Package net.shibboleth.oidc.profile.config

Interface OIDCAuthorizationConfiguration

All Superinterfaces:

AttributeResolvingProfileConfiguration, AuthenticationProfileConfiguration, Component, ConditionalProfileConfiguration, IdentifiedComponent, OAuth2AccessTokenProducingProfileConfiguration, OAuth2AuthorizationCodeProducingProfileConfiguration, OAuth2AuthorizationProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration, OAuth2DPoPProofValidatingProfileConfiguration, OAuth2FlowAwareProfileConfiguration, OAuth2ProfileConfiguration, OAuth2RefreshTokenProducingProfileConfiguration, OAuth2ResourceIndicatingProfileConfiguration, OAuth2ScopeValidatingProfileConfiguration, OAuth2TokenEncryptionProfileConfiguration, OIDCAuthenticationProfileConfiguration, OIDCFlowAwareProfileConfiguration, OIDCIDTokenProducingProfileConfiguration, OIDCProfileConfiguration, OIDCSSOProfileConfiguration, OIDCSSOProviderConfiguration, OverriddenIssuerProfileConfiguration, ProfileConfiguration

All Known Implementing Classes:

DefaultOAuth2PushedAuthorizationRequestConfiguration, DefaultOIDCAuthorizationConfiguration

public interface OIDCAuthorizationConfiguration
extends OIDCAuthenticationProfileConfiguration, OAuth2AuthorizationCodeProducingProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration, OIDCSSOProviderConfiguration

Configuration of an OIDC 1.0 authentication request.

This is specific to the role of the OpenID Provider (OP).

Nested Class Summary

Nested classes/interfaces inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration

OAuth2AuthorizationProfileConfiguration.HttpRequestMethod

Field Summary

Fields

Modifier and Type	Field	Description
static final int	FEATURE_ESSENTIAL_ACR_REQUEST	Bit constant for essential ACR request feature.
static final int	FEATURE_FORCEAUTHN	Bit constant for ForceAuthn feature.
static final int	FEATURE_LOGIN_HINT	Bit constant for the login hint feature.
static final int	FEATURE_RESOURCE_INDICATOR	Bit constant for Resource Indicator feature.
static final int	FEATURE_SCOPE	Bit constant for scope feature.
static final String	PROFILE_ID	ID for this profile configuration.

Fields inherited from interface net.shibboleth.profile.config.ProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Method Summary

Modifier and Type	Method	Description
Set<String>	getDeniedUserInfoAttributes(ProfileRequestContext profileRequestContext)	Get the set of attribute IDs which should be omitted from the UserInfo token.
Set<String>	getEncodedAttributes(ProfileRequestContext profileRequestContext)	Get the set of attribute IDs which should be encoded in encrypted form into the authorization code and/or access/refresh tokens to enable recovery on the back-channel.
boolean	isAcrRequestAlwaysEssential(ProfileRequestContext profileRequestContext)	Get whether all acr claim requests should be treated as Essential.
boolean	isEncodeConsentInTokens(ProfileRequestContext profileRequestContext)	Get whether to encode consent in authorization code and access/refresh tokens.
boolean	isIncludeIssuerInResponse(ProfileRequestContext profileRequestContext)	Get whether to include iss parameter in the authentication response.

Methods inherited from interface net.shibboleth.profile.config.AttributeResolvingProfileConfiguration

isResolveAttributes

Methods inherited from interface net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration

getAuthenticationFlows, getDefaultAuthenticationMethods, getPostAuthenticationFlows, getProxyCount, isForceAuthn, isLocal

Methods inherited from interface net.shibboleth.profile.config.ConditionalProfileConfiguration

getActivationCondition

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration

getAccessTokenClaimsSetManipulationStrategy, getAccessTokenLifetime, getAccessTokenType, isAlwaysIssueBearerAccessToken

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationCodeProducingProfileConfiguration

getAuthorizationCodeClaimsSetManipulationStrategy, getAuthorizeCodeLifetime

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration

getHttpRequestMethod, getResponseMode, getResponseModes, getResponseType, getScopes, isRequireAuthenticationRequest, isRequireDpopJkt, isRequirePushedAuthorizationRequest

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration

getClaimsValidator, getTokenEndpointAuthMethods, getUnregisteredClientPolicy

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2DPoPProofValidatingProfileConfiguration

getDpopProofClaimsValidator, getDpopProofNonceGenerator, getDpopProofSignatureValidationConfiguration, isRequireDpopProof

