Package org.forgerock.oauth2.core
Class AgentOAuth2ProviderSettings
- java.lang.Object
-
- org.forgerock.oauth2.core.AgentOAuth2ProviderSettings
-
- All Implemented Interfaces:
OAuth2ProviderSettings
public class AgentOAuth2ProviderSettings extends Object implements OAuth2ProviderSettings
Models all of the OAuth2 provider settings specific to agents.
-
-
Constructor Summary
Constructors Constructor Description AgentOAuth2ProviderSettings()
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description Map<String,String>additionalDataToReturnFromAuthorizeEndpoint(Map<String,Token> tokens, OAuth2Request request)Provided as an extension point to allow the OAuth2 provider to return additional data from an authorization request.voidadditionalDataToReturnFromTokenEndpoint(AccessToken accessToken, OAuth2Request request)Provided as an extension point to allow the OAuth2 provider to return additional data from an access token request.booleanclientsCanSkipConsent()Whether clients can opt to skip resource owner consent during authorization flows.Map<String,Object>evaluateScope(AccessToken accessToken)Gets the specified access token's information.booleanexists()Checks whether the config exists.longgetAccessTokenLifetime()Gets the lifetime an access token will have before it expires.Map<String,AuthenticationMethod>getAcrMapping()Returns a mapping from Authentication Context Class Reference (ACR) values (typically a Level of Assurance value) to concrete authentication methods.Map<String,ResponseTypeHandler>getAllowedResponseTypes()Gets the response types allowed by the OAuth2 provider.Map<String,String>getAMRAuthModuleMappings()The mappings between amr values and auth module names.longgetAuthorizationCodeLifetime()Gets the lifetime an authorization code will have before it expires.booleangetClaimsParameterSupported()Returns whether this provider supports claims requested via 'claims' parameter.StringgetCompletionUrl()The URL that the user will be sent to on completion of their OAuth 2 login and consent when using the device code flow.StringgetCreatedTimestampAttributeName()Gets the created timestamp attribute name.freemarker.template.TemplategetCustomLoginUrlTemplate()Gets the custom login url template which will create the url to redirect resource owners to for authentication.StringgetDefaultAcrValues()The default Authentication Context Class Reference (ACR) values to use for authentication if none is specified in the request.Set<String>getDefaultScopes()Gets the default set of scopes to give a client registering with this provider.intgetDeviceCodeLifetime()The lifetime of the device code.intgetDeviceCodePollInterval()The polling interval for devices waiting for tokens when using the device code flow.Set<String>getEndpointAuthMethodsSupported()Returns the token_endpoint_auth_methods available for clients to register (and subsequently auth) using.StringgetHashSalt()Returns the salt to use for hashing sub values upon pairwise requests.org.forgerock.json.JsonValuegetJWKSet()Gets the JWK Set for this OAuth2 Authorization /OpenID Provider.StringgetJWKSUri()Gets the JSON Web Key Set URI.StringgetModifiedTimestampAttributeName()Gets the modified timestamp attribute name.StringgetOpenIDConnectVersion()Gets the supported version of the OpenID Connect specification.longgetOpenIdTokenLifetime()Gets the lifetime an OpenID token will have before it expires.longgetRefreshTokenLifetime()Gets the lifetime an refresh token will have before it expires.Set<String>getResourceOwnerAuthenticatedAttributes()Gets the attributes of the resource owner that are used for authenticating resource owners.ResourceSetStoregetResourceSetStore()Returns the ResourceSetStore instance for the realm.KeyPairgetSigningKeyPair(org.forgerock.json.jose.jws.JwsAlgorithm algorithm)Gets the signing key pair of the OAuth2 provider.Set<String>getSupportedClaims()Gets the supported claims for this provider.Set<String>getSupportedClaimsWithTranslations()Gets the supported claims for this provider as strings with pipe-separated translations.Set<String>getSupportedIDTokenEncryptionAlgorithms()Gets the algorithms that the OAuth2 provider supports for encryptin OpenID tokens.Set<String>getSupportedIDTokenEncryptionMethods()Gets the encryption methods that the OAuth2 provider supports