All Classes

Class	Description
AbstractAuthenticatableOIDCContext	An abstract base class for subcontexts that carry information which may be authenticated.
AbstractHttpOIDCAuthenticationAction<T extends com.nimbusds.oauth2.sdk.Response>	An abstract class for OIDC actions that make synchronous HTTP requests and return responses.
AbstractJSONResponseDecoderFunction<T>	Abstract class for JSON based response decoders.
AbstractOIDCAuthenticationRequestActionMessageHandler	An abstract message handler that runs inside an WebFlowMessageHandlerAdaptor that provides functions to make available various OIDC contexts.
AbstractOIDCAuthenticationRequestMessageHandler	An abstract message handler that does *not* run inside an WebFlowMessageHandlerAdaptor.
AbstractOIDCAuthenticationResponseAction	Abstract class for actions based on the AuthenticationResponse located under the InOutOperationContext.getInboundMessageContext() and the built OIDCAuthenticationRequest located under the InOutOperationContext.getOutboundMessageContext().
AbstractRequestEncoderFunction	Abstract request encoder function that pulls out various contexts and request/response messages.
AbstractTokenResponseLookupStrategy	Base class for looking up the token response context.
AbstractUserInfoResponseTypeCondition	Abstract predicate for pulling out the UserInfoResponseContext.
AbstractUserInfoTokenResponseLookupStrategy	Base class for looking up the UserInfo token response context.
AccessTokenLookupStrategy	Function that extracts the access_token from the AccessTokenResponseContext.
AccessTokenResponseContext	A context to hold an OIDC token request response.
AccessTokenToPrivateCredentialsMappingStrategy	A mapping strategy that locates the AccessTokenResponseContext from the ProfileRequestContext and constructs and returns an OAuth2AccessTokenPrincipal from the access_token, token_type, and expires_in.
AddAuthenticationContextClassReferencesHandler	A message handler that adds any authentication context class references from the those derived from the profile config - which may be proxied and mapped from the original request.
AddEndpointURIHandler	A message handler that adds the authorization endpoint URI from the providers metadata to the under constructions authentication request.
AddForceAuthenticationHandler	An action that sets the 'prompt' parameter to 'login' and max_age to 0 seconds, iff force authn was requested by the upstream SP (or is overridden in the profile config).
AddLoginHintHandler	Message handler that adds the login_hint parameter based on any defined in the profile configuration.
AddMaxAgeHandler	Message handler that adds the max_age parameter based on any defined in the profile configuration.
AddNonceHandler	A message handler that adds a nonce from a lookup strategy to the authentication request.
AddPassiveAuthenticationHandler	A message handler that sets the 'prompt' parameter to 'none' if passive authentication has been requested by the SP.
AddRedirectURIHandler	A message handler that adds a redirect_uri to the authentication request.
AddRequestedClaimsHandler	A message handler that adds requested claims to the under constructions authentication request.
AddResponseTypeAndModeHandler	Action that populates the authentication request response_mode and response_type from various strategies, by default from the profile configuration.
AddScopesHandler	A message handler that adds the scopes from the profile request object to the authentication request.
AddStateHandler	Add state to the authentication request URL and the request object claims (if present).
AuthenticationRequestNonceClaimLookupStrategy	Lookup strategy that finds the nonce from the OIDCAuthenticationRequest.
AuthenticationRequestTimeLookupFunction	Lookup function that returns the time at which the RP sent the authentication request, as taken from the authentication request object.
AuthorizationController	Servlet compatible with the ExternalAuthentication interface that begins, by HTTP redirect, an OpenID Connect authentication request to an OpenID Connect Provider (an OAuth 2.0 Authorization Server that supports OpenID Connect).
BuildPlainRequestObjectJWT	If the Request Object claims are present in the authentication request, convert them into a JWTClaimsSet inside a PlainJWT.
BuildRequestObject	Action that creates a Request Object JWT, and sets it to the work context OIDCAuthenticationRequest located under InOutOperationContext.getOutboundMessageContext().
ClientAuthenticationConfigurationLookupFunction	A function that returns a SignatureSigningConfiguration list for signing client authentication JWTs.
ClientIDFromOAuth2ClientContextFunction	A function that pulls the client_id out of the OAuth2ClientContext.
DefaultAccessTokenResponseDecoder	Default access token response decoder, which converts a successful HTTP response into an OIDCTokenResponse.
DefaultAuthCodeTokenRequestEncoder	A token request encoder that builds an OAuth2.0 Access Token Request for an authorization_code grant and returns an HttpUriRequest.
DefaultClaimMergingStrategy	A default merging strategy for combing claims in the UserInfo response with those from the id_token.
DefaultClaimSanitizationStrategy	Produce a claims set from the JWT claims set without the validation claims, leaving the identity, authorization, and misc.
