All Classes and Interfaces
Class
Description
A base class for audit extractors that lookup the
OIDCAuthenticationRequest.A base class for audit extractors that lookup the
AuthenticationResponse.A base backing store implementation.
This action is extended by error response actions.
An abstract audit extractor function to extract claims from the located claims set.
Base class for
claims validators.Base class for resolving credentials from
OIDCClientInformation.Base class for
ClientSecretValueResolvers.Abstract strategy for fetching metadata dynamically over HTTP.
A base class for lookup strategies that return encryption algorithms and make use
of the
AlgorithmRegistry.Base class for all metadata criterion classes.
Based on
FilesystemMetadataResolver.A base
MetadataCache implementation.Base implementation for all simple metadata objects containing
String value inside the element.Base class for OAuth profile configurations that support OAuth-defined client authentication methods.
Base class for OIDC protocol configuration, containing configuration bits shared by all flow aware OIDC protocol
configurations.
Abstract profile configuration implementation for interceptor flow aware OAuth2 profile configurations.
Base class for profile configurations that validate previously issued OAuth2 tokens.
Abstract class for OIDC attribute encoders.
A function to produce a "canonical" name for an OIDC claim for transcoding rules.
Abstract base class for subcontexts that carry information about a OIDC entity.
A base class for
Resolvers used for resolving entities containing identifiers based on Identifier.Base class for OIDC message encoders.
An abstract metadata resolver which supports any type of metadata.
Base class for profiles that support OIDC's concept of SSO, which spans multiple endpoints.
Base class for metadata providers that cache and periodically refresh their entities.
A function that returns
(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A validator that checks the access_token value matches its encoded at_hash representation in the
id_token.
A function that returns
OAuth2AccessTokenProducingProfileConfiguration.getAccessTokenLifetime(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that returns
OAuth2AccessTokenProducingProfileConfiguration.getAccessTokenType(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A predicate that returns
OIDCAuthorizationConfiguration.isAcrRequestAlwaysEssential(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function, by default a child
of the ProfileRequestContext.Check the ACR values requested were received.
A predicate implementation that forwards to
OIDCSSOProfileConfiguration.isAllowPKCEPlain(ProfileRequestContext).A function that obtains
OIDCIDTokenProducingProfileConfiguration.getAlwaysIncludedAttributes(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A predicate implementation that forwards to
OAuth2AccessTokenProducingProfileConfiguration.isAlwaysIssueBearerAccessToken(ProfileRequestContext).A predicate implementation that checks if attribute-release is included in the list of post authentication flows
returned by
PostAuthenticationFlowsLookupFunction.Namespace handler for the oidc attribute resolver.
Verifies the Audience (aud) claim contains the appropriate value.
A function that returns the effective audience restrictions to include in ID tokens, based on combining a relying
party's entityID with the result of
OIDCIDTokenProducingProfileConfiguration.getAdditionalAudiencesForIdToken(ProfileRequestContext), if such
a profile is available from a RelyingPartyContext obtained via a lookup function, by default a child of the
ProfileRequestContext.Constants to use for audit logging fields stored in an
AuditContext.Verifies the Audience (aud) claim contains the appropriate value in JWT authentication.
Principal based on a OIDC Authentication Context Class Reference.
Function that extracts the ACRs from the OIDCAuthenticationRequest.Support class for ACR operations.
Message encoder factory function that returns the first encoder suitable for the given request method found in the
profile configuration.
Function that extracts the status of an authentication response i.e.Verifies the auth_time (when the End-User authentication took place):
If the authnLifetimeLookup returns 0 seconds (e.g.
A function that returns
(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A predicate implementation that forwards to
OAuth2FlowAwareProfileConfiguration.isAuthorizationCodeFlowEnabled(ProfileRequestContext).Function that extracts the authorization endpoint from the OIDCAuthenticationRequest.Has the auth_time claim been requested?
A function that returns
OAuth2AuthorizationCodeProducingProfileConfiguration.getAuthorizeCodeLifetime(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A backing store that holds cached objects.
Base class for security message handlers which evaluate a JWT signature with a signature trust engine.
A based metadata cache builder specification.
Base class for Spring bean definition parser for OIDC attribute encoders.
A
TrustEngine implementation for Signed JSON Web Tokens.A base class for
ClientInformationManager and ClientInformationResolver implementations
exploiting StorageService for storing the OIDC client information.Factory to generate a
ClientSecretCredential from a client_secret string.Basic implementation of
DecryptionConfiguration for handling JWEs.Basic implementation of
EncryptionConfiguration for handling JWE encryption.Basic implementation of an ExpiringJWKCredential.
