All Classes and Interfaces

Class	Description
AbstractAdminApiProfileAction	Base class for admin flow actions producing JSON responses.
AbstractAuthenticationRequestLookupFunction<T>	A Abstract function extended by lookups searching fields from authentication request.
AbstractAuthenticationRequestLookupFunction<T>	Deprecated, for removal: This API element is subject to removal in a future version.
AbstractAuthorizationRequestLookupFunction<T>	An abstract function extended by lookups searching fields from authorization request.
AbstractAuthorizationRequestLookupFunction<T>	Deprecated, for removal: This API element is subject to removal in a future version.
AbstractBuildErrorResponseFromEvent<T extends ErrorResponse>	This action is extended by error response actions.
AbstractInitializeOutboundResponseMessageContext	Deprecated, for removal: This API element is subject to removal in a future version.
AbstractOAuthAuthorizationRequestAction	Abstract class for actions performing actions on AuthorizationRequest found via InOutOperationContext.getInboundMessageContext() and MessageContext.getMessage().
AbstractOAuthAuthorizationResponseAction	Abstract class for actions performing actions on OIDCAuthenticationResponseContext located under InOutOperationContext.getOutboundMessageContext().
AbstractOIDCAuthenticationRequestAction	Abstract class for actions performing actions on AuthenticationRequest found via InOutOperationContext.getInboundMessageContext() and MessageContext.getMessage().
AbstractOIDCAuthenticationResponseAction	Abstract class for actions performing actions on OIDCAuthenticationResponseContext located under InOutOperationContext.getOutboundMessageContext().
AbstractOIDCBackChannelLogoutPropagationAction	An abstract action for OIDC back-channel logout actions dealing with OIDCBackChannelLogoutPropagationContext.
AbstractOIDCClientMetadataPopulationAction	Abstract action for populating metadata from the ClientRegistrationRequest message to the response message.
AbstractOIDCLogoutPropagationAction	An abstract action for OIDC logout actions dealing with OIDCLogoutPropagationContext.
AbstractOIDCRequestAction<T>	Abstract class for actions performing actions on a oidc request found via InOutOperationContext.getInboundMessageContext() and MessageContext.getMessage().
AbstractOIDCResponseAction	Abstract class for actions performing actions on OIDCAuthenticationResponseContext located under InOutOperationContext.getOutboundMessageContext().
AbstractOIDCRpInitiatedLogoutAction	An abstract action for OIDC logout actions dealing with OIDC RP-initiated logout.
AbstractOIDCSigningResponseAction	Abstract action to be extended by oidc response actions requiring signing parameters.
AbstractOIDCTokenRequestAction	Abstract class for actions performing actions on TokenRequest found via InOutOperationContext.getInboundMessageContext() and MessageContext.getMessage().
AbstractOIDCTokenResponseAction	Abstract class for actions performing actions on OIDCAuthenticationResponseContext located under InOutOperationContext.getOutboundMessageContext().
AbstractOIDCUserInfoRequestAction	Abstract class for actions performing actions on UserInfoRequest found via InOutOperationContext.getInboundMessageContext() and MessageContext.getMessage().
AbstractOIDCUserInfoResponseAction	Abstract class for actions performing actions on OIDCMetadataContext located under InOutOperationContext.getInboundMessageContext().
AbstractOIDCUserInfoValidationResponseAction	Abstract class for actions performing actions on OIDCAuthenticationResponseContext located under InOutOperationContext.getOutboundMessageContext().
AbstractProcessTokenAction<T>	Action that processes a token by validating it and populating the resulting JWTClaimsSet into an OAuth2TokenMgmtResponseContext placed beneath the outbound MessageContext.
AbstractPushedAuthorizationRequestComponent	Base component for the pushed authorization request URI serializer and deserializer functions.
AbstractTokenClaimsLookupFunction<T>	A Abstract function extended by lookups searching fields from tokens (Authorization Code, Access Token).
AbstractTokenRequestLookupFunction<T>	A Abstract function extended by lookups searching fields from token request.
AbstractTokenRequestLookupFunction<T>	Deprecated, for removal: This API element is subject to removal in a future version.
AccessTokenClaimsSet	Class wrapping claims set for access token.
AccessTokenClaimsSet.Builder	Builder to create instance of AccessTokenClaimsSet.
AccessTokenClaimsSetLookupFunction	A function that returns the access token claims set from response context.
AccessTokenContext	Subcontext carrying information used to produce access tokens.
AddAccessTokenHashToIDToken	Action that adds access token hash claim to a IDTokenClaimsSet.
AddAcrToIDToken	Action that adds acr claim to a IDTokenClaimsSet.
AddApplicationTypeToClientMetadata	Adds the application_type to the OIDCClientRegistrationResponseContext.
AddAttributesToClaimsSet	Action that adds claims to a ClaimsSet.
AddAuthorizationCodeHashToIDToken	Action that adds authorization code hash claim to a IDTokenClaimsSet.
AddAuthTimeToIDToken	Action that adds auth_time claim to a IDTokenClaimsSet.
AddClientNameToClientMetadata	Adds client name from the input metadata to the output OIDCClientMetadata.
AddContactsToClientMetadata	Adds the contents of the contacts attribute from the input metadata to the output OIDCClientMetadata.
AddGrantTypeToClientMetadata	An action that adds the grant_type to the client metadata.
