Class JwtProvider.Builder

java.lang.Object
io.helidon.security.providers.jwt.JwtProvider.Builder
All Implemented Interfaces:
Builder<JwtProvider.Builder, JwtProvider>, Supplier<JwtProvider>
Enclosing class:
JwtProvider
public static final class JwtProvider.Builder extends Object implements Builder<JwtProvider.Builder, JwtProvider>
Fluent API builder for JwtProvider.

  • Method Details

    • build

      public JwtProvider build()
      Description copied from interface: Builder
      Build the instance from this builder.
      Specified by:
      build in interface Builder<JwtProvider.Builder, JwtProvider>
      Returns:
      instance of the built type

    • propagate

      public JwtProvider.Builder propagate(boolean propagate)
      Whether to propagate identity.
      Parameters:
      propagate - whether to propagate identity (true) or not (false)
      Returns:
      updated builder instance

    • authenticate

      public JwtProvider.Builder authenticate(boolean authenticate)
      Whether to authenticate requests.
      Parameters:
      authenticate - whether to authenticate (true) or not (false)
      Returns:
      updated builder instance

    • allowImpersonation

      public JwtProvider.Builder allowImpersonation(boolean allowImpersonation)
      Whether to allow impersonation by explicitly overriding username from outbound requests using EndpointConfig.PROPERTY_OUTBOUND_ID property. By default this is not allowed and identity can only be propagated.
      Parameters:
      allowImpersonation - set to true to allow impersonation
      Returns:
      updated builder instance

    • allowUnsigned

      public JwtProvider.Builder allowUnsigned(boolean allowUnsigned)
      Configure support for unsigned JWTs without requiring verification JWKs. If this is set to true any JWT that has algorithm set to none and no kid defined will be accepted. Such a token does not trigger loading of a configured verification JWK resource. Signed tokens continue to require matching verification keys. Note that this has serious security impact - if JWT can be sent from a third party, this allows the third party to send ANY JWT and it would be accepted as valid.
      Parameters:
      allowUnsigned - to allow unsigned (insecure) JWT
      Returns:
      updated builder instance

    • verifySignature

      public JwtProvider.Builder verifySignature(boolean shouldValidate)
      Configure whether to verify signatures. Signatures verification is enabled by default. You can configure the provider not to verify signatures.

      Make sure your service is properly secured on network level and only accessible from a secure endpoint that provides the JWTs when signature verification is disabled. If signature verification is disabled, configured claim validation still applies, but signatures are not checked.

      Parameters:
      shouldValidate - set to false to disable validation of JWT signatures
      Returns:
      updated builder instance

    • subjectType

      public JwtProvider.Builder subjectType(SubjectType subjectType)
      Principal type this provider extracts (and also propagates).
      Parameters:
      subjectType - type of principal
      Returns:
      updated builder instance

    • atnTokenHandler

      public JwtProvider.Builder atnTokenHandler(TokenHandler tokenHandler)
      Token handler to extract username from request.
      Parameters:
      tokenHandler - token handler instance
      Returns:
      updated builder instance

    • optional

      public JwtProvider.Builder optional(boolean optional)
      Whether authentication is required. By default, request will fail if the username cannot be extracted. If set to false, request will process and this provider will abstain.
      Parameters:
      optional - whether authentication is optional (true) or required (false)
      Returns:
      updated builder instance

    • outboundConfig

      public JwtProvider.Builder outboundConfig(OutboundConfig config)
      Configuration of outbound rules.
      Parameters:
      config - outbound configuration, each target may contain custom object JwtProvider.JwtOutboundTarget to add our configuration.
      Returns:
      updated builder instance

    • signJwk

      public JwtProvider.Builder signJwk(Resource signJwkResource)
      JWK resource used to sign JWTs created by us.
      Parameters:
      signJwkResource - resource pointing to a JSON with keys
      Returns:
      updated builder instance

    • verifyJwk

      public JwtProvider.Builder verifyJwk(Resource verifyJwkResource)
      JWK resource used to verify JWTs created by other parties.
      Parameters:
      verifyJwkResource - resource pointing to a JSON with keys
      Returns:
      updated builder instance

    • verifyJwk

      public JwtProvider.Builder verifyJwk(JwkKeys verifyKeys)
      Fixed JWK keys used to verify JWTs created by other parties.
      Parameters:
      verifyKeys - keys used to verify inbound JWTs
      Returns:
      updated builder instance

    • verifyJwk

      public JwtProvider.Builder verifyJwk(ResourceConfig verifyJwkResource)
      JWK resource configuration used to verify JWTs created by other parties. Filesystem paths and URIs are loaded lazily and protected by the configured retry and circuit breaker. Classpath and inline resources are loaded when the provider is built.
      Parameters:
      verifyJwkResource - configuration of the resource containing verification keys
      Returns:
      updated builder instance

    • jwkRetry

      public JwtProvider.Builder jwkRetry(Retry jwkRetry)
      Retry used when loading verification keys from a filesystem path or URI; by default, it wraps two timeout-guarded attempts within an 11-second overall timeout.
      Parameters:
      jwkRetry - retry to use
      Returns:
      updated builder instance

    • jwkRetry

      public JwtProvider.Builder jwkRetry(RetryConfig jwkRetry)
      Retry used when loading verification keys from a filesystem path or URI. The supplier is invoked only when a dynamic verification JWK source requires the retry.
      Parameters:
      jwkRetry - prototype of retry to use
      Returns:
      updated builder instance

