Package swiss.trustbroker.federation.xmlconfig

Class OidcSecurityPolicies.OidcSecurityPoliciesBuilder

java.lang.Object

swiss.trustbroker.federation.xmlconfig.OidcSecurityPolicies.OidcSecurityPoliciesBuilder

Enclosing class:

OidcSecurityPolicies

public static class OidcSecurityPolicies.OidcSecurityPoliciesBuilder
extends Object

Method Summary

Modifier and Type	Method	Description
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	accessTokenTimeToLiveMin(Integer accessTokenTimeToLiveMin)	Overrides tokenTimeToLiveMin for the access token.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	allowFormBearerToken(Boolean allowFormBearerToken)	Allow access_token in form body Default: false
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	allowPublicClientTokenExchange(Boolean allowPublicClientTokenExchange)	Allow Token Exchange with Public Client Default: false
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	authorizationCodeTimeToLiveMin(Integer authorizationCodeTimeToLiveMin)	Overrides tokenTimeToLiveMin for the authorization code.
OidcSecurityPolicies	build()
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	clientAssertionExpirationLifeTimeSec(Integer clientAssertionExpirationLifeTimeSec)	Restrict client_assertion expiration maxLifeTime Default: 3600 (1h)
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	clientAssertionMaxAgeSec(Integer clientAssertionMaxAgeSec)	Restrict client_assertion age Default: 60
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	clientAssertionNotBeforeToleranceSec(Integer clientAssertionNotBeforeToleranceSec)	client_assertion tolerance NTP drift tolerance.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	clientAssertionNotOnOrAfterToleranceSec(Integer clientAssertionNotOnOrAfterToleranceSec)	client_assertion timestamp clock/transfer tolerance.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	encryptionAlgorithm(String encryptionAlgorithm)	Encryption algorithm Default: RSA-OAEP-256
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	encryptionKid(String encryptionKid)	Encryption keyID
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	encryptionMethod(String encryptionMethod)	Encryption method Default: A256GCM
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	idTokenSignature(String idTokenSignature)	ID token signature algorithm (many adapters only support RS256)
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	idTokenTimeToLiveMin(Integer idTokenTimeToLiveMin)	Overrides tokenTimeToLiveMin for the ID token.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	refreshTokenTimeToLiveMin(Integer refreshTokenTimeToLiveMin)	Overrides tokenTimeToLiveMin for the refresh token.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	requireAuthorizationConsent(Boolean requireAuthorizationConsent)	Require authorization consent (currently unsupported).
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	requireIdTokenEncryption(Boolean requireIdTokenEncryption)	Allow to enable Encrypted IdToken JWT Singing for Rp.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	requireOpaqueAccessToken(Boolean requireOpaqueAccessToken)	Allow to enable Opaque AccessToken for Rp.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	requireOpaqueRefreshToken(Boolean requireOpaqueRefreshToken)	Allow to enable Opaque RefreshToken for Rp.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	requireProofKey(Boolean requireProofKey)	Require Proof Key for Code Exchange (PKCE).
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	requireUserInfoResponseEncryption(Boolean requireUserInfoResponseEncryption)	Allow to enable Encrypted UserInfo response Default: false
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	reuseRefreshTokens(Boolean reuseRefreshTokens)	Reuse refresh tokens.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	sessionCookieSameSite(String sessionCookieSameSite)	Controls the OIDC session cookies sameSite flag None, Strict, Dynamic.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	sessionTimeToLiveMin(Integer sessionTimeToLiveMin)	Allow to invalidate OIDC sessions before token TTL, keep for 1 minute to allow login sequence termination.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	subjectTokenMaxAgeSec(Integer subjectTokenMaxAgeSec)	Restrict Token Exchange subject_token age Default: 60
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	subjectTokenMaxUseCount(Integer subjectTokenMaxUseCount)	Maximum number a subject_token can be used Default: 1
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	subjectTokenNotBeforeToleranceSec(Integer subjectTokenNotBeforeToleranceSec)	subject_token tolerance NTP drift tolerance.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	subjectTokenNotOnOrAfterToleranceSec(Integer subjectTokenNotOnOrAfterToleranceSec)	subject_token timestamp clock/transfer tolerance.
OidcSecurityPolicies.OidcSecurityPoliciesBuilder	tokenTimeToLiveMin(Integer tokenTimeToLiveMin)	Token validity in minutes.
String	toString()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Method Details

requireProofKey

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder requireProofKey(Boolean requireProofKey)

Require Proof Key for Code Exchange (PKCE).
Default: true

Returns:

this.

requireAuthorizationConsent

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder requireAuthorizationConsent(Boolean requireAuthorizationConsent)

Require authorization consent (currently unsupported).
Default: false

Returns:

this.

requireOpaqueAccessToken

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder requireOpaqueAccessToken(Boolean requireOpaqueAccessToken)

Allow to enable Opaque AccessToken for Rp.
Default: false

Returns:

this.

Since:

1.11.0

allowFormBearerToken

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder allowFormBearerToken(Boolean allowFormBearerToken)

Allow access_token in form body
Default: false

Returns:

this.

Since:

1.14.0

requireIdTokenEncryption

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder requireIdTokenEncryption(Boolean requireIdTokenEncryption)

Allow to enable Encrypted IdToken JWT Singing for Rp.
Default: false

Returns:

this.

