).

from()

auto sourcemeta::core::OIDCClientMetadata::from ( JSON && data ) -> std::optional< OIDCClientMetadata >

staticnodiscard

Construct and validate a client registration document, returning no value when it is invalid. The document is moved in.

has_post_logout_redirect_uri()

auto sourcemeta::core::OIDCClientMetadata::has_post_logout_redirect_uri ( const std::string_view value ) const -> bool

nodiscard

Whether a post-logout redirection URI is registered (OpenID Connect RP-Initiated Logout 1.0 Section 3).

has_redirect_uri()

auto sourcemeta::core::OIDCClientMetadata::has_redirect_uri ( const std::string_view value ) const -> bool

nodiscard

Whether a redirection URI is registered (OpenID Connect Dynamic Client Registration 1.0 Section 2).

id_token_encrypted_response_alg()

auto sourcemeta::core::OIDCClientMetadata::id_token_encrypted_response_alg ( ) const -> std::optional< std::string_view >

nodiscard

The ID Token encryption algorithm (OpenID Connect Dynamic Client Registration 1.0 Section 2).

id_token_signed_response_alg()

auto sourcemeta::core::OIDCClientMetadata::id_token_signed_response_alg ( ) const -> std::string_view

nodiscard

The ID Token signing algorithm, defaulting to RS256 (OpenID Connect Dynamic Client Registration 1.0 Section 2).

initiate_login_uri()

auto sourcemeta::core::OIDCClientMetadata::initiate_login_uri ( ) const -> std::optional< std::string_view >

nodiscard

The URI a third party uses to initiate login (OpenID Connect Dynamic Client Registration 1.0 Section 2).

require_auth_time()

auto sourcemeta::core::OIDCClientMetadata::require_auth_time ( ) const -> bool

nodiscard

Whether the auth_time claim is always required, defaulting to false (OpenID Connect Dynamic Client Registration 1.0 Section 2).

sector_identifier_uri()

auto sourcemeta::core::OIDCClientMetadata::sector_identifier_uri ( ) const -> std::optional< std::string_view >

nodiscard

The sector identifier URI for pairwise subjects (OpenID Connect Dynamic Client Registration 1.0 Section 2).

subject_type()

auto sourcemeta::core::OIDCClientMetadata::subject_type ( ) const -> std::optional< std::string_view >

nodiscard

The subject identifier type (OpenID Connect Dynamic Client Registration 1.0 Section 2).

userinfo_signed_response_alg()

auto sourcemeta::core::OIDCClientMetadata::userinfo_signed_response_alg ( ) const -> std::optional< std::string_view >

nodiscard

The UserInfo signing algorithm (OpenID Connect Dynamic Client Registration 1.0 Section 2).

Enumeration Type Documentation

OIDCAuthenticationError

enum class sourcemeta::core::OIDCAuthenticationError : std::uint8_t

strong

The error codes an authentication endpoint returns in addition to the OAuth authorization error codes (OpenID Connect Core 1.0 Section 3.1.2.6).

Enumerator
InteractionRequired	The authentication request cannot be completed without end user interaction, returned when prompt=none was requested.
LoginRequired	The authentication request cannot be completed without end user authentication, returned when prompt=none was requested.
AccountSelectionRequired	The end user must select a session, returned when prompt=none was requested and more than one session is available.
ConsentRequired	The authentication request cannot be completed without end user consent, returned when prompt=none was requested.
InvalidRequestURI	The request_uri is invalid or unreachable.
InvalidRequestObject	The request object is invalid.
RequestNotSupported	The provider does not support the request parameter.
RequestURINotSupported	The provider does not support the request_uri parameter.
RegistrationNotSupported	The provider does not support the registration parameter.

OIDCProfile

enum class sourcemeta::core::OIDCProfile : std::uint8_t

strong

The behavioural profile a builder or validator runs under. Strict allows only the Authorization Code flow with PKCE, and Legacy additionally permits the Hybrid code id_token flow, which is weaker and off by default (OpenID Connect Core 1.0 Section 3, the module design Section 14.2). For example:

#include <sourcemeta/core/oidc.h>
 
const auto profile{sourcemeta::core::OIDCProfile::Strict};

Enumerator
Strict	The default, allowing only the Authorization Code flow and requiring PKCE with the S256 method.
Legacy	Additionally permits the Hybrid code id_token flow, still seen in older deployments, which requires a nonce on the request. Validating its ID Token still requires the caller to enable c_hash checking through the ID Token validation options.

