DpopKeyManager class
Manages the RSA key pair used for DPoP proofs.
Why this must be created BEFORE authentication
Solid-OIDC requires DPoP key binding at the token endpoint level
(RFC 9449 §5). The client MUST send a DPoP proof JWT as the DPoP
HTTP header on the token endpoint request. The OP then:
- Validates the proof.
- Computes
jkt= base64url(SHA-256(RFC 7638 JWK thumbprint)). - Embeds
cnf: { jkt: "…" }in the issued access token.
A Resource Server verifying a PATCH / GET / etc. request later
checks that the DPoP proof was signed by the key whose thumbprint
matches cnf.jkt in the access token.
If the token was issued WITHOUT a DPoP proof at token-request time
there is no cnf claim at all, and the RS returns:
"Expected object property cnf, got:
object Object"
Fix: generate the key pair here ONCE, inject it into every token
request via a package:oidc token hook, and reuse the same key pair
for all subsequent resource-level DPoP proofs.
Properties
- hashCode → int
-
The hash code for this object.
no setterinherited
- keyPair → KeyPair
-
RSA-2048 key pair (PEM-encoded).
final
-
publicKeyJwk
→ Map<
String, dynamic> -
Public key as a JWK map — embedded in every DPoP proof JWT header.
final
- runtimeType → Type
-
A representation of the runtime type of the object.
no setterinherited
Methods
-
noSuchMethod(
Invocation invocation) → dynamic -
Invoked when a nonexistent method or property is accessed.
inherited
-
toString(
) → String -
A string representation of this object.
inherited
Operators
-
operator ==(
Object other) → bool -
The equality operator.
inherited
Static Methods
-
clear(
) → void - Clears the cached instance (call on logout).
-
getInstance(
) → Future< DpopKeyManager> - Returns the cached key manager, generating a fresh pair if none exists.
-
restoreFromPem(
{required String privateKeyPem, required String publicKeyPem}) → Future< DpopKeyManager> - Restores the singleton from previously persisted PEM-encoded keys.
-
rotate(
) → Future< DpopKeyManager> - Generates a new RSA-2048 pair and replaces the cached instance.