The expected audience for tokens from this provider
OptionalclientOAuth client ID for this provider (used by OAuth proxy for upstream auth)
ProtectedconfigThe issuer URL for this provider (must match the 'iss' claim in tokens)
ProtectedjwksThe JWKS endpoint URL for retrieving signing keys
Unique name identifier for this provider
Maps a verified host-assertion payload to standard MJ identity fields.
Gets the signing key for token verification with retry logic
Checks if a given issuer URL belongs to this provider
Host identity never uses JWKS — config is valid as long as it names the provider.
Verifies a host-signed RS256 assertion against the host's STATIC public key (PEM) and extracts the
asserted visitor identity. The assertion's aud must equal expectedAudience (the widget key, bound
at the host) and it must carry an email. It must also be short-lived: it must declare its own exp
AND be no older than HOST_ASSERTION_MAX_AGE_SECONDS since iat — so a misbehaving host cannot
mint an unbounded token. Never throws — returns a structured result.
SECURITY: hostPublicKeyPem MUST originate from an independent trust path (the registered
WidgetInstance.HostPublicKey, set out-of-band by an administrator) — NEVER from the same request
that carries assertion. Passing a key the assertion's presenter could influence defeats the
signature check entirely (see the class-level SECURITY INVARIANT note).
Authentication provider for the public web-widget host-identity strategy (D1).
When a widget is embedded in an already-authenticated host portal, the host signs a short-lived RS256 assertion (with ITS OWN key) describing the visitor. Unlike Auth0/magic-link tokens — validated by the standard issuer→JWKS path — a host assertion is verified against a STATIC per-widget public key (stored on
WidgetInstance.HostPublicKey) and exchanged atPOST /widget/sessionfor an MJ guest JWT. So this provider does NOT use the JWKS machinery: it exposes VerifyHostAssertion (static-PEM RS256 verification) + extractUserInfo, and the widget mint resolves it via the ClassFactory.SECURITY INVARIANT — key/assertion provenance MUST be independent. The party that presents a signed assertion must NOT also be able to provide or influence the public key used to verify it. If one party controlled both, the signature would prove nothing: an attacker could mint a fresh keypair, sign any claims with the private key, hand over the matching public key, and the check would trivially pass. The verifying key must therefore come from an independent trust path — here, out-of-band administrator configuration on
WidgetInstance.HostPublicKey(the analog, for a static PEM, of pinning a trusted issuer's JWKS endpoint). That is why VerifyHostAssertion takes the PEM as a caller-supplied argument rather than reading any key material from the assertion itself: the caller (the widget mint) is responsible for sourcing the PEM from the registered widget record, never from the request payload.It still subclasses BaseAuthProvider (and registers in the same factory) so host-identity is a first-class, discoverable provider rather than ad-hoc mint code — the architecture the widget plan calls for. The base constructor builds a JWKS client from
jwksUri; host-identity has no JWKS, so callers pass a placeholderjwksUrithat is never contacted (verification goes through VerifyHostAssertion).