OIDCSubjectType

enum class sourcemeta::core::OIDCSubjectType : std::uint8_t

strong

The subject identifier type an OpenID Provider assigns (OpenID Connect Core 1.0 Section 8). A public subject is shared across clients, while a pairwise subject is distinct per sector so clients cannot correlate the end user.

Enumerator
Public	The same subject value is returned to every client (OpenID Connect Core 1.0 Section 8).
Pairwise	A distinct subject value is returned to each sector (OpenID Connect Core 1.0 Section 8).

Function Documentation

oidc_authorization_url()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_authorization_url	(	const std::string_view	authorization_endpoint,
		const std::string_view	client_id,
		const std::string_view	redirect_uri,
		const std::string_view	state,
		const std::string_view	code_challenge,
		const std::string_view	nonce ) -> std::optional< std::string >

A convenience for the common authorization code flow authentication request, enforcing scope=openid, response_type=code, and the PKCE S256 method, returning the URL or no value when the request is malformed (OpenID Connect Core 1.0 Section 3.1.2.1). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto url{sourcemeta::core::oidc_authorization_url(
    "https://server.example/authorize", "s6BhdRkqt3",
    "https://client.example/cb", "xyz",
    "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM", "n-0S6_WzA2Mj")};
assert(url.has_value());

oidc_build_authentication_url()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_build_authentication_url	(	const std::string_view	endpoint,
		const OIDCAuthenticationRequest &	request,
		std::string &	sink,
		const OIDCProfile	profile = OIDCProfile::Strict ) -> bool

Build an OpenID Connect authentication request URL from an endpoint and a request, returning whether the request is well formed (OpenID Connect Core 1.0 Section 3.1.2.1). The client_id and redirect_uri are REQUIRED, the scope must contain openid, when prompt carries none it must be the only value, and offline_access cannot pair with a none prompt. The response_type is limited by the profile, which permits the Authorization Code flow by default and additionally the Hybrid code id_token flow under OIDCProfile::Legacy, any flow that returns an ID Token requires a nonce, and OIDCProfile::Strict requires a code_challenge with the S256 method (PKCE). The OpenID Connect parameters are appended to the OAuth authorization query, percent-escaped, and the sink is appended to and never cleared. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
#include <string>
 
sourcemeta::core::OIDCAuthenticationRequest request;
request.client_id = "s6BhdRkqt3";
request.redirect_uri = "https://client.example/cb";
request.scope = "openid profile";
request.nonce = "n-0S6_WzA2Mj";
request.code_challenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM";
request.code_challenge_method = "S256";
std::string url;
assert(sourcemeta::core::oidc_build_authentication_url(
    "https://server.example/authorize", request, url));

oidc_build_claims_parameter()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_build_claims_parameter	(	const std::span< const OIDCClaimRequest >	userinfo_claims,
		const std::span< const OIDCClaimRequest >	id_token_claims ) -> JSON

Build a claims request parameter object requesting the given claims for the UserInfo endpoint and the ID Token (OpenID Connect Core 1.0 Section 5.5). An essential claim is requested with {"essential":true}, and a voluntary claim with null. A target with no claims is omitted. For example:

#include <sourcemeta/core/oidc.h>
#include <array>
#include <cassert>
 
const std::array<sourcemeta::core::OIDCClaimRequest, 1> userinfo{
    {{.name = "email", .essential = true}}};
const auto document{
    sourcemeta::core::oidc_build_claims_parameter(userinfo, {})};
assert(document.defines("userinfo"));

oidc_build_logout_url()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_build_logout_url	(	const std::string_view	end_session_endpoint,
		const OIDCLogoutRequest &	request,
		std::string &	sink ) -> void

Build an RP-Initiated Logout request URL from an end session endpoint and a request (OpenID Connect RP-Initiated Logout 1.0 Section 2). Each present parameter is percent-escaped, an existing query on the endpoint is honored, and the sink is appended to and never cleared. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
#include <string>
 
sourcemeta::core::OIDCLogoutRequest request;
request.id_token_hint = "eyJ...";
request.post_logout_redirect_uri = "https://client.example/after";
std::string url;
sourcemeta::core::oidc_build_logout_url(
    "https://server.example/logout", request, url);

oidc_build_request_object()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_build_request_object	(	const JSON &	parameters,
		const JWKPrivate &	key,
		const JWSAlgorithm	algorithm ) -> std::optional< std::string >