for encryptin OpenID tokens.Set<String>getSupportedIDTokenSigningAlgorithms()Gets the algorithms that the OAuth2 provider supports for signing OpenID tokens.Set<String>getSupportedScopes()Gets the supported scopes for this provider without translations.Set<String>getSupportedScopesWithTranslations()Gets the supported scopes for this provider.Set<String>getSupportedSubjectTypes()Gets the subject types supported by the OAuth2 provider.StringgetTokenHmacSharedSecret()Gets the Base64 encoded shared secret used to sign stateless access and refresh tokens.StringgetTokenSigningAlgorithm()Gets the signing algorithm used when issuing stateless access and refresh tokens.StringgetUserDisplayNameAttribute()The attribute that can be used to obtain a UI-displayable name for a user's AMIdentity.UserInfoClaimsgetUserInfo(ClientRegistration clientRegistration, AccessToken token, OAuth2Request request)Gets the resource owners information based on an issued access token or request.StringgetVerificationUrl()The URL that the user will be instructed to visit to complete their OAuth 2 login and consent when using the device code flow.booleanisAlwaysAddClaimsToToken()Whether to always add claims to id_tokens - non-spec compliant.booleanisCodeVerifierRequired()Whether or not to enforce the Code Verifier Parameter.booleanisConsentSaved(ResourceOwner resourceOwner, String clientId, Set<String> scope)Determines whether a resource owner's consent has been saved from a previous authorize request.booleanisIdTokenInfoClientAuthenticationEnabled()Determines whether idtokeninfo endpoint should require client authentication.booleanisOpenDynamicClientRegistrationAllowed()Indicates whether clients may register without providing an access token.booleanisOpenIDConnectSSOProviderEnabled()Whether OpenID Connect ID Tokens are accepted as SSOTokens in this realm or not.booleanisRegistrationAccessTokenGenerationEnabled()Whether to generate access tokens for clients that register without one.booleanisSaveConsentEnabled()Determines if the consent can be saved or not, due to a lack of configuration.booleanisStatelessTokensEnabled()Determines whether access and refresh tokens should be stateless.booleanissueRefreshTokens()Whether the OAuth2 provider should issue refresh tokens when issuing access tokens.booleanissueRefreshTokensOnRefreshingToken()Whether the OAuth2 provider should issue refresh tokens when refreshing access tokens.booleanisTokenCompressionEnabled()Determines whether token compression is enabled for stateless access and refresh tokens.voidrevokeConsent(String userId, String clientId)Revokes the resource owner's consent for the granting authorization for the specified client.voidsaveConsent(ResourceOwner resourceOwner, String clientId, Set<String> scope)Saves the resource owner's consent for the granting authorization for the specified client with the specified scope.booleanshouldStoreOpsTokens()Whether to generate and store an ops token in CTS for this OIDC provider.Set<String>validateAccessTokenScope(ClientRegistration clientRegistration, Set<String> scope, OAuth2Request request)Provided as an extension point to allow the OAuth2 provider to customise the scope requested when an access token is requested.Set<String>validateAuthorizationScope(ClientRegistration clientRegistration, Set<String> scope, OAuth2Request request)Provided as an extension point to allow the OAuth2 provider to customise the scope requested when authorization is requested.Set<String>validateRefreshTokenScope(ClientRegistration clientRegistration, Set<String> requestedScope, Set<String> tokenScope, OAuth2Request request)Provided as an extension point to allow the OAuth2 provider to customise the scope requested when a refresh token is requested.StringvalidateRequestedClaims(String requestedClaims)Validates that the requested claims are appropriate to be requested by the given client.
-
-
-
Method Detail
-
isStatelessTokensEnabled
public boolean isStatelessTokensEnabled() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsDetermines whether access and refresh tokens should be stateless.- Specified by:
isStatelessTokensEnabledin interfaceOAuth2ProviderSettings- Returns:
trueif access and refresh tokens are stateless.- Throws:
ServerException- If any internal server error occurs.
