Package net.shibboleth.oidc.profile.config

Interface OIDCAuthorizationConfiguration

All Superinterfaces:
AttributeResolvingProfileConfiguration, AuthenticationProfileConfiguration, Component, ConditionalProfileConfiguration, IdentifiedComponent, OAuth2AccessTokenProducingProfileConfiguration, OAuth2AuthorizationCodeProducingProfileConfiguration, OAuth2AuthorizationProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2DPoPProofValidatingProfileConfiguration, OAuth2FlowAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2RefreshTokenProducingProfileConfiguration, OAuth2ScopeValidatingProfileConfiguration, OAuth2TokenEncryptionProfileConfiguration, OIDCAuthenticationProfileConfiguration, OIDCFlowAwareProfileConfiguration, OIDCIDTokenProducingProfileConfiguration, OIDCProfileConfiguration, OIDCSSOProfileConfiguration, OIDCSSOProviderConfiguration, OverriddenIssuerProfileConfiguration, ProfileConfiguration
All Known Implementing Classes:
DefaultOAuth2PushedAuthorizationRequestConfiguration, DefaultOIDCAuthorizationConfiguration
public interface OIDCAuthorizationConfiguration extends OIDCAuthenticationProfileConfiguration, OAuth2AuthorizationCodeProducingProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration, OIDCSSOProviderConfiguration
Configuration of an OIDC 1.0 authentication request.

This is specific to the role of the OpenID Provider (OP).

  • Field Details

  • Method Details

    • isAcrRequestAlwaysEssential

      @ConfigurationSetting(name="acrRequestAlwaysEssential") boolean isAcrRequestAlwaysEssential(@Nullable ProfileRequestContext profileRequestContext)
      Get whether all acr claim requests should be treated as Essential.
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether all acr claim requests should be treated as Essential

    • isEncodeConsentInTokens

      @ConfigurationSetting(name="encodeConsentInTokens") boolean isEncodeConsentInTokens(@Nullable ProfileRequestContext profileRequestContext)
      Get whether to encode consent in authorization code and access/refresh tokens.
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether to encode consent in authorization code and access/refresh tokens

    • getDeniedUserInfoAttributes

      @ConfigurationSetting(name="deniedUserInfoAttributes") @Nonnull @NonnullElements @NotLive Set<String> getDeniedUserInfoAttributes(@Nullable ProfileRequestContext profileRequestContext)
      Get the set of attribute IDs which should be omitted from the UserInfo token.

      Default behavior is to include all claims, but omiited claims also affect the set that may need to be embedded for recovery into the access/refresh tokens.

      Parameters:
      profileRequestContext - profile request context
      Returns:
      the attribute IDs to omit from UserInfo token

    • isIncludeIssuerInResponse

      @ConfigurationSetting(name="includeIssuerInResponse") boolean isIncludeIssuerInResponse(@Nullable ProfileRequestContext profileRequestContext)
      Get whether to include iss parameter in the authentication response.
      Parameters:
      profileRequestContext - profile request context
      Returns:
      whether to include iss parameter in the authentication response
      Since:
      2.1.0

    • getEncodedAttributes

      @ConfigurationSetting(name="encodedAttributes") @Nonnull @NonnullElements @NotLive Set<String> getEncodedAttributes(@Nullable ProfileRequestContext profileRequestContext)
      Get the set of attribute IDs which should be encoded in encrypted form into the authorization code and/or access/refresh tokens to enable recovery on the back-channel.
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the attribute IDs to encode