OidcProvider (security.providers.oidc) Configuration

OidcProvider (security.providers.oidc) Configuration

Open ID Connect security provider

Type: io.helidon.security.providers.oidc.OidcProvider

Config key

oidc

Copied

This type provides the following service implementations:

io.helidon.security.spi.AuthenticationProvider
io.helidon.security.spi.SecurityProvider

Configuration options

Optional configuration options

key	type	default value	description
`audience`	string		Audience of issued tokens.
`authorization-endpoint-uri`	URI		URI of an authorization endpoint used to redirect users to for logging-in. If not defined, it is obtained from #oidcMetadata(Resource), if that is not defined an attempt is made to use #identityUri(URI)/oauth2/v1/authorize.
`base-scopes`	string	`openid`	Configure base scopes. By default this is `DEFAULT_BASE_SCOPES`. If scope has a qualifier, it must be used here.
`client-id`	string		Client ID as generated by OIDC server.
`client-secret`	string		Client secret as generated by OIDC server. Used to authenticate this application with the server when requesting JWT based on a code.
`client-timeout-millis`	Duration	`30000`	Timeout of calls using web client.
`cookie-domain`	string		Domain the cookie is valid for. Not used by default.
`cookie-encryption-enabled`	boolean	`true`	Whether to encrypt token and tenant cookies created by this microservice. Defaults to `true`.
`cookie-http-only`	boolean	`true`	When using cookie, if set to true, the HttpOnly attribute will be configured. Defaults to `OidcCookieHandler.Builder#DEFAULT_HTTP_ONLY`.
`cookie-max-age-seconds`	long		When using cookie, used to set MaxAge attribute of the cookie, defining how long the cookie is valid. Not used by default.
`cookie-name`	string	`JSESSIONID`	Name of the cookie to use. Defaults to `DEFAULT_COOKIE_NAME`.
`cookie-path`	string	`/`	Path the cookie is valid for. Defaults to "/".
`cookie-same-site`	SameSite (LAX, STRICT, NONE)	`LAX`	When using cookie, used to set the SameSite cookie value. Can be "Strict" or "Lax".
`cookie-secure`	boolean	`false`	When using cookie, if set to true, the Secure attribute will be configured. Defaults to false.
`cookie-use`	boolean	`true`	Whether to use cookie to store JWT between requests. Defaults to `DEFAULT_COOKIE_USE`.
`cors`	CrossOriginConfig		Assign cross-origin resource sharing settings.
`fallback-to-default-tenant-enabled`	boolean	`false`	Whether unknown tenant ids should use default tenant configuration. When `false`, unknown tenant ids are rejected instead of silently using the default tenant. Set to `true` to restore the previous fallback behavior.
`force-https-redirects`	boolean	`false`	Force HTTPS for redirects to identity provider. Defaults to `false`.
`frontend-uri`	string		Full URI of this application that is visible from user browser. Used to redirect request back from identity server after successful login.
`header-token`	TokenHandler		A TokenHandler to process header containing a JWT. Default is "Authorization" header with a prefix "bearer ".
`header-use`	boolean	`true`	Whether to expect JWT in a header field.
`identity-uri`	URI		URI of the identity server, base used to retrieve OIDC metadata.
`introspect-endpoint-uri`	URI		Endpoint to use to validate JWT. Either use this or set #signJwk(JwkKeys) or #signJwk(Resource).
`issuer`	string		Issuer of issued tokens.
`legacy-cookie-encryption`	boolean	`false`	Whether password-based encrypted OIDC cookies should be written without a version byte and with the legacy PBKDF2 iteration count. This can be enabled during rolling upgrades so upgraded nodes continue creating cookies that older nodes can decrypt. Leave disabled for steady-state deployments and reset to `false` after all nodes run the new version. This setting does not affect named Security encryption configured with `cookie-encryption-name`.
`legacy-cookie-fallback`	boolean	`false`	Whether password-based encrypted OIDC cookies should retry decryption with the alternate cookie format after primary decryption fails. This can be enabled after a rolling upgrade to accept older unversioned legacy cookies until they expire, or while legacy writes must read versioned current cookies. Leave disabled for steady-state deployments and reset to `false` after legacy cookies expire. This setting does not affect named Security encryption configured with `cookie-encryption-name`.
`legacy-query-param-handoff`	boolean	`false`	Whether to use the legacy raw access token query parameter handoff after OIDC callback. This can be enabled during rolling updates so upgraded nodes continue creating query parameter handoff values that older nodes can process. Leave disabled for steady-state deployments and reset to `false` after all nodes run the updated version.
`legacy-state-fallback`	boolean	`false`	Whether to accept the legacy raw local redirect URI from the OIDC `state` parameter. This can be enabled during rolling updates to accept raw state values generated by older nodes until in-flight login redirects expire. The raw value is still validated as a local redirect URI before use, but is not authenticated or time-bound. Leave disabled for steady-state deployments and reset to `false` after legacy redirects expire.