-
isIdTokenInfoClientAuthenticationEnabled
public boolean isIdTokenInfoClientAuthenticationEnabled() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsDetermines whether idtokeninfo endpoint should require client authentication.- Specified by:
isIdTokenInfoClientAuthenticationEnabledin interfaceOAuth2ProviderSettings- Returns:
trueif idtokeninfo endpoint requires client authentication.- Throws:
ServerException- If any internal server error occurs.
-
getTokenSigningAlgorithm
public String getTokenSigningAlgorithm() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the signing algorithm used when issuing stateless access and refresh tokens.- Specified by:
getTokenSigningAlgorithmin interfaceOAuth2ProviderSettings- Returns:
- The signing algorithm.
- Throws:
ServerException- If any internal server error occurs.
-
isTokenCompressionEnabled
public boolean isTokenCompressionEnabled() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsDetermines whether token compression is enabled for stateless access and refresh tokens.- Specified by:
isTokenCompressionEnabledin interfaceOAuth2ProviderSettings- Returns:
- true if compression should be enabled.
- Throws:
ServerException- if an error occurs reading the settings.
-
getTokenHmacSharedSecret
public String getTokenHmacSharedSecret() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the Base64 encoded shared secret used to sign stateless access and refresh tokens.- Specified by:
getTokenHmacSharedSecretin interfaceOAuth2ProviderSettings- Returns:
- The Base64 encoded shared secret.
- Throws:
ServerException- If any internal server error occurs.
-
getAllowedResponseTypes
public Map<String,ResponseTypeHandler> getAllowedResponseTypes() throws UnsupportedResponseTypeException, ServerException
Description copied from interface:OAuth2ProviderSettingsGets the response types allowed by the OAuth2 provider.- Specified by:
getAllowedResponseTypesin interfaceOAuth2ProviderSettings- Returns:
- The allowed response types and their handler implementations.
- Throws:
UnsupportedResponseTypeException- If the requested response type is not supported by either the client or the OAuth2 provider.ServerException- If any internal server error occurs.
-
isSaveConsentEnabled
public boolean isSaveConsentEnabled()
Description copied from interface:OAuth2ProviderSettingsDetermines if the consent can be saved or not, due to a lack of configuration.- Specified by:
isSaveConsentEnabledin interfaceOAuth2ProviderSettings- Returns:
trueif the consent can be saved, false if it is not configured properly.
-
isConsentSaved
public boolean isConsentSaved(ResourceOwner resourceOwner, String clientId, Set<String> scope)
Description copied from interface:OAuth2ProviderSettingsDetermines whether a resource owner's consent has been saved from a previous authorize request.- Specified by:
isConsentSavedin interfaceOAuth2ProviderSettings- Parameters:
resourceOwner- The resource owner.clientId- The if of the client making the request.scope- The requested scope.- Returns:
trueif the resource owner has previously requested that consent should be saved from the specified client and the exact scope.
-
validateAuthorizationScope
public Set<String> validateAuthorizationScope(ClientRegistration clientRegistration, Set<String> scope, OAuth2Request request) throws ServerException, InvalidScopeException
Description copied from interface:OAuth2ProviderSettingsProvided as an extension point to allow the OAuth2 provider to customise the scope requested when authorization is requested.- Specified by:
validateAuthorizationScopein interfaceOAuth2ProviderSettings- Parameters:
clientRegistration- The client registration.scope- The requested scope.- Returns:
- The updated scope used in the remaining OAuth2 process.
- Throws:
ServerException- If any internal server error occurs.InvalidScopeException- If the requested scope is invalid, unknown, or malformed.
-
validateAccessTokenScope
public Set<String> validateAccessTokenScope(ClientRegistration clientRegistration, Set<String> scope, OAuth2Request request) throws ServerException, InvalidScopeException
Description copied from interface:OAuth2ProviderSettingsProvided as an extension point to allow the OAuth2 provider to customise the scope requested when an access token is requested.- Specified by:
validateAccessTokenScopein interfaceOAuth2ProviderSettings- Parameters:
clientRegistration- The client registration.scope- The requested scope.request- The OAuth2 request.- Returns:
- The updated scope used in the remaining OAuth2 process.
