io.helidon.security.providers.oidc.common.OidcConfig

Description

Open ID Connect configuration

Configuration options

Key	Type	Default	Description
`access-token-ip-check`	`Boolean`	`true`	Whether to check if current IP address matches the one access token was issued for
`audience`	`String`		Audience of issued tokens
`authorization-endpoint-uri`	`URI`		URI of an authorization endpoint used to redirect users to for logging-in
`base-scopes`	`String`	`openid`	Configure base scopes
`check-audience`	`Boolean`	`true`	Configure audience claim check
`client-credentials-config`	`ClientCredentialsConfig`		Set the configuration related to the client credentials flow
`client-id`	`String`		Client ID as generated by OIDC server
`client-secret`	`String`		Client secret as generated by OIDC server
`client-timeout-millis`	`Duration`	`30000`	Timeout of calls using web client
`cookie-compression-enabled`	`Boolean`	`true if server-type is idcs; false otherwise`	Whether to GZIP-compress the access token cookie when this reduces its size, unless password-based legacy cookie encryption is enabled
`cookie-compression-id-enabled`	`Boolean`	`true if server-type is idcs; false otherwise`	Whether to GZIP-compress the ID token cookie when this reduces its size, unless password-based legacy cookie encryption is enabled
`cookie-domain`	`String`		Domain the cookie is valid for
`cookie-encryption-enabled`	`Boolean`	`true`	Whether to encrypt token cookie created by this microservice
`cookie-encryption-id-enabled`	`Boolean`	`true`	Whether to encrypt id token cookie created by this microservice
`cookie-encryption-name`	`String`		Name of the encryption configuration available through `Security#encrypt(String, byte[])` and `Security#decrypt(String, String)`
`cookie-encryption-password`	`List<String>`		Master password for encryption/decryption of cookies
`cookie-encryption-refresh-enabled`	`Boolean`	`true`	Whether to encrypt refresh token cookie created by this microservice
`cookie-encryption-state-enabled`	`Boolean`	`true`	Whether to encrypt state cookie created by this microservice
`cookie-encryption-tenant-enabled`	`Boolean`	`true`	Whether to encrypt tenant name cookie created by this microservice
`cookie-http-only`	`Boolean`	`true`	When using cookie, if set to true, the HttpOnly attribute will be configured
`cookie-max-age-seconds`	`Long`		When using cookie, used to set MaxAge attribute of the cookie, defining how long the cookie is valid
`cookie-name`	`String`	`JSESSIONID`	Name of the cookie to use
`cookie-name-id-token`	`String`	`JSESSIONID_2`	Name of the cookie to use for id token
`cookie-name-refresh-token`	`String`	`JSESSIONID_3`	The name of the cookie to use for the refresh token
`cookie-name-state`	`String`	`JSESSIONID_3`	The name of the cookie to use for the state storage
`cookie-name-tenant`	`String`	`HELIDON_TENANT`	The name of the cookie to use for the tenant name
`cookie-path`	`String`	`/`	Path the cookie is valid for
`cookie-same-site`	`SameSite`	`LAX`	When using cookie, used to set the SameSite cookie value
`cookie-secure`	`Boolean`	`false`	When using cookie, if set to true, the Secure attribute will be configured
`cookie-use`	`Boolean`	`true`	Whether to use cookie to store JWT between requests
`decryption-keys`			Configuration for decryption-keys
`fallback-to-default-tenant-enabled`	`Boolean`	`false`	Whether unknown tenant ids should use default tenant configuration
`force-https-redirects`	`Boolean`	`false`	Force HTTPS for redirects to identity provider
`frontend-uri`	`String`		Full URI of this application that is visible from user browser
`header-token`	`TokenHandler`		A `TokenHandler` to process header containing a JWT
`header-use`	`Boolean`	`true`	Whether to expect JWT in a header field
`id-token-signature-validation`	`Boolean`	`true`	Whether id token signature check should be enabled
`identity-uri`	`URI`		URI of the identity server, base used to retrieve OIDC metadata
`introspect-endpoint-uri`	`URI`		Endpoint to use to validate JWT
`issuer`	`String`		Issuer of issued tokens
`jwk-loader`			Configuration for jwk-loader
`legacy-cookie-encryption`	`Boolean`	`false`	Whether password-based encrypted OIDC cookies should be written without a version byte and with the legacy PBKDF2 iteration count
`legacy-cookie-fallback`	`Boolean`	`false`	Whether password-based encrypted OIDC cookies should retry decryption with the alternate cookie format after primary decryption fails
`max-redirects`	`Integer`	`5`	Configure maximal number of redirects when redirecting to an OIDC provider within a single authentication attempt
`oidc-metadata`			Configuration for oidc-metadata
`oidc-metadata-well-known`	`Boolean`	`true`	If set to true, metadata will be loaded from default (well known) location, unless it is explicitly defined using oidc-metadata-resource
`optional-audience`	`Boolean`	`false`	Allow audience claim to be optional
`outbound-type`	`OidcOutboundType`	`USER_JWT`	Type of the OIDC outbound
`pkce-challenge-method`	`PkceChallengeMethod`	`S256`	Proof Key Code Exchange (PKCE) challenge creation method
`pkce-enabled`	`Boolean`	`false`	Whether this provider should support PKCE
`query-id-token-param-name`	`String`	`id_token`	Name of a query parameter that contains the JWT id token when parameter is used
`query-param-name`	`String`	`accessToken`	Name of a query parameter that contains the JWT access token when parameter is used
`query-param-tenant-name`	`String`	`h_tenant`	Name of a query parameter that contains the tenant name when the parameter is used
`query-param-use`	`Boolean`	`false`	Whether to use a query parameter to send JWT token from application to this server
`redirect`	`Boolean`	`false`	By default, the client should redirect to the identity server for the user to log in
`redirect-attempt-counter-strategy`	`RedirectAttemptCounterStrategy`	`PARAM`	Configure the strategy used to count redirects to an identity server
`redirect-attempt-param`	`String`	`h_ra`	Configure the redirect attempt query parameter and cookie name prefix
`redirect-uri`	`String`	`/oidc/redirect`	URI to register web server component on, used by the OIDC server to redirect authorization requests to after a user logs in or approves scopes
`scope-audience`	`String`		Audience of the scope required by this application
`server-type`	`String`	`@default`	Configure one of the supported types of identity servers
`sign-jwk`			Configuration for sign-jwk
`tenants`	`TenantConfig`		Configurations of the tenants
`token-endpoint-auth`	`ClientAuthentication`	`CLIENT_SECRET_BASIC`	Type of authentication to use when invoking the token endpoint. With CLIENT_SECRET_BASIC, credentials are sent only to POST requests on the resolved token endpoint scheme, host, and path and, when JWT introspection is used, to POST requests on the resolved introspection endpoint scheme, host, and path
`token-endpoint-uri`	`URI`		URI of a token endpoint used to obtain a JWT based on the authentication code
`token-signature-validation`	`Boolean`	`true`	Whether access token signature check should be enabled
`validate-jwt-with-jwk`	`Boolean`	`true`	Use JWK (a set of keys to validate signatures of JWT) to validate tokens
`webclient`	`WebClient`		WebClient configuration used for outbound requests to the identity server. This configuration sets the values to the OIDC WebClient default configuration

Dependent Types

io.helidon.security.providers.oidc.OidcProvider

Usages

See the manifest for all available types.

Edit this page or Report an issue