// GeIDTokenLifespan returns how long an id token should be valid. Defaults to one hour.
14947
func (c *Config) GetIDTokenLifespan() time.Duration {
	if c.IDTokenLifespan == 0 {
		return time.Hour
	}
	return c.IDTokenLifespan
}
520868
func (l *State) ServiceToken(id string) string {
	l.RLock()
	defer l.RUnlock()
	return l.serviceToken(id)
}
1161121
func (o *OIDCAuthenticator) AuthenticateToken(ctx context.Context, rawtoken string) (*Claims, error) {
	idToken, err := o.verifier.Verify(ctx, rawtoken)
	if err != nil {
		return nil, fmt.Errorf("Token failed validation: %v", err)
	}

	// Check for required claims
	var claims map[string]interface{}
	if err := idToken.Claims(&claims); err != nil {
		return nil, fmt.Errorf("Unable to get claim map from token: %v", err)
	}
	for _, requiredClaim := range requiredClaims {
		if _, ok := claims[requiredClaim]; !ok {
			// Claim missing
			return nil, fmt.Errorf("Required claim %v missing from token", requiredClaim)
		}
	}

	return o.parseClaims(claims)
}
757082
func (m *GormExternalTokenRepository) LoadByProviderIDAndIdentityID(ctx context.Context, providerID uuid.UUID, identityID uuid.UUID) ([]ExternalToken, error) {
	defer goa.MeasureSince([]string{"goa", "db", "ExternalToken", "LoadByProviderIDAndIdentityID"}, time.Now())
	var externalProviderTokens []ExternalToken
	externalProviderTokens, err := m.Query(ExternalTokenFilterByIdentityID(identityID), ExternalTokenFilterByProviderID(providerID), ExternalTokenWithIdentity())
	if err != nil && err != gorm.ErrRecordNotFound {
		return nil, errs.WithStack(err)
	}
	return externalProviderTokens, nil
}
858010
func (c *Client) CreateSignupToken(user services.UserV1, ttl time.Duration) (string, error) {
	if err := user.Check(); err != nil {
		return "", trace.Wrap(err)
	}
	out, err := c.PostJSON(c.Endpoint("signuptokens"), createSignupTokenReq{
		User: user,
		TTL:  ttl,
	})
	if err != nil {
		return "", trace.Wrap(err)
	}
	var token string
	if err := json.Unmarshal(out.Bytes(), &token); err != nil {
		return "", trace.Wrap(err)
	}
	return token, nil
}
155689
func VerifyToken(c *messagebird.Client, id, token string) (*Verify, error) {
	params := &url.Values{}
	params.Set("token", token)

	pathWithParams := path + "/" + id + "?" + params.Encode()

	verify := &Verify{}
	if err := c.Request(verify, http.MethodGet, pathWithParams, nil); err != nil {
		return nil, err
	}

	return verify, nil
}
561628
func newTokenBucket(rate *rate, clock timetools.TimeProvider) *tokenBucket {
	return &tokenBucket{
		period:          rate.period,
		timePerToken:    time.Duration(int64(rate.period) / rate.average),
		burst:           rate.burst,
		clock:           clock,
		lastRefresh:     clock.UtcNow(),
		availableTokens: rate.burst,
	}
}
1370827
func (s *Secret) TokenID() (string, error) {
	if s == nil {
		return "", nil
	}

	if s.Auth != nil && len(s.Auth.ClientToken) > 0 {
		return s.Auth.ClientToken, nil
	}

	if s.Data == nil || s.Data["id"] == nil {
		return "", nil
	}

	id, ok := s.Data["id"].(string)
	if !ok {
		return "", fmt.Errorf("token found but in the wrong format")
	}

	return id, nil
}
46168
func (c *Config) GetAuthorizeCodeLifespan() time.Duration {
	if c.AuthorizeCodeLifespan == 0 {
		return time.Minute * 15
	}
	return c.AuthorizeCodeLifespan
}
296208
func (ups UsernamePasswordConfig) ServicePrincipalToken() (*adal.ServicePrincipalToken, error) {
	oauthConfig, err := adal.NewOAuthConfig(ups.AADEndpoint, ups.TenantID)
	if err != nil {
		return nil, err
	}
	return adal.NewServicePrincipalTokenFromUsernamePassword(*oauthConfig, ups.ClientID, ups.Username, ups.Password, ups.Resource)
}
182582
func (s *server) createToken(idt *lib.Identity) (string, error) {

	token := jwt.New(jwt.GetSigningMethod(s.p.signMethod))
	token.Claims["pid"] = idt.Pid
	token.Claims["idp"] = idt.Idp
	token.Claims["display_name"] = idt.DisplayName
	token.Claims["email"] = idt.Email
	token.Claims["iss"] = "localhost"
	token.Claims["exp"] = time.Now().Add(time.Second * 3600).UnixNano()

	tokenStr, err := token.SignedString([]byte(s.p.sharedSecret))
	if err != nil {
		return "", err
	}

	return tokenStr, nil
}
920352
func (l *State) checkToken(id types.CheckID) string {
	var token string
	c := l.checks[id]
	if c != nil {
		token = c.Token
	}
	if token == "" {
		token = l.tokens.UserToken()
	}
	return token
}
526430
func (mw *GinJWTMiddleware) TokenGenerator(data interface{}) (string, time.Time, error) {
	token := jwt.New(jwt.GetSigningMethod(mw.SigningAlgorithm))
	claims := token.Claims.(jwt.MapClaims)

	if mw.PayloadFunc != nil {
		for key, value := range mw.PayloadFunc(data) {
			claims[key] = value
		}
	}

	expire := mw.TimeFunc().UTC().Add(mw.Timeout)
	claims["exp"] = expire.Unix()
	claims["orig_iat"] = mw.TimeFunc().Unix()
	tokenString, err := mw.signedString(token)
	if err != nil {
		return "", time.Time{}, err
	}

	return tokenString, expire, nil
}
619555
func (m *mesosScheduler) createLoginToken() ([]byte, error) {
	// create a signer for rsa 256
	sm := jwt.GetSigningMethod("RS256")
	mc := jwt.MapClaims{}
	t := jwt.NewWithClaims(sm, mc)

	// set our claims
	mc["uid"] = m.uid

	// set the expire time
	// see http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-20#section-4.1.4
	mc["exp"] = time.Now().Add(defaultLoginExp).Unix()

	tokenString, err := t.SignedString(m.privateKey)
	if err != nil {
		log.Errorf("Token Signing error: %v\n", err)
		return nil, err
	}

	log.Debugf("Login Token: %s\n", tokenString)

	return []byte(tokenString), nil
}
316498
func (state *UserState) SetToken(username, token string, expire time.Duration) {
	state.users.SetExpire(username, "token", token, expire)
}
1277317
func (ldt *LogplexDrainToken) AddToken(token string) {
	ldt.Lock()
	ldt.tokens[token] = struct{}{}
	ldt.Unlock()
}
356976
func routeInvalidToken(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "text/html")
	w.WriteHeader(http.StatusForbidden)
	fmt.Fprint(w, `Your token <strong>expired</strong>, click <a href="javascript:void(0)" onclick="window.history.back()">here</a> to try again.`)
}