A factory bean for creating a
BasicExpiringJWKCredential from an injected secret.A basic implementation of
JOSEObjectCredentialResolver.A basic implementation of
JWKCredential.Factory bean for Basic JSON Web Keys (JWK).
A basic implementation of
JWKReferenceCredential.Deprecated, for removal: This API element is subject to removal in a future version.
The configuration information to use when generating an signed JWT.
Basic implementation of an
SignatureSigningParametersResolver.Basic implementation of
SignatureValidationConfiguration for signed JWTs.Basic implementation of
SignatureValidationParametersResolver.A specialisation of a
BackingStore that deals with batch metadata.A
metadata cache implementation that supports 'refresh-ahead' semantics for batch
cache updates.A specification for building a batch read-ahead metadata cache.
A custom metadata policy operator that fetches a bean from
ApplicationContext and uses it for as
CustomMetadataPolicyOperator.This action reads an event from the configured
EventContext lookup strategy, constructs a json error response
message and attaches it as the outbound message.Context to hold information pertaining to a cache loading event.
Exception to catch cache loading errors.
A function that calculates the SHA-256 digest and returns the value as a hex string, if the input length is more
than 64 characters.
A client information provider that uses registered resolvers, in turn, to answer queries.
A concrete implementation of
AbstractChainingCredentialResolver which is scoped to
the simple JOSEObjectCredentialResolver type.A
ClaimsValidator implementation that validates a JWT claims set from a chain
of configured validators.A provider metadata provider that uses registered resolvers, in turn, to answer queries.
An action that uses a
OIDCClientInformation to verify the encryption parameters of an incoming encrypted JWT
are compliant with configuration in the client metadata.A
MessageHandler that uses a OIDCClientInformation to verify the signature of a signed JWT uses
expected algorithm.Activation condition to check a claim exists in the claims set.
Strategy to pull out a ClaimsSet from a located JWT.
High-level API for validating a JWT's claims set.
A function that obtains
OAuth2ClientAuthenticableProfileConfiguration.getClaimsValidator(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A
Criterion representing an OIDC client ID.A function that returns client_id via client information stored in
OIDCMetadataContext.A
JOSEObjectCredentialResolver that resolves client secret from of a ClientInformation.A
JOSEObjectCredentialResolver that resolves credentials from the jwks or contents of jwks_uri of a
ClientInformation.Client information criterion to make decisions based on client information.
A lookup strategy that finds data/content encryption algorithms from local configuration that are compatible
with those advertised by the RP/client information.
An implementation of
SignatureTrustEngine which evaluates the validity
and trustworthiness of JWT signatures.A lookup strategy that finds key transport algorithms from local configuration that are compatible with those
configured to RP.
A manager that is capable of managing
ClientInformation instances.Exception indicating a problem managing client information.
An implementation of
MetadataNodeProcessor which supports adding an instance of
OIDCClientInformation to the object metadata of SPSSODescriptor.Parser for a <ClientInformation> node processor.
A resolver that is capable of resolving
ClientInformation instances which meet certain supplied criteria.Strategy for summoning up a
ClientInformationResolver from a populated ApplicationContext.An implementation of an
SignatureSigningParametersResolver that extends the BasicSignatureSigningParametersResolver functionality by adding a configurable lookup strategy for fetching
the desired algorithm value from OIDCClientInformation.Fetches the value for the configured key as
String.SAML2 OIDC metadata extension 'ClientSecret'.
Builder of
ClientSecretImpl.Credential wrapping a client_secret.
A
Criterion that holds a single, fixed, client_secret credential.Extracts a credential held inside the
ClientSecretCredentialCriterion from the given criteria set.Concrete implementation of
ClientSecret.SAML2 OIDC metadata extension 'ClientSecretReferenceKey'.
Builder of
ClientSecretKeyReferenceImpl.Concrete implementation of
ClientSecretKeyReference.Implementation of
KeyInfoProvider which provides basic support for
extracting a NimbusSecretCredential child of KeyInfo.A
Criterion representing a reference to a client secret.Implementation of
KeyInfoProvider which provides basic support for
extracting a NimbusSecretCredential child of KeyInfo.A resolver that is capable of resolving client secret values (as
Strings) which meet certain supplied
criteria.An implementation of
BasicJOSEObjectCredentialResolver that
uses a Collection as the underlying credential source.Constants related to SAML 2.0 Metadata extension OAuthRPRoleDescriptorType.
Generic tool methods related to converting
Credential to JWK.A factory that returns a list of credentials which does not contain any null elements.
