JwtClaim uses ConstantsTrait

Enumeration of standard JWT claim names.

$assertion = JWT::encode
(
    [
        JwtClaim::ISS => $this->serviceAccount[ ZitadelKeyFile::USER_ID ] ,
        JwtClaim::SUB => $this->serviceAccount[ ZitadelKeyFile::USER_ID ] ,
        JwtClaim::AUD => $this->issuer ,
        JwtClaim::IAT => $now ,
        JwtClaim::EXP => $now + 3600 ,
    ] ,
    ...
) ;

Tags

author

Marc Alcaraz (ekameleon)

since

1.1.0

Table of Contents

Constants

ACR  : string = 'acr'

`acr` — Authentication Context Class Reference (OIDC Core §2).

ACT  : string = 'act'

`act` — Actor (RFC 8693 §4.1).

ADDRESS  : string = 'address'

`address` — End-User's preferred postal address, as a JSON object (see OIDC Core §5.1.1 for sub-fields).

AMR  : string = 'amr'

`amr` — Authentication Methods References (OIDC Core §2).

AT_HASH  : string = 'at_hash'

`at_hash` — Access Token hash value (OIDC Core §3.1.3.6).

AUD  : string = 'aud'

`aud` — Audience of the JWT (RFC 7519 §4.1.3).

AUDIENCE  : string = 'aud'

Long-form alias of {@see self::AUD}.

AUTH_TIME  : string = 'auth_time'

`auth_time` — Time when the End-User authentication occurred (OIDC Core §2).

AZP  : string = 'azp'

`azp` — Authorized Party (OIDC Core §2).

BIRTHDATE  : string = 'birthdate'

`birthdate` — End-User's birthday in ISO 8601:2004 `YYYY-MM-DD` format. The year may be `0000` to indicate that it is omitted.

C_HASH  : string = 'c_hash'

`c_hash` — Authorization Code hash value (OIDC Core §3.3.2.11).

CLIENT_ID  : string = 'client_id'

`client_id` — OAuth 2.0 Client Identifier valid at the authorization server (RFC 8693 §4.3).

CNF  : string = 'cnf'

`cnf` — Confirmation (RFC 7800).

EMAIL  : string = 'email'

`email` — End-User's preferred e-mail address.

EMAIL_VERIFIED  : string = 'email_verified'

`email_verified` — Boolean. `true` if the End-User's e-mail address has been verified, `false` otherwise.

ENTITLEMENTS  : string = 'entitlements'

`entitlements` — Entitlements / fine-grained permissions granted to the subject. Non-standard.

EXP  : string = 'exp'

`exp` — Expiration time (RFC 7519 §4.1.4).

EXPIRES_AT  : string = 'exp'

Long-form alias of {@see self::EXP}.

FAMILY_NAME  : string = 'family_name'

`family_name` — Surname(s) or last name(s) of the End-User.

GENDER  : string = 'gender'

`gender` — End-User's gender. Values defined by the specification are `female` and `male`; other values may be used when neither fits.

GIVEN_NAME  : string = 'given_name'

`given_name` — Given name(s) or first name(s) of the End-User.

GROUPS  : string = 'groups'

`groups` — Group memberships of the subject.

IAT  : string = 'iat'

`iat` — Issued At (RFC 7519 §4.1.6).

ISS  : string = 'iss'

`iss` — Issuer of the JWT (RFC 7519 §4.1.1).

ISSUED_AT  : string = 'iat'

Long-form alias of {@see self::IAT}.

ISSUER  : string = 'iss'

Long-form alias of {@see self::ISS}.

JTI  : string = 'jti'

`jti` — JWT ID (RFC 7519 §4.1.7).

JWT_ID  : string = 'jti'

Long-form alias of {@see self::JTI}.

LOCALE  : string = 'locale'

`locale` — End-User's locale, as a BCP47 language tag (e.g. `en-US`, `fr-FR`).

MAY_ACT  : string = 'may_act'

`may_act` — Authorized Actor (RFC 8693 §4.4).

MIDDLE_NAME  : string = 'middle_name'

`middle_name` — Middle name(s) of the End-User.

NAME  : string = 'name'

`name` — End-User's full name in displayable form, including all name parts.

NBF  : string = 'nbf'

`nbf` — Not Before (RFC 7519 §4.1.5).

NICKNAME  : string = 'nickname'

`nickname` — Casual name of the End-User. May or may not be the same as {@see self::GIVEN_NAME}.

NONCE  : string = 'nonce'

`nonce` — String value used to associate a Client session with an ID Token and to mitigate replay attacks (OIDC Core §2).

NOT_BEFORE  : string = 'nbf'

Long-form alias of {@see self::NBF}.

OID  : string = 'oid'

`oid` — Object ID.

PHONE_NUMBER  : string = 'phone_number'

`phone_number` — End-User's preferred telephone number, preferably in E.164 format (e.g. `+33123456789`).

PHONE_NUMBER_VERIFIED  : string = 'phone_number_verified'

`phone_number_verified` — Boolean. `true` if the End-User's phone number has been verified, `false` otherwise.

PICTURE  : string = 'picture'

`picture` — URL of the End-User's profile picture.

PREFERRED_USERNAME  : string = 'preferred_username'

`preferred_username` — Shorthand name by which the End-User wishes to be referred to. Not guaranteed to be unique.

PROFILE  : string = 'profile'

`profile` — URL of the End-User's profile page.

ROLES  : string = 'roles'

`roles` — Role assignments of the subject.

SCOPE  : string = 'scope'

`scope` — OAuth 2.0 scope values (RFC 8693 §4.2).

SCP  : string = 'scp'

`scp` — Alternative scope representation used by some identity providers (e.g. Microsoft Identity Platform).

SESSION_ID  : string = 'sid'

Long-form alias of {@see self::SID}.

SID  : string = 'sid'

`sid` — Session ID.

SUB  : string = 'sub'

`sub` — Subject of the JWT (RFC 7519 §4.1.2).

SUBJECT  : string = 'sub'

Long-form alias of {@see self::SUB}.

TID  : string = 'tid'

`tid` — Tenant ID.

UPDATED_AT  : string = 'updated_at'

`updated_at` — Time the End-User's information was last updated.

WEBSITE  : string = 'website'

`website` — URL of the End-User's web page or blog.

ZONEINFO  : string = 'zoneinfo'

`zoneinfo` — String from the zoneinfo time zone database representing the End-User's time zone (e.g. `Europe/Paris`).