io.helidon.security.providers.oidc.common.OidcConfig

Description

Open ID Connect configuration

Configuration options

Key	Type	Default	Description
`access-token-ip-check`	`Boolean`	`true`	Whether to check if current IP address matches the one access token was issued for
`audience`	`String`		Audience of issued tokens
`authorization-endpoint-uri`	`URI`		URI of an authorization endpoint used to redirect users to for logging-in
`base-scopes`	`String`	`openid`	Configure base scopes
`check-audience`	`Boolean`	`true`	Configure audience claim check
`client-credentials-config`	`ClientCredentialsConfig`		Set the configuration related to the client credentials flow
`client-id`	`String`		Client ID as generated by OIDC server
`client-secret`	`String`		Client secret as generated by OIDC server
`client-timeout-millis`	`Duration`	`30000`	Timeout of calls using web client
`cookie-compression-enabled`	`Boolean`	`true if server-type is idcs; false otherwise`	Whether to GZIP-compress the access token cookie when this reduces its size
`cookie-compression-id-enabled`	`Boolean`	`true if server-type is idcs; false otherwise`	Whether to GZIP-compress the ID token cookie when this reduces its size
`cookie-domain`	`String`		Domain the cookie is valid for
`cookie-encryption-enabled`	`Boolean`	`true`	Whether to encrypt token cookie created by this microservice
`cookie-encryption-id-enabled`	`Boolean`	`true`	Whether to encrypt id token cookie created by this microservice
`cookie-encryption-name`	`String`		Name of the encryption configuration available through Security encryption. If configured and encryption is enabled for any cookie, Security must be registered in the global or current context
`cookie-encryption-password`	`List<String>`		Master password for encryption/decryption of cookies. Configure the same value on each service that shares encrypted cookies. If encrypted cookies are enabled and neither this option nor cookie-encryption-name is configured, Helidon creates or reads .helidon-oidc-secret in the current working directory
`cookie-encryption-refresh-enabled`	`Boolean`	`true`	Whether to encrypt refresh token cookie created by this microservice
`cookie-encryption-state-enabled`	`Boolean`	`true`	Whether to encrypt state cookie created by this microservice
`cookie-encryption-tenant-enabled`	`Boolean`	`true`	Whether to encrypt tenant name cookie created by this microservice
`cookie-http-only`	`Boolean`	`true`	When using cookie, if set to true, the HttpOnly attribute will be configured
`cookie-max-age-seconds`	`Long`		When using cookie, used to set MaxAge attribute of the cookie, defining how long the cookie is valid
`cookie-name`	`String`	`JSESSIONID`	Name of the cookie to use
`cookie-name-id-token`	`String`	`JSESSIONID_2`	Name of the cookie to use for id token
`cookie-name-refresh-token`	`String`	`JSESSIONID_3`	The name of the cookie to use for the refresh token
`cookie-name-state`	`String`	`JSESSIONID_3`	The name of the cookie to use for the state storage
`cookie-name-tenant`	`String`	`HELIDON_TENANT`	The name of the cookie to use for the tenant name
`cookie-path`	`String`	`/`	Path the cookie is valid for
`cookie-same-site`	`SameSite`	`LAX`	When using cookie, used to set the SameSite cookie value
`cookie-secure`	`Boolean`	`false`	When using cookie, if set to true, the Secure attribute will be configured
`cookie-use`	`Boolean`	`true`	Whether to use cookie to store JWT between requests
`cors`	`CrossOriginConfig`		Assign cross-origin resource sharing settings
`decryption-keys`			Configuration for decryption-keys
`fallback-to-default-tenant-enabled`	`Boolean`	`false`	Whether unknown tenant ids should use default tenant configuration
`force-https-redirects`	`Boolean`	`false`	Force HTTPS for redirects to identity provider
`frontend-uri`	`String`		Full URI of this application that is visible from user browser
`header-token`	`TokenHandler`		A `TokenHandler` to process header containing a JWT
`header-use`	`Boolean`	`true`	Whether to expect JWT in a header field
