Setu-TS
    Preparing search index...

    Interface OidcProvider

    An OpenID Connect provider: endpoints and keys come from discovery, and the callback verifies an ID token.

    0.8.0

    interface OidcProvider {
        clientId: string;
        clientSecret?: string;
        failureRedirect?: string;
        issuer: string;
        kind: "oidc";
        name: string;
        redirectUri: string;
        rpInitiatedLogout?: { idTokenHint?: true; postLogoutRedirectUri: string };
        scopes?: readonly string[];
        tokenEndpointAuth?: TokenEndpointAuth;
        onTokens?(tokens: ProviderTokens): void | Promise<void>;
        toPrincipal(
            claims: Readonly<Record<string, unknown>>,
        ): IPrincipal | Promise<IPrincipal | null> | null;
    }

    Hierarchy (View Summary)

    Index
    clientId clientSecret? failureRedirect? issuer kind name redirectUri rpInitiatedLogout? scopes? tokenEndpointAuth?
    onTokens? toPrincipal
    clientId: string

    The provider's client id.

    clientSecret?: string

    The client secret. Required for client_secret_basic and client_secret_post, forbidden with tokenEndpointAuth: 'none'.

    failureRedirect?: string

    Redirect here with a fixed ?error= code instead of answering 401. The code is one of this plugin's own; a provider-supplied message is never placed in the URL.

    issuer: string

    The issuer URL. Discovery reads <issuer>/.well-known/openid-configuration, and the ID token's iss must equal this value exactly.

    kind: "oidc"

    Discriminant.

    name: string

    Kebab-case name, used in the route paths (/auth/<name>/login).

    redirectUri: string

    The exact redirect URI sent to the provider. Its path must end with that provider's callback path, <basePath>/<name>/callback, so the registered route and the value the provider matches against cannot disagree.

    rpInitiatedLogout?: { idTokenHint?: true; postLogoutRedirectUri: string }

    RP-initiated logout (plan §3.8). Without it, logout ends the local session only.

    Type Declaration

    • Optional ReadonlyidTokenHint?: true

      Store the ID token at sign-in and send it as id_token_hint. Off by default: an ID token routinely runs to kilobytes and would consume the session cookie's budget. The README recommends the store strategy for it.

    • ReadonlypostLogoutRedirectUri: string

      The exact post_logout_redirect_uri registered with the provider.

    scopes?: readonly string[]

    Requested scopes. Defaults to ['openid'] for oidc and [] for oauth2.

    tokenEndpointAuth?: TokenEndpointAuth

    Token-endpoint authentication. Defaults to client_secret_basic when a secret is present, otherwise none.

    Settings
    Member Visibility

    On This Page
    Properties
    Methods