Package swiss.trustbroker.federation.xmlconfig

Class OidcSecurityPolicies

java.lang.Object
swiss.trustbroker.federation.xmlconfig.OidcSecurityPolicies
All Implemented Interfaces:
Serializable
public class OidcSecurityPolicies extends Object implements Serializable
Security policy overrides for OIDC.
See Also:

  • Constructor Details

    • OidcSecurityPolicies

      public OidcSecurityPolicies()

    • OidcSecurityPolicies

      public OidcSecurityPolicies(Boolean requireProofKey, Boolean requireAuthorizationConsent, Boolean requireOpaqueAccessToken, Boolean allowFormBearerToken, Boolean requireIdTokenEncryption, Boolean requireOpaqueRefreshToken, Boolean requireUserInfoResponseEncryption, String encryptionAlgorithm, String encryptionMethod, String encryptionKid, Integer tokenTimeToLiveMin, Integer accessTokenTimeToLiveMin, Integer idTokenTimeToLiveMin, Integer refreshTokenTimeToLiveMin, Integer authorizationCodeTimeToLiveMin, Integer sessionTimeToLiveMin, Boolean reuseRefreshTokens, String idTokenSignature, String sessionCookieSameSite, Boolean allowPublicClientTokenExchange, Integer subjectTokenMaxAgeSec, Integer subjectTokenMaxUseCount, Integer subjectTokenNotOnOrAfterToleranceSec, Integer subjectTokenNotBeforeToleranceSec, Integer clientAssertionMaxAgeSec, Integer clientAssertionExpirationLifeTimeSec, Integer clientAssertionNotOnOrAfterToleranceSec, Integer clientAssertionNotBeforeToleranceSec)
      Creates a new OidcSecurityPolicies instance.
      Parameters:
      requireProofKey - Require Proof Key for Code Exchange (PKCE).
      Default: true
      requireAuthorizationConsent - Require authorization consent (currently unsupported).
      Default: false
      requireOpaqueAccessToken - Allow to enable Opaque AccessToken for Rp.
      Default: false
      allowFormBearerToken - Allow access_token in form body
      Default: false
      requireIdTokenEncryption - Allow to enable Encrypted IdToken JWT Singing for Rp.
      Default: false
      requireOpaqueRefreshToken - Allow to enable Opaque RefreshToken for Rp.
      Default: false
      requireUserInfoResponseEncryption - Allow to enable Encrypted UserInfo response
      Default: false
      encryptionAlgorithm - Encryption algorithm
      Default: RSA-OAEP-256
      encryptionMethod - Encryption method
      Default: A256GCM
      encryptionKid - Encryption keyID
      tokenTimeToLiveMin - Token validity in minutes.
      accessTokenTimeToLiveMin - Overrides tokenTimeToLiveMin for the access token.
      idTokenTimeToLiveMin - Overrides tokenTimeToLiveMin for the ID token.
      refreshTokenTimeToLiveMin - Overrides tokenTimeToLiveMin for the refresh token.
      authorizationCodeTimeToLiveMin - Overrides tokenTimeToLiveMin for the authorization code.
      sessionTimeToLiveMin - Allow to invalidate OIDC sessions before token TTL, keep for 1 minute to allow login sequence termination.
      Default: 1
      reuseRefreshTokens - Reuse refresh tokens.
      Default: false
      idTokenSignature - ID token signature algorithm (many adapters only support RS256)
      sessionCookieSameSite - Controls the OIDC session cookies sameSite flag None, Strict, Dynamic. Dynamic: Choose None or Strict based on whether the involved URLs are same site or not. (A value of Lax while valid has no benefits over Strict and is too restrictive for cross-domain use.)
      Default: Dynamic
      allowPublicClientTokenExchange - Allow Token Exchange with Public Client
      Default: false
      subjectTokenMaxAgeSec - Restrict Token Exchange subject_token age
      Default: 60
      subjectTokenMaxUseCount - Maximum number a subject_token can be used
      Default: 1
      subjectTokenNotOnOrAfterToleranceSec - subject_token timestamp clock/transfer tolerance.
      subjectTokenNotBeforeToleranceSec - subject_token tolerance NTP drift tolerance.
      clientAssertionMaxAgeSec - Restrict client_assertion age
      Default: 60
      clientAssertionExpirationLifeTimeSec - Restrict client_assertion expiration maxLifeTime
      Default: 3600 (1h)
      clientAssertionNotOnOrAfterToleranceSec - client_assertion timestamp clock/transfer tolerance.
      clientAssertionNotBeforeToleranceSec - client_assertion tolerance NTP drift tolerance.
      Since:
      1.11.0, 1.14.0, 1.11.0, 1.11.0, 1.11.0, 1.11.0, 1.11.0, 1.11.0, 1.14.0, 1.14.0, 1.14.0, 1.14.0, 1.14.0, 1.14.0, 1.14.0, 1.14.0, 1.14.0