AddIDTokenShell	Action that creates a IDTokenClaimsSet object shell, and sets it to work context OIDCAuthenticationResponseContext located under InOutOperationContext.getOutboundMessageContext().
AddJwksToClientMetadata	An action that adds the jwks or jwks_uri to the client metadata, if one of those were defined in the request.
AddLogoUrisToClientMetadata	This action adds the logo_uri(s) to the client metadata.
AddLogoutParametersToClientMetadata	Adds the parameters related to OIDC logout to the output OIDCClientMetadata.
AddMetadataStatementToClientMetadata	An action that adds the trusted metadata_statement chain (containing OP's signed key) to the metadata_statement claim in the response metadata.
AddNonceToIDToken	Action that adds nonce claim to a IDTokenClaimsSet.
AddPolicyUrisToClientMetadata	This action adds the policy_uri(s) to the client metadata.
AddRedirectUrisToClientMetadata	Adds the (mandatory) redirect_uris to the output OIDCClientMetadata.
AddRemainingClaimsToClientMetadata	Adds the remaining recognized claims from the input metadata to the output OIDCClientMetadata.
AddRequestObjectSecurityConfigurationToClientMetadata	Verifies and adds the request object configuration details (request_object_signing_alg, request_object_encryption_alg and request_object_encryption_enc) to the client metadata.
AddRequestUrisToClientMetadata	Adds the pre-registered request_uri values to the output OIDCClientMetadata.
AddResponseTypesToClientMetadata	An action that adds response_types to the OIDC client metadata.
AddScopeToClientMetadata	Adds the Scope from the input metadata to the output OIDCClientMetadata.
AddSecurityConfigurationToClientMetadata	Verifies and adds the security configuration details (*_response_alg and *_response_enc) to the client metadata.
AddSubjectTypeToClientMetadata	An action that adds the subject_type to the client metadata.
AddTokenDeliveryAttributesToClaimsSet	Action that adds claims to a ClaimsSet.
AddTokenEndpointAuthMethodsToClientMetadata	An action that adds the token_endpoint_auth_method to the client metadata.
AddTosUrisToClientMetadata	This action adds the tos_uri(s) to the client metadata.
AddUserInfoShell	Action that creates a UserInfo object shell, and sets it to work context OIDCAuthenticationResponseContext located under InOutOperationContext.getOutboundMessageContext().
AlgorithmInfoMetadataValueResolver	A MetadataValueResolver for resolving signing/encryption algorithm information from the current SecurityConfiguration.
ArrayMetadataValueResolver	An implementation to MetadataValueResolver that contains an array of other MetadataValueResolvers.
AttributeConsentEnabledInTokenClaimsSetPredicate	A predicate implementation that checks if attribute consent flag is enabled.
AttributeFilterNamespaceHandler	Namespace handler for the oidc specific attribute filter engine functions.
AttributeInOIDCRequestedClaimsMatcher	Class for matching attribute to requested claims.
AttributeInOIDCRequestedClaimsRuleParser	Bean definition parser for AttributeInOIDCRequestedClaimsMatcher.
AttributeOIDCScopePolicyRule	Compare the scopes of oidc authentication request with the provided value.
AttributeOIDCScopeRuleParser	Bean definition parser for AttributeOIDCScopePolicyRule.
AttributeResolutionSubjectLookupFunction	A function that returns subject identifier from filtered claims.
AttributeTokenRevocationCondition	A condition that checks for token revocation against a resolved IdPAttribute.
AudienceClientIDLookupFunction	Returns a ClientID from the first value found in OIDCAuthenticationResponseContext.getAudience().
AuditFields	Constants to use for audit logging fields stored in an AuditContext.
AuthenticationContextReferenceAuditExtractor	Looks up the 'acr' value from the OIDC authentication response context.
AuthenticationRequestClaimsAuditExtractor	A function that resolves a claim value from the authentication request.
AuthorizeCodeClaimsSet	Class wrapping claims set for authorize code.
AuthorizeCodeClaimsSet.Builder	Builder to create instance of AuthorizeCodeClaimsSet.
BaseOAuth2RequestDecoder<T extends Request>	Base decoder for Nimbus OAuth2 request messages.
BuildAccessToken	Action that creates an Access Token, and stores it to an AccessTokenContext.
BuildAuthenticationErrorResponseFromEvent	This action reads an event from the configured EventContext lookup strategy, constructs an OIDC authentication error response message and attaches it as the outbound message.
BuildClientInformation	An action that uses the information from OIDCClientRegistrationResponseContext attached to the message context for creating a new ClientInformationResponse.
BuildIntrospectionErrorResponseFromEvent	This action reads an event from the configured EventContext lookup strategy, constructs an OAuth2 Token Introspection error response message and attaches it as the outbound message.
BuildPushedAuthorizationErrorResponseFromEvent	This action reads an event from the configured EventContext lookup strategy, constructs an OAuth2 Token PAR error response message and attaches it as the outbound message.
BuildRegistrationErrorResponseFromEvent	This action reads an event from the configured EventContext lookup strategy, constructs an OIDC client registration error response message and attaches it as the outbound message.
BuildRevokeTokenErrorResponseFromEvent	This action reads an event from the configured EventContext lookup strategy, constructs an OAuth2 Token Revocation error response message and attaches it as the outbound message.