Interface describing a custom policy operator to be used with
MetadataPolicy objects.A function that returns
OIDCSSOProfileConfiguration.getCustomRedirectUriValidationStrategy(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.An implementation of an
Criterion which specifies content encryption algorithm criteria.A JWT claim extractor function that returns a formatted String representation of the JSON Date.
The configuration information to use when decrypting JWEs.
Criterion which holds one or more instances of a
DecryptionConfiguration.Describes the decryption parameters the system is required to use to decrypt a JWE.
An interface for components which resolve
DecryptionParameters based on a CriteriaSet.Decrypt the located JWE using the decryption parameters stored in the security context.
SAML2 OIDC metadata extension 'DefaultAcrValue'.
Builder of
DefaultAcrValueImpl.Concrete implementation of
DefaultAcrValue.Default implementation of a
BatchBackingStore.A basic implementation of
ClientSecretCredential.A BiFunction which pulls data encryption (content encryption) algorithms to use from the
encryption configuration and filters them.
Basic implementation of
DecryptionParametersResolver.Default implementation of a
DynamicBackingStore.Default implementation of an
EncryptionParametersResolver.Default strategy for loading information from a file.
Deserializes a UTF-8 JSON string into a Map.
A BiFunction that retrieves and filters the key transport encryption algorithms from the
EncryptionConfiguration inside the criteria set.A function that applies the given
MetadataPolicy to the given object.A
CustomMetadataPolicyOperator implementation that uses customizable Predicate for validating the
metadata policy and BiFunction for performing the operation.The response handler for parsing the metadata policy document into a map.
A function that verifies that the map of
MetadataPolicy entries meets the restrictions defined in the
OIDC federation specification 1.0 (draft 17 / September 2021):Implementation of a profile configuration for the OAuth2 Pushed Authorization Requests (PAR).
Implementation of an OAuth 2.0 token "audience" profile configuration.
Implementation of an OIDC-aware OAuth 2 token endpoint profile configuration.
Implementation of a profile configuration for the OAuth2 Token Introspection.
Implementation of a profile configuration for OAuth2 Token Revocation.
Implementation of a profile configuration for the OpenID Connect authorization endpoint.
Implemenation of a profile configuration for the OpenID Connect dynamic client registration.
Implementation of a profile configuration for the OpenID Connect logout.
Implementation of a profile configuration for the OpenID Connect Provider Configuration.
Strategy for extracting the
IssuerIDCriterion from a CriteriaSet.Strategy for computing an expiry time for
OIDCProviderMetadata.Strategy for finding the Issuer of the given OIDCProviderMetadata.
Parse a raw byte array into a *single* OIDCProviderMetadata object.
Implementation of a profile configuration for publishing OP key set.
Implementation of a profile configuration for the OpenID Connect core protocol userinfo endpoint.
Default strategy for loading information from a resource.
Simple strategy for computing an expiry time by adding an expiry duration to the current time.
A function that obtains
OIDCAuthorizationConfiguration.getDeniedUserInfoAttributes(ProfileRequestContext) or
OIDCUserInfoConfiguration.getDeniedUserInfoAttributes(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that obtains
OAuth2DPoPProofValidatingProfileConfiguration.getDpopProofClaimsValidator(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that obtains
OAuth2DPoPProofValidatingProfileConfiguration.getDpopProofNonceGenerator(ProfileRequestContext) if such a profile is
available from a RelyingPartyContext obtained via a lookup function, by default a child of the
ProfileRequestContext.A function that obtains
OAuth2DPoPProofValidatingProfileConfiguration.getDpopProofSignatureValidationConfiguration(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A dynamic version of a
BackingStore.A metadata cache implementation that supports 'read-through' semantics.
A specification for building a dynamic read-through metadata cache.
Marker interface for
OIDCMetadataResolver implementations which resolve
metadata by dynamically querying for the requested data individually at the time of the
resolution operation, for example by invoking a request to the well-known provider configuration
endpoint.A backing store which provides no functionality other than to return empty unmodifiable lists.
A predicate implementation that forwards to
OIDCAuthorizationConfiguration.isEncodeConsentInTokens(ProfileRequestContext).A function that obtains
OIDCAuthorizationConfiguration.getEncodedAttributes(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.Algorithm descriptor for block encryption algorithm: A128CBC-HS256.
Algorithm descriptor for block encryption algorithm: 128GCM.
Algorithm descriptor for block encryption algorithm: A192CBC-HS384.
Algorithm descriptor for block encryption algorithm: 192GCM.
Algorithm descriptor for block encryption algorithm: A256CBC-HS512.
Algorithm descriptor for block encryption algorithm: 256GCM.
The configuration information to use when generating a JWE.
Criterion which holds one or more instances of
EncryptionConfigurationCriterion.Algorithm Header Parameter 'enc' Values for JWE as defined by RFC 7518.