Build and sign a request object from a set of authentication request parameters, returning the compact JWT or no value when the key cannot produce the signature (OpenID Connect Core 1.0 Section 6.1). The parameters should carry the iss set to the client and the aud set to the OpenID Provider issuer. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto parameters{sourcemeta::core::parse_json(
    R"JSON({"iss":"client","aud":"https://op.example","scope":"openid"})JSON")};
const auto object{sourcemeta::core::oidc_build_request_object(
    parameters, key, sourcemeta::core::JWSAlgorithm::RS256)};
assert(object.has_value());

oidc_build_userinfo()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_build_userinfo	(	const std::string_view	subject,
		const JSON &	additional_claims ) -> JSON

Build a UserInfo response object for the given subject and additional claims, ensuring the REQUIRED sub claim is present (OpenID Connect Core 1.0 Section 5.3.2). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto
claims{sourcemeta::core::parse_json(R"JSON({"email":"a@b"})JSON")}; const
auto document{sourcemeta::core::oidc_build_userinfo("user-1", claims)};
assert(document.at("sub").to_string() == "user-1");

oidc_claim_request_accepts()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_claim_request_accepts	(	const JSON &	request,
		const JSON &	value ) -> bool

Whether an individual claim request permits a value, where the request is the member value a claims request parameter maps a claim name to (OpenID Connect Core 1.0 Section 5.5.1). A null request or one with neither a value nor a values constraint permits any value, comparison is JSON equality over the whole value, and essential has no effect. For example:

#include <sourcemeta/core/oidc.h>
#include <sourcemeta/core/json.h>
#include <cassert>
 
const auto request{sourcemeta::core::parse_json(
    R"JSON({ "values": [ "gold", "silver" ] })JSON")};
assert(sourcemeta::core::oidc_claim_request_accepts(
    request, sourcemeta::core::JSON{"gold"}));

oidc_claim_to_scope()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_claim_to_scope ( const std::string_view claim ) -> std::optional< std::string_view >

noexcept

The standard scope that requests a claim, or no value when no claim-requesting scope carries it (OpenID Connect Core 1.0 Section 5.4). The sub claim maps to openid, which always returns it (Section 5.3.2), and a scope name is never invented from a non-standard claim name. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
assert(sourcemeta::core::oidc_claim_to_scope("email").value() == "email");
assert(!sourcemeta::core::oidc_claim_to_scope("groups").has_value());

oidc_claims_parameter_accepts()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_claims_parameter_accepts	(	const JSON &	claims,
		const std::string_view	target,
		const std::string_view	claim,
		const JSON &	value ) -> bool

Whether the request for a claim permits the given value for a target member, which is userinfo or id_token (OpenID Connect Core 1.0 Section 5.5.1). A request with neither a value nor a values constraint permits any value, and a claim that is not requested permits none. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto claims{sourcemeta::core::parse_json(
    R"JSON({"id_token":{"acr":{"values":["a","b"]}}})JSON")};
assert(sourcemeta::core::oidc_claims_parameter_accepts(
    claims, "id_token", "acr", sourcemeta::core::JSON{"b"}));

oidc_claims_parameter_is_essential()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_claims_parameter_is_essential	(	const JSON &	claims,
		const std::string_view	target,
		const std::string_view	claim ) -> bool

Whether a claims request parameter marks a claim as essential for a target member, which is userinfo or id_token (OpenID Connect Core 1.0 Section 5.5.1). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto claims{sourcemeta::core::parse_json(
    R"JSON({"id_token":{"auth_time":{"essential":true}}})JSON")};
assert(sourcemeta::core::oidc_claims_parameter_is_essential(
    claims, "id_token", "auth_time"));

oidc_claims_parameter_requests()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_claims_parameter_requests	(	const JSON &	claims,
		const std::string_view	target,
		const std::string_view	claim ) -> bool

Whether a claims request parameter requests a claim for a target member, which is userinfo or id_token (OpenID Connect Core 1.0 Section 5.5). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto claims{sourcemeta::core::parse_json(
    R"JSON({"id_token":{"auth_time":{"essential":true}}})JSON")};
assert(sourcemeta::core::oidc_claims_parameter_requests(
    claims, "id_token", "auth_time"));

oidc_claims_parameter_value()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_claims_parameter_value	(	const JSON &	claims,
		const std::string_view	target,
		const std::string_view	claim ) -> const JSON *