- Throws:
ServerException- If any internal server error occurs.InvalidScopeException- If the requested scope is invalid, unknown, or malformed.
-
validateRefreshTokenScope
public Set<String> validateRefreshTokenScope(ClientRegistration clientRegistration, Set<String> requestedScope, Set<String> tokenScope, OAuth2Request request) throws ServerException, InvalidScopeException
Description copied from interface:OAuth2ProviderSettingsProvided as an extension point to allow the OAuth2 provider to customise the scope requested when a refresh token is requested.- Specified by:
validateRefreshTokenScopein interfaceOAuth2ProviderSettings- Parameters:
clientRegistration- The client registration.requestedScope- The requested scope.tokenScope- The scope from the access token.request- The OAuth2 request.- Returns:
- The updated scope used in the remaining OAuth2 process.
- Throws:
ServerException- If any internal server error occurs.InvalidScopeException- If the requested scope is invalid, unknown, or malformed.
-
getUserInfo
public UserInfoClaims getUserInfo(ClientRegistration clientRegistration, AccessToken token, OAuth2Request request) throws ServerException, UnauthorizedClientException, NotFoundException
Description copied from interface:OAuth2ProviderSettingsGets the resource owners information based on an issued access token or request.- Specified by:
getUserInfoin interfaceOAuth2ProviderSettings- Parameters:
clientRegistration- The client registration.token- The access token.request- The OAuth2 request.- Returns:
- The claims for the resource owner's information.
- Throws:
ServerException- If any internal server error occurs.UnauthorizedClientException- If the client's authorization fails.NotFoundException- If the realm does not have an OAuth 2.0 provider service.
-
evaluateScope
public Map<String,Object> evaluateScope(AccessToken accessToken) throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the specified access token's information.- Specified by:
evaluateScopein interfaceOAuth2ProviderSettings- Parameters:
accessToken- The access token.- Returns:
- A
Map<String, Object>of the access token's information. - Throws:
ServerException- If any internal server error occurs.
-
additionalDataToReturnFromAuthorizeEndpoint
public Map<String,String> additionalDataToReturnFromAuthorizeEndpoint(Map<String,Token> tokens, OAuth2Request request) throws ServerException
Description copied from interface:OAuth2ProviderSettingsProvided as an extension point to allow the OAuth2 provider to return additional data from an authorization request.- Specified by:
additionalDataToReturnFromAuthorizeEndpointin interfaceOAuth2ProviderSettings- Parameters:
tokens- The tokens that will be returned from the authorization call.request- The OAuth2 request.- Returns:
- A
Map<String, String>of the additional data to return. - Throws:
ServerException- If any internal server error occurs.
-
additionalDataToReturnFromTokenEndpoint
public void additionalDataToReturnFromTokenEndpoint(AccessToken accessToken, OAuth2Request request) throws ServerException, InvalidClientException, NotFoundException
Description copied from interface:OAuth2ProviderSettingsProvided as an extension point to allow the OAuth2 provider to return additional data from an access token request.
Any additional data to be returned should be added to the access token by invoking, AccessToken#addExtraData(String, String).- Specified by:
additionalDataToReturnFromTokenEndpointin interfaceOAuth2ProviderSettings- Parameters:
accessToken- The access token.request- The OAuth2 request.- Throws:
ServerException- If any internal server error occurs.InvalidClientException- If either the request does not contain the client's id or the client fails to be authenticated.NotFoundException- If the realm does not have an OAuth 2.0 provider service.
-
saveConsent
public void saveConsent(ResourceOwner resourceOwner, String clientId, Set<String> scope)
Description copied from interface:OAuth2ProviderSettingsSaves the resource owner's consent for the granting authorization for the specified client with the specified scope.- Specified by:
saveConsentin interfaceOAuth2ProviderSettings- Parameters:
resourceOwner- The resource owner.clientId- The client id.scope- The requested scope.