BuildTokenErrorResponseFromEvent	This action reads an event from the configured EventContext lookup strategy, constructs an OIDC token error response message and attaches it as the outbound message.
BuildUserInfoErrorResponseFromEvent	This action reads an event from the configured EventContext lookup strategy, constructs an OIDC user info error response message and attaches it as the outbound message.
ChainExpiryClaimsValidator	Iff a chain expiration time (c_exp) claim is present, verifies that it is ahead of the current time, else the JWT claims set is rejected.
CheckRedirectURIs	The action that verifies the redirect_uris from the request.
ClaimsAuditExtractor	Function that returns the released claims for the endpoint.
ClientAuthenticationJWTPayloadClaimsAuditExtractor	Function that returns the desired claim from the client authentication JWT payload.
ClientAuthenticationJWTTypeHeaderAuditExtractor	Function that returns the type header from the client authentication JWT payload.
ClientIdRegistrationAuditExtractor	Looks up the client ID value from the OIDC client registration response context.
ClientInfoAudienceLookupFunction	A function that returns OIDCMetadataContext.
ClientInfoScopeLookupFunction	A function that returns OIDCMetadataContext.
ClientManagementArguments	Command line processing for OIDC client mgmt flow.
CredentialMetadataValueResolver	An implementation of MetadataValueResolver that converts public parts of the attached Credential to the value.
CustomNimbusRequestParser<T extends Request>	An interface for custom parsers for transforming HttpServletRequest into a Nimbus request object.
CustomResourceHttpServletRequestWrapper	A custom extension to HttpServletRequestWrapper overriding the resource parameter values with a custom prefix in the query string (for GET) and parameter map (for POST).
DefaultAllowedScopeLookupFunction	Default function for looking up the allowed scope.
DefaultAuthorizationRequestTypeValidationStrategy	Validation strategy for the inbound message.
DefaultAuthTimeLookupFunction	A function that returns auth time via a lookup function.
DefaultChainRevocationLifetimeLookupStrategy	Default lookup function for fetching the chain revocation lifetime.
DefaultClientIDLookupFunction	A function that returns client id of the authentication request via a lookup function.
DefaultClientIDLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultComputeAuthorizationCodeHashFunction	A function that computes a hash value for the authorization code via required configurable lookup function.
DefaultDPoPProofNonceGenerator	Default implementation for the function used for generating new DPoP Proof nonces.
DefaultDPoPProofThumbprintLookupFunction	A function that returns validated DPoP proof JWK thumbprint if stored in OAuth2DPoPProofContext.
DefaultEnforceSelfAudienceCondition	A predicate that returns true if all the following conditions are met: DefaultEnforceSelfAudienceCondition.limitInitialAccessTokenToSelfPredicate returns true The inbound message is a TokenRequest The token request grant_type is authorization_code
DefaultJwtRefreshTokenDeserializationFunction	Default implementation for deserializing an incoming JWT refresh token into the refresh token claims set.
DefaultJwtRefreshTokenSerializationFunction	Default implementation for serializing the refresh token claims set into a JWT refresh token.
DefaultLogoutHintMatchingPredicate	Default validation strategy for logout hints.
DefaultMetadataPolicyCriteriaLookupFunction	A function returning a CriteriaSet which contains the metadata policy document location as ResourceLocationCriterion.
DefaultMetadataPolicyMergingStrategy	A function that merges two maps of metadata policies according to the rules specified in the OIDC federation spec (draft 17), section 5.1.3.1:
DefaultOIDCClientRegistrationTokenClaimsContextLookupFunction	A function that returns a OIDCClientRegistrationTokenClaimsContext from the inbound message context, located as a subcontext for the profile request context.
DefaultOIDCClientRegistrationTokenMetadataPolicyLookupFunction	A function that returns a map of metadata policies from the RegistrationClaimsSet.
DefaultOIDCMetadataContextLookupFunction	A function that returns OIDCMetadataContext.
DefaultPostLogoutRedirectURIValidationPredicate	Default validation strategy for post logout redirection URIs.
DefaultPushedAuthorizationRequestUriDeserializationFunction	Default deserialization function for decoding the request URI into claims set within OAuth2 PAR.
DefaultPushedAuthorizationRequestUriSerializationFunction	Default serialization function for the request URI claims set within OAuth2 PAR.
DefaultRequestAudienceLookupFunction	A function that returns resource value of the authorization request.
DefaultRequestAudienceLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestCodeChallengeLookupFunction	A function that returns code challenge value of the authorization request via a lookup function.
DefaultRequestCodeChallengeLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestCodeChallengeMethodLookupFunction	A function that returns code challenge method value of the authorization request via a lookup function.
DefaultRequestCodeChallengeMethodLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestCodeVerifierLookupFunction	For Token endpoint.
DefaultRequestCodeVerifierLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestDPoPJktLookupFunction	A function that returns dpop_jkt value of the authorization request via a lookup function.
DefaultRequestedAcrLookupFunction	A function that returns copy of requested acr values via a lookup function.
DefaultRequestedAcrLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestedClaimsLookupFunction	A function that returns copy of requested claims via a lookup function.
DefaultRequestedClaimsLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestedPromptLookupFunction	A function that returns copy of requested prompt via a lookup function.
DefaultRequestedPromptLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestedScopeLookupFunction	A function that returns copy of requested scopes via a lookup function.
DefaultRequestedScopeLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestLoginHintLookupFunction	A function that returns request login hint via a lookup function.
DefaultRequestLoginHintLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestMaxAgeLookupFunction	A function that returns authentication max age parameter the request via a lookup function.
DefaultRequestMaxAgeLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestNonceLookupFunction	A function that returns copy of Nonce via a lookup function.
DefaultRequestNonceLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestRedirectURILookupFunction	A function that returns redirect uri of the authentication request via a lookup function.
DefaultRequestRedirectURILookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestResponseModeLookupFunction	A function that returns copy of the response mode of the request via a lookup function.
DefaultRequestResponseModeLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestResponseTypeLookupFunction	A function that returns copy of response type via a lookup function.
DefaultRequestResponseTypeLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultRequestStateLookupFunction	A function that returns copy of the state the request via a lookup function.
DefaultRequestStateLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DefaultResponseClaimsSetLookupFunction	A function that returns id token claims set from response context.
DefaultRevokeConsentPredicate	Default predicate to decide if the pre-existing consent should be revoked.
DefaultRootTokenIdentifierLookupStrategy	Default lookup function for fetching the root token identifier from the given claims set.
DefaultSubjectTypeStrategy	Function to decide on subject type.
DefaultTokenRevocationLifetimeLookupStrategy	Default lookup function for fetching the token revocation lifetime from the given claims set.
DefaultUnregisteredClientAllowedScopeLookupFunction	Default lookup function for fetching the allowed scope from the unregistered client policy.
DefaultUnregisteredClientPolicyValidator	Default validator for the unregistered client policies.
DefaultUnregisteredClientResponseTypesLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version. The response type validation is handled against the policy in the SWF action
DefaultUseOnlyRequestObjectPredicate	Default predicate for using only request object parameters if the authorization request (1) contains request object and (2) is not OIDC authentication request or is provided by the PAR endpoint.
DefaultUserInfoSigningAlgLookupFunction	A function that returns registered userinfo signing algorithm from metadata.
DefaultValidPostLogoutRedirectUrisLookupFunction	A function that returns registered post logout redirection uris from metadata.
DefaultValidRedirectUrisLookupFunction	A function that returns registered redirection uris from metadata.
DefaultValidResponseTypesLookupFunction	A function that returns a set of valid response type for the authorization request.
DefaultValidResponseTypesLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
DoClientManagementOperation	Action that implements a JSON REST API for querying and deleting OIDC client information.
DPoPAccessTokenHashFromRequestLookupFunction	A function that calculates a hash of the DPoP access token from the HttpServletRequest if found.
DPoPAccessTokenInRequestCondition	A predicate returning true it detects a DPoP access token from the HttpServletRequest.
DPoPProofNonceClaimsValidator	A ClaimsValidator for validating if nonce included in the DPoP Proof JWT is valid.
DPoPProofNonceJWTValidationException	A DPoP Proof nonce-specific extension to JWTValidationException.
DynamicFilesystemProviderMetadataResolver	An extension to FilesystemProviderMetadataResolver that enables some of the claims to be dynamically updated outside the file.
ExecuteBackChannelLogoutRequest	An action that executes the OIDC back-channel logout request and sets the result via LogoutPropagationContext.setResult(net.shibboleth.idp.session.context.LogoutPropagationContext.Result).
ExtractClientAuthenticationFromRequest	Extracts OAuth 2 client authentication details from a request and stores them in an OAuth2ClientAuthenticationContext beneath the AuthenticationContext for subsequent validation.
FilesystemMetadataValueResolver	An implementation to RefreshableMetadataValueResolver that fetches the information from a file.
FilesystemProviderMetadataResolver	Based on FilesystemMetadataResolver.
FormOutboundAuthenticationResponseMessage	Action that forms outbound message based on request and response context.
FormOutboundDiscoveryResponse	This action builds a response for the OP configuration discovery request.
FormOutboundIntrospectionResponseMessage	Action that forms outbound token introspection success message.
FormOutboundLogoutRequestMessage	Action that forms outbound message based on request and response context.
FormOutboundRevokeTokenResponseMessage	Action that forms outbound token revocation success message.
FormOutboundTokenResponseMessage	Action that forms outbound message based on token request and response context.
FormOutboundUserInfoResponseMessage	Action that forms outbound message based on response context.
FormOutbounPushedAuthorizationResponseMessage	Action that forms outbound pushed authorization response message.
FormRpInitiatedLogoutResponse	Action that forms outbound message based on request and response context.
FrontChannelLogoutPropagationResponse	A Nimbus Response implementation representing a front-channel logout propagation message that is sent to the RP's front-channel logout URI endpoint.
FunctionMetadataValueResolver	An implementation of MetadataValueResolver that resolves the value via attached Function.
GenerateClientID	Creates the client ID for the registration.
GenerateClientSecret	Creates a new client secret with the IdentifierGenerationStrategy attached to this action.
IdTokenClaimsAuditExtractor	A function that resolves a claim value from the id_token claims set.
InitializeAuthenticationContext	An action that creates an AuthenticationContext and attaches it to the current ProfileRequestContext.
InitializeDPoPProofContext	Action that stores DPoP proof JWT to OAuth2DPoPProofContext.