  • Method Details

    • getAccessTokenTimeToLiveMin

      public Integer getAccessTokenTimeToLiveMin()

    • getIdTokenTimeToLiveMin

      public Integer getIdTokenTimeToLiveMin()

    • builder

      public static OidcSecurityPolicies.OidcSecurityPoliciesBuilder builder()

    • getRequireProofKey

      public Boolean getRequireProofKey()
      Require Proof Key for Code Exchange (PKCE).
      Default: true

    • getRequireAuthorizationConsent

      public Boolean getRequireAuthorizationConsent()
      Require authorization consent (currently unsupported).
      Default: false

    • getRequireOpaqueAccessToken

      public Boolean getRequireOpaqueAccessToken()
      Allow to enable Opaque AccessToken for Rp.
      Default: false
      Since:
      1.11.0

    • getAllowFormBearerToken

      public Boolean getAllowFormBearerToken()
      Allow access_token in form body
      Default: false
      Since:
      1.14.0

    • getRequireIdTokenEncryption

      public Boolean getRequireIdTokenEncryption()
      Allow to enable Encrypted IdToken JWT Singing for Rp.
      Default: false
      Since:
      1.11.0

    • getRequireOpaqueRefreshToken

      public Boolean getRequireOpaqueRefreshToken()
      Allow to enable Opaque RefreshToken for Rp.
      Default: false
      Since:
      1.11.0

    • getRequireUserInfoResponseEncryption

      public Boolean getRequireUserInfoResponseEncryption()
      Allow to enable Encrypted UserInfo response
      Default: false
      Since:
      1.11.0

    • getEncryptionAlgorithm

      public String getEncryptionAlgorithm()
      Encryption algorithm
      Default: RSA-OAEP-256
      Since:
      1.11.0

    • getEncryptionMethod

      public String getEncryptionMethod()
      Encryption method
      Default: A256GCM
      Since:
      1.11.0

    • getEncryptionKid

      public String getEncryptionKid()
      Encryption keyID
      Since:
      1.11.0

    • getTokenTimeToLiveMin

      public Integer getTokenTimeToLiveMin()
      Token validity in minutes.

    • getRefreshTokenTimeToLiveMin

      public Integer getRefreshTokenTimeToLiveMin()
      Overrides tokenTimeToLiveMin for the refresh token.

    • getAuthorizationCodeTimeToLiveMin

      public Integer getAuthorizationCodeTimeToLiveMin()
      Overrides tokenTimeToLiveMin for the authorization code.

    • getSessionTimeToLiveMin

      public Integer getSessionTimeToLiveMin()
      Allow to invalidate OIDC sessions before token TTL, keep for 1 minute to allow login sequence termination.
      Default: 1

    • getReuseRefreshTokens

      public Boolean getReuseRefreshTokens()
      Reuse refresh tokens.
      Default: false

    • getIdTokenSignature

      public String getIdTokenSignature()
      ID token signature algorithm (many adapters only support RS256)

    • getSessionCookieSameSite

      public String getSessionCookieSameSite()
      Controls the OIDC session cookies sameSite flag None, Strict, Dynamic. Dynamic: Choose None or Strict based on whether the involved URLs are same site or not. (A value of Lax while valid has no benefits over Strict and is too restrictive for cross-domain use.)
      Default: Dynamic

