Package swiss.trustbroker.federation.xmlconfig

Class OidcClient

java.lang.Object
swiss.trustbroker.federation.xmlconfig.OidcClient
All Implemented Interfaces:
Serializable
public class OidcClient extends Object implements Serializable
OIDC client application configuration.
See Also:

  • Constructor Details

    • OidcClient

      public OidcClient()

    • OidcClient

      public OidcClient(String id, String federationId, String issuerId, String realm, String usePepQoa, ProtocolEndpoints protocolEndpoints, AcWhitelist redirectUris, Certificates certificates, String clientSecret, OidcSecurityPolicies oidcSecurityPolicies, AuthorizationGrantTypes authorizationGrantTypes, ClientAuthenticationMethods clientAuthenticationMethods, Scopes scopes, Audiences audiences, Resources resources, ResponseMode responseMode, Qoa qoa, AttributesSelection claimsSelection, OidcClaimsSources claimsSources, org.springframework.security.oauth2.server.authorization.client.RegisteredClient registeredClient, org.opensaml.security.credential.Credential clientEncryptionCredential, List<com.nimbusds.jose.jwk.JWK> cpJwks)
      Creates a new OidcClient instance.
      Parameters:
      id - Client ID.
      Notes:
      • OIDC client IDs must be unique for all RPs within the configuration of each environment (trustbroker-inventories/environment).
      • OIDC client IDs used for CPs may overlap both across CPs and with those of RPs.
      federationId - Federation ID override.
      Fallback to RP ID.
      issuerId - CP issuer ID override for iss claim validation.
      Fallback to CP ID.
      realm - Optional support to be able to map back /oauth2/authorize
      usePepQoa - Legacy Policy Enforcement Point (PEP) QOA mapping policy.
      Fallback: Global defaultUsePepQoaPolicy
      protocolEndpoints - OpenID endpoints a single CP side OIDC client uses for federated login.
      redirectUris - Permitted redirect URLs for this client.
      certificates - Required for JWT encryption
      clientSecret - You can encode the secret with one of the supported encoders. See the provided example EncodePassword.groovy for how to encode a password using Argon2.
      oidcSecurityPolicies - Override security policies.
      authorizationGrantTypes - Authorization grant types to be allowed.
      Default: authorization_code, refresh_token
      clientAuthenticationMethods - Client authentication methods to be allowed.
      Default: none, client_secret_basic, client_secret_post
      scopes - OIDC scopes to be used.
      Default: openid, profile, email, address, phone
      audiences - OIDC allowed audience in TokenExchange.
      resources - OIDC allowed resources in TokenExchange.
      responseMode - Response mode to be requested from CP.
      Default: form_post
      qoa - QoAs to use.
      claimsSelection - Attribute selection applied to the claims.
      claimsSources - Sources of claims for OIDC CPs.
      Default: id_token
      registeredClient -
      clientEncryptionCredential -
      cpJwks -
      Since:
      1.10.0, 1.9.0, 1.13.0, 1.13.0, 1.10.0, 1.10.0
      See Also:

  • Method Details

    • isValidRedirectUri

      public boolean isValidRedirectUri(String requestedRedirectUri)

    • isValidRedirectUris

      public boolean isValidRedirectUris(List<String> requestedRedirectUris)

    • isTrustedOrigin

      public boolean isTrustedOrigin(String origin)

    • isSameRealm

      public boolean isSameRealm(String incomingRealm)

    • getQoaConfig

      public QoaConfig getQoaConfig()

    • hasScopes

      public boolean hasScopes()

    • useClaimsFromSource

      public boolean useClaimsFromSource(OidcClaimsSource claimsSource)

    • useClaimsFromSourceThat

      public boolean useClaimsFromSourceThat(Predicate<OidcClaimsSource> predicate)

    • builder

      public static OidcClient.OidcClientBuilder builder()

    • getId

      public String getId()
      Client ID.
      Notes:
      • OIDC client IDs must be unique for all RPs within the configuration of each environment (trustbroker-inventories/environment).
      • OIDC client IDs used for CPs may overlap both across CPs and with those of RPs.

    • getFederationId

      public String getFederationId()
      Federation ID override.
      Fallback to RP ID.

    • getIssuerId

      public String getIssuerId()
      CP issuer ID override for iss claim validation.
      Fallback to CP ID.
      Since:
      1.10.0

    • getRealm

      public String getRealm()
      Optional support to be able to map back /oauth2/authorize

    • getUsePepQoa

      public String getUsePepQoa()
      Legacy Policy Enforcement Point (PEP) QOA mapping policy.
      Fallback: Global defaultUsePepQoaPolicy

    • getProtocolEndpoints

      public ProtocolEndpoints getProtocolEndpoints()
      OpenID endpoints a single CP side OIDC client uses for federated login.
      Since:
      1.9.0

    • getRedirectUris

      public AcWhitelist getRedirectUris()
      Permitted redirect URLs for this client.

    • getCertificates

      public Certificates getCertificates()
      Required for JWT encryption

    • getClientSecret

      public String getClientSecret()
      You can encode the secret with one of the supported encoders. See the provided example EncodePassword.groovy for how to encode a password using Argon2.
      See Also:

    • getOidcSecurityPolicies

      public OidcSecurityPolicies getOidcSecurityPolicies()
      Override security policies.

