lws-jwt-auth.h

Go to the documentation of this file.

/*
 * libwebsockets - small server side websockets and web server implementation
 *
 * Copyright (C) 2010 - 2026 Andy Green <andy@warmcat.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to
 * deal in the Software without restriction, including without limitation the
 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
 * sell copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 */
 
#if !defined(_LWS_JWT_AUTH_H_)
#define _LWS_JWT_AUTH_H_
 
#define LWS_SSO_MAX_COOKIE 4096
struct lws_jwt_auth;
 
/* States emitted via the callback */
#define LWS_JWT_AUTH_STATE_REAUTH  1
#define LWS_JWT_AUTH_STATE_EXPIRED 2
 
typedef int (*lws_jwt_auth_cb_t)(struct lws_jwt_auth *ja, int state, void *user);
 
/*
 * The "pur" claim the lws auth server signs into its session and device
 * tokens, and that its in-tree relying parties (lws-login, deaddrop, hls,
 * oauth-preauth, dht-dnssec-monitor, the auth server itself) require.  Any
 * other kind of token signed with the same jwk carries a different purpose,
 * or none, and is refused by them.
 */
#define LWS_JWT_AUTH_PURPOSE_SSO "sso"

struct lws_jwt_auth_info {
        struct lws_jwk          *jwk;
        const char              *cookie_name;
        const char              *iss;
        const char              *aud;
        const char              *purpose;
        lws_jwt_auth_cb_t       cb;
        void                    *user;
};

LWS_VISIBLE LWS_EXTERN struct lws_jwt_auth *
lws_jwt_auth_create_via_info(struct lws *wsi, const struct lws_jwt_auth_info *i,
                             const char **reason);

LWS_VISIBLE LWS_EXTERN struct lws_jwt_auth *
lws_jwt_auth_create(struct lws *wsi, struct lws_jwk *jwk,
                    const char *cookie_name,
                    lws_jwt_auth_cb_t cb, void *user,
                    const char **reason);

LWS_VISIBLE LWS_EXTERN int
lws_jwt_auth_query_grant(struct lws_jwt_auth *ja, const char *service_name);

LWS_VISIBLE LWS_EXTERN const char *
lws_jwt_auth_get_sub(struct lws_jwt_auth *ja);

LWS_VISIBLE LWS_EXTERN const char *
lws_jwt_auth_get_did(struct lws_jwt_auth *ja);

LWS_VISIBLE LWS_EXTERN uint32_t
lws_jwt_auth_get_uid(struct lws_jwt_auth *ja);

LWS_VISIBLE LWS_EXTERN uint64_t
lws_jwt_auth_get_exp(struct lws_jwt_auth *ja);

LWS_VISIBLE LWS_EXTERN uint32_t
lws_jwt_auth_get_sec(struct lws_jwt_auth *ja);

LWS_VISIBLE LWS_EXTERN uint32_t
lws_jwt_auth_count_grants(struct lws_jwt_auth *ja);

LWS_VISIBLE LWS_EXTERN int
lws_jwt_auth_update(struct lws_jwt_auth *ja, const char *jwt, const char **reason);

LWS_VISIBLE LWS_EXTERN void
lws_jwt_auth_destroy(struct lws_jwt_auth **ja);
 
#endif /* _LWS_JWT_AUTH_H_ */