A predicate implementation that forwards to
OAuth2TokenEncryptionProfileConfiguration.isEncryptionOptional(ProfileRequestContext).The effective parameters to use when generating encrypted JWTs.
An interface for components which resolve
EncryptionParameters based on a CriteriaSet.A
MessageHandler that encrypts a JWT using the EncryptionParameters found in the
SecurityParametersContext.A predicate that determines if the RequestObject JWT should be encrypted based on the profile configuration.
A predicate implementation that forwards to
OAuth2TokenConfiguration.isEnforceRefreshTokenRotation(ProfileRequestContext).Instance of evaluable credential criteria for evaluating credential key IDs.
Instance of evaluable credential criteria for evaluating if the key length of the secret key inside the credential
is compatible with the MAC algorithm given.
Validator that checks a JWT claim exactly matches (by Object equality) a value returned by a lookup strategy.
Context to hold information pertaining to the computation of a metadata's expiration time.
A
credential that expires at some duration in seconds after 1970-01-01T0:0:0Z.Iff an expiration time (exp) claim is present, verifies that it is ahead of the current time, else the JWT claims set
is rejected.
An implementation of
SignatureTrustEngine which evaluates the validity
and trustworthiness of JWT signatures.Auxillary trust evaluator for evaluating an untrusted key or credential against a trusted key or credential.
A
metadata cache implementation that does not support reading and writing to
a backing store.A specification for building a fetch-through metadata cache.
An OIDC metadata provider that pulls client metadata from a file on the local filesystem.
An OIDC metadata provider that pulls provider metadata from a file on the local filesystem.
An exception thrown during the evaluation of a
MetadataFilter.Function that returns true if the OIDC prompt is set as 'login' in the authentication request.Has forced authentication been requested?
A predicate implementation that forwards to
OIDCSSOProfileConfiguration.isForcePKCE(ProfileRequestContext).Action that forms outbound message containing keyset.
A predicate implementation that forwards to
OIDCLogoutProfileConfiguration.isFrontChannelSuccess(ProfileRequestContext).A
ClaimsValidator that relies on an injected BiFunction.A function that obtains
OAuth2TokenConfiguration.getGrantTypes(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A
message encoder that encodes an OpenID authentication request by
HTTP Form POST Serialization.A
message decoder that decodes an incoming AuthenticationResponse
when using a form_post response_type.A dynamic strategy for fetching OpenID Connect Provider Configuration Metadata from its well-known location
(OpenID Connect Discovery 1.0, section 4).
Default strategy for composing a well-known URL to fetch a provider's configuration document from.
The response handler for parsing the providers's configuration information into
OIDCProviderMetadata.A
message encoder that encodes an OpenID authentication request by
Query String Serialization and sends a HTTP redirect response.A
message decoder that decodes an incoming AuthenticationResponse
when using a query response_mode.A predicate implementation that forwards to
OIDCFlowAwareProfileConfiguration.isHybridFlowEnabled(ProfileRequestContext).Enum of those OIDC ID token claims that are not part of the standard
JWT claims set.A function that returns
OIDCIDTokenProducingProfileConfiguration.getIDTokenLifetime(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that returns
OIDCIDTokenProducingProfileConfiguration.getIDTokenManipulationStrategy(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A predicate implementation that forwards to
OAuth2FlowAwareProfileConfiguration.isImplicitFlowEnabled(ProfileRequestContext).Looks up the value of the simple class name from the inbound message context's message object.
A predicate implementation that forwards to
OIDCAuthorizationConfiguration.isIncludeIssuerInResponse(ProfileRequestContext).Implementation of
KeyInfoProvider which provides basic support for
extracting a JWKCredential child of KeyInfo.If the 'iat' claim is present in the JWT, verifies it is not to far away from the current time.
A function that obtains
OAuth2TokenValidatingProfileConfiguration.getIssuedClaimsValidator(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A predicate implementation that forwards to
OAuth2TokenConfiguration.isIssueIdTokenViaRefreshToken(ProfileRequestContext).A
Criterion representing an OIDC issuer ID.A function that returns the issuer id via the provider information stored in
OIDCProviderMetadataContext.Additional constants to
JCAConstants defined in and/or used with the
Java Cryptography Architecture (JCA) specification.Specialized
CredentialResolver marker interface for resolvers which resolve
credentials from the headers of a JOSEObject instance.An implementation of
Criterion which specifies criteria based
on the contents of a JOSEObject element.Class for creating JSON Error response for requests expecting JSON response.
Concrete metadata resolver for OIDC Provider configuration metadata resolution.
