@asgardeo/auth-react 1.1.9 → 1.1.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +60 -42
- package/dist/main.js +48 -12
- package/dist/src/api.d.ts +7 -0
- package/dist/src/api.d.ts.map +1 -1
- package/dist/src/authenticate.d.ts +1 -1
- package/dist/src/authenticate.d.ts.map +1 -1
- package/dist/src/models.d.ts +1 -0
- package/dist/src/models.d.ts.map +1 -1
- package/dist/tsconfig.tsbuildinfo +110 -28
- package/package.json +2 -2
- package/src/api.ts +10 -0
- package/src/authenticate.tsx +9 -4
- package/src/models.ts +1 -0
package/README.md
CHANGED
|
@@ -126,10 +126,10 @@ npm install && npm start
|
|
|
126
126
|
|
|
127
127
|
### 1. Installing the Package
|
|
128
128
|
|
|
129
|
-
Install
|
|
129
|
+
Install `@asgardeo/auth-react` and `react-router-dom` from the npm registry.
|
|
130
130
|
|
|
131
131
|
```
|
|
132
|
-
npm install
|
|
132
|
+
npm install @asgardeo/auth-react react-router-dom --save
|
|
133
133
|
```
|
|
134
134
|
|
|
135
135
|
### 2. Import `AuthProvider`, `useAuthContext` and Provide Configuration Parameters
|
|
@@ -219,7 +219,7 @@ The provider takes a prop called `config` that accepts a config object of type [
|
|
|
219
219
|
|
|
220
220
|
In addition, the `fallback` prop is used to specify a fallback component that will be rendered when the user is not authenticated.
|
|
221
221
|
|
|
222
|
-
As an optional parameter, `
|
|
222
|
+
As an optional parameter, `plugin` parameter can be used to pass an external plugin.
|
|
223
223
|
|
|
224
224
|
The `AuthProvider` also automatically requests for the access token should the URL contain the `code` query parameter.
|
|
225
225
|
|
|
@@ -237,14 +237,14 @@ export const MyApp = (): ReactElement => {
|
|
|
237
237
|
}
|
|
238
238
|
```
|
|
239
239
|
|
|
240
|
-
#### Example with
|
|
240
|
+
#### Example with an external Auth SPA plugin
|
|
241
241
|
|
|
242
242
|
```TypeScript
|
|
243
|
-
import {
|
|
243
|
+
import { TokenExchangePlugin } from "@asgardeo/token-exchange-plugin";
|
|
244
244
|
|
|
245
245
|
export const MyApp = (): ReactElement => {
|
|
246
246
|
return (
|
|
247
|
-
<AuthProvider config={ config }
|
|
247
|
+
<AuthProvider config={ config } plugin={ TokenExchangePlugin.getInstance() }>
|
|
248
248
|
<Dashboard />
|
|
249
249
|
</AuthProvider>
|
|
250
250
|
)
|
|
@@ -348,7 +348,7 @@ signIn(config?: SignInConfig, authorizationCode?: string, sessionState?: string,
|
|
|
348
348
|
A callback function that fires when sign-in is successful. The callback function takes an object of type [`BasicUserInfo`](#BasicUserInfo) as an argument.
|
|
349
349
|
#### Description
|
|
350
350
|
|
|
351
|
-
As the name implies, this method is used to sign-in users. This method will have to be called twice to implement the two phases of the authentication process. The first phase generates
|
|
351
|
+
As the name implies, this method is used to sign-in users. This method will have to be called twice to implement the two phases of the authentication process. The first phase generates the authorization URl and takes the user to the single-sign-on page of the identity server, while second phase triggers the token request to complete the authentication process. So, this method should be called when initiating authentication and when the user is redirected back to the app after authentication themselves with the server.
|
|
352
352
|
|
|
353
353
|
The `sign-in` hook is used to fire a callback function after signing in is successful. Check the [on()](#on) section for more information.