InitializeOutboundAuthenticationResponseMessageContext	Action that adds an outbound MessageContext and related OIDC contexts to the ProfileRequestContext based on the identity of a relying party accessed via a lookup strategy, by default an immediate child of the profile request context.
InitializeOutboundRegistrationResponseMessageContext	Action that adds an outbound MessageContext and related OIDC context to the ProfileRequestContext.
InitializeOutboundResponseMessageContext	Action that adds an outbound MessageContext typed to generic Response to ProfileRequestContext.
InitializeOutboundRpInitiatedLogoutResponseMessageContext	Action that adds an outbound MessageContext and related contexts to the ProfileRequestContext.
InitializeOutboundTokenMgmtResponseMessageContext	Action that adds an outbound MessageContext and related contexts to the ProfileRequestContext.
InitializeOutboundTokenResponseMessageContext	Deprecated, for removal: This API element is subject to removal in a future version.
InitializeOutboundUserInfoResponseMessageContext	Deprecated, for removal: This API element is subject to removal in a future version.
InitializeRegistrationMetadataPolicyContext	Initializes the OIDCClientRegistrationMetadataPolicyContext and attaches it as a subcontext for the incoming MessageContext.
InitializeRelyingPartyContext	Action that adds a RelyingPartyContext to the current ProfileRequestContext tree via a creation function.
InitializeSubjectContext	An action that creates an SubjectContext and attaches it to the current ProfileRequestContext.
InitializeUnverifiedRelyingPartyContext	Action that adds a RelyingPartyContext to the current ProfileRequestContext tree via a creation function.
IsPassiveAuditExtractor	Function that returns true is prompt contains 'none' in AuthenticationRequest.
IssueIDTokenCondition	Activation condition returning true if validated scope contains 'openid' scope.
IssuerCriterion	A Criterion representing an OIDC (provider) issuer.
IssueRegistrationAccessToken	Action that issues access token to be used for the OIDC dynamic registration endpoint.
IssueRegistrationAccessTokenArguments	Command line processing for issue-registration-access-token flow.
IssueRegistrationTokenFlowDescriptor	Descriptor for flow that issues access tokens for client registration.
JSONErrorResponse	Deprecated, for removal: This API element is subject to removal in a future version.
JSONSuccessResponse	Deprecated, for removal: This API element is subject to removal in a future version.
JWTAccessTokenUpdateStrategy	Add the JWT back to the AccessTokenContext.
JWTClaimsSetFromIDTokenLookupFunction	Extract the JWTClaimsSet from the id_token in OIDCAuthenticationResponseContext.
JWTClaimsSetFromJWTAccessTokenLookupFunction	Extract the JWTClaimsSet from the JWT in AccessTokenContext.
JWTClaimsSetFromLogoutContextLookupFunction	Extract the JWTClaimsSet from the JWT in OIDCBackChannelLogoutPropagationContext.
JWTClaimsSetFromUserInfoLookupFunction	Extract the Payload from the user info in OIDCAuthenticationResponseContext.
JWTCredentialValidator	A validator that handles authentication via signed JWT.
LogoutRequestClientIDLookupFunction	A function that returns client id of the OIDC logout request.
ManipulateClaimsForIDToken	An action that can be used for manipulating id_token claims via configurable strategy (bi-function).
MetadataPolicyRedirectUriValidator	A custom bi-predicate for redirect URI validation exploiting metadata policy.
MetadataStatementsLookupFunction	A function that returns metadata_statements (oidcfed) obtained via a lookup function.
MetadataValueEqualsCondition	A predicate for matching if the OIDC metadata value with a configurable key is equal to a configurable value.
MetadataValueResolver	A resolver that is capable of resolving dynamic metadata values (as Objects) which meet certain supplied criteria.
NimbusResponseEncoder	A message encodes that encodes the Nimbus Response in the message context inside the attached HttpServletResponse.
OAuth2AuthorizationRequestDecoder	Message decoder decoding OAuth2 AuthorizationRequests.
OAuth2DPoPProofContext	Subcontext carrying information for an OAuth2 DPoP Proof JWT.
OAuth2IntrospectionRequestDecoder	Message decoder decoding OpenID Connect TokenIntrospectionRequests.
OAuth2PushedAuthorizationRequestDecoder	Message decoder decoding OAuth2 PushedAuthorizationRequests.
OAuth2RevocationErrorResponse	OAuth2 Token Revocation Error message class.
OAuth2RevocationRequestDecoder	Message decoder decoding OpenID Connect TokenRevocationRequests.
OAuth2RevocationSuccessResponse	OAuth2 Token Revocation Success message class.
OAuth2TokenMgmtResponseContext	Subcontext carrying information for an OAuth token management responses such as introspection or revocation.
OfflineAccessScopeCondition	A predicate returning true if validated scope contains 'offline_access' value.
OIDCAuthenticationRequestDecoder	Message decoder decoding OpenID Connect AuthenticationRequests.
OIDCAuthenticationResponseConsentContext	Subcontext carrying user consent information in a form suitable for OIDC processing.
OIDCAuthenticationResponseContext	Subcontext carrying information to form authentication, token and userinfo responses for relying party.
OIDCAuthenticationResponseContextLookupFunction	A ContextDataLookupFunction that returns the outbound OIDCAuthenticationResponseContext for a ProfileRequestContext.