A resolver that is capable of resolving
Map instances which meet certain supplied criteria.Class extends SecurityConfiguration to support separate configuration for various encryption and signature
validation operations.
Class for creating JSON Success response.
Support class for JSON Web Algorithm credentials.
A function that returns
EncryptionConfiguration.getDataEncryptionAlgorithms() if it is available in the
OIDC security configuration of the profile configuration.A function that returns
EncryptionConfiguration.getKeyTransportEncryptionAlgorithms() if it is available
in the OIDC security configuration of the profile configuration.Supports decryption of encrypted JSON Web Tokens using the JSON Web Encryption standard.
Credential based on JSON Web Key (JWK).
Strategy to locate the set of JWK credentials to publish in a KeySet document.
Provide JWK specific credential support.
Credential based on a reference (URI) to a JSON Web Key (JWK).
SAML2 OIDC metadata extension 'JwksData'.
Builder of
JwksDataImpl.Concrete implementation of
JwksData.Implementation of
KeyInfoProvider which provides basic support for
extracting a JWKReferenceCredential child of KeyInfo.SAML2 OIDC metadata extension 'JwksUri'.
Builder of
JwksUriImpl.Concrete implementation of
JwksUri.Generic utility class for helping with JWS assembly.
A function that returns
SignatureSigningConfiguration.getSignatureAlgorithms() if it is available in the
OIDC security configuration of the profile configuration.Supports signing a JSON Web Token (JWT) claims set using the JSON Web Signature standard using the algorithm and
credential contained inside the
SignatureSigningParameters.Enum that represents the standard set of registered JWT claims.
A function that returns a
DecryptionConfiguration list for JWE decrypting by way
of various lookup strategies.A function that returns an
EncryptionConfiguration list for JWT encryption by way
of various lookup strategies.Verifies the identifier (jit) from the JWT against replay via configurable
ReplayCache.Verifies the identifier (jit) from the JWT against revocation via configurable
RevocationCache.A
MessageHandler that uses a TrustEngine to evaluate the signature of a signed JWT.A function that returns a
SignatureSigningConfiguration list for JWT signing by way of various lookup
strategies.A function that returns a
SignatureValidationConfiguration list for JWS validation by way
of various lookup strategies.Generic utility class for helping JWT signature validation.
JWT validation exception, to throw when validation fails.
Algorithm descriptor for JWE key management algorithm: ECDH-ES.
Algorithm descriptor for JWE key management algorithm: ECDH-ES+A128KW.
Algorithm descriptor for JWE key management algorithm: ECDH-ES+A192KW.
Algorithm descriptor for JWE key management algorithm: ECDH-ES+A256KW.
An implementation of
Criterion which specifies key ID criteria.Algorithm Header Parameter 'alg' Values for JWE as defined by RFC 7518.
An implementation of
Criterion which specifies key management algorithm criteria.Algorithm descriptor for JWE key transport algorithm: RSA1_5.
Algorithm descriptor for JWE key transport algorithm: RSA-OAEP.
Algorithm descriptor for JWE key transport algorithm: RSA-OAEP-256.
Algorithm descriptor for JWE key transport algorithm: RSA-OAEP-384.
Algorithm descriptor for JWE key transport algorithm: RSA-OAEP-512.
A predicate implementation that forwards to
OAuth2TokenConfiguration.isLimitInitialAccessTokenToSelf(ProfileRequestContext).A strategy that loads binary information from a configured source.
A simple specialization of
BasicJOSEObjectCredentialResolver
which is capable of resolving local credentials from a supplied CredentialResolver
which manages local credentials.A function that returns
OIDCLogoutProfileConfiguration.getLogoutHintMatchingStrategy(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A resolver that is capable of resolving Maps which meet certain supplied criteria.
Adaptor function that allows a profile request context lookup function to work inside a message handler.
A function that returns
OAuth2InterceptorAwareProfileConfiguration.getMessageHandler(MessageContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A cache for loading, storing, and retrieving metadata against against the supplied
CriteriaSet.A builder that creates, initializes, and safely publishes the correct
metadata cache
based on the supplied metadata cache builder specification.A static builder for generating a batch metadata cache from a given specification.
Marker interface for metadata cache builder specifications.
Base exception for metadata cache related errors.
A metadata filter is used to process a metadata document after it has been acquired from a metadata source.
Class used to provide contextual information at runtime to
MetadataFilter implementations.Marker interface for data classes to be used with
MetadataFilterContext.Class that holds management data about an entities metadata.
Namespace handler for
urn:mace:shibboleth:2.0:metadata:oidc.The metadata policy for a single claim.
Builder class for the
MetadataPolicy objects.Static utility methods related to metadata policies.
