All Classes and Interfaces
Class
Description
An abstract base class for subcontexts that carry information which may be authenticated.
AbstractHttpOIDCAuthenticationAction<T extends com.nimbusds.oauth2.sdk.Response>
An abstract class for OIDC actions that make synchronous HTTP requests and return types of
responses.Abstract class for JSON based Http client response decoders.
An abstract message handler that runs inside an
WebFlowMessageHandlerAdaptor
that provides functions to make available various OIDC contexts.An abstract message handler that does *not* run inside an
WebFlowMessageHandlerAdaptor.Abstract class for actions based on the
AuthenticationResponse located under
the InOutOperationContext.getInboundMessageContext() and the built OIDCAuthenticationRequest
located under the InOutOperationContext.getOutboundMessageContext().Abstract request encoder function that pulls out various contexts and request/response messages.
Base class for looking up the token response context.
Abstract predicate for pulling out the
UserInfoResponseContext.Base class for looking up the UserInfo token response context.
Function that extracts the access_token from the
AccessTokenResponseContext.A context to hold an OIDC token request response.
A mapping strategy that locates the
AccessTokenResponseContext from the ProfileRequestContext and
constructs and returns an OAuth2AccessTokenPrincipal from the access_token, token_type, and expires_in.A message handler that adds any authentication context class references from the those derived from the
profile config - which may be proxied and mapped from the original request.
Message handler that adds the optional 'display' request parameter if manually set on the profile configuration.
A message handler that adds the authorization endpoint URI from the providers metadata
to the under constructions authentication request.
An action that sets the 'prompt' parameter to 'login' and max_age to 0 seconds, iff force authn was requested by the
upstream SP (or is overridden in the profile config).
Message handler that adds the login_hint parameter based on any defined in the profile configuration.
Message handler that adds the max_age parameter based on any defined in the profile configuration.
A message handler that adds a nonce from a lookup strategy to the authentication request.
A message handler that sets the 'prompt' parameter to 'none' if passive authentication has been requested by the
SP.
Create an OAuth 2.0 PCKE code_verifier to use in the token request, and derives a code_challenge for immediate use in
the authorization request.
A message handler that adds a redirect_uri to the authentication request.
A message handler that adds requested claims to the under constructions authentication request.
A message handler that populates the authentication request response_mode and response_type from various strategies,
by default from the profile configuration.
A message handler that adds the scopes from the profile request object to the authentication request.
Add state to the authentication request URL and the request object claims (if present).
Lookup strategy that finds the nonce from the
OIDCAuthenticationRequest.Lookup function that returns the time at which the RP sent the authentication request, as taken from the
authentication request object.
Servlet compatible with the
ExternalAuthentication interface that begins, by HTTP redirect, an
OpenID Connect authentication request to an OpenID Connect Provider (an OAuth 2.0 Authorization Server
that supports OpenID Connect).If the Request Object claims are present in the authentication request, convert them
into a JWTClaimsSet inside a PlainJWT.
Action that creates a Request Object
JWT, and sets it to the work context
OIDCAuthenticationRequest located under InOutOperationContext.getOutboundMessageContext().A function that returns a
SignatureSigningConfiguration list for signing client authentication JWTs.A function that pulls the client_id out of the
OAuth2ClientContext.Default access token response decoder which converts a successful HTTP response into an
OIDCTokenResponse and a unsuccessful response into an TokenErrorResponse.A token request encoder that builds an OAuth2.0 Access Token Request for an authorization_code grant and returns an
HttpUriRequest.A default merging strategy for combing claims in the UserInfo response with those from the id_token.
Produce a claims set from the JWT claims set without either the validation claims or claims with null values.
Function that extracts the end-user's claims from the
EndUserClaimsContext.Function that extracts the id_token from the
AccessTokenResponseContext.Strategy to pull out the ID of the OIDC proxy issuer/provider from the
OIDCPeerEntityContext.Constructive, pure, function that returns a redirect_uri from one of (ordered):
A pre-registered redirect_uri on the
OAuth2ClientContext.getRedirectUriOverride().Function that extracts the UserInfo claims as a JWT from the
UserInfoResponseContext.Default encoder for UserInfo requests.
The default Http client UserInfo response decoder.
Function that extracts the id_token from the
AccessTokenResponseContext iff it is an EncryptedJWT
type.Function that extracts the UserInfo JWT from the
UserInfoResponseContext iff it is an EncryptedJWT
type.A context to hold the final set of claims associated with an authenticated end-user.
Action to exchange the authorization code in the authentication response for an OAuth access token which
contains an OIDC id_token.
Locate additional accepted audiences from the ID Token profile config value.
A simple audit extractor that allows a fixed string to be logged.