|
|
354
354
|
|
|
@@ -429,6 +429,7 @@ httpRequest(config: `HttpRequestConfig`): Promise<HttpResponse>;
|
|
|
429
429
|
|--|--|--|--|
|
|
430
430
|
|`attachToken`|`boolean`|`true`|If set to `true`, the token will be attached to the request header.|
|
|
431
431
|
|`shouldEncodeToFormData`|`boolean`|`false`|If set to `true`, the request body will be encoded to `FormData`. The body (specified by the `data` attribute) should be a Javascript object. |
|
|
432
|
+
|`shouldAttachIDPAccessToken`|`boolean`|`false`| If set to `true`, the IDP access token will be attached to the the request `Authorization` header. |
|
|
432
433
|
|
|
433
434
|
#### Returns
|
|
434
435
|
|
|
@@ -628,6 +629,32 @@ getDecodedIDToken().then((idToken) => {
|
|
|
628
629
|
});
|
|
629
630
|
```
|
|
630
631
|
---
|
|
632
|
+
|
|
633
|
+
### getDecodedIDPIDToken
|
|
634
|
+
|
|
635
|
+
```typescript
|
|
636
|
+
getDecodedIDPIDToken(): Promise<DecodedIDTokenPayload>
|
|
637
|
+
```
|
|
638
|
+
|
|
639
|
+
#### Returns
|
|
640
|
+
|
|
641
|
+
A promise that returns with the IDP [`DecodedIDTokenPayload`](#DecodedIDTokenPayload) object.
|
|
642
|
+
|
|
643
|
+
#### Description
|
|
644
|
+
|
|
645
|
+
This method returns a promise that resolves with the decoded payload of the JWT ID token provided by the IDP.
|
|
646
|
+
|
|
647
|
+
#### Example
|
|
648
|
+
|
|
649
|
+
```TypeScript
|
|
650
|
+
getDecodedIDPIDToken().then((idToken) => {
|
|
651
|
+
// console.log(idToken);
|
|
652
|
+
}).error((error) => {
|
|
653
|
+
// console.error(error);
|
|
654
|
+
});
|
|
655
|
+
```
|
|
656
|
+
---
|
|
657
|
+
|
|
631
658
|
### getIDToken
|
|
632
659
|
|
|
633
660
|
```TypeScript
|
|
@@ -662,7 +689,7 @@ A Promise that resolves with the access token.
|
|
|
662
689
|
|
|
663
690
|
#### Description
|
|
664
691
|
|
|
665
|
-
This returns a promise that resolves with the access token. The promise resolves successfully only if the storage type is set to a type other than `webWorker`. Otherwise an error is thrown.
|
|
692
|
+
This returns a promise that resolves with the access token. The promise resolves successfully only if the storage type is set to a type other than `webWorker`. Otherwise, an error is thrown.
|
|
666
693
|
|
|
667
694
|
#### Example
|
|
668
695
|
|
|
@@ -686,22 +713,13 @@ A Promise that resolves with the [`BasicUserInfo`](#BasicUserInfo) object.
|
|
|
686
713
|
|
|
687
714
|
#### Description
|
|
688
715
|
|
|
689
|
-
This refreshes the access token and stores the refreshed session information in either the session or local storage as per your configuration. Note that this method
|
|
716
|
+
This refreshes the access token and stores the refreshed session information in either the session or local storage as per your configuration. Note that this method is not required to be used when the storage type is set to `webWorker` since the web worker automatically refreshes the token and there is no need for the developer to do it.
|
|
690
717
|
|
|
691
|
-
This method also returns a Promise that resolves with an object containing the attributes mentioned in the table below.
|
|
692
|
-
|Attribute|Description|
|
|
693
|
-
|--|--|
|
|
694
|
-
`"accessToken"`| The new access token |
|
|
695
|
-
`"expiresIn"`| The expiry time in seconds|
|
|
696
|
-
`"idToken"`| The ID token|
|
|
697
|
-
`"refreshToken"`| The refresh token|
|
|
698
|
-
`"scope"`| The scope of the access token|
|
|
699
|
-
`"tokenType"`| The type of the token. E.g.: Bearer|
|
|
700
718
|
|
|
701
719
|
#### Example
|
|
702
720
|
|
|
703
721
|
```TypeScript
|
|
704
|
-
|
|
722
|
+
refreshAccessToken().then((response)=>{
|
|
705
723
|
// console.log(response);
|
|
706
724
|
}).catch((error)=>{
|
|
707
725
|
// console.error(error);
|
|
@@ -868,7 +886,7 @@ const httpClient = getHttpClient();
|
|
|
868
886
|
|
|
869
887
|
When the `responseMode` is set to `form_post`, the authorization code is sent in the body of a `POST` request as opposed to in the URL. So, the Single Page Application should have a backend to receive the authorization code and send it back to the Single Page Application.
