---
name: "WebAuth::Token::Proxy"
section: "3pm"
platform: "linux"
package: "libwebauth-perl"
version: "4.7.0-8"
release: "Debian 11 (Bullseye)"
platforms: ["linux"]
url: "https://new.carta.tech/WebAuth::Token::Proxy"
---

# WebAuth::Token::Proxy(3pm)

WebAuth proxy tokens

## NAME

WebAuth::Token::Proxy - WebAuth proxy tokens

## SYNOPSIS

```
    my $token = WebAuth::Token::Proxy->new;
    $token->subject ('user');
    $token->type ('krb5');
    $token->webkdc_proxy ($raw);
    $token->expiration (time + 3600);
    print $token->encode ($keyring), "\n";
```

## DESCRIPTION

A WebAuth proxy token, used by a WebAuth Application Server to request other tokens from the WebKDC.  This is returned by the WebKDC to a WebAuth Application Server if the WAS may need to request various tokens (particularly credential tokens).

## CLASS METHODS

- new ()

  Create a new, empty WebAuth::Token::Proxy.  At least some attributes will have to be set using the accessor methods described below before the token can be used.

## INSTANCE METHODS

As with WebAuth module functions, failures are signaled by throwing WebAuth::Exception rather than by return status.

## General Methods

- encode (KEYRING)

  Generate the encoded and encrypted form of this token using the provided KEYRING.  The encryption key used will be the one returned by the **best\_key()** method of WebAuth::Keyring on that KEYRING.

## Accessor Methods

- subject (\[SUBJECT\])

  Get or set the subject, which holds the authenticated identity of the user whose credentials and id tokens can be retrieved using this token.

- authz\_subject (\[SUBJECT\])

  Get or set the authorization subject, which holds the asserted authorization identity of the user holding this token.  The authorization identity may not match the authenticated identity.  It represents a request to use the authorization identity instead of the authentication subject when applying ACLs or determining identity in the application.

- type (\[TYPE\])

  Get or set the type of proxy token, which specifies the type of webkdc-proxy token is included in it.  This is currently always `"krb5"`.

- webkdc\_proxy (\[DATA\])

  Get or set the embedded webkdc-proxy token.  This is an opaque blob of data from the perspective of the WebAuth Application Server.  It is decrypted and used by the WebKDC to fulfill a token request and consists of a webkdc-proxy token without the base64 encoding.

- initial\_factors (\[FACTORS\])

  Get or set a comma-separated list of authentication factors used by the user during initial authentication (the single sign-on transaction).  For a list of possible factors and their meaning, see the WebAuth protocol specification.

- session\_factors (\[FACTORS\])

  Get or set a comma-separated list of authentication factors used by the user to authenticate this session (this particular visit to this WebAuth Application Server).  For a list of possible factors and their meaning, see the WebAuth protocol specification.

- loa (\[LOA\])

  Get or set the level of assurance established for this user authentication.  This is a number whose values are site-defined but for which increasing numbers represent increasing assurance for the authentication.

- creation (\[TIMESTAMP\])

  Get or set the creation timestamp for this token in seconds since epoch. If not set, the encoded token will have a creation time set to the time of encoding.

- expiration (\[TIMESTAMP\])

  Get or set the expiration timestamp for this token in seconds since epoch.

## AUTHOR

Russ Allbery \<eagle@eyrie.org\>

## SEE ALSO

**WebAuth**(3), **WebAuth::Keyring**(3), **WebAuth::Token**(3)

This module is part of WebAuth.  The current version is available from \<http://webauth.stanford.edu/\>.