The specific value a claims request parameter asks a claim to have for a target member, which is userinfo or id_token, or no value when none is requested (OpenID Connect Core 1.0 Section 5.5.1). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto claims{sourcemeta::core::parse_json(
    R"JSON({"id_token":{"acr":{"value":"urn:mace:silver"}}})JSON")};
const auto *value{sourcemeta::core::oidc_claims_parameter_value(
    claims, "id_token", "acr")};
assert(value != nullptr && value->to_string() == "urn:mace:silver");

oidc_decrypt_nested_jwt()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_decrypt_nested_jwt	(	const std::string_view	compact,
		const JWKPrivate &	key ) -> std::optional< std::string >

Decrypt a nested encrypted token, recovering the inner signed JWT from a compact JWE, returning no value when the input is not a valid JWE or the key cannot decrypt it (OpenID Connect Core 1.0 Section 10.2). OpenID Connect encrypted ID Tokens, UserInfo responses, and request objects are a signed JWT wrapped in a JWE, so the Relying Party decrypts first and then verifies the recovered signature. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto inner{sourcemeta::core::oidc_decrypt_nested_jwt(compact, key)};
if (inner.has_value()) {
  const auto token{sourcemeta::core::JWT::from(inner.value())};
  assert(token.has_value());
}

oidc_discovery_url()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_discovery_url

(

const std::string_view

issuer

)

-> std::optional< std::string >

Derive the OpenID Provider Configuration well-known URL from an issuer identifier, returning no value when the issuer is not a valid identifier (OpenID Connect Discovery 1.0 Section 4.1). Unlike the RFC 8414 form, the well-known string is appended after the issuer path rather than inserted before it. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto url{sourcemeta::core::oidc_discovery_url("https://example.com")};
assert(url.has_value());
assert(url.value() ==
       "https://example.com/.well-known/openid-configuration");

oidc_error_code()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_error_code ( const OIDCAuthenticationError error ) -> std::string_view

noexcept

The wire code for an authentication endpoint error (OpenID Connect Core 1.0 Section 3.1.2.6). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
assert(sourcemeta::core::oidc_error_code(
           sourcemeta::core::OIDCAuthenticationError::LoginRequired) ==
       "login_required");

oidc_front_channel_pairing_is_valid()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_front_channel_pairing_is_valid	(	const std::string_view	issuer,
		const std::string_view	session_id ) -> bool

Whether a Front-Channel Logout iss and sid pair is used in a valid combination, which is both present or both absent (OpenID Connect Front-Channel Logout 1.0 Section 3). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
assert(sourcemeta::core::oidc_front_channel_pairing_is_valid(
    "https://issuer.example", "session-1"));
assert(!sourcemeta::core::oidc_front_channel_pairing_is_valid(
    "https://issuer.example", ""));

oidc_is_standard_claim()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_is_standard_claim ( const std::string_view name ) -> bool

noexcept

Whether a name is one of the OpenID Connect standard claims (OpenID Connect Core 1.0 Section 5.1). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
assert(sourcemeta::core::oidc_is_standard_claim("email"));
assert(!sourcemeta::core::oidc_is_standard_claim("custom_claim"));

oidc_make_provider_metadata()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_make_provider_metadata

(

const OIDCProviderMetadataConfig &

config

)

-> std::optional< JSON >

Build an OpenID Provider metadata document for the well-known endpoint (OpenID Connect Discovery 1.0 Section 3), returning no value when the document would be unusable: the OAuth base is unusable, the REQUIRED jwks_uri, subject_types_supported, or id_token_signing_alg_values_supported is missing or empty, the ID Token signing algorithm list omits RS256 or contains none, or an advertised OpenID Connect endpoint is not a valid https URL. For example:

#include <sourcemeta/core/oidc.h>
#include <array>
#include <cassert>
#include <string_view>
 
const std::array<std::string_view, 1> response_types{{"code"}};
const std::array<std::string_view, 1> subject_types{{"public"}};
const std::array<std::string_view, 1> id_token_algs{{"RS256"}};
sourcemeta::core::OIDCProviderMetadataConfig config;
config.base.issuer = "https://server.example";
config.base.authorization_endpoint = "https://server.example/authorize";
config.base.token_endpoint = "https://server.example/token";
config.base.jwks_uri = "https://server.example/jwks";
config.base.response_types_supported = response_types;
config.subject_types_supported = subject_types;
config.id_token_signing_alg_values_supported = id_token_algs;
const auto document{sourcemeta::core::oidc_make_provider_metadata(config)};
assert(document.has_value());
assert(document.value().at("issuer").to_string() ==
       "https://server.example");

oidc_mint_id_token()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_mint_id_token	(	const OIDCIdTokenClaims &	claims,
		const JWKPrivate &	key,
		const JWSAlgorithm	algorithm ) -> std::optional< std::string >

