Package swiss.trustbroker.federation.xmlconfig

Class OidcClient.OidcClientBuilder

java.lang.Object

swiss.trustbroker.federation.xmlconfig.OidcClient.OidcClientBuilder

Enclosing class:

OidcClient

public static class OidcClient.OidcClientBuilder
extends Object

Method Summary

Modifier and Type	Method	Description
OidcClient.OidcClientBuilder	audiences(Audiences audiences)	OIDC allowed audience in TokenExchange.
OidcClient.OidcClientBuilder	authorizationGrantTypes(AuthorizationGrantTypes authorizationGrantTypes)	Authorization grant types to be allowed.
OidcClient	build()
OidcClient.OidcClientBuilder	certificates(Certificates certificates)	Required for JWT encryption
OidcClient.OidcClientBuilder	claimsSelection(AttributesSelection claimsSelection)	Attribute selection applied to the claims.
OidcClient.OidcClientBuilder	claimsSources(OidcClaimsSources claimsSources)	Sources of claims for OIDC CPs.
OidcClient.OidcClientBuilder	clientAuthenticationMethods(ClientAuthenticationMethods clientAuthenticationMethods)	Client authentication methods to be allowed.
OidcClient.OidcClientBuilder	clientEncryptionCredential(org.opensaml.security.credential.Credential clientEncryptionCredential)
OidcClient.OidcClientBuilder	clientSecret(String clientSecret)	You can encode the secret with one of the supported encoders.
OidcClient.OidcClientBuilder	cpJwks(List<com.nimbusds.jose.jwk.JWK> cpJwks)
OidcClient.OidcClientBuilder	federationId(String federationId)	Federation ID override.
OidcClient.OidcClientBuilder	id(String id)	Client ID.
OidcClient.OidcClientBuilder	issuerId(String issuerId)	CP issuer ID override for iss claim validation.
OidcClient.OidcClientBuilder	oidcSecurityPolicies(OidcSecurityPolicies oidcSecurityPolicies)	Override security policies.
OidcClient.OidcClientBuilder	protocolEndpoints(ProtocolEndpoints protocolEndpoints)	OpenID endpoints a single CP side OIDC client uses for federated login.
OidcClient.OidcClientBuilder	qoa(Qoa qoa)	QoAs to use.
OidcClient.OidcClientBuilder	realm(String realm)	Optional support to be able to map back /oauth2/authorize
OidcClient.OidcClientBuilder	redirectUris(AcWhitelist redirectUris)	Permitted redirect URLs for this client.
OidcClient.OidcClientBuilder	registeredClient(org.springframework.security.oauth2.server.authorization.client.RegisteredClient registeredClient)
OidcClient.OidcClientBuilder	resources(Resources resources)	OIDC allowed resources in TokenExchange.
OidcClient.OidcClientBuilder	responseMode(ResponseMode responseMode)	Response mode to be requested from CP.
OidcClient.OidcClientBuilder	scopes(Scopes scopes)	OIDC scopes to be used.
String	toString()
OidcClient.OidcClientBuilder	usePepQoa(String usePepQoa)	Legacy Policy Enforcement Point (PEP) QOA mapping policy.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Method Details

id

public OidcClient.OidcClientBuilder id(String id)

Client ID.
Notes:

• OIDC client IDs must be unique for all RPs within the configuration of each environment (trustbroker-inventories/environment).
• OIDC client IDs used for CPs may overlap both across CPs and with those of RPs.

Returns:

this.

federationId

public OidcClient.OidcClientBuilder federationId(String federationId)

Federation ID override.
Fallback to RP ID.

Returns:

this.

issuerId

public OidcClient.OidcClientBuilder issuerId(String issuerId)

CP issuer ID override for iss claim validation.
Fallback to CP ID.

Returns:

this.

Since:

1.10.0

realm

public OidcClient.OidcClientBuilder realm(String realm)

Optional support to be able to map back /oauth2/authorize

Returns:

this.

usePepQoa

public OidcClient.OidcClientBuilder usePepQoa(String usePepQoa)

Legacy Policy Enforcement Point (PEP) QOA mapping policy.
Fallback: Global defaultUsePepQoaPolicy

Returns:

this.

protocolEndpoints

public OidcClient.OidcClientBuilder protocolEndpoints(ProtocolEndpoints protocolEndpoints)

OpenID endpoints a single CP side OIDC client uses for federated login.

Returns:

this.

Since:

1.9.0

redirectUris

public OidcClient.OidcClientBuilder redirectUris(AcWhitelist redirectUris)

Permitted redirect URLs for this client.

Returns:

this.

certificates

public OidcClient.OidcClientBuilder certificates(Certificates certificates)

Required for JWT encryption

Returns:

this.

clientSecret

public OidcClient.OidcClientBuilder clientSecret(String clientSecret)

You can encode the secret with one of the supported encoders. See the provided example EncodePassword.groovy for how to encode a password using Argon2.

Returns:

this.

See Also:

• OidcSecurityConfiguration.passwordEncoder()

oidcSecurityPolicies

public OidcClient.OidcClientBuilder oidcSecurityPolicies(OidcSecurityPolicies oidcSecurityPolicies)

Override security policies.

Returns:

this.

authorizationGrantTypes

public OidcClient.OidcClientBuilder authorizationGrantTypes(AuthorizationGrantTypes authorizationGrantTypes)

Authorization grant types to be allowed.
Default: authorization_code, refresh_token

Returns:

this.

clientAuthenticationMethods

public OidcClient.OidcClientBuilder clientAuthenticationMethods(ClientAuthenticationMethods clientAuthenticationMethods)

Client authentication methods to be allowed.
Default: none, client_secret_basic, client_secret_post

Returns:

this.

scopes

public OidcClient.OidcClientBuilder scopes(Scopes scopes)

OIDC scopes to be used.
Default: openid, profile, email, address, phone

Returns:

this.

audiences

public OidcClient.OidcClientBuilder audiences(Audiences audiences)

OIDC allowed audience in TokenExchange.

Returns:

this.

Since:

1.13.0

resources

public OidcClient.OidcClientBuilder resources(Resources resources)

OIDC allowed resources in TokenExchange.

Returns:

this.

Since:

1.13.0

responseMode

public OidcClient.OidcClientBuilder responseMode(ResponseMode responseMode)

Response mode to be requested from CP.
Default: form_post

Returns:

this.

Since:

1.10.0

qoa

public OidcClient.OidcClientBuilder qoa(Qoa qoa)

QoAs to use.

Returns:

this.

claimsSelection

public OidcClient.OidcClientBuilder claimsSelection(AttributesSelection claimsSelection)

Attribute selection applied to the claims.

Returns:

this.

claimsSources

public OidcClient.OidcClientBuilder claimsSources(OidcClaimsSources claimsSources)

Sources of claims for OIDC CPs.
Default: id_token

Returns:

this.

Since:

1.10.0

registeredClient

public OidcClient.OidcClientBuilder registeredClient(org.springframework.security.oauth2.server.authorization.client.RegisteredClient registeredClient)

Returns:

this.

clientEncryptionCredential

public OidcClient.OidcClientBuilder clientEncryptionCredential(org.opensaml.security.credential.Credential clientEncryptionCredential)

Returns:

this.

cpJwks

public OidcClient.OidcClientBuilder cpJwks(List<com.nimbusds.jose.jwk.JWK> cpJwks)

Returns:

this.

build

public OidcClient build()

toString

public String toString()

Overrides:

toString in class Object