|
|
870
888
|
|
|
871
|
-
The backend can then inject the authorization code into a
|
|
889
|
+
The backend can then inject the authorization code into a JavaScript variable while rendering the webpage in the server side. But this results in the authorization code getting printed in the HTML of the page creating a **threat vector**.
|
|
872
890
|
|
|
873
891
|
To address this issue, we recommend storing the authorization code in a server session variable and providing the Single Page Application a separate API endpoint to request the authorization code. The server, when the request is received, can then respond with the authorization code from the server session.
|
|
874
892
|
|
|
@@ -907,29 +925,29 @@ initialize(config);
|
|
|
907
925
|
|
|
908
926
|
### AuthReactConfig
|
|
909
927
|
|
|
910
|
-
| Attribute | Required/Optional | Type | Default Value | Description
|
|
911
|
-
| --------- | ----------------- | ---- | -------------
|
|
912
|
-
| `signInRedirectURL` | Required | `string` | "" | The URL to redirect to after the user authorizes the client app. eg: `https//localhost:3000/sign-in`
|
|
913
|
-
| `signOutRedirectURL` | Optional | `string` | The `signInRedirectURL` URL will be used if this value is not provided. | The URL to redirect to after the user
|
|
914
|
-
| `clientHost` | Optional | `string` | The origin of the client app obtained using `window.origin` | The hostname of the client app. eg: `https://localhost:3000`
|
|
915
|
-
| `clientID` | Required | `string` | "" | The client ID of the OIDC application hosted in the Asgardeo.
|
|
916
|
-
| `clientSecret` | Optional | `string` | "" | The client secret of the OIDC application
|
|
917
|
-
| `enablePKCE` | Optional | `boolean` | `true` | Specifies if a PKCE should be sent with the request for the authorization code.
|
|
918
|
-
| `prompt` | Optional | `string` | "" | Specifies the prompt type of an OIDC request
|
|
919
|
-
| `responseMode` | Optional | `ResponseMode` | `"query"` | Specifies the response mode. The value can either be `query` or `form_post`
|
|
920
|
-
| `scope` | Optional | `string[]` | `["openid"]` | Specifies the requested scopes.
|
|
921
|
-
| `baseUrl` | Required (If `wellKnownEndpoint` or `endpoints` is not provided) | `string` | "" | The origin of the Identity Provider. eg: `https://www.asgardeo.io/t/<org_name>`
|
|
922
|
-
| `endpoints` | Optional (Required to provide all endpoints, if `wellKnownEndpoint` or `baseUrl` is not provided) | `OIDCEndpoints` | [OIDC Endpoints Default Values](#oidc-endpoints) | The OIDC endpoint URLs. The SDK will try to obtain the endpoint URLS
|
|
923
|
-
`wellKnownEndpoint` | Optional | `string` | `"/oauth2/token/.well-known/openid-configuration"` | The URL of the `.well-known` endpoint.
|
|
924
|
-
| `overrideWellEndpointConfig` | Optional | `boolean` | `false` | If this option is set to `true`, then the `endpoints` object will override endpoints obtained
|
|
925
|
-
| `validateIDToken` | Optional | `boolean` | `true` | Allows you to enable/disable JWT ID token validation after obtaining the ID token.
|
|
926
|
-
| `clockTolerance` | Optional | `number` | `60` | Allows you to configure the leeway when validating the id_token.
|
|
927
|
-
| `skipRedirectCallback` | Optional | `boolean` | `false` | Stop listening to Auth param changes i.e `code` & `session_state` to trigger auto login.