Mint and sign an ID Token from a claim set under a signing key and algorithm, returning the compact serialization or no value when the key cannot produce the signature (OpenID Connect Core 1.0 Section 2). The at_hash and c_hash claims are computed and embedded when the access token or code is supplied. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
#include <chrono>
 
sourcemeta::core::OIDCIdTokenClaims claims;
claims.issuer = "https://issuer.example";
claims.subject = "user-1";
claims.audience = "client-id";
claims.issued_at = std::chrono::system_clock::now();
claims.expiration = claims.issued_at + std::chrono::hours{1};
const auto token{sourcemeta::core::oidc_mint_id_token(
    claims, key, sourcemeta::core::JWSAlgorithm::RS256)};
assert(token.has_value());

oidc_nonce()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_nonce

(

)

-> std::array< char, 43 >

Generate a fresh nonce for an authentication request, an unguessable value bound to the session and returned in the ID Token (OpenID Connect Core 1.0 Section 15.5.2). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto nonce{sourcemeta::core::oidc_nonce()};
assert(nonce.size() == 43);

oidc_pairwise_subject()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_pairwise_subject	(	const std::string_view	sector_identifier,
		const std::string_view	local_account_identifier,
		const std::string_view	provider_secret ) -> std::string

Derive a pairwise subject identifier from a sector identifier and a local account identifier, keyed by a confidential OpenID Provider secret (OpenID Connect Core 1.0 Section 8.1). The provider_secret must be kept secret, as a public value would let account identifiers be enumerated from the pairwise subjects. The value is a keyed HMAC-SHA256 over the sector and account, base64url-encoded, so it is stable per client, distinct per sector, non-reversible, and well under the 255 character limit. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto subject{sourcemeta::core::oidc_pairwise_subject(
    "client.example", "user-1", "provider-secret")};
assert(!subject.empty());

oidc_parse_authentication_request()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_parse_authentication_request	(	const std::string_view	query,
		std::string &	storage,
		OIDCAuthenticationRequest &	result,
		const OIDCProfile	profile = OIDCProfile::Strict ) -> bool

Parse the query of an OpenID Connect authentication request at the provider into the result, returning whether it is well formed (OpenID Connect Core 1.0 Section 3.1.2.1). The client_id, redirect_uri, and response_type are REQUIRED, the scope must contain openid, a none prompt must appear alone, an offline_access scope that cannot yield a refresh token, such as one paired with a none prompt, is dropped rather than rejected (OpenID Connect Core 1.0 Section 11), the response_type is limited by the profile, and OIDCProfile::Strict requires a code_challenge with the S256 method (PKCE). Each recognized value is form-decoded, borrowing from the input when it carries no escape and otherwise from the storage arena, which the caller owns and reuses across parses. The result is reset first, then borrows from the input and the storage, so both must outlive it. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
#include <string>
 
std::string storage;
sourcemeta::core::OIDCAuthenticationRequest request;
assert(sourcemeta::core::oidc_parse_authentication_request(
    "response_type=code&client_id=s6BhdRkqt3&"
    "redirect_uri=https%3A%2F%2Fclient.example%2Fcb&scope=openid&"
    "nonce=n-0S6&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&"
    "code_challenge_method=S256",
    storage, request));
assert(request.nonce == "n-0S6");

oidc_parse_id_token()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_parse_id_token

(

const JSON &

token_response

)

-> std::optional< std::string >

Extract the ID Token from a token endpoint response document, returning no value when the id_token member is absent or not a string (OpenID Connect Core 1.0 Section 3.1.3.3). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto response{sourcemeta::core::parse_json(
    R"JSON({"access_token":"at","id_token":"eyJ..."})JSON")};
const auto id_token{sourcemeta::core::oidc_parse_id_token(response)};
assert(id_token.has_value());

oidc_request_object_pairing_is_valid()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_request_object_pairing_is_valid	(	const std::string_view	request,
		const std::string_view	request_uri ) -> bool

Whether the request and request_uri parameters are used in a valid combination, which is at most one of them (OpenID Connect Core 1.0 Section 6). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
assert(sourcemeta::core::oidc_request_object_pairing_is_valid(
    "eyJ...", ""));
assert(!sourcemeta::core::oidc_request_object_pairing_is_valid(
    "eyJ...", "https://client.example/request.jwt"));

oidc_scope_to_claims()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_scope_to_claims	(	const std::string_view	scopes,
		const std::function< void(std::string_view)> &	on_claim ) -> void