-
revokeConsent
public void revokeConsent(String userId, String clientId)
Description copied from interface:OAuth2ProviderSettingsRevokes the resource owner's consent for the granting authorization for the specified client.- Specified by:
revokeConsentin interfaceOAuth2ProviderSettings- Parameters:
userId- The user id.clientId- The client id.
-
issueRefreshTokens
public boolean issueRefreshTokens() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsWhether the OAuth2 provider should issue refresh tokens when issuing access tokens.- Specified by:
issueRefreshTokensin interfaceOAuth2ProviderSettings- Returns:
trueif refresh tokens should be issued.- Throws:
ServerException- If any internal server error occurs.
-
issueRefreshTokensOnRefreshingToken
public boolean issueRefreshTokensOnRefreshingToken() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsWhether the OAuth2 provider should issue refresh tokens when refreshing access tokens.- Specified by:
issueRefreshTokensOnRefreshingTokenin interfaceOAuth2ProviderSettings- Returns:
trueif refresh tokens should be issued when access tokens are refreshed.- Throws:
ServerException- If any internal server error occurs.
-
getAuthorizationCodeLifetime
public long getAuthorizationCodeLifetime() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsGets the lifetime an authorization code will have before it expires.- Specified by:
getAuthorizationCodeLifetimein interfaceOAuth2ProviderSettings- Returns:
- The lifetime of an authorization code in seconds.
- Throws:
ServerException- If any internal server error occurs.
-
getAccessTokenLifetime
public long getAccessTokenLifetime() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsGets the lifetime an access token will have before it expires.- Specified by:
getAccessTokenLifetimein interfaceOAuth2ProviderSettings- Returns:
- The lifetime of an access token in seconds.
- Throws:
ServerException- If any internal server error occurs.
-
getOpenIdTokenLifetime
public long getOpenIdTokenLifetime() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsGets the lifetime an OpenID token will have before it expires.- Specified by:
getOpenIdTokenLifetimein interfaceOAuth2ProviderSettings- Returns:
- The lifetime of an OpenID token in seconds.
- Throws:
ServerException- If any internal server error occurs.
-
getRefreshTokenLifetime
public long getRefreshTokenLifetime() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsGets the lifetime an refresh token will have before it expires.- Specified by:
getRefreshTokenLifetimein interfaceOAuth2ProviderSettings- Returns:
- The lifetime of an refresh token in seconds.
- Throws:
ServerException- If any internal server error occurs.
-
getSigningKeyPair
public KeyPair getSigningKeyPair(org.forgerock.json.jose.jws.JwsAlgorithm algorithm) throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the signing key pair of the OAuth2 provider.- Specified by:
getSigningKeyPairin interfaceOAuth2ProviderSettings- Parameters:
algorithm- The signing algorithm.- Returns:
- The KeyPair.
- Throws:
ServerException- If any internal server error occurs.
-
getResourceOwnerAuthenticatedAttributes
public Set<String> getResourceOwnerAuthenticatedAttributes() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the attributes of the resource owner that are used for authenticating resource owners.- Specified by:
getResourceOwnerAuthenticatedAttributesin interfaceOAuth2ProviderSettings- Returns:
- A
Setof resource owner attributes. - Throws:
ServerException- If any internal server error occurs.
-
getSupportedClaims
public Set<String> getSupportedClaims() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the supported claims for this provider.- Specified by:
getSupportedClaimsin interfaceOAuth2ProviderSettings- Returns:
- A
Setof the supported claims. - Throws:
ServerException- If any internal server error occurs.
-
getSupportedClaimsWithTranslations
public Set<String> getSupportedClaimsWithTranslations() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the supported claims for this provider as strings with pipe-separated translations.- Specified by:
getSupportedClaimsWithTranslationsin interfaceOAuth2ProviderSettings- Returns:
- A
Setof the supported claims. - Throws:
ServerException- If any internal server error occurs.