DefaultEndUserClaimsLookupStrategy	Function that extracts the end-user's claims from the EndUserClaimsContext.
DefaultIDTokenLookupStrategy	Function that extracts the id_token from the AccessTokenResponseContext.
DefaultIssuerIDLookupFunction	Strategy to pull out the ID of the OIDC proxy issuer/provider from the OIDCPeerEntityContext.
DefaultRedirectUriCreationFunction	Constructive, pure, function that returns a redirect_uri from one of (ordered): A pre-registered redirect_uri on the OAuth2ClientContext.getRedirectUriOverride().
DefaultUserInfoJWTLookupStrategy	Function that extracts the UserInfo claims as a JWT from the UserInfoResponseContext.
DefaultUserInfoRequestEncoder	Default encoder for UserInfo requests.
DefaultUserInfoResponseDecoder	Response decoder for UserInfo responses.
EncryptedIDTokenLookupStrategy	Function that extracts the id_token from the AccessTokenResponseContext iff it is an EncryptedJWT type.
EncryptedUserInfoJWTLookupStrategy	Function that extracts the UserInfo JWT from the UserInfoResponseContext iff it is an EncryptedJWT type.
EndUserClaimsContext	A context to hold the final set of claims associated with an authenticated end-user.
ExchangeCodeForAccessToken	Action to exchange the authorization code in the authentication response for an OAuth access token which contains an OIDC id_token.
ExtraAudiencesLookupStrategy	Locate additional accepted audiences from the ID Token profile config value.
FixedStringAuditExtractor	A simple audit extractor that allows a fixed string to be logged.
IDTokenInAccessTokenUpdateStrategy	Consumer to update the id_token in the AccessTokenResponseContext.
IDTokenJOSEHeaderLookupStrategy	Function that extracts the JWS JOSE header from the id_token inside the AccessTokenResponseContext.
InboundMessageContextFromProxyPRC	A ContextDataLookupFunction that returns the inbound MessageContext for a ProfileRequestContext located inside an AuthenticationContext i.e.
InitializeAuthorizationRequest	An action that creates an OIDCAuthenticationRequest shell to populate in future steps, and sets it to the outbound message context.
InitializeBlankOutboundResponseMessageContext	Action that adds an outbound MessageContext to the outbound message context inside the ProfileRequestContext.
InitializeOAuth2ClientAuthenticationContext	An action that initializes an OAuth2ClientAuthenticationContext for later use.
InitializeOAuth2ClientAuthenticationMethodHandler	An action that resolves the Client Authentication method for the chosen upstream OpenID Provider (issuer) from the profile configuration, and adds it to the OAuth2ClientAuthenticationContext.
InitializeOAuth2ClientContext	An action that resolves the client identifier and redirect URI for the chosen provider (issuer).
InitializeOutboundAuthorizationRequestMessageContext	Initialize an outbound message context with an OIDC peer entity context ready for an authorization/authentication request to be built.
InitializeRelyingPartyContext	Action that adds a RelyingPartyContext to the current ProfileRequestContext tree via a creation function.
InitializeUnverifiedRelyingPartyContext	Action that adds an unverified RelyingPartyContext to the current ProfileRequestContext tree via a creation function.
IsCodeFlowPredicate	A predicate that determines if the flow is a 'code-flow' using the Authentication Request that is inside the message context.
IsHybridFlowPredicate	A predicate that determines if the flow is a 'hybrid-flow' using the Authentication Request that is inside the message context.
IsImplicitFlowPredicate	A predicate that determines if the flow is a 'implicit-flow' using the Authentication Request that is inside the message context.
JWTBearerTokenForClientAuthenticationPredicate	A predicate that determines if the client authentication method chosen is a JWT type.
JWTClaimsSetFromRequestObjectLookupFunction	Extract the Payload from the Request Object inside the OIDCAuthenticationRequest.
ManyValuesIntegerComparisonPredicate	Predicate that returns true if the test integer is greater than 1.
MaxAgeLookupFunction	Locate the maximum authentication age from the authentication request (first) or profile configuration (second).
NonceValidationActivationCondition	Determines if nonce validation should occur.
OAuth2AccessTokenPrincipal	Principal based on an OAuth 2.0 access token.
OAuth2ClientContext	A context to store information pertaining to the OAuth2 client (Relying Party) to use in communication with a OpenID Provider.
OAuth2RefreshTokenPrincipal	Principal based on an OAuth 2.0 refresh token.
OIDCAuthnContext	Manages state during proxied OIDC authentication via a Spring Controller.
OIDCProviderMetadataFromOuboundPeerLookupStrategy	Lookup function to extract the OIDCProviderMetadataContext from the OIDCPeerEntityContext in the outbound message.
