com.sap.cloud.security.token

Interface AccessToken

All Superinterfaces:

Serializable, Token

public interface AccessToken
extends Token

Represents an access token in the format of a JSON Web Token (not a short opaque token). In difference to a ID token the access token has no/less information about the user but has information about the authorities (scopes).

Field Summary

Fields inherited from interface com.sap.cloud.security.token.Token

services

Method Summary

Modifier and Type	Method and Description
GrantType	getGrantType() Returns the grant type of the jwt token.
Set<String>	getScopes() Returns the list of the claim "scope".
default String	getSubaccountId() Returns subaccount identifier.
boolean	hasLocalScope(String scope) Check if a local scope is available in the authentication token.
boolean	hasScope(String scope) Checks if a scope is available in the access token.

Methods inherited from interface com.sap.cloud.security.token.Token

create, getAttributeFromClaimAsString, getAttributeFromClaimAsStringList, getAudiences, getClaimAsJsonObject, getClaimAsString, getClaimAsStringList, getClaims, getClientId, getExpiration, getHeaderParameterAsString, getHeaders, getNotBefore, getPrincipal, getService, getTokenValue, getZoneId, hasClaim, hasHeaderParameter, isExpired

Method Detail

getScopes

Set<String> getScopes()

Returns the list of the claim "scope".

Returns:

the list of the claim scope or empty list.

hasScope

boolean hasScope(String scope)

Checks if a scope is available in the access token.

Parameters:

scope - name of the scope

Returns:

true if scope is available

hasLocalScope

boolean hasLocalScope(@Nonnull
                      String scope)

Check if a local scope is available in the authentication token. The exact definition of a local scope depends on the specific token implementation.

Parameters:

scope - name of local scope

Returns:

true if local scope is available

getGrantType

@Nullable
GrantType getGrantType()

Returns the grant type of the jwt token.

Returns:

the grant type

getSubaccountId

@Nullable
default String getSubaccountId()

Returns subaccount identifier. This reflects claim ext_attr.subaccountid in xsuaa access tokens. For example, commercialized multi-tenant applications with a need for metering and billing use getSubaccountId() method as identifier for the account to be billed.
Multi-tenant applications need to adapt using the zone ID instead of the subaccount ID as key for data isolation between tenants. For that purpose, use the Token.getZoneId() method instead.

Returns:

subaccount identifier or null