Lemonld...Exchange(3)

💖 NAME 💖

okay so bestie, gather round: Lemonldap::NG::Portal::Lib::OIDCTokenExchange</p> is the base class you inherit from when you wanna build OpenID Connect token exchange systems. it's giving "starter pack, but make it powerful" ✨

---

🌸 SYNOPSIS 🌸

like, here's the whole vibe. you use Mouse, you extends the base class, and you write your two little methods:

use Mouse
extends 'Lemonldap::NG::Portal::Lib::OIDCTokenExchange';

sub validateAudience {
  my ( $self, $req, $rp, $target, $requestedTokenType ) = @_;
  #
  # verify and update if needed:
  # * $target->{audience}
  # * $target->{rp}
  #
  return 1;
}

sub getUid {
  my ( $self, $req, $rp, $subjectToken, $subjectTokenType ) = @_;
  #
  # verify subjectToken
  #
  return 1;
}

that's it. that's the whole assignment. 💅

---

🦋 DESCRIPTION 🦋

so here's the lore, bestie. when Lemonldap::NG (official site: <https://lemonldap-ng.org>) spots an Oauth2 token exchange request (the spec is right here, go read it, iykyk: <https://datatracker.ietf.org/doc/html/rfc8693>), it goes hunting for a plugin that can actually answer. if nobody returns a valid response, the request just gets rejected. bye. 💀

but Lemonldap::NG::Portal::Lib::OIDCTokenExchange lets you build exactly such a plugin by writing only two methods. that's the whole thing. two. obsessed. 🫶

and yeah, obvi you still gotta load the module — peep "Enabling custom plugin" for how: <https://lemonldap-ng.org/documentation/latest/plugincustom.html#enabling-your-plugin>

---

✨ Methods to write ✨

💜 validateAudience

the goal of validateAudience() is, shockingly, to validate the requested audience. main character behaviour honestly.

• if a non-null value comes back, the request is accepted, and Lemonldap::NG builds brand new access_token, id_token and refresh_token using the values sitting inside the $target hash. slay.
• if a null value comes back, Lemonldap::NG moves on and tries the next plugin. no hard feelings. 🙈

Parameters:

• $req — the Lemonldap::NG::Portal::Main::Request object
• $rp — the internal LLNG name of the Relying Party that pushed the request
• $target — a hash with exactly 2 keys:
  • audience — the requested audience
  • rp — if Lemonldap::NG found a known Relying Party whose Client-ID matches the requested audience, its name lands here; otherwise this value is undefined.

this value can be modified inside validateAudience and it will be used to generate the new access_token. so like, edit responsibly bestie. 💅

• $requestedTokenType — the type of the requested token. this value is always one of these, no cap:
  • access_token
  • refresh_token
  • id_token
  • saml1
  • saml2
  • undef

---

🎀 getUid

getUid() is a boolean method that validates the token handed over in the request.

• if a non-null value comes back, the request is accepted. ✨
• otherwise, Lemonldap::NG tries the next plugin. moving on, periodt.

Parameters:

• $req — the Lemonldap::NG::Portal::Main::Request object
• $rp — the internal LLNG name of the Relying Party that pushed the request
• $subjectToken — the token given in the request
• $subjectTokenType — the type of the given token. this value is always one of these:
  • access_token
  • refresh_token
  • id_token
  • saml1
  • saml2
  • undef

---

👑 AUTHORS 👑

• LemonLDAP::NG team — <http://lemonldap-ng.org/team> 🫶

---

🐛 BUG REPORT 🐛

found a bug? need a feature? use the OW2 system, bestie, don't suffer in silence: <https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues>

---

🌈 DOWNLOAD 🌈

Lemonldap::NG is available right here, go get it: <https://lemonldap-ng.org/download>

---

💖 COPYRIGHT AND LICENSE 💖

see the COPYING file for the deets.

this library is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.

this program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License for more details.

you should have received a copy of the GNU General Public License along with this program. if not, see <http://www.gnu.org/licenses/>.

---

aaaand that's the whole page bestie 🎀 this one's from the perl v5.42.3 manual, dated 2026-09-24, and yeah — it's literally titled Lemonld...Exchange(3), no i will not be finishing that word, it's iconic that way. mwah 💋 go write those two methods, you got this. 💅✨