A factory for building a function that resolves maps of metadata policies from the profile request context.
A resolver that is capable of resolving map of metadata policies (in the entry values as
MetadataPolicy
objects) which meet certain supplied criteria.A fetching strategy that exploits
ResourceLocationCriterion from the given CriteriaSet to resolve
a location for metadata policy.Data object for
MetadataFilterContext intended to hold information about
the source of the metadata currently being processed.Abstract interface for SAML metadata objects containing single
String value inside the element.Deprecated, for removal: This API element is subject to removal in a future version.
Function that extracts nonce in the OIDCAuthenticationRequest.Determines if nonce validation should occur.
Iff a not-before-time (nbf) claim is present, makes sure it is before the current time.
Activation condition to check the number of values a claim has against a given predicate.
Configuration common to OAuth 2.0 access token producing profiles.
Configuration common to authorizaton code producing profiles.
Configuration for a generic OAuth 2.0 authorization request.
Enumeration of the HTTP methods used in various OAuth requests.
OAuth 2.0 profile configurations that support OAuth-defined client authentication methods.
OAuth 2.0 profile configurations that support OAuth-defined client authentication methods.
A context containing data about OAuth 2.0 client authentication.
Profile configuration for validating DPoP proof JWTs.
Interface for profile configurations that understand OAuth 2.0 authorization grants corresponding to OIDC
authentication flows.
Common interface for interceptor-aware OAuth 2.0 Profile Configurations.
Common interface for OAuth 2.0 Profile Configurations.
Profile configuration for OAuth2 Pushed Authorization Requests (PAR).
Configuration common to OAuth 2.0 refresh token producing profiles.
Profile configuration for validating scope values.
Profile interface for OAuth 2 token "audience" profile configuration.
OIDC-aware OAuth 2.0 token endpoint profile configuration.
Profile configuration for token endpoints that deal with encryption.
Profile configuration for OAuth2 Token Introspection.
Configuration for the OAuth 2.0 Token Revocation profile.
Enumeration of the OAuth2 token revocation methods.
Profile configuration for OIDC-aware OAuth 2.0 token endpoints.
An OAuth 2.0 authorization request.
The code challenge method for Proof Key for Code Exchange.
SAML 2.0 Metadata extension OAuthRPExtensions.
Builder of
OAuthRPExtensions objects.Implementation for
OAuthRPExtensions.Marshaller for
OAuthRPExtensions objects.Unmarshaller for
OAuthRPExtensions objects.Marker interface for transcoders that operate on OIDC claims.
Generic configuration for an OIDC 1.0 authentication request.
Configuration of an OIDC 1.0 authentication request.
OpenID Connect Authentication Request.
Configuration of an OIDC 1.0 authentication request.
Class encoding byte attributes to base64 encoded string json object.
Spring bean definition parser for
OIDCByteAttributeTranscoder.OIDC Common module implementation.
OIDC Common module implementation.
OIDC Common module implementation.
OIDC Common plugin implementation.
Configuration of OpenID Connect Dynamic Client Registration 1.0.
Supplemental error objects for any missing values in the Nimbus library.
OpenID Connect -specific constants to use for
ProfileAction
EventContexts.Interface for profile configurations that understand OIDC specific authentication flows in addition to the OAuth 2.0
flows described by
OAuth2FlowAwareProfileConfiguration.Configuration common to ID Token producing profiles.
Configuration for IdP OpenID Connect Logout.
Concrete metadata resolver for OIDC Provider configuration metadata resolution.
Marker interface for OIDC Message Decoders.
An OIDC message encoder interface which requires implementations to test if the request
method is supported by the encoder.
Subcontext carrying information on metadata of the relying party.
Concrete resolver implementation for metadata policy resolution.
Generic interface for OIDC Metadata resolvers which process specified criteria and
produce some implementation-specific result information.
Lightweight subcontext that carries information about a OIDC peer entity.
Common interface for OpenID Connect 1.0 Profile Configurations.
Profile configuration for an OpenID Connect Provider Configuration.
Subcontext carrying information on metadata of the OpenID Connect Provider.
Concrete metadata resolver for OIDC Provider configuration metadata resolution.
Configuration of an OpenID published key set document.
A source of encoders that first verifies a message being an instance of Nimbus
Response and then returns the attached MessageEncoder.Class encoding scoped string attributes to string json object.
Spring bean definition parser for
OIDCScopedStringAttributeTranscoder.Profile configuration generic to all OIDC SSO profiles.
Profile configuration for an OIDC SSO Provider.
Profile configuration for an OIDC SSO Client or Relying Party.
Class encoding string attributes to string json object.