Invoke the callback with each standard claim that the space-delimited scopes request (OpenID Connect Core 1.0 Section 5.4). The openid scope maps to sub, which is always returned (Section 5.3.2), and profile, Email, address, and phone map to their claim sets. A claim requested by more than one scope is reported once. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
bool has_email{false};
sourcemeta::core::oidc_scope_to_claims(
    "openid email", [&has_email](std::string_view claim) {
      has_email = has_email || claim == "email";
    });
assert(has_email);

oidc_sector_identifier_contains()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_sector_identifier_contains	(	const JSON &	sector_document,
		const std::span< const std::string_view >	redirect_uris ) -> bool

Whether a fetched sector_identifier_uri document, a JSON array of redirection URIs, contains every registered redirection URI (OpenID Connect Dynamic Client Registration 1.0 Section 5). The OpenID Provider performs this check at registration before accepting a pairwise client. For example:

#include <sourcemeta/core/oidc.h>
#include <array>
#include <cassert>
#include <string_view>
 
const auto document{sourcemeta::core::parse_json(
    R"JSON(["https://client.example/cb"])JSON")};
const std::array<std::string_view, 1> registered{
    {"https://client.example/cb"}};
assert(sourcemeta::core::oidc_sector_identifier_contains(document,
                                                         registered));

oidc_session_state()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_session_state	(	const std::string_view	client_id,
		const std::string_view	origin,
		const std::string_view	provider_browser_state,
		const std::string_view	salt ) -> std::string

Compute a Session Management session_state value from the client, the client origin, the OpenID Provider browser state, and a salt (OpenID Connect Session Management 1.0 Section 4.2). The value is the base64url of the SHA-256 of the space-joined inputs, a dot, and the salt. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto state{sourcemeta::core::oidc_session_state(
    "client-id", "https://client.example", "browser-state", "salt")};
assert(!state.empty());

oidc_subject_type_name()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_subject_type_name ( const OIDCSubjectType type ) -> std::string_view

noexcept

The wire name of a subject identifier type (OpenID Connect Core 1.0 Section 8). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
assert(sourcemeta::core::oidc_subject_type_name(
           sourcemeta::core::OIDCSubjectType::Pairwise) == "pairwise");

oidc_token_hash()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_token_hash	(	const std::string_view	token,
		const JWSAlgorithm	algorithm ) -> std::optional< std::string >

Compute an OpenID Connect access token hash (at_hash) or authorization code hash (c_hash) for a token and the ID Token signing algorithm (OpenID Connect Core 1.0 Section 3.1.3.6). The token is hashed with the SHA variant the algorithm is defined over, the left-most half of the digest is kept, and that half is base64url-encoded without padding. The digest is selected from the algorithm by table rather than by slicing its name. Returns no value for EdDSA, whose correct digest depends on the signing curve (SHA-512 for Ed25519, SHAKE256 for Ed448) that the algorithm alone does not convey. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto hash{sourcemeta::core::oidc_token_hash(
    "ya29.CjHSA1l5WUn8xZ6HanHFzzdHdbXm-14rxnC7JHch9eFIsZkQEGoWzaYG4o7k5f6BnPLj",
    sourcemeta::core::JWSAlgorithm::RS256)};
assert(hash.has_value());
assert(hash.value() == "piwt8oCH-K2D9pXlaS1Y-w");

oidc_userinfo_matches_subject()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_userinfo_matches_subject	(	const JSON &	userinfo,
		const std::string_view	expected_subject ) -> bool

Whether a UserInfo response subject matches the ID Token subject, comparing in constant time, the defence against a substituted response (OpenID Connect Core 1.0 Section 5.3.2). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto
userinfo{sourcemeta::core::parse_json(R"JSON({"sub":"user-1"})JSON")};
assert(sourcemeta::core::oidc_userinfo_matches_subject(userinfo, "user-1"));

oidc_validate_id_token() [1/2]

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_validate_id_token	(	const JWT &	token,
		const JWKS &	keys,
		const std::span< const JWSAlgorithm >	allowed_algorithms,
		const std::string_view	issuer,
		const std::string_view	client_id,
		const std::chrono::system_clock::time_point	now,
		const OIDCValidationOptions &	options = {},
		const JWTClockSkew	clock_skew = {} ) -> std::optional< OIDCIdentity >

