Package swiss.trustbroker.config.dto

Class OidcProperties

java.lang.Object
swiss.trustbroker.config.dto.OidcProperties
@Configuration @ConfigurationProperties(prefix="trustbroker.config.oidc") public class OidcProperties extends Object
OIDC protocol configuration.
See Also:

  • Constructor Details

    • OidcProperties

      public OidcProperties()

  • Method Details

    • isEnabled

      public boolean isEnabled()
      OIDC protocol enabled.
      Default: true
      Since:
      1.14.0

    • getIssuer

      public String getIssuer()
      XTB OIDC issuer ID.

    • getPerimeterUrl

      public String getPerimeterUrl()
      XTB OIDC perimeter URL.
      Note: Currently, the path that is requested on XTB needs to be /login/saml2/sso.

    • getEndSessionEndpoint

      public String getEndSessionEndpoint()
      XTB OIDC session termination endpoint, included in the metadata.
      Note: Currently, the path that is requested on XTB needs to be /logout.

    • getSessionIFrameEndpoint

      public String getSessionIFrameEndpoint()
      XTB OIDC session iframe endpoint.

    • isSessionCookie

      public boolean isSessionCookie()
      Use session cookies - delete cookies on browser close.
      Default: true

    • getSessionLifetimeSec

      public int getSessionLifetimeSec()
      OIDC session lifetime in seconds.

    • getCodeLifetimeSec

      public int getCodeLifetimeSec()
      OIDC code lifetime in seconds.
      Since:
      1.9.0

    • getSessionMode

      public TomcatSessionMode getSessionMode()
      Mode for Tomcat sessions.
      Default: IN_DB

    • getIdentityProvider

      public OidcIdentityProvider getIdentityProvider()
      OIDC identity provider configuration.

    • isSamlEncrypt

      public boolean isSamlEncrypt()
      Encrypt internal SAML messages to XTB.

    • getKeySchedule

      public String getKeySchedule()
      Key rotation schedule. Cron expression.

    • getKeyExpirationMinutes

      public long getKeyExpirationMinutes()
      Expiration of keys in minutes.

    • getKeyDeletionMinutes

      public long getKeyDeletionMinutes()
      Deletion of expired (rotated) keys in minutes.

    • isRevocationEnabled

      public boolean isRevocationEnabled()
      Enable revocation endpoint.
      Default: true

    • isIntrospectionEnabled

      public boolean isIntrospectionEnabled()
      Enable introspection endpoint.
      Default: true

    • isUserInfoEnabled

      public boolean isUserInfoEnabled()
      Enable user info endpoint.
      Default: true

    • isLogoutEnabled

      public boolean isLogoutEnabled()
      Enable logout endpoint.
      Default: true

    • isDeviceAuthorizationEnabled

      public boolean isDeviceAuthorizationEnabled()
      Enable device authorization endpoint.
      Default: true
      Since:
      1.10.0

    • isPushedAuthorizationRequestsEndpointEnabled

      public boolean isPushedAuthorizationRequestsEndpointEnabled()
      Enable pushed authorization requests endpoints.
      Default: false (not yet verified)
      Since:
      1.11.0

    • isTlsClientCertificateBoundAccessTokens

      public boolean isTlsClientCertificateBoundAccessTokens()
      Enable TLS client certificate bound access tokens.
      Default: true
      Since:
      1.10.0

    • getTokenEndpointAuthMethods

      public List<String> getTokenEndpointAuthMethods()
      Enabled token endpoint authentication methods.
      Since:
      1.10.0

    • getIntrospectionEndpointAuthMethods

      public List<String> getIntrospectionEndpointAuthMethods()
      Enabled introspection endpoint auth methods.
      Since:
      1.10.0

    • getRevocationEndpointAuthMethods

      public List<String> getRevocationEndpointAuthMethods()
      Enabled revocation endpoint auth methods.
      Since:
      1.10.0

    • getGrantTypes

      public List<String> getGrantTypes()
      Enabled grant types.
      Since:
      1.10.0

    • getResponseTypes

      public List<String> getResponseTypes()
      Enabled response types.
      Since:
      1.10.0