-
getSupportedScopes
public Set<String> getSupportedScopes() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the supported scopes for this provider without translations.- Specified by:
getSupportedScopesin interfaceOAuth2ProviderSettings- Returns:
- A
Setof the supported scopes. - Throws:
ServerException- If any internal server error occurs.
-
getSupportedScopesWithTranslations
public Set<String> getSupportedScopesWithTranslations() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the supported scopes for this provider.- Specified by:
getSupportedScopesWithTranslationsin interfaceOAuth2ProviderSettings- Returns:
- A
Setof the supported scopes. - Throws:
ServerException- If any internal server error occurs.
-
getDefaultScopes
public Set<String> getDefaultScopes() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the default set of scopes to give a client registering with this provider.- Specified by:
getDefaultScopesin interfaceOAuth2ProviderSettings- Returns:
- A
Setof the default scopes. - Throws:
ServerException- If any internal server error occurs.
-
getSupportedIDTokenSigningAlgorithms
public Set<String> getSupportedIDTokenSigningAlgorithms() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the algorithms that the OAuth2 provider supports for signing OpenID tokens.- Specified by:
getSupportedIDTokenSigningAlgorithmsin interfaceOAuth2ProviderSettings- Returns:
- A
Setof the supported algorithms. - Throws:
ServerException- If any internal server error occurs.
-
getSupportedIDTokenEncryptionAlgorithms
public Set<String> getSupportedIDTokenEncryptionAlgorithms() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the algorithms that the OAuth2 provider supports for encryptin OpenID tokens.- Specified by:
getSupportedIDTokenEncryptionAlgorithmsin interfaceOAuth2ProviderSettings- Returns:
- A
Setof the supported algorithms. - Throws:
ServerException- If any internal server error occurs.
-
getSupportedIDTokenEncryptionMethods
public Set<String> getSupportedIDTokenEncryptionMethods() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the encryption methods that the OAuth2 provider supports for encryptin OpenID tokens.- Specified by:
getSupportedIDTokenEncryptionMethodsin interfaceOAuth2ProviderSettings- Returns:
- A
Setof the supported algorithms. - Throws:
ServerException- If any internal server error occurs.
-
getOpenIDConnectVersion
public String getOpenIDConnectVersion()
Description copied from interface:OAuth2ProviderSettingsGets the supported version of the OpenID Connect specification.- Specified by:
getOpenIDConnectVersionin interfaceOAuth2ProviderSettings- Returns:
- The OpenID Connect version.
-
getJWKSet
public org.forgerock.json.JsonValue getJWKSet() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsGets the JWK Set for this OAuth2 Authorization /OpenID Provider.- Specified by:
getJWKSetin interfaceOAuth2ProviderSettings- Returns:
- The JWK Set of signing and encryption keys.
- Throws:
ServerException
-
getCreatedTimestampAttributeName
public String getCreatedTimestampAttributeName() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the created timestamp attribute name.- Specified by:
getCreatedTimestampAttributeNamein interfaceOAuth2ProviderSettings- Returns:
- The created attribute timestamp attribute name.
- Throws:
ServerException
-
getModifiedTimestampAttributeName
public String getModifiedTimestampAttributeName() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the modified timestamp attribute name.- Specified by:
getModifiedTimestampAttributeNamein interfaceOAuth2ProviderSettings- Returns:
- The modified attribute timestamp attribute name.
- Throws:
ServerException
-
getSupportedSubjectTypes
public Set<String> getSupportedSubjectTypes() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the subject types supported by the OAuth2 provider.- Specified by:
getSupportedSubjectTypesin interfaceOAuth2ProviderSettings- Returns:
- A
Setof supported subject types. - Throws:
ServerException- If any internal server error occurs.
-
isOpenDynamicClientRegistrationAllowed
public boolean isOpenDynamicClientRegistrationAllowed() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsIndicates whether clients may register without providing an access token.- Specified by:
isOpenDynamicClientRegistrationAllowedin interfaceOAuth2ProviderSettings- Returns:
- true if allowed, otherwise false.