    • getAllowPublicClientTokenExchange

      public Boolean getAllowPublicClientTokenExchange()
      Allow Token Exchange with Public Client
      Default: false
      Since:
      1.14.0

    • getSubjectTokenMaxAgeSec

      public Integer getSubjectTokenMaxAgeSec()
      Restrict Token Exchange subject_token age
      Default: 60
      Since:
      1.14.0

    • getSubjectTokenMaxUseCount

      public Integer getSubjectTokenMaxUseCount()
      Maximum number a subject_token can be used
      Default: 1
      Since:
      1.14.0

    • getSubjectTokenNotOnOrAfterToleranceSec

      public Integer getSubjectTokenNotOnOrAfterToleranceSec()
      subject_token timestamp clock/transfer tolerance.
      Since:
      1.14.0

    • getSubjectTokenNotBeforeToleranceSec

      public Integer getSubjectTokenNotBeforeToleranceSec()
      subject_token tolerance NTP drift tolerance.
      Since:
      1.14.0

    • getClientAssertionMaxAgeSec

      public Integer getClientAssertionMaxAgeSec()
      Restrict client_assertion age
      Default: 60
      Since:
      1.14.0

    • getClientAssertionExpirationLifeTimeSec

      public Integer getClientAssertionExpirationLifeTimeSec()
      Restrict client_assertion expiration maxLifeTime
      Default: 3600 (1h)
      Since:
      1.14.0

    • getClientAssertionNotOnOrAfterToleranceSec

      public Integer getClientAssertionNotOnOrAfterToleranceSec()
      client_assertion timestamp clock/transfer tolerance.
      Since:
      1.14.0

    • getClientAssertionNotBeforeToleranceSec

      public Integer getClientAssertionNotBeforeToleranceSec()
      client_assertion tolerance NTP drift tolerance.
      Since:
      1.14.0

    • setRequireProofKey

      public void setRequireProofKey(Boolean requireProofKey)
      Require Proof Key for Code Exchange (PKCE).
      Default: true

    • setRequireAuthorizationConsent

      public void setRequireAuthorizationConsent(Boolean requireAuthorizationConsent)
      Require authorization consent (currently unsupported).
      Default: false

    • setRequireOpaqueAccessToken

      public void setRequireOpaqueAccessToken(Boolean requireOpaqueAccessToken)
      Allow to enable Opaque AccessToken for Rp.
      Default: false
      Since:
      1.11.0

    • setAllowFormBearerToken

      public void setAllowFormBearerToken(Boolean allowFormBearerToken)
      Allow access_token in form body
      Default: false
      Since:
      1.14.0

    • setRequireIdTokenEncryption

      public void setRequireIdTokenEncryption(Boolean requireIdTokenEncryption)
      Allow to enable Encrypted IdToken JWT Singing for Rp.
      Default: false
      Since:
      1.11.0

    • setRequireOpaqueRefreshToken

      public void setRequireOpaqueRefreshToken(Boolean requireOpaqueRefreshToken)
      Allow to enable Opaque RefreshToken for Rp.
      Default: false
      Since:
      1.11.0

    • setRequireUserInfoResponseEncryption

      public void setRequireUserInfoResponseEncryption(Boolean requireUserInfoResponseEncryption)
      Allow to enable Encrypted UserInfo response
      Default: false
      Since:
      1.11.0

    • setEncryptionAlgorithm

      public void setEncryptionAlgorithm(String encryptionAlgorithm)
      Encryption algorithm
      Default: RSA-OAEP-256
      Since:
      1.11.0

    • setEncryptionMethod

      public void setEncryptionMethod(String encryptionMethod)
      Encryption method
      Default: A256GCM
      Since:
      1.11.0

    • setEncryptionKid

      public void setEncryptionKid(String encryptionKid)
      Encryption keyID
      Since:
      1.11.0

    • setTokenTimeToLiveMin

      public void setTokenTimeToLiveMin(Integer tokenTimeToLiveMin)
      Token validity in minutes.