    • getSubjectTypes

      public List<String> getSubjectTypes()
      Enabled subject types.
      Since:
      1.10.0

    • getScopes

      public List<String> getScopes()
      Enabled scopes.
      Since:
      1.10.0

    • getCodeChallengeMethods

      public List<String> getCodeChallengeMethods()
      Enabled code challenge methods.
      Since:
      1.10.0

    • getIdTokenSigningAlgorithms

      public List<String> getIdTokenSigningAlgorithms()
      Enabled ID token signing algorithms methods.
      Since:
      1.10.0

    • getDPoPSigningAlgValuesSupported

      public List<String> getDPoPSigningAlgValuesSupported()
      Enabled Demonstrating Proof of Possession (DPoP) signing algorithm values.
      Default: none (not yet verified)
      Since:
      1.11.0

    • isOpaqueRefreshTokenEnabled

      @Deprecated public boolean isOpaqueRefreshTokenEnabled()
      Deprecated.
      Use opaque refresh token.
      Default: false (i.e. JWT token)

    • getIdTokenEncryptionAlgorithms

      public List<String> getIdTokenEncryptionAlgorithms()
      Enabled ID token encryption algorithms.
      Since:
      1.12.0

    • getIdTokenEncryptionMethods

      public List<String> getIdTokenEncryptionMethods()
      Enabled ID token encryption methods.
      Since:
      1.12.0

    • getUserInfoEncryptionAlgorithms

      public List<String> getUserInfoEncryptionAlgorithms()
      Enabled UserInfo encryption algorithms.
      Since:
      1.12.0

    • getUserInfoEncryptionMethods

      public List<String> getUserInfoEncryptionMethods()
      Enabled UserInfo encryption methods.
      Since:
      1.12.0

    • getDefaultQoa

      public String getDefaultQoa()
      Global default QoA.

    • getDefaultUsePepQoaPolicy

      public String getDefaultUsePepQoaPolicy()
      Global default for legacy Policy Enforcement Point (PEP) QOA mapping policy configured via 
      OidcClient.usePepQoa
      .

    • isUseKeycloakIssuerId

      public boolean isUseKeycloakIssuerId()
      Use Keycloak issuer ID. Support CORS headers without preflight and handle Issuer.
      Default: true

    • isKeycloakTransparencyModeOn

      public boolean isKeycloakTransparencyModeOn()
      NOTE: Transparency mode simulates /realms/X URLs and IDs for all clients on redirects etc. in case client adapters are picky on cross-checking URLs against token claims (like iss) and metadata (like Issuer). For now, we assume we do not need it.
      Default: false

    • getSamlNamespacesMappedToOidcFormat

      public List<SamlNamespace> getSamlNamespacesMappedToOidcFormat()
      SAML namespace to OIDC mappings.

    • getSamlErrorCodeRegexMappings

      public List<swiss.trustbroker.common.config.RegexNameValue> getSamlErrorCodeRegexMappings()
      SAML error code mappings.
      If the regex contains a capturing group that matches, use the matching part (converted to snake case) else the value is used to replace the matching status code.

    • getDefaultErrorCode

      public String getDefaultErrorCode()
      Default error code for OIDC.
      Fallback: access_denied

    • getJsonErrorPageHeaders

      public List<swiss.trustbroker.common.config.RegexNameValue> getJsonErrorPageHeaders()
      List of HTTP header names and regex matching the value. If any one matches, the request is considered to originate from Javascript and a JSON response is sent.
      Since:
      1.7.0

    • isAddEidStandardClaims

      public boolean isAddEidStandardClaims()
      Internal fallback to add eID OIDC standard-claims

    • getAddTokenHeader

      public List<String> getAddTokenHeader()
      Globally customize OIDC header (e.g. adding option typ=JWT).

    • getAddTokenClaims

      public List<String> getAddTokenClaims()
      Globally customize /token and /userinfo output dropping technical claims (typ=JWT and iss=issuer we keep for now). Claims to add.

    • getRemoveUserInfoClaims

      public List<String> getRemoveUserInfoClaims()
      Claims to remove for user info.

