The library documents itself · Security & governance
stzOidcProvider
32 own methods · 6 forms written with extensions, listed under their method
the source: base/security/stzOidcProvider.ring(opens in a new tab) · All classes · The area reference: Security & governance
Under each method, its extensions (Q CS XT Z ZZ IB W U): bold and ticked, it exists; struck, it does not. The extensions and what they mean
No method of this class is run on this page: the class reaches files, the network, processes, the clock, chance or sound, and an example run here would only be an example of its effects. Each method carries the explanation the library gives of itself.
Method
Explanation, as the source carries it
init
(no comment in the source: the name reads as a sentence) initno extension
Issuer
identity + keysno extension
SigningKeyId
(no comment in the source: the name reads as a sentence) signing key idno extension
SigningAlgorithm
(no comment in the source: the name reads as a sentence) signing algorithmno extension
UseRsaKey
Sign with RS256 instead, using an RSA private key you already have. Plenty of older clients accept RS256 and nothing else, so an ES256-only issuer cannot serve them. The key stays here; only its public parts reach the JWKS.QCSXTZZZIBWU
UseNewRsaKey
generate one, for developmentQCSXTZZZIBWU
RotateKey
Start signing with a NEW key. The previous public key stays in the JWKS, so tokens already issued keep verifying until they expire -- rotation without an outage. A 32-byte hex seed makes it deterministic ("" = random).QCSXTZZZIBWU
NumberOfPublishedKeys
(no comment in the source: the name reads as a sentence) number of published keysno extension
JwksJson
what a relying party fetches from jwks_uri: the CURRENT key plus any still-valid previous ones.no extension
DiscoveryJson
the discovery document served at /.well-known/openid-configuration.no extension
RegisterClient
the client registry --------------------------------------------- Register an application. The secret is stored HASHED (a leak of our store must not yield working client credentials). paRedirectUris is the exact set a code may be delivered to.QCSXTZZZIBWU
HasClient
(no comment in the source: the name reads as a sentence) has clientno extension
ClientIds
(no comment in the source: the name reads as a sentence) client idsno extension
RedirectUrisOf
(no comment in the source: the name reads as a sentence) redirect uris ofno extension
RemoveClient
(no comment in the source: the name reads as a sentence) remove clientno extension
Authorize
step 1: authorize (the user is already signed in to US) ---------- Issue an authorization code for an authenticated user. paReq: [ :clientId, :redirectUri, :state, :nonce, :codeChallenge, :scope ] -> [ :ok, :code, :redirectTo, :state, :why, :error ]no extension
AuthorizeAt
(no comment in the source: the name reads as a sentence) authorize atno extension
ExchangeCode
step 2: token (a back-channel call from the app's server) -------- Exchange a code for tokens -> [ :ok, :idToken, :accessToken, :tokenType, :expiresIn, :subject, :why, :error ].no extension
ExchangeCodeAt
(no comment in the source: the name reads as a sentence) exchange code atno extension
IssueIdToken
token minting ---------------------------------------------------- a signed id-token for a subject + audience (used by the flow above, and directly when an app trusts this provider in-process).no extension
IssueIdTokenAt
(no comment in the source: the name reads as a sentence) issue id token atno extension
SetTokenTTL
(no comment in the source: the name reads as a sentence) set token ttlQCSXTZZZIBWU
TokenTTL
(no comment in the source: the name reads as a sentence) token ttlno extension
SetCodeTTL
(no comment in the source: the name reads as a sentence) set code ttlQCSXTZZZIBWU
CodeTTL
(no comment in the source: the name reads as a sentence) code ttlno extension
NumberOfPendingCodes
housekeeping + introspectionno extension
PurgeExpiredCodesAt
(no comment in the source: the name reads as a sentence) purge expired codes atno extension
PurgeExpiredCodes
(no comment in the source: the name reads as a sentence) purge expired codesno extension
PkceChallengeOf
the S256 challenge for a verifier (the same computation a client makes).no extension
Why
(no comment in the source: the name reads as a sentence) whyno extension
ErrorCode
(no comment in the source: the name reads as a sentence) error codeno extension
Show
(no comment in the source: the name reads as a sentence) showno extension