- Throws:
ServerException- If any internal server error occurs.
-
isRegistrationAccessTokenGenerationEnabled
public boolean isRegistrationAccessTokenGenerationEnabled() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsWhether to generate access tokens for clients that register without one. Only enabled ifOAuth2ProviderSettings.isOpenDynamicClientRegistrationAllowed()is true.- Specified by:
isRegistrationAccessTokenGenerationEnabledin interfaceOAuth2ProviderSettings- Returns:
- true if an access token should be generated for clients that register without one.
- Throws:
ServerException- If any internal server error occurs.
-
getAcrMapping
public Map<String,AuthenticationMethod> getAcrMapping() throws ServerException
Description copied from interface:OAuth2ProviderSettingsReturns a mapping from Authentication Context Class Reference (ACR) values (typically a Level of Assurance value) to concrete authentication methods.- Specified by:
getAcrMappingin interfaceOAuth2ProviderSettings- Throws:
ServerException
-
getDefaultAcrValues
public String getDefaultAcrValues() throws ServerException
Description copied from interface:OAuth2ProviderSettingsThe default Authentication Context Class Reference (ACR) values to use for authentication if none is specified in the request. This is a space-separated list of values in preference order.- Specified by:
getDefaultAcrValuesin interfaceOAuth2ProviderSettings- Throws:
ServerException
-
getAMRAuthModuleMappings
public Map<String,String> getAMRAuthModuleMappings() throws ServerException
Description copied from interface:OAuth2ProviderSettingsThe mappings between amr values and auth module names.- Specified by:
getAMRAuthModuleMappingsin interfaceOAuth2ProviderSettings- Returns:
- The mappings.
- Throws:
ServerException
-
exists
public boolean exists()
Description copied from interface:OAuth2ProviderSettingsChecks whether the config exists.- Specified by:
existsin interfaceOAuth2ProviderSettings- Returns:
- Whether it exists.
-
getResourceSetStore
public ResourceSetStore getResourceSetStore()
Description copied from interface:OAuth2ProviderSettingsReturns the ResourceSetStore instance for the realm.- Specified by:
getResourceSetStorein interfaceOAuth2ProviderSettings- Returns:
- The ResourceSetStore instance.
-
getClaimsParameterSupported
public boolean getClaimsParameterSupported() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsReturns whether this provider supports claims requested via 'claims' parameter.- Specified by:
getClaimsParameterSupportedin interfaceOAuth2ProviderSettings- Returns:
- true or false.
- Throws:
ServerException
-
validateRequestedClaims
public String validateRequestedClaims(String requestedClaims) throws InvalidRequestException, ServerException
Description copied from interface:OAuth2ProviderSettingsValidates that the requested claims are appropriate to be requested by the given client.- Specified by:
validateRequestedClaimsin interfaceOAuth2ProviderSettings- Throws:
InvalidRequestExceptionServerException
-
getEndpointAuthMethodsSupported
public Set<String> getEndpointAuthMethodsSupported()
Description copied from interface:OAuth2ProviderSettingsReturns the token_endpoint_auth_methods available for clients to register (and subsequently auth) using.- Specified by:
getEndpointAuthMethodsSupportedin interfaceOAuth2ProviderSettings
-
isCodeVerifierRequired
public boolean isCodeVerifierRequired() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsWhether or not to enforce the Code Verifier Parameter.- Specified by:
isCodeVerifierRequiredin interfaceOAuth2ProviderSettings- Returns:
- Whether the Code Verifier option has been configured.
