The issued access token. This property has a non-null value only when the backchannel token delivery mode is "push" and an access token has been issued successfully.

The duration of the access token in seconds.

The next action that the service implementation should take.

The authorization details. This represents the value of the authorization_details request parameter which is defined in "OAuth 2.0 Rich Authorization Requests".

The value of the "auth_req_id" which is associated with the ticket.

Arbitrary attributes associated with the client.

The client ID of the client application that has made the backchannel authentication request.

The client ID alias of the client application that has made the backchannel authentication request.

The flag which indicates whether the client ID alias was used in the backchannel authentication request.

The name of the client application which has made the backchannel authentication request.

The client notification endpoint to which a notification needs to be sent.

This corresponds to the "client_notification_endpoint" metadata of the client application.

The client notification token which needs to be embedded as a Bearer token in the Authorization header in the notification.

This is the value of the "client_notification_token" request parameter included in the backchannel authentication request.

The backchannel token delivery mode.

The issued ID token. This property has a non-null value only when the backchannel token delivery mode is "push" and an ID token has been issued successfully.

The duration of the refresh token in seconds.

The newly issued access token in JWT format.

If the authorization server is configured to issue JWT-based access tokens (= if Service.getAccessTokenSignAlg holds a valid value), a JWT-based access token is issued along with the original random-string one.

Regarding the detailed format of the JWT-based access token, see the description of the Service class.

The issued refresh token. This property has a non-null value only when the backchannel token delivery mode is "push" and a refresh token has been issued successfully.

Note that refresh tokens are not issued if the service does not support the refresh token flow.

The duration of the refresh token in seconds.

The resources specified by the resource request parameters or by the resource property in the request object in the preceding backchannel authentication request. If both are given, the values in the request object take precedence.

See "Resource Indicators for OAuth 2.0" for details.

The content of the notification.

When the value of action is NOTIFICATION, this property has JSON which should be used as the request body of the notification.

In successful cases, when the backchannel token delivery mode is ping, the JSON contains auth_req_id. On the other hand, when the backchannel token delivery mode is push, the JSON contains an access token, an ID token, and optionally a refresh token (and some other properties).

Arbitrary attributes associated with the service.