Validate an ID Token against a key set at a given time, returning the asserted identity or no value when any check fails (OpenID Connect Core 1.0 Section 3.1.3.7). The base JSON Web Token verification (signature under a pinned algorithm, issuer, audience, expiration, and skew) runs first, then the OpenID Connect steps: the subject and issued-at are required, every audience beyond the client must be one the caller trusts, an azp matching the client is required when the audience carries more than one value, the nonce is echoed when one was sent, the authentication context and age constraints hold, and a required binding hash is present and matches. The algorithm allow-list is pinned by the caller and must never contain none. For example:

#include <sourcemeta/core/oidc.h>
#include <array>
#include <cassert>
#include <chrono>
 
const auto token{sourcemeta::core::JWT::from(compact)};
const auto keys{sourcemeta::core::JWKS::from(key_set)};
const std::array allowed{sourcemeta::core::JWSAlgorithm::RS256};
assert(token.has_value() && keys.has_value());
const auto identity{sourcemeta::core::oidc_validate_id_token(
    token.value(), keys.value(), allowed, "https://issuer.example",
    "client-id", std::chrono::system_clock::now())};

oidc_validate_id_token() [2/2]

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_validate_id_token	(	JWKSProvider &	provider,
		const JWT &	token,
		const std::span< const JWSAlgorithm >	allowed_algorithms,
		const std::string_view	issuer,
		const std::string_view	client_id,
		const OIDCValidationOptions &	options = {} ) -> std::optional< OIDCIdentity >

Validate an ID Token against a caching key set provider, returning the asserted identity or no value when any check fails (OpenID Connect Core 1.0 Section 3.1.3.7). The provider supplies the keys, the current time, and the clock skew, and the OpenID Connect steps run against the same clock the signature verification used. For example:

#include <sourcemeta/core/oidc.h>
#include <array>
#include <cassert>
 
const auto token{sourcemeta::core::JWT::from(compact)};
const std::array allowed{sourcemeta::core::JWSAlgorithm::RS256};
assert(token.has_value());
const auto identity{sourcemeta::core::oidc_validate_id_token(
    provider, token.value(), allowed, "https://issuer.example",
    "client-id")};

oidc_validate_logout_token()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_validate_logout_token	(	const JWT &	token,
		const JWKS &	keys,
		const std::span< const JWSAlgorithm >	allowed_algorithms,
		const std::string_view	issuer,
		const std::string_view	client_id,
		const std::chrono::system_clock::time_point	now,
		const JWTClockSkew	clock_skew = {} ) -> bool

Validate a Back-Channel Logout token against a key set at a given time (OpenID Connect Back-Channel Logout 1.0 Section 2.6). The signature is verified under a pinned algorithm, the issuer and audience must match, the iat must be present and not in the future, the exp must be present and not have passed, the typ header when present must be logout+jwt, the token must carry a sub or sid, an events object with the back-channel logout member, a jti, and it must not carry a nonce. Replay rejection by jti is the caller's responsibility. For example:

#include <sourcemeta/core/oidc.h>
#include <array>
#include <cassert>
#include <chrono>
 
const auto token{sourcemeta::core::JWT::from(compact)};
const auto keys{sourcemeta::core::JWKS::from(key_set)};
const std::array allowed{sourcemeta::core::JWSAlgorithm::RS256};
assert(token.has_value() && keys.has_value());
const auto valid{sourcemeta::core::oidc_validate_logout_token(
    token.value(), keys.value(), allowed, "https://issuer.example",
    "client-id", std::chrono::system_clock::now())};

oidc_verify_request_object()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_verify_request_object	(	const JWT &	token,
		const JWKS &	keys,
		const std::span< const JWSAlgorithm >	allowed_algorithms,
		const std::string_view	client_id,
		const std::string_view	provider_issuer ) -> std::optional< JSON >

Verify a request object and return its parameters, or no value when the signature does not verify under a pinned algorithm, the issuer is present but is not the client, or the audience is missing or does not include the OpenID Provider (OpenID Connect Core 1.0 Section 6.1 and Section 6.3). A signed request object must carry an aud that includes the provider, binding it to this provider so it cannot be replayed to another one. For example:

#include <sourcemeta/core/oidc.h>
#include <array>
#include <cassert>
 
const auto token{sourcemeta::core::JWT::from(compact)};
const auto keys{sourcemeta::core::JWKS::from(client_keys)};
const std::array allowed{sourcemeta::core::JWSAlgorithm::RS256};
assert(token.has_value() && keys.has_value());
const auto parameters{sourcemeta::core::oidc_verify_request_object(
    token.value(), keys.value(), allowed, "client", "https://op.example")};

oidc_verify_token_hash()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_verify_token_hash	(	const std::string_view	token,
		const JWSAlgorithm	algorithm,
		const std::string_view	claim ) -> bool