    • getDropDuplicatedAttributeFromOriginalIssuer

      public List<String> getDropDuplicatedAttributeFromOriginalIssuer()
      If we have the same attribute from both original issuer and IDM, drop the original issuer one.

    • getKeystore

      public swiss.trustbroker.common.config.KeystoreProperties getKeystore()
      Default keystore for direct connections to OIDC CPs.
      Since:
      1.10.0

    • getTruststore

      public swiss.trustbroker.common.config.KeystoreProperties getTruststore()
      Default truststore for direct connections to OIDC CPs.
      Since:
      1.9.0

    • getSyncSchedule

      public String getSyncSchedule()
      Schedule for fetching current metadata configurations from all CPs. Cron expression.
      Since:
      1.9.0

    • getMinimumMetadataCacheTimeSecs

      public long getMinimumMetadataCacheTimeSecs()
      Cached CP metadata is only refreshed if cached earlier than this.
      Default: 60
      Since:
      1.10.0

    • isExternalTokenExchangeEnabled

      public boolean isExternalTokenExchangeEnabled()
      Allow token exchange with external tokens.
      Default: false
      Since:
      1.13.0

    • isSaml2TokenExchangeEnabled

      public boolean isSaml2TokenExchangeEnabled()
      Allow saml2 token exchange.
      Default: false
      Since:
      1.14.0

    • setEnabled

      public void setEnabled(boolean enabled)
      OIDC protocol enabled.
      Default: true
      Since:
      1.14.0

    • setIssuer

      public void setIssuer(String issuer)
      XTB OIDC issuer ID.

    • setPerimeterUrl

      public void setPerimeterUrl(String perimeterUrl)
      XTB OIDC perimeter URL.
      Note: Currently, the path that is requested on XTB needs to be /login/saml2/sso.

    • setEndSessionEndpoint

      public void setEndSessionEndpoint(String endSessionEndpoint)
      XTB OIDC session termination endpoint, included in the metadata.
      Note: Currently, the path that is requested on XTB needs to be /logout.

    • setSessionIFrameEndpoint

      public void setSessionIFrameEndpoint(String sessionIFrameEndpoint)
      XTB OIDC session iframe endpoint.

    • setSessionCookie

      public void setSessionCookie(boolean sessionCookie)
      Use session cookies - delete cookies on browser close.
      Default: true

    • setSessionLifetimeSec

      public void setSessionLifetimeSec(int sessionLifetimeSec)
      OIDC session lifetime in seconds.

    • setCodeLifetimeSec

      public void setCodeLifetimeSec(int codeLifetimeSec)
      OIDC code lifetime in seconds.
      Since:
      1.9.0

    • setSessionMode

      public void setSessionMode(TomcatSessionMode sessionMode)
      Mode for Tomcat sessions.
      Default: IN_DB

    • setIdentityProvider

      public void setIdentityProvider(OidcIdentityProvider identityProvider)
      OIDC identity provider configuration.

    • setSamlEncrypt

      public void setSamlEncrypt(boolean samlEncrypt)
      Encrypt internal SAML messages to XTB.

    • setKeySchedule

      public void setKeySchedule(String keySchedule)
      Key rotation schedule. Cron expression.

    • setKeyExpirationMinutes

      public void setKeyExpirationMinutes(long keyExpirationMinutes)
      Expiration of keys in minutes.

    • setKeyDeletionMinutes

      public void setKeyDeletionMinutes(long keyDeletionMinutes)
      Deletion of expired (rotated) keys in minutes.