Spring bean definition parser for
OIDCStringAttributeTranscoder.Configuration for an OpenID Connect core protocol UserInfo endpoint.
Looks up the value of the simple class name from the outbound message context's message object.
Action that resolves and populates
DecryptionParameters on an SecurityParametersContext
created/accessed via a lookup function, by default on a child of the outbound message context.Action that resolves and populates
EncryptionParameters on an SecurityParametersContext
created/accessed via a lookup function, by default on a child of the outbound message context.Action that resolves and populates
SignatureSigningParameters on a SecurityParametersContext
created/accessed via a lookup function, by default on the outbound message context.Handler that resolves and populates
SignatureSigningParameters on a SecurityParametersContext
created/accessed via a lookup function, by default as an immediate child context of the target
MessageContext.Action that resolves and populates
SignatureValidationParameters on a SecurityParametersContext
created/accessed via a lookup function, by default on the inbound message context.Handler that resolves and populates
SignatureValidationParameters on a
SecurityParametersContext created/accessed via a lookup function, by default as
an immediate child context of the target MessageContext.SAML2 OIDC metadata extension 'PostLogoutRedirectUri'.
Builder of
PostLogoutRedirectUriImpl.Concrete implementation of
PostLogoutRedirectUri.A predicate implementation that forwards to
OIDCLogoutProfileConfiguration.isPreferFrontChannel(ProfileRequestContext).Verify the claims set does not contain any of the described set of claims.
A client secret value resolver that fetches the values from the given Properties file.
A
LocalJOSEObjectCredentialResolver that resolves credentials from the jwks_uri of an
OpenID Provider.Provider metadata criterion to make decisions based on OpenID Provider information.
A lookup strategy that finds data/content encryption algorithms from local configuration that are compatible
with those advertised by the OpenID Provider.
A lookup strategy that finds key transport algorithms from local configuration that are compatible with those
advertised by the downstream OpenID Provider.
This class is a sortable container of
ProviderMetadataResolvers, wrapped into a serviceable component.A resolver that is capable of resolving
OIDCProviderMetadata instances which meet certain supplied criteria.Strategy for summoning up a
ProviderMetadataResolver from a populated ApplicationContext.Fetches the values for the configured key as
String.Implements a set of default logic for determining the custom principals to derive the
OIDC ACRs from.
Implements a set of logic for determining the principals to use from OIDC 'amr' or 'acr' claims.
A simple lookup function that returns a singleton function.
A function that returns
OAuth2PushedAuthorizationRequestConfiguration.getRequestUriClaimsSetManipulationStrategy(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that returns
OAuth2PushedAuthorizationRequestConfiguration.getRequestUriLifetime(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that returns
OAuth2PushedAuthorizationRequestConfiguration.getRequestUriType(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.Function that extracts the redirect_uri from the OIDCAuthenticationRequest.Specialization of
ClientInformationResolver that supports on-demand refresh.Specialization of
ProviderMetadataResolver that supports on-demand refresh.A function that returns
OAuth2RefreshTokenProducingProfileConfiguration.getRefreshTokenChainLifetime(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that returns
OAuth2TokenConfiguration.getRefreshTokenClaimsSetManipulationStrategy(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A predicate implementation that forwards to
OAuth2FlowAwareProfileConfiguration.isRefreshTokensEnabled(ProfileRequestContext).A function that returns
OAuth2RefreshTokenProducingProfileConfiguration.getRefreshTokenTimeout(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that returns
OAuth2RefreshTokenProducingProfileConfiguration.getRefreshTokenType(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that returns
OIDCDynamicRegistrationConfiguration.getMetadataPolicy(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that returns
OIDCDynamicRegistrationConfiguration.getRegistrationValidityPeriod(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.This class uses the service interface to implement
ProviderMetadataResolver.This class uses the service interface to implement
ClientInformationResolver.This class exists primarily to allow the parsing of relying-party.xml to create a serviceable implementation of
ClientInformationResolver.A specialization of
BasicSignatureSigningParametersResolver which supports selecting signing credentials
from client_secret credential criterion (e.g.Stores fetched remote key set values for a desired period of time.
Generic utility methods related to remote JWK sets.
Strategy that looks up any requested ACR claims from the requested claims object that have to be contained in
the token's claims set.
SAML2 OIDC metadata extension 'RequestUri'.
Builder of
RequestUriImpl.Concrete implementation of
RequestUri.A predicate implementation that forwards to
OAuth2AuthorizationProfileConfiguration.isRequireAuthenticationRequest(ProfileRequestContext).Verify the claims set contains the given set of required claims.
