---
name: "WebAuth::Token::Id"
section: "3pm"
platform: "linux"
package: "libwebauth-perl"
version: "4.7.0-8"
release: "Debian 11 (Bullseye)"
platforms: ["linux"]
url: "https://new.carta.tech/WebAuth::Token::Id"
---

# WebAuth::Token::Id(3pm)

WebAuth id tokens

## NAME

WebAuth::Token::Id - WebAuth id tokens

## SYNOPSIS

```
    my $token = WebAuth::Token::Id->new;
    $token->subject ('user');
    $token->auth ('webkdc');
    $token->creation (time);
    $token->expiration (time + 3600);
    print $token->encode ($keyring), "\n";
```

## DESCRIPTION

A WebAuth id token, which identifies a user to a WebAuth Authentication Server.  This token is sent from the WebKDC to the WAS following a user authentication to communicate the authentication information.

## CLASS METHODS

- new ()

  Create a new, empty WebAuth::Token::Id.  At least some attributes will have to be set using the accessor methods described below before the token can be used.

## INSTANCE METHODS

As with WebAuth module functions, failures are signaled by throwing WebAuth::Exception rather than by return status.

## General Methods

- encode (KEYRING)

  Generate the encoded and encrypted form of this token using the provided KEYRING.  The encryption key used will be the one returned by the **best\_key()** method of WebAuth::Keyring on that KEYRING.

## Accessor Methods

- subject (\[SUBJECT\])

  Get or set the subject, which holds the authenticated identity of the user holding this token.  This is set for tokens of authenticator type `"webkdc"`, but not for tokens of authenticator type `"krb5"`.

- authz\_subject (\[SUBJECT\])

  Get or set the authorization subject, which holds the asserted authorization identity of the user holding this token.  The authorization identity may not match the authenticated identity.  It represents a request to use the authorization identity instead of the authentication subject when applying ACLs or determining identity in the application.

- auth (\[TYPE\])

  Get or set the authentication type, which describes what type of authenticator is included in this token.  Currently will be one of the values `"webkdc"`, indicating a bearer token, and `"krb5"`, indicating that the token contains a Kerberos authenticator.

- auth\_data (\[DATA\])

  Get or set the authentication data.  If the authenticator type is `"krb5"`, this will hold a Kerberos authenticator such as is created by the **make\_auth()** function of the WebAuth::Krb5 module.  It is raw binary data.

- initial\_factors (\[FACTORS\])

  Get or set a comma-separated list of authentication factors used by the user during initial authentication (the single sign-on transaction).  For a list of possible factors and their meaning, see the WebAuth protocol specification.

- session\_factors (\[FACTORS\])

  Get or set a comma-separated list of authentication factors used by the user to authenticate this session (this particular visit to this WebAuth Application Server).  For a list of possible factors and their meaning, see the WebAuth protocol specification.

- loa (\[LOA\])

  Get or set the level of assurance established for this user authentication.  This is a number whose values are site-defined but for which increasing numbers represent increasing assurance for the authentication.

- creation (\[TIMESTAMP\])

  Get or set the creation timestamp for this token in seconds since epoch. If not set, the encoded token will have a creation time set to the time of encoding.

- expiration (\[TIMESTAMP\])

  Get or set the expiration timestamp for this token in seconds since epoch.

## AUTHOR

Russ Allbery \<eagle@eyrie.org\>

## SEE ALSO

**WebAuth**(3), **WebAuth::Keyring**(3), **WebAuth::Krb5**(3), **WebAuth::Token**(3)

This module is part of WebAuth.  The current version is available from \<http://webauth.stanford.edu/\>.