Package net.shibboleth.oidc.profile.oauth2.config

Interface OAuth2TokenConfiguration

All Superinterfaces:

AttributeResolvingProfileConfiguration, AuthenticationProfileConfiguration, Component, ConditionalProfileConfiguration, IdentifiedComponent, OAuth2AccessTokenProducingProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2DPoPProofValidatingProfileConfiguration, OAuth2FlowAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2RefreshTokenProducingProfileConfiguration, OAuth2ScopeValidatingProfileConfiguration, OAuth2TokenEncryptionProfileConfiguration, OIDCFlowAwareProfileConfiguration, OIDCIDTokenProducingProfileConfiguration, OIDCProfileConfiguration, OIDCSSOProfileConfiguration, OIDCSSOProviderConfiguration, ProfileConfiguration

All Known Implementing Classes:

DefaultOAuth2TokenConfiguration

public interface OAuth2TokenConfiguration
extends OIDCSSOProviderConfiguration

OIDC-aware OAuth 2.0 token endpoint profile configuration.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	PROFILE_ID	ID for this profile configuration.

Fields inherited from interface net.shibboleth.profile.config.ProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Method Summary

Modifier and Type	Method	Description
Set<String>	getGrantTypes(ProfileRequestContext profileRequestContext)	Get the enabled grant types.
BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>	getRefreshTokenClaimsSetManipulationStrategy(ProfileRequestContext profileRequestContext)	Get the bi-function for manipulating refresh token claims set.
boolean	isEnforceRefreshTokenRotation(ProfileRequestContext profileRequestContext)	Get whether always revoke the refresh_token after it's used.
boolean	isIssueIdTokenViaRefreshToken(ProfileRequestContext profileRequestContext)	Get whether the id_token is issued when refresh token grant is used.
boolean	isLimitInitialAccessTokenToSelf(ProfileRequestContext profileRequestContext)	Get whether the initial access token audience is solely to self (i.e.

Methods inherited from interface net.shibboleth.profile.config.AttributeResolvingProfileConfiguration

isResolveAttributes

Methods inherited from interface net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration

getAuthenticationFlows, getDefaultAuthenticationMethods, getPostAuthenticationFlows, getProxyCount, isForceAuthn, isLocal

Methods inherited from interface net.shibboleth.profile.config.ConditionalProfileConfiguration

getActivationCondition

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration

getAccessTokenClaimsSetManipulationStrategy, getAccessTokenLifetime, getAccessTokenType, isAlwaysIssueBearerAccessToken

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration

getClaimsValidator, getTokenEndpointAuthMethods, getUnregisteredClientPolicy

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2DPoPProofValidatingProfileConfiguration

getDpopProofClaimsValidator, getDpopProofNonceGenerator, getDpopProofSignatureValidationConfiguration, isRequireDpopProof

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration

isAuthorizationCodeFlowEnabled, isImplicitFlowEnabled, isRefreshTokensEnabled

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProfileConfiguration

getRefreshTokenChainLifetime, getRefreshTokenTimeout, getRefreshTokenType

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2ScopeValidatingProfileConfiguration

isStrictScopeValidation

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration

isEncryptionOptional

Methods inherited from interface net.shibboleth.oidc.profile.config.OIDCFlowAwareProfileConfiguration

isHybridFlowEnabled

Methods inherited from interface net.shibboleth.oidc.profile.config.OIDCIDTokenProducingProfileConfiguration

getAdditionalAudiencesForIdToken, getAlwaysIncludedAttributes, getIDTokenLifetime, getIDTokenManipulationStrategy

Methods inherited from interface net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration

getCustomRedirectUriValidationStrategy, isAllowPKCEPlain, isForcePKCE

Methods inherited from interface net.shibboleth.profile.config.ProfileConfiguration

getDisallowedFeatures, getSecurityConfiguration, isFeatureDisallowed

Field Details

PROFILE_ID

@Nonnull
@NotEmpty
static final String PROFILE_ID

ID for this profile configuration.

See Also:

• Constant Field Values

Method Details

getGrantTypes

@ConfigurationSetting(name="grantTypes")
@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
Set<String> getGrantTypes(@Nullable
 ProfileRequestContext profileRequestContext)

Get the enabled grant types.

Parameters:

profileRequestContext - profile request context

Returns:

enabled grant types

isEnforceRefreshTokenRotation

@ConfigurationSetting(name="enforceRefreshTokenRotation")
boolean isEnforceRefreshTokenRotation(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether always revoke the refresh_token after it's used.

Parameters:

profileRequestContext - profile request context

Returns:

whether always revoke the refresh_token after it's used

Since:

2.1.0

getRefreshTokenClaimsSetManipulationStrategy

@ConfigurationSetting(name="refreshTokenClaimsSetManipulationStrategy")
@Nullable
BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getRefreshTokenClaimsSetManipulationStrategy(@Nullable
 ProfileRequestContext profileRequestContext)

Get the bi-function for manipulating refresh token claims set.

Parameters:

profileRequestContext - profile request context

Returns:

the bi-function for manipulating refresh token claims set

Since:

2.1.0

isIssueIdTokenViaRefreshToken

@ConfigurationSetting(name="issueIdTokenViaRefreshToken")
boolean isIssueIdTokenViaRefreshToken(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the id_token is issued when refresh token grant is used.

Parameters:

profileRequestContext - profile request context

Returns:

whether id_token is issued when refresh token grant is used

Since:

2.2.0

isLimitInitialAccessTokenToSelf

@ConfigurationSetting(name="limitInitialAccessTokenToSelf")
boolean isLimitInitialAccessTokenToSelf(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the initial access token audience is solely to self (i.e. UserInfo) use.

Parameters:

profileRequestContext - profile request context

Returns:

whether initial access token audience is solely to self (i.e. UserInfo) use

Since:

3.2.0