Class: Safire::Protocols::UdapSoftwareStatement Private

Inherits:
Object
  • Object
show all
Includes:
URIValidation
Defined in:
lib/safire/protocols/udap_software_statement.rb

Overview

This class is part of a private API. You should avoid using this class if possible, as it may be removed or be changed in the future.

Builds X.509-backed UDAP Dynamic Client Registration software statements.

The resulting compact JWS follows the software-statement requirements in HL7 UDAP Security STU2 and is intended for use by the UDAP registration protocol flow. This class performs local signing-identity checks only; the authorization server remains responsible for trusting the submitted client certificate chain.

See Also:

Instance Method Summary collapse

Constructor Details

#initialize(metadata:, client_uri:, registration_endpoint:, private_key:, certificate_chain:, supported_algorithms:, algorithm: nil, clock: Time, jti_generator: nil, allow_insecure_localhost: false) ⇒ UdapSoftwareStatement

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns a new instance of UdapSoftwareStatement.

Parameters:

  • metadata (Safire::Protocols::UdapRegistrationMetadata) —

    validated registration metadata

  • client_uri (String) —

    absolute client URI used as iss and sub

  • registration_endpoint (String) —

    discovered registration endpoint used exactly as aud

  • private_key (OpenSSL::PKey::RSA, OpenSSL::PKey::EC, String) —

    signing private key or PEM

  • certificate_chain (Array<String, OpenSSL::X509::Certificate>) —

    leaf-first, issuer-ordered client certificate chain

  • supported_algorithms (Array<String>) —

    algorithms advertised by UDAP discovery

  • algorithm (String, nil) (defaults to: nil) —

    optional explicit signing algorithm

  • clock (#now) (defaults to: Time) —

    time source returning Time for deterministic NumericDate claims

  • jti_generator (#call, nil) (defaults to: nil) —

    JTI source; defaults to SecureRandom.uuid

  • allow_insecure_localhost (Boolean) (defaults to: false) —

    permit HTTP localhost registration endpoint for development

Raises:



52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
 
# File 'lib/safire/protocols/udap_software_statement.rb', line 52

def initialize(metadata:, client_uri:, registration_endpoint:, private_key:, certificate_chain:,
               supported_algorithms:, algorithm: nil, clock: Time, jti_generator: nil,
               allow_insecure_localhost: false)
  @metadata = validate_metadata(metadata)
  @client_uri = validate_client_uri(client_uri)
  @registration_endpoint = validate_registration_endpoint(registration_endpoint, allow_insecure_localhost)
  @clock = validate_clock(clock)
  @jti_generator = validate_jti_generator(jti_generator)
  @private_key = parse_private_key(private_key)
  @certificate_chain = parse_certificate_chain(certificate_chain)
  @supported_algorithms = validate_supported_algorithms(supported_algorithms)
  @algorithm = select_algorithm(algorithm)

  validate_certificate_chain!
  freeze
end

Instance Method Details

#to_jwt ⇒ String

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns the signed software statement as a compact JWS string.

Returns:

  • (String)

Raises:



74
75
76
77
78
79
 
# File 'lib/safire/protocols/udap_software_statement.rb', line 74

def to_jwt
  signing_time = current_time
  validate_certificate_times!(signing_time)

  JWT.encode(payload(signing_time), @private_key, @algorithm, header)
end