---
name: "WebAuth::Token::Cred"
section: "3pm"
platform: "linux"
package: "libwebauth-perl"
version: "4.7.0-8"
release: "Debian 11 (Bullseye)"
platforms: ["linux"]
url: "https://new.carta.tech/WebAuth::Token::Cred"
---

# WebAuth::Token::Cred(3pm)

WebAuth cred tokens

## NAME

WebAuth::Token::Cred - WebAuth cred tokens

## SYNOPSIS

```
    my $token = WebAuth::Token::Cred->new;
    $token->subject ('user');
    $token->type ('krb5');
    $token->service ('service/foo@EXAMPLE.COM');
    $token->data ($ticket);
    $token->creation (time);
    $token->expiration (time + 3600);
    print $token->encode ($keyring), "\n";
```

## DESCRIPTION

A WebAuth cred token, which holds a credential for some other service, usually a Kerberos service ticket.  It is sent back by the WebKDC to a WebAuth Application Server when requested using a proxy token, and the WAS also uses it to store the credentials in cookies.

## CLASS METHODS

- new ()

  Create a new, empty WebAuth::Token::Cred.  At least some attributes will have to be set using the accessor methods described below before the token can be used.

## INSTANCE METHODS

As with WebAuth module functions, failures are signaled by throwing WebAuth::Exception rather than by return status.

## General Methods

- encode (KEYRING)

  Generate the encoded and encrypted form of this token using the provided KEYRING.  The encryption key used will be the one returned by the **best\_key()** method of WebAuth::Keyring on that KEYRING.

## Accessor Methods

- subject (\[SUBJECT\])

  Get or set the subject, which holds the identity of the user for which this token contains credentials.

- type (\[TYPE\])

  Get or set the type of credential stored in this token.  Currently, this is always `"krb5"` (but still must be explicitly set if creating a new token).

- service (\[SERVICE\])

  Get or set the service for which this token stores a credential.  For tokens of type `"krb5"`, this is the fully-qualified principal name of the service ticket stored in this token.

- data (\[CREDENTIAL\])

  Get or set the credential stored in this token.  This is currently always a Kerberos ticket in the form created by the **export\_cred()** method of the WebAuth::Krb5 module.

- creation (\[TIMESTAMP\])

  Get or set the creation timestamp for this token in seconds since epoch. If not set, the encoded token will have a creation time set to the time of encoding.

- expiration (\[TIMESTAMP\])

  Get or set the expiration timestamp for this token in seconds since epoch.

## AUTHOR

Russ Allbery \<eagle@eyrie.org\>

## SEE ALSO

**WebAuth**(3), **WebAuth::Keyring**(3), **WebAuth::Krb5**(3), **WebAuth::Token**(3)

This module is part of WebAuth.  The current version is available from \<http://webauth.stanford.edu/\>.