    • setRevocationEnabled

      public void setRevocationEnabled(boolean revocationEnabled)
      Enable revocation endpoint.
      Default: true

    • setIntrospectionEnabled

      public void setIntrospectionEnabled(boolean introspectionEnabled)
      Enable introspection endpoint.
      Default: true

    • setUserInfoEnabled

      public void setUserInfoEnabled(boolean userInfoEnabled)
      Enable user info endpoint.
      Default: true

    • setLogoutEnabled

      public void setLogoutEnabled(boolean logoutEnabled)
      Enable logout endpoint.
      Default: true

    • setDeviceAuthorizationEnabled

      public void setDeviceAuthorizationEnabled(boolean deviceAuthorizationEnabled)
      Enable device authorization endpoint.
      Default: true
      Since:
      1.10.0

    • setPushedAuthorizationRequestsEndpointEnabled

      public void setPushedAuthorizationRequestsEndpointEnabled(boolean pushedAuthorizationRequestsEndpointEnabled)
      Enable pushed authorization requests endpoints.
      Default: false (not yet verified)
      Since:
      1.11.0

    • setTlsClientCertificateBoundAccessTokens

      public void setTlsClientCertificateBoundAccessTokens(boolean tlsClientCertificateBoundAccessTokens)
      Enable TLS client certificate bound access tokens.
      Default: true
      Since:
      1.10.0

    • setTokenEndpointAuthMethods

      public void setTokenEndpointAuthMethods(List<String> tokenEndpointAuthMethods)
      Enabled token endpoint authentication methods.
      Since:
      1.10.0

    • setIntrospectionEndpointAuthMethods

      public void setIntrospectionEndpointAuthMethods(List<String> introspectionEndpointAuthMethods)
      Enabled introspection endpoint auth methods.
      Since:
      1.10.0

    • setRevocationEndpointAuthMethods

      public void setRevocationEndpointAuthMethods(List<String> revocationEndpointAuthMethods)
      Enabled revocation endpoint auth methods.
      Since:
      1.10.0

    • setGrantTypes

      public void setGrantTypes(List<String> grantTypes)
      Enabled grant types.
      Since:
      1.10.0

    • setResponseTypes

      public void setResponseTypes(List<String> responseTypes)
      Enabled response types.
      Since:
      1.10.0

    • setSubjectTypes

      public void setSubjectTypes(List<String> subjectTypes)
      Enabled subject types.
      Since:
      1.10.0

    • setScopes

      public void setScopes(List<String> scopes)
      Enabled scopes.
      Since:
      1.10.0

    • setCodeChallengeMethods

      public void setCodeChallengeMethods(List<String> codeChallengeMethods)
      Enabled code challenge methods.
      Since:
      1.10.0

    • setIdTokenSigningAlgorithms

      public void setIdTokenSigningAlgorithms(List<String> idTokenSigningAlgorithms)
      Enabled ID token signing algorithms methods.
      Since:
      1.10.0

    • setDPoPSigningAlgValuesSupported

      public void setDPoPSigningAlgValuesSupported(List<String> dPoPSigningAlgValuesSupported)
      Enabled Demonstrating Proof of Possession (DPoP) signing algorithm values.
      Default: none (not yet verified)
      Since:
      1.11.0

    • setOpaqueRefreshTokenEnabled

      @Deprecated public void setOpaqueRefreshTokenEnabled(boolean opaqueRefreshTokenEnabled)
      Deprecated.
      Use opaque refresh token.
      Default: false (i.e. JWT token)

    • setIdTokenEncryptionAlgorithms

      public void setIdTokenEncryptionAlgorithms(List<String> idTokenEncryptionAlgorithms)
      Enabled ID token encryption algorithms.
      Since:
      1.12.0

    • setIdTokenEncryptionMethods

      public void setIdTokenEncryptionMethods(List<String> idTokenEncryptionMethods)
      Enabled ID token encryption methods.
      Since:
      1.12.0

    • setUserInfoEncryptionAlgorithms

      public void setUserInfoEncryptionAlgorithms(List<String> userInfoEncryptionAlgorithms)
      Enabled UserInfo encryption algorithms.
      Since:
      1.12.0

    • setUserInfoEncryptionMethods

      public void setUserInfoEncryptionMethods(List<String> userInfoEncryptionMethods)
      Enabled UserInfo encryption methods.
      Since:
      1.12.0

    • setDefaultQoa

      public void setDefaultQoa(String defaultQoa)
      Global default QoA.

    • setDefaultUsePepQoaPolicy

      public void setDefaultUsePepQoaPolicy(String defaultUsePepQoaPolicy)
      Global default for legacy Policy Enforcement Point (PEP) QOA mapping policy configured via 
      OidcClient.usePepQoa
      .

