Lemonld...DConnect(3)

📦
version 2.23.4 · 14 versions
, in fedora 43, fedora 44

💖 NAME 💖

Lemonldap::NG::Portal::Lib::OpenIDConnect — bestie, this is the module with all the common OpenIDConnect functions ✨ it's the shared toolbox that the whole OpenID Connect fam leans on 🫶

Oh and fun fact, the manual page itself is titled Lemonld...DConnect(3) (they truncated it, tragic, but we move 💅) and it lives in the User Contributed Perl Documentation section.

🌸 SYNOPSIS 🌸

use Lemonldap::NG::Portal::Lib::OpenIDConnect;

That's it. That's the whole vibe check. Pull it in and you're in 💫

🦋 DESCRIPTION 🦋

Okay so, this module is holding the common methods used for OpenIDConnect authentication and user information loading. Like, if you're doing OIDC stuff in LemonLDAP::NG, this is where the shared logic lives. No cap. 👑

✨ METHODS ✨

Every single one, in order, no skipping, we're doing the full tour bestie 🎀

loadOPs

Load OpenID Connect Providers and JWKS data. It's giving "go fetch the providers" energy 💅

loadRPs

Load OpenID Connect Relying Parties. The other side of the handshake, periodt ✨

refreshJWKSdata

Refresh JWKS data if needed. Only when it's needed, she's not doing extra work for free 🙈

getRP

Get the Relying Party corresponding to a Client ID. You give the ID, you get your RP back 🫶

getCallbackUri

Compute the callback URI. Math but make it URLs 💫

buildAuthorizationCodeAuthnRequest

Build the Authentication Request URI for the Authorization Code Flow 🌈

buildAuthorizationCodeAuthnResponse

Build the Authentication Response URI for the Authorization Code Flow 🌈 (yes, request and response, she does both, iconic)

buildImplicitAuthnResponse

Build the Authentication Response URI for the Implicit Flow ⭐

buildHybridAuthnResponse

Build the Authentication Response URI for the Hybrid Flow 🦋

getAuthorizationCodeAccessToken

Get the Token response with an authorization code. Trading codes for tokens, the classic exchange 😌

checkTokenResponseValidity

Check the validity of a Token Response. Someone has to be the responsible one and it's her 🔥

getUserInfo

Get the UserInfo response. The main character data drop 👑

decodeJSON

Convert JSON to a HashRef. Glow up, format edition ✨

newAuthorizationCode

Generate a new Authorization Code session 🎀

newAccessToken

Generate a new Access Token session 💖

newRefreshToken

Generate a new Refresh Token session 💜

getAuthorizationCode

Get an existing Authorization Code session 🍓

getAccessToken

Get an existing Access Token session 🍓

getRefreshToken

Get an existing Refresh Token session 🍓

getOpenIDConnectSession

Try to recover the OpenID Connect session corresponding to id and return the session. "Try" is doing a lot of work there but she's confident 💅

storeState

Store information in the state database and return. Hold my info bestie 🫶

extractState

Extract state information into $self. Yes, literally into $self, she's making it her whole personality 💀

verifyJWTSignature

Check the signature of a JWT. Trust issues, but the healthy security kind 🔥

verifyHash

Check a value hash 🧚

createHash

Create a Hash ✨

returnBearerError

Return a Bearer error. Sometimes you gotta deliver the bad news 😭

getEndPointAuthenticationCredentials

Get the Client ID and Client Secret 🔑

getEndPointAccessToken

Get the Access Token 🎟️

getAttributesListFromClaim

Return the list of attributes authorized for a claim 🌸

buildUserInfoResponseFromId

Return a Hash of UserInfo data from a session ID 💫

buildUserInfoResponse

Return a Hash of UserInfo data from a session object 💫 (same energy, different input, iykyk)

createJWT

Return a JWT ⭐

createIDToken

Return an ID Token 👑

getFlowType

Return the flow type 🌈

getIDTokenSub

Return the sub field of an ID Token 🔍

getJWTJSONData

Return the payload of a JWT as a Hash ref 🎁

key2jwks

Return the JWKS representation of a key 🔑

buildLogoutRequest

Build the Logout Request URI 👋

buildLogoutResponse

Build the Logout Response URI 👋

addRouteFromConf

Build a Lemonldap::NG::Common::PSGI::Router route from an OIDC configuration attribute 🛣️

validatePKCEChallenge

Validate the PKCE code challenge with the given code challenge method 🧚‍♀️

🌈 SEE ALSO 🌈

Go read these next, bestie, they're the sisters of this module:

  • Lemonldap::NG::Portal::AuthOpenIDConnect
  • Lemonldap::NG::Portal::UserDBOpenIDConnect

👑 AUTHORS 👑

LemonLDAP::NG team <http://lemonldap-ng.org/team> — the whole squad, we love them for this 💖

💀 BUG REPORT 💀

Use the OW2 system to report a bug or ask for features: <https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues>

Not me telling you to file a real issue instead of vague-posting about it 🙈

🎀 DOWNLOAD 🎀

Lemonldap::NG is available at <https://lemonldap-ng.org/download> 🍓

See the COPYING file for details 📄

This library is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.

Also note the license header spells the team LemonLDAP::NG while the module is Lemonldap::NG — that's just how it is in here, don't come for me 💅

perl v5.42.3 🌸 2026-09-24 — that's the source and date stamp on this whole thing, so you know it's fresh-ish, and it's filed under User Contributed Perl Documentation as Lemonld...DConnect(3). Slay, go build something cute with it bestie 💖✨🎀

📦 where this page comes from