OIDCAuthenticationResponseTokenClaimsContext	Subcontext carrying information to form token and userinfo responses for relying party.
OIDCBackChannelLogoutPropagationContext	Subcontext carrying information about OIDC back-channel logout.
OIDCClientInfoCredentialValidator	A password validator that authenticates against OIDC client metadata (which may itself be emulated via SAML metadata).
OIDCClientRegistrationMetadataPolicyContext	Subcontext carrying information on the metadata policy related to the dynamic client registration.
OIDCClientRegistrationRequestDecoder	Message decoder decoding OpenID Connect ClientRegistrationRequests.
OIDCClientRegistrationRequestMetadataLookupFunction	A function that returns OIDCClientMetadata if such is available in the message from a MessageContext obtained via InOutOperationContext.getInboundMessageContext().
OIDCClientRegistrationResponseContext	Subcontext carrying information on OIDC client registration response.
OIDCClientRegistrationResponseMetadataLookupFunction	A function that returns OIDCClientMetadata if such is available in the message from a OIDCClientRegistrationResponseContext.
OIDCClientRegistrationTokenClaimsContext	Subcontext carrying information on the claims included in the initial access token used for accessing the dynamic client registration endpoint.
OIDCLogoutPropagationContext	Subcontext carrying information about OIDC logout propagation (both front- and back-channel).
OIDCLogoutRequestDecoder	Message decoder decoding OpenID Connect LogoutRequests.
OIDCMetadataLookupHandler	Handler for inbound OIDC protocol messages that attempts to locate OIDC metadata for a rp, and attaches it with a OIDCMetadataContext as a child of a pre-existing instance of MessageContext.
OIDCOPModule	IdPModule implementation.
OIDCOPPlugin	Details about the OIDC OP plugin.
OIDCPolicyEnforcedClientRegistrationRequestMetadataLookupFunction	A lookup function for fetching policy-enforced client metadata related to the dynamic client registration request.
OIDCRegistrationResponseContextLookupFunction	A ContextDataLookupFunction that returns the outbound OIDCClientRegistrationResponseContext for a ProfileRequestContext.
OIDCResponseEncoderFactory	A source of encoders that first verifies a message being an instance of Nimbus Response and then returns the attached MessageEncoder.
OIDCRpInitiatedLogoutContext	Subcontext carrying information about OIDC RP-initiated logout.
OIDCRPSession	A concrete SPSession implementation for OIDC relying parties.
OIDCRPSession.Builder	Builder class for building OIDCRPSession.
OIDCRPSessionClientIDLookupFunction	A lookup function that fetches ClientID value from the OIDCRPSession found from the session stored in the LogoutPropagationContext.
OIDCRPSessionCreationStrategy	A function to create a OIDCRPSession based on profile execution state.
OIDCRPSessionSerializer	A serializer for OIDCRPSession objects.
OIDCTokenRequestDecoder	Message decoder decoding OpenID Connect TokenRequests.
OIDCUserInfoRequestDecoder	Message decoder decoding OpenID Connect UserInfoRequests.
OpenIDConfigurationSuccessResponse	OpenID Configuration success message class.
PairwiseSubjectActivationCondition	Activation condition returning true if pairwise subject is requested.
ParseAccessToken	Action that parses an access token and initially populates the claims for later validation.
PayloadFromJWTAccessTokenLookupFunction	Extract the Payload from the JWT in AccessTokenContext.
PayloadFromProcessedTokenLookupFunction	Extract the Payload from the processed token in OIDCAuthenticationResponseContext.
PayloadFromUserInfoLookupFunction	Extract the Payload from the user info in OIDCAuthenticationResponseContext.
PopulateLogoutContext	This action creates OIDCLogoutPropagationContext and populates it with the front- and back-channel URIs if found from the RP metadata.
PopulateOIDCMetadataContext	A message handler that attempts to locate OIDC client information from the SAML entity descriptor containing role descriptor of type SPSSODescriptor.
PopulateRpInitiatedLogoutContext	Populates the OIDCRpInitiatedLogoutContext with the values found from the incoming logout request.
PrepareBackChannelLogoutRequest	An action that constructs LogoutTokenClaimsSet and attaches it to the OIDCBackChannelLogoutPropagationContext.
ProcessedIdTokenHintUpdateStrategy	Add the JWT back to the processed ID token hint in the OIDCRpInitiatedLogoutContext.
ProcessedTokenUpdateStrategy	Add the JWT back to the processed token in the OIDCAuthenticationResponseContext.
ProcessRequestedAuthnContext	An action that creates an RequestedPrincipalContext or PreferredPrincipalContext and attaches it to the current AuthenticationContext.
ProcessRpInitiatedLogoutRequest	Profile action that processes LogoutRequest and OIDCRpInitiatedLogoutContext by resolving matching sessions and populating the associated SPSession objects into a LogoutContext.
ProcessTokenForIntrospection	Action that processes a token for introspection.
ProcessTokenForRevocation	Action that processes a token for revocation.
ProfileResponderIdLookupFunction	A function that returns responder id based on profile.
ProviderMetadataResolver	A resolver that is capable of resolving OIDCProviderMetadata instances which meet certain supplied criteria.
ProviderMetadataResolverServiceStrategy	Strategy for summoning up a ProviderMetadataResolver from a populated ApplicationContext.
