io.helidon.security.providers.oidc.OidcProvider

Description

Open ID Connect security provider

Configuration options

Key	Type	Default	Description
`force-https-redirects`	`Boolean`	`false`	Force HTTPS for redirects to identity provider
`cors`	`CrossOriginConfig`		Assign cross-origin resource sharing settings
`cookie-encryption-refresh-enabled`	`Boolean`	`true`	Whether to encrypt refresh token cookie created by this microservice
`query-id-token-param-name`	`String`	`id_token`	Name of a query parameter that contains the JWT id token when parameter is used
`jwt-groups-path`	`String`	`groups`	Path to the JWT payload claim containing the groups to add as role grants
`header-use`	`Boolean`	`true`	Whether to expect JWT in a header field
`header-token`	`TokenHandler`		A `TokenHandler` to process header containing a JWT
`cookie-name-state`	`String`	`JSESSIONID_3`	The name of the cookie to use for the state storage
`cookie-compression-enabled`	`Boolean`	`true if server-type is idcs; false otherwise`	Whether to GZIP-compress the access token cookie when this reduces its size
`outbound`	`List<OutboundTarget>`		Add a new target configuration
`propagate`	`Boolean`	`false`	Whether to propagate identity
`client-credentials-config`	`ClientCredentialsConfig`		Set the configuration related to the client credentials flow
`fallback-to-default-tenant-enabled`	`Boolean`	`false`	Whether unknown tenant ids should use default tenant configuration
`cookie-name-refresh-token`	`String`	`JSESSIONID_3`	The name of the cookie to use for the refresh token
`query-param-tenant-name`	`String`	`h_tenant`	Name of a query parameter that contains the tenant name when the parameter is used
`query-param-name`	`String`	`accessToken`	Name of a query parameter that contains the JWT access token when parameter is used
`pkce-challenge-method`	`PkceChallengeMethod`	`S256`	Proof Key Code Exchange (PKCE) challenge creation method
`optional`	`Boolean`	`false`	Whether authentication is required
`redirect-attempt-counter-strategy`	`RedirectAttemptCounterStrategy`	`PARAM`	Configure the strategy used to count redirects to an identity server
`legacy-cookie-fallback`	`Boolean`	`false`	Whether password-based encrypted OIDC cookies should retry decryption with the alternate cookie format after primary decryption fails
`cookie-domain`	`String`		Domain the cookie is valid for
`jwt-groups-separator`	`String`		Separator used to split a string claim value into multiple groups
`frontend-uri`	`String`		Full URI of this application that is visible from user browser
`cookie-same-site`	`SameSite`	`LAX`	When using cookie, used to set the SameSite cookie value
`cookie-encryption-id-enabled`	`Boolean`	`true`	Whether to encrypt id token cookie created by this microservice
`webclient`	`WebClient`		WebClient configuration used for outbound requests to the identity server. This configuration sets the values to the OIDC WebClient default configuration
`cookie-http-only`	`Boolean`	`true`	When using cookie, if set to true, the HttpOnly attribute will be configured
`cookie-encryption-enabled`	`Boolean`	`true`	Whether to encrypt token cookie created by this microservice
`pkce-enabled`	`Boolean`	`false`	Whether this provider should support PKCE
`proxy-port`	`Integer`	`80`	Proxy port
`cookie-encryption-tenant-enabled`	`Boolean`	`true`	Whether to encrypt tenant name cookie created by this microservice
`use-jwt-groups`	`Boolean`	`true`	Claim `groups` from JWT will be used to automatically add groups to current subject (may be used with `jakarta.annotation.security.RolesAllowed` annotation)
`cookie-compression-id-enabled`	`Boolean`	`true if server-type is idcs; false otherwise`	Whether to GZIP-compress the ID token cookie when this reduces its size
`token-signature-validation`	`Boolean`	`true`	Whether access token signature check should be enabled
`cookie-name`	`String`	`JSESSIONID`	Name of the cookie to use
`cookie-use`	`Boolean`	`true`	Whether to use cookie to store JWT between requests
`outbound-type`	`OidcOutboundType`	`USER_JWT`	Type of the OIDC outbound
`redirect`	`Boolean`	`false`	Whether to redirect to OIDC server when authentication information is missing
`redirect-uri`	`String`	`/oidc/redirect`	URI to register web server component on, used by the OIDC server to redirect authorization requests to after a user logs in or approves scopes
`cookie-name-id-token`	`String`	`JSESSIONID_2`	Name of the cookie to use for id token
`tenants`	`TenantConfig`		Configurations of the tenants
`cookie-max-age-seconds`	`Long`		When using cookie, used to set MaxAge attribute of the cookie, defining how long the cookie is valid
`cookie-encryption-password`	`List<String>`		Master password for encryption/decryption of cookies. Configure the same value on each service that shares encrypted cookies. If encrypted cookies are enabled and neither this option nor cookie-encryption-name is configured, Helidon creates or reads .helidon-oidc-secret in the current working directory
`cookie-encryption-state-enabled`	`Boolean`	`true`	Whether to encrypt state cookie created by this microservice
`cookie-path`	`String`	`/`	Path the cookie is valid for
`query-param-use`	`Boolean`	`false`	Whether to use a query parameter to send JWT token from application to this server
`cookie-name-tenant`	`String`	`HELIDON_TENANT`	The name of the cookie to use for the tenant name
`cookie-secure`	`Boolean`	`false`	When using cookie, if set to true, the Secure attribute will be configured
`legacy-cookie-encryption`	`Boolean`	`false`	Whether password-based encrypted OIDC cookies should be written without a version byte and with the legacy PBKDF2 iteration count
`cookie-encryption-name`	`String`		Name of the encryption configuration available through Security encryption. If configured and encryption is enabled for any cookie, Security must be registered in the global or current context
`id-token-signature-validation`	`Boolean`	`true`	Whether id token signature check should be enabled
`max-redirects`	`Integer`	`5`	Configure maximal number of redirects when redirecting to an OIDC provider within a single authentication attempt
`access-token-ip-check`	`Boolean`	`true`	Whether to check if current IP address matches the one access token was issued for
`redirect-attempt-param`	`String`	`h_ra`	Configure the redirect attempt query parameter and cookie name prefix

Deprecated Options

Key	Type	Default	Description
`relative-uris`	`Boolean`	`false`	Whether to force relative URIs in all requests
`proxy-host`	`String`		Proxy host to use
`proxy-protocol`	`String`	`http`	Proxy protocol to use when proxy is used

Usages

See the manifest for all available types.

Edit this page or Report an issue