    • setAccessTokenTimeToLiveMin

      public void setAccessTokenTimeToLiveMin(Integer accessTokenTimeToLiveMin)
      Overrides tokenTimeToLiveMin for the access token.

    • setIdTokenTimeToLiveMin

      public void setIdTokenTimeToLiveMin(Integer idTokenTimeToLiveMin)
      Overrides tokenTimeToLiveMin for the ID token.

    • setRefreshTokenTimeToLiveMin

      public void setRefreshTokenTimeToLiveMin(Integer refreshTokenTimeToLiveMin)
      Overrides tokenTimeToLiveMin for the refresh token.

    • setAuthorizationCodeTimeToLiveMin

      public void setAuthorizationCodeTimeToLiveMin(Integer authorizationCodeTimeToLiveMin)
      Overrides tokenTimeToLiveMin for the authorization code.

    • setSessionTimeToLiveMin

      public void setSessionTimeToLiveMin(Integer sessionTimeToLiveMin)
      Allow to invalidate OIDC sessions before token TTL, keep for 1 minute to allow login sequence termination.
      Default: 1

    • setReuseRefreshTokens

      public void setReuseRefreshTokens(Boolean reuseRefreshTokens)
      Reuse refresh tokens.
      Default: false

    • setIdTokenSignature

      public void setIdTokenSignature(String idTokenSignature)
      ID token signature algorithm (many adapters only support RS256)

    • setSessionCookieSameSite

      public void setSessionCookieSameSite(String sessionCookieSameSite)
      Controls the OIDC session cookies sameSite flag None, Strict, Dynamic. Dynamic: Choose None or Strict based on whether the involved URLs are same site or not. (A value of Lax while valid has no benefits over Strict and is too restrictive for cross-domain use.)
      Default: Dynamic

    • setAllowPublicClientTokenExchange

      public void setAllowPublicClientTokenExchange(Boolean allowPublicClientTokenExchange)
      Allow Token Exchange with Public Client
      Default: false
      Since:
      1.14.0

    • setSubjectTokenMaxAgeSec

      public void setSubjectTokenMaxAgeSec(Integer subjectTokenMaxAgeSec)
      Restrict Token Exchange subject_token age
      Default: 60
      Since:
      1.14.0

    • setSubjectTokenMaxUseCount

      public void setSubjectTokenMaxUseCount(Integer subjectTokenMaxUseCount)
      Maximum number a subject_token can be used
      Default: 1
      Since:
      1.14.0

    • setSubjectTokenNotOnOrAfterToleranceSec

      public void setSubjectTokenNotOnOrAfterToleranceSec(Integer subjectTokenNotOnOrAfterToleranceSec)
      subject_token timestamp clock/transfer tolerance.
      Since:
      1.14.0

    • setSubjectTokenNotBeforeToleranceSec

      public void setSubjectTokenNotBeforeToleranceSec(Integer subjectTokenNotBeforeToleranceSec)
      subject_token tolerance NTP drift tolerance.
      Since:
      1.14.0

    • setClientAssertionMaxAgeSec

      public void setClientAssertionMaxAgeSec(Integer clientAssertionMaxAgeSec)
      Restrict client_assertion age
      Default: 60
      Since:
      1.14.0

    • setClientAssertionExpirationLifeTimeSec

      public void setClientAssertionExpirationLifeTimeSec(Integer clientAssertionExpirationLifeTimeSec)
      Restrict client_assertion expiration maxLifeTime
      Default: 3600 (1h)
      Since:
      1.14.0

    • setClientAssertionNotOnOrAfterToleranceSec

      public void setClientAssertionNotOnOrAfterToleranceSec(Integer clientAssertionNotOnOrAfterToleranceSec)
      client_assertion timestamp clock/transfer tolerance.
      Since:
      1.14.0

    • setClientAssertionNotBeforeToleranceSec

      public void setClientAssertionNotBeforeToleranceSec(Integer clientAssertionNotBeforeToleranceSec)
      client_assertion tolerance NTP drift tolerance.
      Since:
      1.14.0

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • canEqual

      protected boolean canEqual(Object other)

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object