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration

isAuthorizationCodeFlowEnabled, isImplicitFlowEnabled, isRefreshTokensEnabled

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProfileConfiguration

getRefreshTokenChainLifetime, getRefreshTokenTimeout, getRefreshTokenType

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2ResourceIndicatingProfileConfiguration

getResourceIndicators

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2ScopeValidatingProfileConfiguration

isStrictScopeValidation

Methods inherited from interface net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration

isEncryptionOptional

Methods inherited from interface net.shibboleth.oidc.profile.config.OIDCAuthenticationProfileConfiguration

getAuthenticationContextClassReferenceTranslationStrategy, getAuthenticationMethodsReferencesTranslationStrategy, getDisplay, getLoginHint, getMaxAuthenticationAge, getRequestedClaims, isUseRequestObject

Methods inherited from interface net.shibboleth.oidc.profile.config.OIDCFlowAwareProfileConfiguration

isHybridFlowEnabled

Methods inherited from interface net.shibboleth.oidc.profile.config.OIDCIDTokenProducingProfileConfiguration

getAdditionalAudiencesForIdToken, getAlwaysIncludedAttributes, getIDTokenLifetime, getIDTokenManipulationStrategy

Methods inherited from interface net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration

getCustomRedirectUriValidationStrategy, isAllowPKCEPlain, isForcePKCE

Methods inherited from interface net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration

getIssuer

Methods inherited from interface net.shibboleth.profile.config.ProfileConfiguration

getDisallowedFeatures, getSecurityConfiguration, isFeatureDisallowed

Field Details

PROFILE_ID

@Nonnull
@NotEmpty
static final String PROFILE_ID

ID for this profile configuration.

See Also:

• Constant Field Values

FEATURE_ESSENTIAL_ACR_REQUEST

static final int FEATURE_ESSENTIAL_ACR_REQUEST

Bit constant for essential ACR request feature.

See Also:

• Constant Field Values

FEATURE_LOGIN_HINT

static final int FEATURE_LOGIN_HINT

Bit constant for the login hint feature.

See Also:

• Constant Field Values

FEATURE_FORCEAUTHN

static final int FEATURE_FORCEAUTHN

Bit constant for ForceAuthn feature.

See Also:

• Constant Field Values

FEATURE_RESOURCE_INDICATOR

static final int FEATURE_RESOURCE_INDICATOR

Bit constant for Resource Indicator feature.

See Also:

• Constant Field Values

FEATURE_SCOPE

static final int FEATURE_SCOPE

Bit constant for scope feature.

See Also:

• Constant Field Values

Method Details

isAcrRequestAlwaysEssential

@ConfigurationSetting(name="acrRequestAlwaysEssential")
boolean isAcrRequestAlwaysEssential(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether all acr claim requests should be treated as Essential.

Parameters:

profileRequestContext - profile request context

Returns:

whether all acr claim requests should be treated as Essential

isEncodeConsentInTokens

@ConfigurationSetting(name="encodeConsentInTokens")
boolean isEncodeConsentInTokens(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether to encode consent in authorization code and access/refresh tokens.

Parameters:

profileRequestContext - profile request context

Returns:

whether to encode consent in authorization code and access/refresh tokens

getDeniedUserInfoAttributes

@ConfigurationSetting(name="deniedUserInfoAttributes")
@Nonnull
@NonnullElements
@NotLive
Set<String> getDeniedUserInfoAttributes(@Nullable
 ProfileRequestContext profileRequestContext)

Get the set of attribute IDs which should be omitted from the UserInfo token.

Default behavior is to include all claims, but omiited claims also affect the set that may need to be embedded for recovery into the access/refresh tokens.

Parameters:

profileRequestContext - profile request context

Returns:

the attribute IDs to omit from UserInfo token

isIncludeIssuerInResponse

@ConfigurationSetting(name="includeIssuerInResponse")
boolean isIncludeIssuerInResponse(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether to include iss parameter in the authentication response.

Parameters:

profileRequestContext - profile request context

Returns:

whether to include iss parameter in the authentication response

Since:

2.1.0

getEncodedAttributes

@ConfigurationSetting(name="encodedAttributes")
@Nonnull
@NonnullElements
@NotLive
Set<String> getEncodedAttributes(@Nullable
 ProfileRequestContext profileRequestContext)

Get the set of attribute IDs which should be encoded in encrypted form into the authorization code and/or access/refresh tokens to enable recovery on the back-channel.

Parameters:

profileRequestContext - profile request context

Returns:

the attribute IDs to encode