    • jwkRetry

      public JwtProvider.Builder jwkRetry(Consumer<RetryConfig.Builder> consumer)
      Retry used when loading verification keys from a filesystem path or URI.
      Parameters:
      consumer - consumer of builder of retry to use
      Returns:
      updated builder instance

    • jwkRetry

      public JwtProvider.Builder jwkRetry(Supplier<? extends Retry> supplier)
      Retry used when loading verification keys from a filesystem path or URI.
      Parameters:
      supplier - supplier of retry to use
      Returns:
      updated builder instance

    • jwkTimeout

      public JwtProvider.Builder jwkTimeout(Timeout jwkTimeout)
      Timeout applied to each attempt to load verification keys from a filesystem path or URI; it defaults to 5 seconds, must be positive, must execute on the current thread, and must not exceed the retry overall timeout. Current-thread execution ensures that a retry cannot overlap an attempt that is still unwinding after an interrupt. The deadline interrupts the loader; prompt termination also depends on the underlying I/O honoring interruption or enforcing its own timeout.
      Parameters:
      jwkTimeout - timeout to use
      Returns:
      updated builder instance

    • jwkTimeout

      public JwtProvider.Builder jwkTimeout(TimeoutConfig jwkTimeout)
      Timeout applied to each attempt to load verification keys from a filesystem path or URI. The supplier is invoked only when a dynamic verification JWK source requires the timeout.
      Parameters:
      jwkTimeout - prototype of timeout to use
      Returns:
      updated builder instance

    • jwkTimeout

      public JwtProvider.Builder jwkTimeout(Consumer<TimeoutConfig.Builder> consumer)
      Timeout applied to each attempt to load verification keys from a filesystem path or URI.
      Parameters:
      consumer - consumer of builder of timeout to use
      Returns:
      updated builder instance

    • jwkTimeout

      public JwtProvider.Builder jwkTimeout(Supplier<? extends Timeout> supplier)
      Timeout applied to each attempt to load verification keys from a filesystem path or URI.
      Parameters:
      supplier - supplier of timeout to use
      Returns:
      updated builder instance

    • jwkCircuitBreaker

      public JwtProvider.Builder jwkCircuitBreaker(CircuitBreaker jwkCircuitBreaker)
      Circuit breaker around each complete retry batch used to load verification keys from a filesystem path or URI; by default, the circuit opens after one exhausted batch and permits a recovery probe after 5 seconds.
      Parameters:
      jwkCircuitBreaker - circuit breaker to use
      Returns:
      updated builder instance

    • jwkCircuitBreaker

      public JwtProvider.Builder jwkCircuitBreaker(CircuitBreakerConfig jwkCircuitBreaker)
      Circuit breaker used when loading verification keys from a filesystem path or URI. The supplier is invoked only when a dynamic verification JWK source requires the circuit breaker.
      Parameters:
      jwkCircuitBreaker - prototype of circuit breaker to use
      Returns:
      updated builder instance

    • jwkCircuitBreaker

      public JwtProvider.Builder jwkCircuitBreaker(Consumer<CircuitBreakerConfig.Builder> consumer)
      Circuit breaker used when loading verification keys from a filesystem path or URI.
      Parameters:
      consumer - consumer of builder of circuit breaker to use
      Returns:
      updated builder instance

    • jwkCircuitBreaker

      public JwtProvider.Builder jwkCircuitBreaker(Supplier<? extends CircuitBreaker> supplier)
      Circuit breaker used when loading verification keys from a filesystem path or URI.
      Parameters:
      supplier - supplier of circuit breaker to use
      Returns:
      updated builder instance

    • issuer

      public JwtProvider.Builder issuer(String issuer)
      Issuer used to create new JWTs.
      Parameters:
      issuer - issuer to add to the issuer claim
      Returns:
      updated builder instance

    • config

      public JwtProvider.Builder config(Config config)
      Load this builder from a configuration.
      Parameters:
      config - configuration to load from
      Returns:
      updated builder instance

    • expectedAudience

      public void expectedAudience(String audience)
      Audience expected in inbound JWTs.
      Parameters:
      audience - audience string

    • expectedIssuer

      public JwtProvider.Builder expectedIssuer(String issuer)
      Issuer expected in inbound JWTs.
      Parameters:
      issuer - issuer string
      Returns:
      updated builder instance

    • useJwtGroups

      public JwtProvider.Builder useJwtGroups(boolean useJwtGroups)
      Claim groups from JWT will be used to automatically add groups to current subject (may be used with RolesAllowed annotation).
      Parameters:
      useJwtGroups - whether to use groups claim from JWT to retrieve roles
      Returns:
      updated builder instance

    • jwtGroupsPath

      public JwtProvider.Builder jwtGroupsPath(String jwtGroupsPath)
      Path to the JWT payload claim containing the groups to add as role grants. The default path is groups. Nested object claims can be configured with slash-separated path segments, such as realm/groups.
      Parameters:
      jwtGroupsPath - JWT groups claim path
      Returns:
      updated builder instance

    • jwtGroupsSeparator

      public JwtProvider.Builder jwtGroupsSeparator(String jwtGroupsSeparator)
      Separator used to split a string claim value into multiple groups. This is used only when jwtGroupsPath(String) configures a custom path other than groups. The default groups claim keeps the standard JWT behavior. Setting this property without changing the JWT groups path has no effect.
      Parameters:
      jwtGroupsSeparator - separator for string-valued custom groups claim
      Returns:
      updated builder instance