OIDCProviderMetadataLookupHandler	Handler for inbound OIDC protocol messages that attempts to locate OIDC metadata for a OP (issuer), and attaches it with a OIDCMetadataContext as a child of a pre-existing instance of MessageContext.
OIDCProxyException	An exception to signal a general proxy error.
OIDCProxySupport	Support class for OIDC proxy related implementations.
OIDCRPException	An exception to signal a general OIDC RelyingParty error.
OIDCRPModule	IdP Module implementation.
OIDCRPPlugin	Plugin description about the OIDC-RP plugin.
OIDCSubjectIdentifierPrincipal	Principal based on an OIDC 'sub' (subject) identifier.
OutboundMessageContextFromProxyPRC	A ContextDataLookupFunction that returns the outbound MessageContext for a ProfileRequestContext located inside an AuthenticationContext i.e.
OutboundMessageHandlerContext	A context to stash controller parameters for use by message handlers.
PayloadFromRequestObjectLookupFunction	Extract the Payload from the Request Object inside the OIDCAuthenticationRequest.
PrepareOIDCInboundMessageContext	Action that adds an inbound MessageContext and a OIDCPeerEntityContext to the ProfileRequestContext based on the identity of a relying party, by default from the AuthenticationContext.getAuthenticatingAuthority().
ProcessEndUserClaims	Process the end-user claims from the id_token and possible UserInfo claims sets.
ProviderMetadataStringListValueLookupFunction	Fetches the value for the configured key as List of Strings.
ProxyAuthenticationFlowAuditExtractor	A Function that returns the authentication flow ID from the attempted flow of the parent context used to satisfy a request.
RedirectUriLookupFunction	Pull a redirect_uri from the Relying Party profile config if present.
RequestObjectRequiredAndSupported	A predicate that tests whether a request object should be built based on what is configured in the profile configuration and whether the OP supports it.
RequestObjectSupportedSignatureSigningAlgorithms	Pull out the request object supported signature signing algorithms from the metadata.
RequestObjectTokenUpdateStrategy	Consumer that adds the JWT back to the Request Object in the OIDCAuthenticationRequest.
RequiresSignatureVerificationPredicate	Is successful TLS credential verification enough to validate the JWT in question or should JWT signature validation be applied? Defaults to true — signature verification is required.
SetAuthenticationRequestTimeHandler	Handler that adds the authentication request time to the authentication request.
SimpleOIDCSubjectIdentifierCanonicalization	An action that operates on a SubjectCanonicalizationContext child of the current ProfileRequestContext, and transforms the input Subject into a principal name by searching for one and only one OIDCSubjectIdentifierPrincipal custom principal.
SimpleOIDCSubjectIdentifierCanonicalization.ActivationCondition	A predicate that determines if this action can run or not.
SubFromIDTokenLookupFunction	A function that pulls the subject 'sub' out of the id_token in the AccessTokenResponseContext.
TransitionActionWriteAuditLog	A simple extension of the WriteAuditLog action that creates an Event with the string literal 'success', such that the write audit log action can be used inside a transition and does not prevent the transition from proceeding.
UnsupportedResponseTypeAction	Simple action to log the response from an unsupported grant type.
UserInfoEndpointLookup	Request information from the UserInfo OAuth2.0 endpoint using the access_token already present in the context.
UserInfoHttpRequestMethodLookupStrategy	Locate the HTTP request method to use for the UserInfo request.
UserInfoInUserInfoResponseContextUpdateStrategy	Consumer strategy to update the UserInfo JWT in the UserInfoResponseContext.
UserInfoLookupCondition	Checks whether the UserInfo endpoint should be accessed to retrieve claims about the authenticated end-user.
UserInfoPlainResponseTypeCondition	Condition that returns true if the UserInfo response was an plain JSON type i.e.
UserInfoResponseContext	A context to hold the response from the UserInfo endpoint.
ValidateAuthenticationResponseResult	An action that checks the inbound authentication response indicated success as opposed to an error.
ValidateExternalAuthenticationContext	An action that checks for a ExternalAuthenticationContext for a signalled event via the ExternalAuthenticationContext.getAuthnError() method.
ValidateOAuthAccessTokenResponse	Validation action that validates the OAuth Access Token Response against RFC 6749 section 5.1 and OpenID Connect Core 1.0 section 3.1.3.3.
ValidateOIDCAuthentication	An action that builds an AuthenticationResult based on an inbound OIDC authentication response.
ValidateResponseState	Authentication action that validates the authentication response state parameter (which is required in the Proxy flow) matches that in the authentication request.
ValidateTokenClaims	Action that validates the claims of a JWT using the supplied claims validator.
ValidateUserInfoJSONObjectClaims	Validate a successful UserInfo JSON Object Response according to section 5.3.2 of OpenID Connect Core 1.0.