Since:

1.11.0

requireOpaqueRefreshToken

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder requireOpaqueRefreshToken(Boolean requireOpaqueRefreshToken)

Allow to enable Opaque RefreshToken for Rp.
Default: false

Returns:

this.

Since:

1.11.0

requireUserInfoResponseEncryption

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder requireUserInfoResponseEncryption(Boolean requireUserInfoResponseEncryption)

Allow to enable Encrypted UserInfo response
Default: false

Returns:

this.

Since:

1.11.0

encryptionAlgorithm

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder encryptionAlgorithm(String encryptionAlgorithm)

Encryption algorithm
Default: RSA-OAEP-256

Returns:

this.

Since:

1.11.0

encryptionMethod

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder encryptionMethod(String encryptionMethod)

Encryption method
Default: A256GCM

Returns:

this.

Since:

1.11.0

encryptionKid

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder encryptionKid(String encryptionKid)

Encryption keyID

Returns:

this.

Since:

1.11.0

tokenTimeToLiveMin

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder tokenTimeToLiveMin(Integer tokenTimeToLiveMin)

Token validity in minutes.

Returns:

this.

accessTokenTimeToLiveMin

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder accessTokenTimeToLiveMin(Integer accessTokenTimeToLiveMin)

Overrides tokenTimeToLiveMin for the access token.

Returns:

this.

idTokenTimeToLiveMin

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder idTokenTimeToLiveMin(Integer idTokenTimeToLiveMin)

Overrides tokenTimeToLiveMin for the ID token.

Returns:

this.

refreshTokenTimeToLiveMin

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder refreshTokenTimeToLiveMin(Integer refreshTokenTimeToLiveMin)

Overrides tokenTimeToLiveMin for the refresh token.

Returns:

this.

authorizationCodeTimeToLiveMin

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder authorizationCodeTimeToLiveMin(Integer authorizationCodeTimeToLiveMin)

Overrides tokenTimeToLiveMin for the authorization code.

Returns:

this.

sessionTimeToLiveMin

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder sessionTimeToLiveMin(Integer sessionTimeToLiveMin)

Allow to invalidate OIDC sessions before token TTL, keep for 1 minute to allow login sequence termination.
Default: 1

Returns:

this.

reuseRefreshTokens

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder reuseRefreshTokens(Boolean reuseRefreshTokens)

Reuse refresh tokens.
Default: false

Returns:

this.

idTokenSignature

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder idTokenSignature(String idTokenSignature)

ID token signature algorithm (many adapters only support RS256)

Returns:

this.

sessionCookieSameSite

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder sessionCookieSameSite(String sessionCookieSameSite)

Controls the OIDC session cookies sameSite flag None, Strict, Dynamic. Dynamic: Choose None or Strict based on whether the involved URLs are same site or not. (A value of Lax while valid has no benefits over Strict and is too restrictive for cross-domain use.)
Default: Dynamic

Returns:

this.

allowPublicClientTokenExchange

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder allowPublicClientTokenExchange(Boolean allowPublicClientTokenExchange)

Allow Token Exchange with Public Client
Default: false

Returns:

this.

Since:

1.14.0

subjectTokenMaxAgeSec

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder subjectTokenMaxAgeSec(Integer subjectTokenMaxAgeSec)

Restrict Token Exchange subject_token age
Default: 60

Returns:

this.

Since:

1.14.0

subjectTokenMaxUseCount

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder subjectTokenMaxUseCount(Integer subjectTokenMaxUseCount)

Maximum number a subject_token can be used
Default: 1

Returns:

this.

Since:

1.14.0

subjectTokenNotOnOrAfterToleranceSec

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder subjectTokenNotOnOrAfterToleranceSec(Integer subjectTokenNotOnOrAfterToleranceSec)

subject_token timestamp clock/transfer tolerance.

Returns:

this.

Since:

1.14.0

subjectTokenNotBeforeToleranceSec

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder subjectTokenNotBeforeToleranceSec(Integer subjectTokenNotBeforeToleranceSec)

subject_token tolerance NTP drift tolerance.

Returns:

this.

Since:

1.14.0

clientAssertionMaxAgeSec

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder clientAssertionMaxAgeSec(Integer clientAssertionMaxAgeSec)

Restrict client_assertion age
Default: 60

Returns:

this.

Since:

1.14.0

clientAssertionExpirationLifeTimeSec

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder clientAssertionExpirationLifeTimeSec(Integer clientAssertionExpirationLifeTimeSec)

Restrict client_assertion expiration maxLifeTime
Default: 3600 (1h)

Returns:

this.

Since:

1.14.0

clientAssertionNotOnOrAfterToleranceSec

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder clientAssertionNotOnOrAfterToleranceSec(Integer clientAssertionNotOnOrAfterToleranceSec)

client_assertion timestamp clock/transfer tolerance.

Returns:

this.

Since:

1.14.0

clientAssertionNotBeforeToleranceSec

public OidcSecurityPolicies.OidcSecurityPoliciesBuilder clientAssertionNotBeforeToleranceSec(Integer clientAssertionNotBeforeToleranceSec)

client_assertion tolerance NTP drift tolerance.

Returns:

this.

Since:

1.14.0

build

public OidcSecurityPolicies build()

toString

public String toString()

Overrides:

toString in class Object