    • getAuthorizationGrantTypes

      public AuthorizationGrantTypes getAuthorizationGrantTypes()
      Authorization grant types to be allowed.
      Default: authorization_code, refresh_token

    • getClientAuthenticationMethods

      public ClientAuthenticationMethods getClientAuthenticationMethods()
      Client authentication methods to be allowed.
      Default: none, client_secret_basic, client_secret_post

    • getScopes

      public Scopes getScopes()
      OIDC scopes to be used.
      Default: openid, profile, email, address, phone

    • getAudiences

      public Audiences getAudiences()
      OIDC allowed audience in TokenExchange.
      Since:
      1.13.0

    • getResources

      public Resources getResources()
      OIDC allowed resources in TokenExchange.
      Since:
      1.13.0

    • getResponseMode

      public ResponseMode getResponseMode()
      Response mode to be requested from CP.
      Default: form_post
      Since:
      1.10.0

    • getQoa

      public Qoa getQoa()
      QoAs to use.

    • getClaimsSelection

      public AttributesSelection getClaimsSelection()
      Attribute selection applied to the claims.

    • getClaimsSources

      public OidcClaimsSources getClaimsSources()
      Sources of claims for OIDC CPs.
      Default: id_token
      Since:
      1.10.0

    • getRegisteredClient

      public org.springframework.security.oauth2.server.authorization.client.RegisteredClient getRegisteredClient()

    • getClientEncryptionCredential

      public org.opensaml.security.credential.Credential getClientEncryptionCredential()

    • getCpJwks

      public List<com.nimbusds.jose.jwk.JWK> getCpJwks()

    • setId

      public void setId(String id)
      Client ID.
      Notes:
      • OIDC client IDs must be unique for all RPs within the configuration of each environment (trustbroker-inventories/environment).
      • OIDC client IDs used for CPs may overlap both across CPs and with those of RPs.

    • setFederationId

      public void setFederationId(String federationId)
      Federation ID override.
      Fallback to RP ID.

    • setIssuerId

      public void setIssuerId(String issuerId)
      CP issuer ID override for iss claim validation.
      Fallback to CP ID.
      Since:
      1.10.0

    • setRealm

      public void setRealm(String realm)
      Optional support to be able to map back /oauth2/authorize

    • setUsePepQoa

      public void setUsePepQoa(String usePepQoa)
      Legacy Policy Enforcement Point (PEP) QOA mapping policy.
      Fallback: Global defaultUsePepQoaPolicy

    • setProtocolEndpoints

      public void setProtocolEndpoints(ProtocolEndpoints protocolEndpoints)
      OpenID endpoints a single CP side OIDC client uses for federated login.
      Since:
      1.9.0

    • setRedirectUris

      public void setRedirectUris(AcWhitelist redirectUris)
      Permitted redirect URLs for this client.

    • setCertificates

      public void setCertificates(Certificates certificates)
      Required for JWT encryption

    • setClientSecret

      public void setClientSecret(String clientSecret)
      You can encode the secret with one of the supported encoders. See the provided example EncodePassword.groovy for how to encode a password using Argon2.
      See Also:

    • setOidcSecurityPolicies

      public void setOidcSecurityPolicies(OidcSecurityPolicies oidcSecurityPolicies)
      Override security policies.

    • setAuthorizationGrantTypes

      public void setAuthorizationGrantTypes(AuthorizationGrantTypes authorizationGrantTypes)
      Authorization grant types to be allowed.
      Default: authorization_code, refresh_token

    • setClientAuthenticationMethods

      public void setClientAuthenticationMethods(ClientAuthenticationMethods clientAuthenticationMethods)
      Client authentication methods to be allowed.
      Default: none, client_secret_basic, client_secret_post

    • setScopes

      public void setScopes(Scopes scopes)
      OIDC scopes to be used.
      Default: openid, profile, email, address, phone

    • setAudiences

      public void setAudiences(Audiences audiences)
      OIDC allowed audience in TokenExchange.
      Since:
      1.13.0

    • setResources

      public void setResources(Resources resources)
      OIDC allowed resources in TokenExchange.
      Since:
      1.13.0

    • setResponseMode

      public void setResponseMode(ResponseMode responseMode)
      Response mode to be requested from CP.
      Default: form_post
      Since:
      1.10.0

    • setQoa

      public void setQoa(Qoa qoa)
      QoAs to use.

    • setClaimsSelection

      public void setClaimsSelection(AttributesSelection claimsSelection)
      Attribute selection applied to the claims.

    • setClaimsSources

      public void setClaimsSources(OidcClaimsSources claimsSources)
      Sources of claims for OIDC CPs.
      Default: id_token
      Since:
      1.10.0

    • setRegisteredClient

      public void setRegisteredClient(org.springframework.security.oauth2.server.authorization.client.RegisteredClient registeredClient)

    • setClientEncryptionCredential

      public void setClientEncryptionCredential(org.opensaml.security.credential.Credential clientEncryptionCredential)

    • setCpJwks

      public void setCpJwks(List<com.nimbusds.jose.jwk.JWK> cpJwks)

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • canEqual

      protected boolean canEqual(Object other)

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object