Class: OIDCStrategy

Defined in: src/auth/OIDCStrategy.ts:165

Implements an authentication strategy for performing OIDC 2.0 or OpenID Connect (OIDC) authorization with a third-party provider. This strategy does not require that require an account already be registered. When using this strategy, ensure to allow for account creation to occur after a successful login.

The authorization flow has the following steps:

1. Client initiates a request for an Authorization Request URI. Builds the Authorization Request URI and returns it to the client in a 302 REDIRECT response. Clients can pass in no_redirect=true to receive a JSON response with the URL instead.
2. The client should automatically redirect the user to the Authorization Request URI obtained in step 1.
3. Once the user has approved the authorization request with the third-party provider the client will be redirected to the application's registered callback URL with a single query parameter containing an Authorization Code. The client initiates a request to a route handler, containing the code, and then calls authenticate().

NOTE: Requires session support!

Implements

• AuthStrategy

Constructors

Constructor

new OIDCStrategy(options): OIDCStrategy

Defined in: src/auth/OIDCStrategy.ts:171

Parameters

options

OIDCStrategyOptions

Returns

OIDCStrategy

Properties

name

readonly name: string = "oauth"

Defined in: src/auth/OIDCStrategy.ts:166

The unique name of the strategy used to register with the AuthMiddleware.

Implementation of

AuthStrategy.name

Methods

authenticate()

authenticate(req, res, required?): Promise<AuthResult | undefined>

Defined in: src/auth/OIDCStrategy.ts:301

Attempts to perform authentication with the given request data. If authentication was successful, returns an AuthResult containing the authentication details. If authentication fails and required is set to true throws an error, otherwise returns undefined.

Parameters

req

HttpRequest

The request containing data to attempt authentication with.

res

HttpResponse

The response to use when writing back directly to the client.

required?

boolean

Returns

Promise<AuthResult | undefined>

Implementation of

AuthStrategy.authenticate

---

authenticateSync()

authenticateSync(req, res, required?): AuthResult | undefined

Defined in: src/auth/OIDCStrategy.ts:383

Attempts to perform authentication with the given request data. If authentication was successful, returns an AuthResult containing the authentication details. If authentication fails and required is set to true throws an error, otherwise returns undefined.

This is the synchronous version of authenticate that performs blocking based authentication.

Parameters

req

HttpRequest

The request containing data to attempt authentication with.

res

HttpResponse

The response to use when writing back directly to the client.

required?

boolean

Returns

AuthResult | undefined

Implementation of

AuthStrategy.authenticateSync

---

buildAuthorizationURI()

protected buildAuthorizationURI(req, redirectURI?): string

Defined in: src/auth/OIDCStrategy.ts:214

Creates and returns the Authorization Request URI for the configured OIDC provider.

Parameters

req

HttpRequest

The source HTTP request.

redirectURI?

string

The source URI to redirect the user to once authentication is complete.

Returns

string

---

convertProfile()

protected convertProfile(profile): OIDCProfile

Defined in: src/auth/OIDCStrategy.ts:455

Converts the given user profile obtained from the specified OAuth provider into an OIDCProfile object.

Parameters

profile

any

The profile to convert.

Returns

OIDCProfile

---

exchangeOIDCCode()

protected exchangeOIDCCode(req): Promise<any>

Defined in: src/auth/OIDCStrategy.ts:397

Performs a request against the OIDC provider to exchange the given authorization code for an access token.

Parameters

req

HttpRequest

The request data to use in the exchange exchange.

Returns

Promise<any>

---

resolvePkceMethod()

protected resolvePkceMethod(clientMethod?): PkceMethod

Defined in: src/auth/OIDCStrategy.ts:183

Resolves the effective PKCE code challenge method to use, given what the provider requires (if anything specific) and what the client requested. Throws if the client requests an invalid value, or a value that conflicts with a provider-mandated method.

Parameters

clientMethod?

string

The code_challenge_method requested by the client, if any.

Returns

PkceMethod

---

retrieveUserProfile()

protected retrieveUserProfile(token, req): Promise<OIDCProfile | undefined>

Defined in: src/auth/OIDCStrategy.ts:496

Retrieves the user profile from the specified OIDC provider using the given access token.

Parameters

token

any

The access token to use to retrieve the user profile.

req

HttpRequest

The source HTTP request, used to validate the id_token's nonce claim.

Returns

Promise<OIDCProfile | undefined>