`id-token-signature-validation`	`Boolean`	`true`	Whether id token signature check should be enabled
`identity-uri`	`URI`		URI of the identity server, base used to retrieve OIDC metadata
`introspect-endpoint-uri`	`URI`		Endpoint to use to validate JWT
`issuer`	`String`		Issuer of issued tokens
`legacy-cookie-encryption`	`Boolean`	`false`	Whether password-based encrypted OIDC cookies should be written without a version byte and with the legacy PBKDF2 iteration count
`legacy-cookie-fallback`	`Boolean`	`false`	Whether password-based encrypted OIDC cookies should retry decryption with the alternate cookie format after primary decryption fails
`max-redirects`	`Integer`	`5`	Configure maximal number of redirects when redirecting to an OIDC provider within a single authentication attempt
`oidc-metadata`			Configuration for oidc-metadata
`oidc-metadata-well-known`	`Boolean`	`true`	If set to true, metadata will be loaded from default (well known) location, unless it is explicitly defined using oidc-metadata-resource
`optional-audience`	`Boolean`	`false`	Allow audience claim to be optional
`outbound-type`	`OidcOutboundType`	`USER_JWT`	Type of the OIDC outbound
`pkce-challenge-method`	`PkceChallengeMethod`	`S256`	Proof Key Code Exchange (PKCE) challenge creation method
`pkce-enabled`	`Boolean`	`false`	Whether this provider should support PKCE
`proxy-port`	`Integer`	`80`	Proxy port
`query-id-token-param-name`	`String`	`id_token`	Name of a query parameter that contains the JWT id token when parameter is used
`query-param-name`	`String`	`accessToken`	Name of a query parameter that contains the JWT access token when parameter is used
`query-param-tenant-name`	`String`	`h_tenant`	Name of a query parameter that contains the tenant name when the parameter is used
`query-param-use`	`Boolean`	`false`	Whether to use a query parameter to send JWT token from application to this server
`redirect`	`Boolean`	`false`	Whether to redirect to OIDC server when authentication information is missing
`redirect-attempt-counter-strategy`	`RedirectAttemptCounterStrategy`	`PARAM`	Configure the strategy used to count redirects to an identity server
`redirect-attempt-param`	`String`	`h_ra`	Configure the redirect attempt query parameter and cookie name prefix
`redirect-uri`	`String`	`/oidc/redirect`	URI to register web server component on, used by the OIDC server to redirect authorization requests to after a user logs in or approves scopes
`scope-audience`	`String`		Audience of the scope required by this application
`server-type`	`String`	`@default`	Configure one of the supported types of identity servers
`sign-jwk`			Configuration for sign-jwk
`tenants`	`TenantConfig`		Configurations of the tenants
`token-endpoint-auth`	`ClientAuthentication`	`CLIENT_SECRET_BASIC`	Type of authentication to use when invoking the token endpoint. With CLIENT_SECRET_BASIC, credentials are sent only to POST requests on the resolved token endpoint scheme, host, and path and, when JWT introspection is used, to POST requests on the resolved introspection endpoint scheme, host, and path
`token-endpoint-uri`	`URI`		URI of a token endpoint used to obtain a JWT based on the authentication code
`token-signature-validation`	`Boolean`	`true`	Whether access token signature check should be enabled
`validate-jwt-with-jwk`	`Boolean`	`true`	Use JWK (a set of keys to validate signatures of JWT) to validate tokens
`webclient`	`WebClient`		WebClient configuration used for outbound requests to the identity server. This configuration sets the values to the OIDC WebClient default configuration

Deprecated Options

Key	Type	Default	Description
`proxy-host`	`String`		Proxy host to use
`proxy-protocol`	`String`	`http`	Proxy protocol to use when proxy is used
`relative-uris`	`Boolean`	`false`	Whether to force relative URIs in all requests

Dependent Types

io.helidon.security.providers.oidc.OidcProvider

Usages

See the manifest for all available types.

Edit this page or Report an issue