Whether an at_hash or c_hash claim matches a token under the ID Token signing algorithm, comparing in constant time (OpenID Connect Core 1.0 Section 3.1.3.6). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
assert(sourcemeta::core::oidc_verify_token_hash(
    "ya29.CjHSA1l5WUn8xZ6HanHFzzdHdbXm-14rxnC7JHch9eFIsZkQEGoWzaYG4o7k5f6BnPLj",
    sourcemeta::core::JWSAlgorithm::RS256, "piwt8oCH-K2D9pXlaS1Y-w"));

oidc_verify_userinfo()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_verify_userinfo	(	const JWT &	token,
		const JWKS &	keys,
		const std::span< const JWSAlgorithm >	allowed_algorithms,
		const std::string_view	expected_subject,
		const std::string_view	expected_issuer,
		const std::string_view	expected_client_id ) -> std::optional< JSON >

Verify a signed UserInfo response and its subject, returning the claims or no value when the signature does not verify under a pinned algorithm, the subject does not match the ID Token subject, or iss or aud is missing or does not identify this provider and client. A signed response MUST carry iss and aud (OpenID Connect Core 1.0 Section 5.3.2, errata set 2), so a signed response lacking either is rejected. Checking aud binds the response to this client, preventing one minted for another client from being accepted here. For example:

#include <sourcemeta/core/oidc.h>
#include <array>
#include <cassert>
 
const auto token{sourcemeta::core::JWT::from(compact)};
const auto keys{sourcemeta::core::JWKS::from(key_set)};
const std::array allowed{sourcemeta::core::JWSAlgorithm::RS256};
assert(token.has_value() && keys.has_value());
const auto claims{sourcemeta::core::oidc_verify_userinfo(
    token.value(), keys.value(), allowed, "user-1",
    "https://op.example", "client-id")};

oidc_webfinger_issuer()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_webfinger_issuer

(

const JSON &

descriptor

)

-> std::optional< std::string_view >

Extract the issuer from a WebFinger JSON Resource Descriptor, the href of the link whose rel is the OpenID Connect issuer relation and whose value is a valid https issuer identifier, returning no value when none is present (OpenID Connect Discovery 1.0 Section 2). The returned view borrows from the descriptor, which must outlive it. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto jrd{sourcemeta::core::parse_json(R"JSON({"links":[{
    "rel":"http://openid.net/specs/connect/1.0/issuer",
    "href":"https://example.com"}]})JSON")};
const auto issuer{sourcemeta::core::oidc_webfinger_issuer(jrd)};
assert(issuer.has_value());
assert(issuer.value() == "https://example.com");

oidc_webfinger_request()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::oidc_webfinger_request

(

const std::string_view

identifier

)

-> std::optional< OIDCWebFingerRequest >

Normalize a user-supplied identifier and build its WebFinger issuer discovery request, returning no value when the identifier has no host (OpenID Connect Discovery 1.0 Section 2, 2.1). An acct: identifier and an https URL are kept as the resource, a bare user@host becomes an acct: URI, and any other input is treated as an https URL. For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
const auto request{sourcemeta::core::oidc_webfinger_request(
    "acct:joe@example.com")};
assert(request.has_value());
assert(request.value().url.starts_with(
    "https://example.com/.well-known/webfinger"));

to_oidc_authentication_error()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::to_oidc_authentication_error ( const std::string_view code ) -> std::optional< OIDCAuthenticationError >

noexcept

Map an authentication endpoint error code to its value, returning no value for an unrecognized code (OpenID Connect Core 1.0 Section 3.1.2.6). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
assert(sourcemeta::core::to_oidc_authentication_error("consent_required")
           .has_value());

to_oidc_subject_type()

SOURCEMETA_CORE_OIDC_EXPORT auto sourcemeta::core::to_oidc_subject_type ( const std::string_view name ) -> std::optional< OIDCSubjectType >

noexcept

Map a subject identifier type name to its value, returning no value for an unrecognized name (OpenID Connect Core 1.0 Section 8). For example:

#include <sourcemeta/core/oidc.h>
#include <cassert>
 
assert(sourcemeta::core::to_oidc_subject_type("public").has_value());