|
|
928
|
-
| [`storage`](#storage) | Optional | `"sessionStorage"`, `"webWorker"`, `"localStorage"` | `"sessionStorage"` | The storage medium where the session information such as the access token should be stored
|
|
928
|
+
| Attribute | Required/Optional | Type | Default Value | Description |
|
|
929
|
+
| --------- | ----------------- | ---- | ------------- |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
930
|
+
| `signInRedirectURL` | Required | `string` | "" | The URL to redirect to after the user authorizes the client app. eg: `https//localhost:3000/sign-in` |
|
|
931
|
+
| `signOutRedirectURL` | Optional | `string` | The `signInRedirectURL` URL will be used if this value is not provided. | The URL to redirect to after the user | signs out. eg: `https://localhost:3000/dashboard` |
|
|
932
|
+
| `clientHost` | Optional | `string` | The origin of the client app obtained using `window.origin` | The hostname of the client app. eg: `https://localhost:3000` |
|
|
933
|
+
| `clientID` | Required | `string` | "" | The client ID of the OIDC application hosted in the Asgardeo. |
|
|
934
|
+
| `clientSecret` | Optional | `string` | "" | The client secret of the OIDC application |
|
|
935
|
+
| `enablePKCE` | Optional | `boolean` | `true` | Specifies if a PKCE should be sent with the request for the authorization code. |
|
|
936
|
+
| `prompt` | Optional | `string` | "" | Specifies the prompt type of an OIDC request |
|
|
937
|
+
| `responseMode` | Optional | `ResponseMode` | `"query"` | Specifies the response mode. The value can either be `query` or `form_post` |
|
|
938
|
+
| `scope` | Optional | `string[]` | `["openid"]` | Specifies the requested scopes. |
|
|
939
|
+
| `baseUrl` | Required (If `wellKnownEndpoint` or `endpoints` is not provided) | `string` | "" | The origin of the Identity Provider. eg: `https://www.asgardeo.io/t/<org_name>` |
|
|
940
|
+
| `endpoints` | Optional (Required to provide all endpoints, if `wellKnownEndpoint` or `baseUrl` is not provided) | `OIDCEndpoints` | [OIDC Endpoints Default Values](#oidc-endpoints) | The OIDC endpoint URLs. The SDK will try to obtain the endpoint URLS | using the `.well-known` endpoint. If this fails, the SDK will use these endpoint URLs. If this attribute is not set, then the default endpoint URLs will be | used. However, if the `overrideWellEndpointConfig` is set to `true`, then this will override the endpoints obtained from the `.well-known` endpoint. |
|
|
941
|
+
`wellKnownEndpoint` | Optional | `string` | `"/oauth2/token/.well-known/openid-configuration"` | The URL of the `.well-known` endpoint. |
|
|
942
|
+
| `overrideWellEndpointConfig` | Optional | `boolean` | `false` | If this option is set to `true`, then the `endpoints` object will override endpoints obtained | from the `.well-known` endpoint. If this is set to `false`, then this will be used as a fallback if the request to the `.well-known` endpoint fails. |
|
|
943
|
+
| `validateIDToken` | Optional | `boolean` | `true` | Allows you to enable/disable JWT ID token validation after obtaining the ID token. |
|
|
944
|
+
| `clockTolerance` | Optional | `number` | `60` | Allows you to configure the leeway when validating the id_token. |
|
|
945
|
+
| `skipRedirectCallback` | Optional | `boolean` | `false` | Stop listening to Auth param changes i.e `code` & `session_state` to trigger auto login. |
|
|
946
|
+
| [`storage`](#storage) | Optional | `"sessionStorage"`, `"webWorker"`, `"localStorage"` | `"sessionStorage"` | The storage medium where the session information such as the access token should be stored. | |
|
|
929
947
|
| `resourceServerURLs` |Required if the `storage` is set to `webWorker` | `string[]` | `[]` | The URLs of the API endpoints. This is needed only if the storage method is set to `webWorker`. When API calls are made through the [`httpRequest`](#httprequest) or the [`httpRequestAll`](#httprequestall) method, only the calls to the endpoints specified in the `baseURL` attribute will be allowed. Everything else will be denied. | |
|
|
930
|
-
|`requestTimeout` | Optional | `number`| 60000 (seconds) | Specifies in seconds how long a request to the web worker should wait before being timed out.
|
|
931
|
-
| `disableTrySignInSilently` | Optional | `boolean` | `true` | Specifies if the SDK should try to sign in silently on mount
|
|
932
|
-
|`enableOIDCSessionManagement` |Optional|`boolean`| false | Flag to enable OIDC Session Management |
|
|
948
|
+
|`requestTimeout` | Optional | `number`| 60000 (seconds) | Specifies in seconds how long a request to the web worker should wait before being timed out. |
|
|
949
|
+
| `disableTrySignInSilently` | Optional | `boolean` | `true` | Specifies if the SDK should try to sign in silently on mount. |
|
|
950
|
+
|`enableOIDCSessionManagement` |Optional|`boolean`| false | Flag to enable OIDC Session Management. Set this flag to `true` to add single logout capabilities to your application. |
|
|
933
951
|
|
|
934
952
|
### BasicUserInfo
|
|
935
953
|
|