A predicate implementation that forwards to
OAuth2AuthorizationProfileConfiguration.isRequireDpopJkt(ProfileRequestContext).A predicate implementation that forwards to
OAuth2DPoPProofValidatingProfileConfiguration.isRequireDpopProof(ProfileRequestContext).A predicate implementation that forwards to
OIDCLogoutProfileConfiguration.isRequireIdTokenHint(ProfileRequestContext).A predicate implementation that forwards to
OAuth2AuthorizationProfileConfiguration.isRequirePushedAuthorizationRequest(ProfileRequestContext).A lookup function for the map of
MetadataPolicy objects, resolved via configurable
MetadataPolicyResolver and optionally configurable CriteriaSet.Helper methods for (OIDC) metadata resolution classes.
A client secret value resolver that fetches the values from the given
AttributeResolver service.A
Criterion representing a resource location.Function that extracts response_mode in the OIDCAuthenticationRequest.A function that returns
OAuth2AuthorizationProfileConfiguration.getResponseModes(ProfileRequestContext) if such a profile is
available from a RelyingPartyContext obtained via a lookup function, by default a child of the
ProfileRequestContext.Function that extracts response_type in the OIDCAuthenticationRequest.An implementation of
JOSEObjectCredentialResolver that uses a Collection as the underlying
credential source.A function that returns
OAuth2TokenRevocationConfiguration.getRevocationLifetime(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A function that returns
OAuth2TokenRevocationConfiguration.getRevocationMethod(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A predicate implementation that forwards to
OIDCLogoutProfileConfiguration.isRevokeTokens(ProfileRequestContext).Function that extracts scope in the OIDCAuthenticationRequest.A function that returns
OIDCDynamicRegistrationConfiguration.getSecretExpirationPeriod(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A context implementation for storing parameter instances for JWS signature signing and validation, and JWE
encryption and decryption.
Algorithm Header Parameter Values for JWS.
Algorithm descriptor for signature algorithm: ES256.
Algorithm descriptor for signature algorithm: ES384.
Algorithm descriptor for signature algorithm: ES512.
Exception thrown when an error occurs during JWS signature operations.
Algorithm descriptor for HMAC algorithm: HS256.
Algorithm descriptor for HMAC algorithm: HS384.
Algorithm descriptor for HMAC algorithm: HS512.
Algorithm descriptor for signature algorithm: PS256.
Algorithm descriptor for signature algorithm: PS384.
Algorithm descriptor for signature algorithm: PS512.
Algorithm descriptor for signature algorithm: RS256.
Algorithm descriptor for signature algorithm: RS384.
Algorithm descriptor for signature algorithm: RS512.
The configuration information to use when generating a signed JWT.
Criterion which holds one or more instances of
SignatureSigningConfigurationCriterion.The effective parameters to use when generating a JWS.
An interface for components which resolve
SignatureSigningParameters based on a CriteriaSet.The configuration information to use when validating a JWS.
Criterion which holds one or more instances of
SignatureValidationConfiguration
for signed JWTs.The effective parameters to use when validating a JWS.
Criterion which holds an instance of
SignatureValidationParameters.An interface for components which resolve
SignatureValidationParameters based on a CriteriaSet.Message handler that signs a JWT and sets it back to the message context via an update consumer.
A predicate that determines if the RequestObject JWT should be signed based on the profile configuration.
A message encodes that encodes the Nimbus a
Response in the message context inside the attached
HttpServletResponse by calling its Response.toHTTPResponse() method.A
ClientInformationManager exploiting StorageService for storing the data.A
ClientInformationResolver exploiting StorageService for fetching the stored data.A predicate implementation that forwards to
OAuth2ScopeValidatingProfileConfiguration.isStrictScopeValidation(ProfileRequestContext).A JWT claim extractor function that returns String objects.
A JWT claim extractor function that returns lists of string objects.
Algorithm descriptor for JWE key management algorithm: AES128GCMKW.
Algorithm descriptor for JWE key management algorithm: AES128KW.
Algorithm descriptor for JWE key management algorithm: AES192GCMKW.
Algorithm descriptor for JWE key management algorithm: AES192KW.
Algorithm descriptor for JWE key management algorithm: AES256GCMKW.
Algorithm descriptor for JWE key management algorithm: AES256KW.
A
TrustEngine implementation for Signed JSON Web Tokens.A function that obtains
OAuth2ClientAuthenticableProfileConfiguration.getTokenEndpointAuthMethods(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.The policy used for validating single claim of an unregistered client.
A function that obtains
OAuth2ClientAuthenticableProfileConfiguration.getUnregisteredClientPolicy(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A predicate that determines if a RequestObject JWT should be used based on the profile configuration.
XMLObject provider initializer for the metadata extension.
ClientSecretCredential