PublicSubjectActivationCondition	Activation condition returning true if public subject is requested.
PushedAuthorizationRequestClientIDLookupFunction	A function that returns client id of the PAR request.
RefreshableMetadataValueResolver	A resolver that is capable of resolving dynamic metadata values (as Objects) which meet certain supplied criteria.
RefreshableProviderMetadataResolver	Specialization of ProviderMetadataResolver that supports on-demand refresh.
RefreshTokenClaimsSet	Class wrapping claims set for refresh token.
RefreshTokenClaimsSet.Builder	Builder to create instance of RefreshTokenClaimsSet.
RegistrationClaimsSet	Class wrapping claims for the initial registration access token.
RegistrationClaimsSet.Builder	The builder for RegistrationClaimsSet.
RequestedGrantTypesCondition	Checks whether a TokenRequest was for one of a set of candidate grant_type values.
RequestObjectUpdateStrategy	Add the JWT back to the request object in the OIDCAuthenticationResponseContext.
RequestUtil	Request logging helper class.
ResponseContextAuthorizationCodeLookupFunction	A function that returns raw authorization code value from the OIDCAuthenticationResponseContext.
ResponseUtil	Response logging helper class.
RevocationCacheContexts	Revocation cache contexts shared across actions.
RevokeConsent	Action that revokes consent if the configurable predicate returns true.
RevokedTokenAuditExtractor	Function that returns token to be revoked by TokenRevocationRequest.
RevokeToken	Action that revokes a single token or the full chain of tokens, depending on the result of the configured lookup strategy for the revocation method.
RevokeTokenChain	An action that revokes the token chain related to the logout propagation.
RootTokenIdRevocationValidator	Verifies the root identifier (TokenClaimsSet.KEY_ROOT_JTI from the JWT against revocation via configurable RevocationCache.
RpInitiatedLogoutResponse	A Nimbus Response implementation representing a post front-channel logout redirection message that is sent to the RP's post front-channel logout URI endpoint.
ScopeUtil	Static helper methods for handling Scope objects, especially with IdP attributes.
SectorIdentifierLookupFunction	A function that returns sector identifier obtained via a lookup function.
ServiceableProviderMetadataProvider	A serviceable implementation of ProviderMetadataResolver.
SetAccessTokenToResponseContext	Action that creates a Access Token, and sets it to work context OIDCAuthenticationResponseContext.getAccessToken() located under InOutOperationContext.getOutboundMessageContext().
SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext	Action that sets authentication context class reference to work context OIDCAuthenticationResponseContext located under InOutOperationContext.getOutboundMessageContext().
SetAuthenticationContextClassReferenceToResponseContext	Action that sets authentication context class reference to work context OIDCAuthenticationResponseContext located under InOutOperationContext.getOutboundMessageContext().
SetAuthenticationTimeToResponseContext	Action that sets authentication instant to work context OIDCAuthenticationResponseContext located under InOutOperationContext.getOutboundMessageContext().
SetAuthorizationCodeToResponseContext	Action that creates a Authorization Code, and sets it to work context OIDCAuthenticationResponseContext.getAuthorizationCode() located under InOutOperationContext.getOutboundMessageContext().
SetConsentFromTokenToResponseContext	Action that locates consent from authorization code / access token.
SetConsentToResponseContext	Action that checks for adds the currently existing attributes from AttributeContext for token delivery.
SetEntityIdToSAMLPeerEntityContext	MessageHandler that sets the entityID to the given SAMLPeerEntityContext class.
SetFrontChannelLogoutSuccess	Action that sets the LogoutPropagationContext.setResult(Result) as 'success'.
SetRefreshTokenToResponseContext	Action that creates a Refresh Token, and sets it to work context OIDCAuthenticationResponseContext.getRefreshToken() located under InOutOperationContext.getOutboundMessageContext().
SetRequestedClaimsToResponseContext	Action that sets requested claims to response context.
SetRequestedSubjectToResponseContext	Action that sets requested sub value to response context.
SetRequestObjectToResponseContext	Action that stored request object to OIDCAuthenticationResponseContext.
SetResponseStatusCodeFromEvent	This action reads an event from the configured EventContext lookup strategy and sets the status code for HttpServletResponse according to the attached configuration.
SetSectorIdentifierForAttributeResolution	An action that sets AttributeResolutionContext.setAttributeRecipientGroupID(java.lang.String) to sector identifier if pairwise subject is requested.
SetSessionIdToResponseContext	Action that locates session id using configurable lookup strategy.
SetSubjectToResponseContext	Action that locates subject using strategy.
SetTokenDeliveryAttributesFromTokenToResponseContext	Action that locates any token delivery claims from authorization code / access token.
SetTokenDeliveryAttributesToResponseContext	Action that checks for any released attributes marked for token delivery.
StorageServicePushedAuthorizationRequestUriDeserializationFunction	Default deserialization function for decoding the request URI into claims set within OAuth2 PAR.
StorageServicePushedAuthorizationRequestUriSerializationFunction	A serialization function for the request URI claims set within OAuth2 PAR.
StoreClientInformation	An action that stores the ClientInformation from the OIDCClientRegistrationResponseContext to the associated ClientInformationManager.
StoreDPoPProofKeyThumbprint	Stores the dpop_jkt parameter from the incoming authorization request.
