io.helidon.security.providers.oidc.common.OidcConfig

Description

Open ID Connect configuration

Configuration options

Key	Type	Default	Description
`access-token-ip-check`	`Boolean`	`true`	Whether to check if current IP address matches the one access token was issued for
`audience`	`String`		Audience of issued tokens
`authorization-endpoint-uri`	`URI`		URI of an authorization endpoint used to redirect users to for logging-in
`base-scopes`	`String`	`openid`	Configure base scopes
`check-audience`	`Boolean`	`true`	Configure audience claim check
`client-credentials-config`	`ClientCredentialsConfig`		Set the configuration related to the client credentials flow
`client-id`	`String`		Client ID as generated by OIDC server
`client-secret`	`String`		Client secret as generated by OIDC server
`client-timeout-millis`	`Duration`	`30000`	Timeout of calls using web client
`cookie-domain`	`String`		Domain the cookie is valid for
`cookie-encryption-enabled`	`Boolean`	`false`	Whether to encrypt token cookie created by this microservice
`cookie-encryption-id-enabled`	`Boolean`	`true`	Whether to encrypt id token cookie created by this microservice
`cookie-encryption-name`	`String`		Name of the encryption configuration available through `Security#encrypt(String, byte[])` and `Security#decrypt(String, String)`
`cookie-encryption-password`	`List<String>`		Master password for encryption/decryption of cookies
`cookie-encryption-refresh-enabled`	`Boolean`	`true`	Whether to encrypt refresh token cookie created by this microservice
`cookie-encryption-state-enabled`	`Boolean`	`true`	Whether to encrypt state cookie created by this microservice
`cookie-encryption-tenant-enabled`	`Boolean`	`true`	Whether to encrypt tenant name cookie created by this microservice
`cookie-http-only`	`Boolean`	`true`	When using cookie, if set to true, the HttpOnly attribute will be configured
`cookie-max-age-seconds`	`Long`		When using cookie, used to set MaxAge attribute of the cookie, defining how long the cookie is valid
`cookie-name`	`String`	`JSESSIONID`	Name of the cookie to use
`cookie-name-id-token`	`String`	`JSESSIONID_2`	Name of the cookie to use for id token
`cookie-name-refresh-token`	`String`	`JSESSIONID_3`	The name of the cookie to use for the refresh token
`cookie-name-state`	`String`	`JSESSIONID_3`	The name of the cookie to use for the state storage
`cookie-name-tenant`	`String`	`HELIDON_TENANT`	The name of the cookie to use for the tenant name
`cookie-path`	`String`	`/`	Path the cookie is valid for
`cookie-same-site`	`SameSite`	`LAX`	When using cookie, used to set the SameSite cookie value
`cookie-secure`	`Boolean`	`false`	When using cookie, if set to true, the Secure attribute will be configured
`cookie-use`	`Boolean`	`true`	Whether to use cookie to store JWT between requests
`cors`	`CrossOriginConfig`		Assign cross-origin resource sharing settings
`decryption-keys`			Configuration for decryption-keys
`force-https-redirects`	`Boolean`	`false`	Force HTTPS for redirects to identity provider
`frontend-uri`	`String`		Full URI of this application that is visible from user browser
`header-token`	`TokenHandler`		A `TokenHandler` to process header containing a JWT
`header-use`	`Boolean`	`true`	Whether to expect JWT in a header field
`id-token-signature-validation`	`Boolean`	`true`	Whether id token signature check should be enabled
`identity-uri`	`URI`		URI of the identity server, base used to retrieve OIDC metadata
`introspect-endpoint-uri`	`URI`		Endpoint to use to validate JWT
`issuer`	`String`		Issuer of issued tokens
`max-redirects`	`Integer`	`5`	Configure maximal number of redirects when redirecting to an OIDC provider within a single authentication attempt
`oidc-metadata`			Configuration for oidc-metadata
`oidc-metadata-well-known`	`Boolean`	`true`	If set to true, metadata will be loaded from default (well known) location, unless it is explicitly defined using oidc-metadata-resource
`optional-audience`	`Boolean`	`false`	Allow audience claim to be optional
`outbound-type`	`OidcOutboundType`	`USER_JWT`	Type of the OIDC outbound
`pkce-challenge-method`	`PkceChallengeMethod`	`S256`	Proof Key Code Exchange (PKCE) challenge creation method
`pkce-enabled`	`Boolean`	`false`	Whether this provider should support PKCE
`proxy-port`	`Integer`	`80`	Proxy port
`query-id-token-param-name`	`String`	`id_token`	Name of a query parameter that contains the JWT id token when parameter is used
`query-param-name`	`String`	`accessToken`	Name of a query parameter that contains the JWT access token when parameter is used
`query-param-tenant-name`	`String`	`h_tenant`	Name of a query parameter that contains the tenant name when the parameter is used
`query-param-use`	`Boolean`	`false`	Whether to use a query parameter to send JWT token from application to this server
`redirect`	`Boolean`	`false`	By default, the client should redirect to the identity server for the user to log in
`redirect-attempt-param`	`String`	`h_ra`	Configure the parameter used to store the number of attempts in redirect
`redirect-uri`	`String`	`⁠/⁠oidc/redirect`	URI to register web server component on, used by the OIDC server to redirect authorization requests to after a user logs in or approves scopes
`scope-audience`	`String`		Audience of the scope required by this application
`server-type`	`String`	`@default`	Configure one of the supported types of identity servers
`sign-jwk`			Configuration for sign-jwk
`tenants`	`TenantConfig`		Configurations of the tenants
`token-endpoint-auth`	`ClientAuthentication`	`CLIENT_SECRET_BASIC`	Type of authentication to use when invoking the token endpoint
`token-endpoint-uri`	`URI`		URI of a token endpoint used to obtain a JWT based on the authentication code
`token-signature-validation`	`Boolean`	`true`	Whether access token signature check should be enabled
`validate-jwt-with-jwk`	`Boolean`	`true`	Use JWK (a set of keys to validate signatures of JWT) to validate tokens
`webclient`	`WebClient`		WebClient configuration used for outbound requests to the identity server. This configuration sets the values to the OIDC WebClient default configuration

Deprecated Options

Key	Type	Default	Description
`proxy-host`	`String`		Proxy host to use
`proxy-protocol`	`String`	`http`	Proxy protocol to use when proxy is used
`relative-uris`	`Boolean`	`false`	Can be set to `true` to force the use of relative URIs in all requests, regardless of the presence or absence of proxies or no-proxy lists

Dependent Types

io.helidon.security.providers.oidc.OidcProvider

Usages

See the manifest for all available types.

Edit this page or Report an issue