Setu-TS
    Preparing search index...

    Interface SignInProviderBase

    The fields an oidc and an oauth2 provider share.

    0.8.0

    interface SignInProviderBase {
        clientId: string;
        clientSecret?: string;
        failureRedirect?: string;
        name: string;
        redirectUri: string;
        scopes?: readonly string[];
        tokenEndpointAuth?: TokenEndpointAuth;
        onTokens?(tokens: ProviderTokens): void | Promise<void>;
        toPrincipal(
            claims: Readonly<Record<string, unknown>>,
        ): IPrincipal | Promise<IPrincipal | null> | null;
    }

    Hierarchy (View Summary)

    Index
    clientId clientSecret? failureRedirect? name redirectUri scopes? tokenEndpointAuth?
    onTokens? toPrincipal
    clientId: string

    The provider's client id.

    clientSecret?: string

    The client secret. Required for client_secret_basic and client_secret_post, forbidden with tokenEndpointAuth: 'none'.

    failureRedirect?: string

    Redirect here with a fixed ?error= code instead of answering 401. The code is one of this plugin's own; a provider-supplied message is never placed in the URL.

    name: string

    Kebab-case name, used in the route paths (/auth/<name>/login).

    redirectUri: string

    The exact redirect URI sent to the provider. Its path must end with that provider's callback path, <basePath>/<name>/callback, so the registered route and the value the provider matches against cannot disagree.

    scopes?: readonly string[]

    Requested scopes. Defaults to ['openid'] for oidc and [] for oauth2.

    tokenEndpointAuth?: TokenEndpointAuth

    Token-endpoint authentication. Defaults to client_secret_basic when a secret is present, otherwise none.

    • Maps the verified claims to a principal. For oidc these are the ID token claims; for oauth2 the userinfoEndpoint response. Return null to refuse the sign-in with 403.

      sub is unique only within its issuer, so an application with more than one identity source must namespace the id, exactly as TrustedIssuer.toPrincipal requires.

      Parameters

      • claims: Readonly<Record<string, unknown>>

      Returns IPrincipal | Promise<IPrincipal | null> | null

    Settings
    Member Visibility

    On This Page
    Properties
    Methods