    • setUseKeycloakIssuerId

      public void setUseKeycloakIssuerId(boolean useKeycloakIssuerId)
      Use Keycloak issuer ID. Support CORS headers without preflight and handle Issuer.
      Default: true

    • setKeycloakTransparencyModeOn

      public void setKeycloakTransparencyModeOn(boolean keycloakTransparencyModeOn)
      NOTE: Transparency mode simulates /realms/X URLs and IDs for all clients on redirects etc. in case client adapters are picky on cross-checking URLs against token claims (like iss) and metadata (like Issuer). For now, we assume we do not need it.
      Default: false

    • setSamlNamespacesMappedToOidcFormat

      public void setSamlNamespacesMappedToOidcFormat(List<SamlNamespace> samlNamespacesMappedToOidcFormat)
      SAML namespace to OIDC mappings.

    • setSamlErrorCodeRegexMappings

      public void setSamlErrorCodeRegexMappings(List<swiss.trustbroker.common.config.RegexNameValue> samlErrorCodeRegexMappings)
      SAML error code mappings.
      If the regex contains a capturing group that matches, use the matching part (converted to snake case) else the value is used to replace the matching status code.

    • setDefaultErrorCode

      public void setDefaultErrorCode(String defaultErrorCode)
      Default error code for OIDC.
      Fallback: access_denied

    • setJsonErrorPageHeaders

      public void setJsonErrorPageHeaders(List<swiss.trustbroker.common.config.RegexNameValue> jsonErrorPageHeaders)
      List of HTTP header names and regex matching the value. If any one matches, the request is considered to originate from Javascript and a JSON response is sent.
      Since:
      1.7.0

    • setAddEidStandardClaims

      public void setAddEidStandardClaims(boolean addEidStandardClaims)
      Internal fallback to add eID OIDC standard-claims

    • setAddTokenHeader

      public void setAddTokenHeader(List<String> addTokenHeader)
      Globally customize OIDC header (e.g. adding option typ=JWT).

    • setAddTokenClaims

      public void setAddTokenClaims(List<String> addTokenClaims)
      Globally customize /token and /userinfo output dropping technical claims (typ=JWT and iss=issuer we keep for now). Claims to add.

    • setRemoveUserInfoClaims

      public void setRemoveUserInfoClaims(List<String> removeUserInfoClaims)
      Claims to remove for user info.

    • setDropDuplicatedAttributeFromOriginalIssuer

      public void setDropDuplicatedAttributeFromOriginalIssuer(List<String> dropDuplicatedAttributeFromOriginalIssuer)
      If we have the same attribute from both original issuer and IDM, drop the original issuer one.

    • setKeystore

      public void setKeystore(swiss.trustbroker.common.config.KeystoreProperties keystore)
      Default keystore for direct connections to OIDC CPs.
      Since:
      1.10.0

    • setTruststore

      public void setTruststore(swiss.trustbroker.common.config.KeystoreProperties truststore)
      Default truststore for direct connections to OIDC CPs.
      Since:
      1.9.0

    • setSyncSchedule

      public void setSyncSchedule(String syncSchedule)
      Schedule for fetching current metadata configurations from all CPs. Cron expression.
      Since:
      1.9.0

    • setMinimumMetadataCacheTimeSecs

      public void setMinimumMetadataCacheTimeSecs(long minimumMetadataCacheTimeSecs)
      Cached CP metadata is only refreshed if cached earlier than this.
      Default: 60
      Since:
      1.10.0

    • setExternalTokenExchangeEnabled

      public void setExternalTokenExchangeEnabled(boolean externalTokenExchangeEnabled)
      Allow token exchange with external tokens.
      Default: false
      Since:
      1.13.0

    • setSaml2TokenExchangeEnabled

      public void setSaml2TokenExchangeEnabled(boolean saml2TokenExchangeEnabled)
      Allow saml2 token exchange.
      Default: false
      Since:
      1.14.0

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • canEqual

      protected boolean canEqual(Object other)

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object