SubjectActivationCondition	Activation condition returning true if subject cannot be located from oidc response context.
SubjectTypeAuditExtractor	Function that returns the type of the subject from OIDCAuthenticationResponseContext.
SubjectValueAuditExtractor	Function that returns the value of the subject from OIDCAuthenticationResponseContext.
TokenClaimsSet	Class to extend for token claims sets.
TokenClaimsSet.Builder<T extends TokenClaimsSet>	Abstract builder to extend builders from that are instantiating claims sets extending TokenClaimsSet.
TokenExtensionFactory	Factory used for obtaining token extension beans of the desired type, identifier and scope.
TokenExtensionFactory.TokenExtensionType	Enumeration of the supported token extension types.
TokenRequestAudienceLookupFunction	A function that returns a copy of requested resource list from a TokenRequest.
TokenRequestAudienceLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
TokenRequestAuthorizationCodeLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
TokenRequestAuthTimeLookupFunction	For Token and UserInfo end points.
TokenRequestClientIDLookupFunction	For Token, Revocation and other end points supporting client authentication.
TokenRequestClientIDLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
TokenRequestConsentedAttributesLookupFunction	For Token and UserInfo end points.
TokenRequestDeliveryClaimsLookupFunction	For Token and UserInfo end points.
TokenRequestIDTokenDeliveryClaimsLookupFunction	For Token end point.
TokenRequestNonceLookupFunction	For Token and UserInfo end points.
TokenRequestRedirectURILookupFunction	For Token endpoint.
TokenRequestRedirectURILookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
TokenRequestRequestedClaimsLookupFunction	For Token and UserInfo end points.
TokenRequestScopeLookupFunction	A function that returns a copy of requested scopes from a TokenRequest.
TokenRequestScopeLookupFunction	Deprecated, for removal: This API element is subject to removal in a future version.
TokenRequestSessionIdLookupFunction	For Token and UserInfo end points.
TokenRequestSubjectLookupFunction	For Token and UserInfo end points.
TokenRequestTokenClaimsSetLookupFunction	A bi-function that returns value for the given claim via a lookup function.
TokenRequestUserInfoDeliveryClaimsLookupFunction	For user info end point.
TokenRequestValidRequestURIsLookupFunction	For Token and UserInfo end points.
TokenRevocationConditionValidator	Verifies the claims set against configurable token revocation condition.
UserInfoRequestClientIDLookupFunction	For UserInfo end point.
UserInfoResponseClaimsSetLookupFunction	A function that returns user info claims set from response context.
ValidateAccessToken	Action that validates the claims pulled from an access token as usable for access to the OP's UserInfo endpoint.
ValidateAudience	Action that validates requested resource/audience values against a computed set of "allowed" values and populates the resulting set into the OIDCAuthenticationResponseContext and a ProxiedRequesterContext.
ValidateAuthorizationRequestType	An action that validates the incoming OAuth2 authorization request via configurable strategy.
ValidateClientAuthenticationType	Validates the client authentication type with the token_endpoint_auth_method stored in the client's metadata and the profile configuration.
ValidateClientIDAgainstPolicy	Validates a client ID against unregistered client policy via configurable policy enforcer.
ValidateCodeChallenge	Validates the presence of PKCE code challenge parameter from the incoming authentication request.
ValidatedAudienceLookupFunction	A function that returns OIDCAuthenticationResponseContext.getAudience().
ValidateDPoPProof	Action validates DPoP Proof JWT if already stored to the context.
ValidatedRedirectUriAuditExtractor	Looks up the validated redirect URI value from the OIDC authentication response context.
ValidatedRedirectURILookupFunction	A function that returns validated redirect uri from response context.
ValidatedScopeLookupFunction	A function that returns OIDCAuthenticationResponseContext.getScope().
ValidatedScopePredicate	Predicate that evaluates a ProfileRequestContext by looking for the validated Scope that matches one of a designated set of string values, a single value, or a generic predicate.
ValidateGrant	Action that validates an authorization grant.
ValidateGrantType	An action that validates the grant type is registered to the requesting RP.
ValidateIdTokenHint	Action validates ID token hint in response context.
ValidatePKCE	Action performs PKCE (https://oauth.net/2/pkce/) validation.
ValidatePostLogoutRedirectURI	Action that validates post redirect URI is expected if it's being requested.
ValidatePushedAuthorizationClientIDMatch	Validates the client ID in the incoming authorization request matches with the one used in endpoint authentication.
ValidateRedirectURI	Action that validates redirect uri is expected.
ValidateRegistrationAccessToken	Action that validates registration access token is a valid one.
ValidateRegistrationRequestMetadata	Validates the incoming dynamic client registration request against the metadata policy stored in the OIDCClientRegistrationMetadataPolicyContext.
ValidateRequestObject	Action validates request object in response context.
ValidateResponseMode	An action that validates the requested response_mode is compliant with the profile configuration.
ValidateResponseType	An action that validates the requested response_type is (1) registered to the requesting RP (or accepted in the policy for unregistered clients) and (2) valid for the protocol used for request.
ValidateScope	Action that validates requested and previously granted scopes are also registered in client metadata and stores the resulting set in the response context.
VerifyRequestedSubjectIdentifier	Action verifies that produced subject equals to requested subject if such exists.