- Throws:
ServerException- See Also:
-
getHashSalt
public String getHashSalt() throws ServerException
Description copied from interface:OAuth2ProviderSettingsReturns the salt to use for hashing sub values upon pairwise requests.- Specified by:
getHashSaltin interfaceOAuth2ProviderSettings- Throws:
ServerException
-
isAlwaysAddClaimsToToken
public boolean isAlwaysAddClaimsToToken() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsWhether to always add claims to id_tokens - non-spec compliant.- Specified by:
isAlwaysAddClaimsToTokenin interfaceOAuth2ProviderSettings- Throws:
ServerException- See Also:
- OpenID Connect Specification
-
getUserDisplayNameAttribute
public String getUserDisplayNameAttribute() throws ServerException
Description copied from interface:OAuth2ProviderSettingsThe attribute that can be used to obtain a UI-displayable name for a user's AMIdentity.- Specified by:
getUserDisplayNameAttributein interfaceOAuth2ProviderSettings- Throws:
ServerException
-
getJWKSUri
public String getJWKSUri() throws ServerException
Description copied from interface:OAuth2ProviderSettingsGets the JSON Web Key Set URI.- Specified by:
getJWKSUriin interfaceOAuth2ProviderSettings- Returns:
- The JWKS URI.
- Throws:
ServerException- If any internal server error occurs.
-
getCustomLoginUrlTemplate
public freemarker.template.Template getCustomLoginUrlTemplate() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsGets the custom login url template which will create the url to redirect resource owners to for authentication.- Specified by:
getCustomLoginUrlTemplatein interfaceOAuth2ProviderSettings- Returns:
- The custom login url template.
- Throws:
ServerException- If the custom login url template setting could not be retrieved.
-
getVerificationUrl
public String getVerificationUrl() throws ServerException
Description copied from interface:OAuth2ProviderSettingsThe URL that the user will be instructed to visit to complete their OAuth 2 login and consent when using the device code flow.- Specified by:
getVerificationUrlin interfaceOAuth2ProviderSettings- Returns:
- The verification URL.
- Throws:
ServerException- If the setting could not be retrieved.
-
getCompletionUrl
public String getCompletionUrl() throws ServerException
Description copied from interface:OAuth2ProviderSettingsThe URL that the user will be sent to on completion of their OAuth 2 login and consent when using the device code flow.- Specified by:
getCompletionUrlin interfaceOAuth2ProviderSettings- Returns:
- The completion URL.
- Throws:
ServerException- If the setting could not be retrieved.
-
getDeviceCodeLifetime
public int getDeviceCodeLifetime() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsThe lifetime of the device code.- Specified by:
getDeviceCodeLifetimein interfaceOAuth2ProviderSettings- Returns:
- The lifetime in seconds.
- Throws:
ServerException- If the setting could not be retrieved.
-
getDeviceCodePollInterval
public int getDeviceCodePollInterval() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsThe polling interval for devices waiting for tokens when using the device code flow.- Specified by:
getDeviceCodePollIntervalin interfaceOAuth2ProviderSettings- Returns:
- The interval in seconds.
- Throws:
ServerException- If the setting could not be retrieved.
-
shouldStoreOpsTokens
public boolean shouldStoreOpsTokens() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsWhether to generate and store an ops token in CTS for this OIDC provider.- Specified by:
shouldStoreOpsTokensin interfaceOAuth2ProviderSettings- Returns:
trueif ops tokens should be generated/stored in CTS.- Throws:
ServerException- If the setting could not be retrieved.
-
clientsCanSkipConsent
public boolean clientsCanSkipConsent() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsWhether clients can opt to skip resource owner consent during authorization flows.- Specified by:
clientsCanSkipConsentin interfaceOAuth2ProviderSettings- Returns:
trueif clients are allowed to opt to skip resource owner consent.- Throws:
ServerException- If the setting could not be retrieved.
-
isOpenIDConnectSSOProviderEnabled
public boolean isOpenIDConnectSSOProviderEnabled() throws ServerExceptionDescription copied from interface:OAuth2ProviderSettingsWhether OpenID Connect ID Tokens are accepted as SSOTokens in this realm or not.- Specified by:
isOpenIDConnectSSOProviderEnabledin interfaceOAuth2ProviderSettings- Returns:
trueif ID Tokens are accepted as SSOTokens in this realm.- Throws:
ServerException- If the setting could not be retrieved.
-
-