`legacy-state-param`	boolean	`false`	Whether to use the legacy raw local redirect URI as the OIDC `state` parameter. This can be enabled during rolling updates so upgraded nodes continue creating state values that older nodes can process. When enabled, callbacks also accept raw state values that pass local redirect validation; raw state is not authenticated or time-bound. Leave disabled for steady-state deployments and reset to `false` after all nodes run the updated version.
`max-redirects`	int	`5`	Configure maximal number of redirects when redirecting to an OIDC provider within a single authentication attempt. Defaults to `DEFAULT_MAX_REDIRECTS`
`oidc-metadata-well-known`	boolean	`true`	If set to true, metadata will be loaded from default (well known) location, unless it is explicitly defined using oidc-metadata-resource. If set to false, it would not be loaded even if oidc-metadata-resource is not defined. In such a case all URIs must be explicitly defined (e.g. token-endpoint-uri).
`oidc-metadata.resource`	Resource		Resource configuration for OIDC Metadata containing endpoints to various identity services, as well as information about the identity server.
`optional`	boolean	`false`	Whether authentication is required. By default, request will fail if the authentication cannot be verified. If set to true, request will process and this provider will abstain.
`outbound`	OutboundTarget[]		Add a new target configuration.
`propagate`	boolean	`false`	Whether to propagate identity.
`proxy-host`	string		Proxy host to use. When defined, triggers usage of proxy for HTTP requests. Setting to empty String has the same meaning as setting to null - disables proxy.
`proxy-port`	int	`80`	Proxy port. Defaults to `DEFAULT_PROXY_PORT`
`proxy-protocol`	string	`http`	Proxy protocol to use when proxy is used. Defaults to `DEFAULT_PROXY_PROTOCOL`.
`query-param-name`	string	`accessToken`	Name of a query parameter that contains the JWT token or encrypted handoff when parameter is used.
`query-param-use`	boolean	`false`	Whether to use a query parameter to receive a JWT token or encrypted handoff from application to this server. OIDC callback redirects use an encrypted handoff unless `legacy-query-param-handoff` is enabled.
`redirect`	boolean	`false`	By default the client should redirect to the identity server for the user to log in. This behavior can be overridden by setting redirect to false. When token is not present in the request, the client will not redirect and just return appropriate error response code.
`redirect-attempt-param`	string	`h_ra`	Configure the parameter used to store the number of attempts in redirect. Defaults to `DEFAULT_ATTEMPT_PARAM`
`redirect-uri`	string	`/oidc/redirect`	URI to register web server component on, used by the OIDC server to redirect authorization requests to after a user logs in or approves scopes. Note that usually the redirect URI configured here must be the same one as configured on OIDC server. Defaults to `DEFAULT_REDIRECT_URI`
`relative-uris`	boolean	`false`	Can be set to `true` to force the use of relative URIs in all requests, regardless of the presence or absence of proxies or no-proxy lists. By default, requests that use the Proxy will have absolute URIs. Set this flag to `true` if the host is unable to accept absolute URIs. Defaults to `DEFAULT_RELATIVE_URIS`.
`scope-audience`	string		Audience of the scope required by this application. This is prefixed to the scope name when requesting scopes from the identity server. Defaults to empty string.
`server-type`	string	`@default`	Configure one of the supported types of identity servers. If the type does not have an explicit mapping, a warning is logged and the default implementation is used.
`sign-jwk.resource`	Resource		A resource pointing to JWK with public keys of signing certificates used to validate JWT.
`token-endpoint-auth`	ClientAuthentication (CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, CLIENT_SECRET_JWT, PRIVATE_KEY_JWT, NONE)	`CLIENT_SECRET_BASIC`	Type of authentication to use when invoking the token endpoint. With CLIENT_SECRET_BASIC, credentials are sent only to POST requests on the resolved token endpoint scheme, host, port, path, and query and, when JWT introspection is used, to POST requests on the resolved introspection endpoint scheme, host, port, path, and query. Current supported options: io.helidon.security.providers.oidc.common.OidcConfig.ClientAuthentication#CLIENT_SECRET_BASIC io.helidon.security.providers.oidc.common.OidcConfig.ClientAuthentication#CLIENT_SECRET_POST io.helidon.security.providers.oidc.common.OidcConfig.ClientAuthentication#NONE
`token-endpoint-uri`	URI		URI of a token endpoint used to obtain a JWT based on the authentication code. If not defined, it is obtained from #oidcMetadata(Resource), if that is not defined an attempt is made to use #identityUri(URI)/oauth2/v1/token.
`use-jwt-groups`	boolean	`true`	Claim `groups` from JWT will be used to automatically add groups to current subject (may be used with jakarta.annotation.security.RolesAllowed annotation).
`validate-jwt-with-jwk`	boolean	`true`	Use JWK (a set of keys to validate signatures of JWT) to validate tokens. Use this method when you want to use default values for JWK or introspection endpoint URI.