Consumer to update the id_token in the
AccessTokenResponseContext.Function that extracts the JWS JOSE header from the id_token inside the
AccessTokenResponseContext.A
ContextDataLookupFunction that returns the inbound MessageContext for a
ProfileRequestContext located inside an AuthenticationContext i.e.An action that creates an
OIDCAuthenticationRequest shell to populate in future steps,
and sets it to the outbound message context.Action that adds an outbound
MessageContext to the outbound message context inside
the ProfileRequestContext.An
action that initializes an OAuth2ClientAuthenticationContext for later use.An
action that resolves the Client Authentication method for the chosen
upstream OpenID Provider (issuer) from the profile configuration, and adds it to the
OAuth2ClientAuthenticationContext.An
action that resolves the client identifier and redirect URI for the chosen
provider (issuer).Initialize an outbound message context with an OIDC peer entity context ready for an authorization/authentication
request to be built.
Action that adds a
RelyingPartyContext to the current ProfileRequestContext tree via a creation
function.Action that adds an unverified
RelyingPartyContext to the current ProfileRequestContext tree via a
creation function.A predicate that determines if the flow is a 'code-flow' using the Authentication Request that is inside
the message context.
A predicate that determines if the flow is a 'hybrid-flow' using the Authentication Request that is inside
the message context.
A predicate that determines if the flow is a 'implicit-flow' using the Authentication Request that is inside
the message context.
A predicate that determines if the client authentication method chosen is a JWT type.
Extract the
Payload from the Request Object inside the OIDCAuthenticationRequest.Predicate that returns true if the test integer is greater than 1.
Locate the maximum authentication age from the authentication request (first) or profile configuration (second).
Determines if nonce validation should occur.
Principal based on an OAuth 2.0 access token.
A context to store information pertaining to the OAuth2 client (Relying Party) to use in communication
with a OpenID Provider.
Principal based on an OAuth 2.0 refresh token.
Manages state during proxied OIDC authentication via a Spring Controller.
Lookup function to extract the
OIDCProviderMetadataContext from the OIDCPeerEntityContext in the
outbound message.Handler for inbound OIDC protocol messages that attempts to locate OIDC metadata for a OP (issuer),
and attaches it with a
OIDCMetadataContext as a child of a pre-existing instance of MessageContext.An exception to signal a general proxy error.
Support class for OIDC proxy related implementations.
An exception to signal a general OIDC RelyingParty error.
IdP Module implementation.Plugin description about the OIDC-RP plugin.
Principal based on an OIDC 'sub' (subject) identifier.
A
ContextDataLookupFunction that returns the outbound MessageContext for a
ProfileRequestContext located inside an AuthenticationContext i.e.A context to stash controller parameters for use by message handlers.
Extract the
Payload from the Request Object inside the OIDCAuthenticationRequest.Action that adds an inbound
MessageContext and a OIDCPeerEntityContext to the
ProfileRequestContext based on the identity of a relying party, by default from the
AuthenticationContext.getAuthenticatingAuthority().Process the end-user claims from the id_token and possible UserInfo claims sets.
Fetches the value for the configured key as List of
Strings.A
Function that returns the authentication flow ID from the attempted flow of the
parent context used to satisfy a request.Pull a redirect_uri from the Relying Party profile config if present.
A predicate that tests whether a request object should be built based on what is configured in the profile
configuration and whether the OP supports it.
Pull out the request object supported signature signing algorithms from the metadata.
Consumer that adds the
JWT back to the Request Object in the OIDCAuthenticationRequest.Is successful TLS credential verification enough to validate the JWT in question or should JWT signature validation
be applied? Defaults to true — signature verification is required.
Handler that adds the authentication request time to the authentication request.
An action that operates on a
SubjectCanonicalizationContext child of the current
ProfileRequestContext, and transforms the input Subject
into a principal name by searching for one and only one OIDCSubjectIdentifierPrincipal custom principal.A predicate that determines if this action can run or not.
A function that pulls the subject 'sub' out of the id_token in the
AccessTokenResponseContext.A simple extension of the
WriteAuditLog action that creates an Event with the string
literal 'success', such that the write audit log action can be used inside a transition
and does not prevent the transition from proceeding.Simple action to log the response from an unsupported grant type.
Request information from the UserInfo OAuth2.0 endpoint using the access_token already present
in the context.
Locate the HTTP request method to use for the UserInfo request.
Consumer strategy to update the UserInfo JWT in the
UserInfoResponseContext.Checks whether the UserInfo endpoint should be accessed to retrieve claims about the
authenticated end-user.
Condition that returns true if the UserInfo response was an plain JSON type i.e.
A context to hold the response from the UserInfo endpoint.
An action that checks the inbound authentication response indicated success as opposed to an error.
An action that checks for a
ExternalAuthenticationContext for a signalled event via the
ExternalAuthenticationContext.getAuthnError() method.Validation action that validates the OAuth Access Token Response against RFC 6749 section 5.1
and OpenID Connect Core 1.0 section 3.1.3.3.
An action that builds an
AuthenticationResult based on an inbound OIDC authentication response.Authentication action that validates the authentication response state parameter
(which is required in the Proxy flow) matches that in the authentication request.
Action that validates the claims of a JWT using the supplied
claims validator.Validate a successful UserInfo JSON Object Response according to section 5.3.2 of OpenID Connect Core 1.0.