Description
Open ID Connect security provider.
Usages
Configuration options
| Key | Kind | Type | Default Value | Description |
|---|---|---|---|---|
access-token-ip-check | VALUE | Boolean | true | Whether to check if current IP address matches the one access token was issued for |
client-credentials-config | VALUE | i.h.s.p.o.c.ClientCredentialsConfig | Set the configuration related to the client credentials flow | |
cookie-domain | VALUE | String | Domain the cookie is valid for | |
cookie-encryption-enabled | VALUE | Boolean | false | Whether to encrypt token cookie created by this microservice |
cookie-encryption-id-enabled | VALUE | Boolean | true | Whether to encrypt id token cookie created by this microservice |
cookie-encryption-name | VALUE | String | Name of the encryption configuration available through Security#encrypt(String, byte[) and Security#decrypt(String, String)] | |
cookie-encryption-password | LIST | String | Master password for encryption/decryption of cookies | |
cookie-encryption-refresh-enabled | VALUE | Boolean | true | Whether to encrypt refresh token cookie created by this microservice |
cookie-encryption-state-enabled | VALUE | Boolean | true | Whether to encrypt state cookie created by this microservice |
cookie-encryption-tenant-enabled | VALUE | Boolean | true | Whether to encrypt tenant name cookie created by this microservice |
cookie-http-only | VALUE | Boolean | true | When using cookie, if set to true, the HttpOnly attribute will be configured |
cookie-max-age-seconds | VALUE | Long | When using cookie, used to set MaxAge attribute of the cookie, defining how long the cookie is valid | |
cookie-name | VALUE | String | JSESSIONID | Name of the cookie to use |
cookie-name-id-token | VALUE | String | JSESSIONID_2 | Name of the cookie to use for id token |
cookie-name-refresh-token | VALUE | String | JSESSIONID_3 | The name of the cookie to use for the refresh token |
cookie-name-state | VALUE | String | JSESSIONID_3 | The name of the cookie to use for the state storage |
cookie-name-tenant | VALUE | String | HELIDON_TENANT | The name of the cookie to use for the tenant name |
cookie-path | VALUE | String | / | Path the cookie is valid for |
cookie-same-site | VALUE | i.h.h.S.SameSite | LAX | When using cookie, used to set the SameSite cookie value |
cookie-secure | VALUE | Boolean | false | When using cookie, if set to true, the Secure attribute will be configured |
cookie-use | VALUE | Boolean | true | Whether to use cookie to store JWT between requests |
cors | VALUE | i.h.c.CrossOriginConfig | Assign cross-origin resource sharing settings | |
force-https-redirects | VALUE | Boolean | false | Force HTTPS for redirects to identity provider |
frontend-uri | VALUE | String | Full URI of this application that is visible from user browser | |
header-token | VALUE | i.h.s.u.TokenHandler | A TokenHandler to process header containing a JWT | |
header-use | VALUE | Boolean | true | Whether to expect JWT in a header field |
id-token-signature-validation | VALUE | Boolean | true | Whether id token signature check should be enabled |
max-redirects | VALUE | Integer | 5 | Configure maximal number of redirects when redirecting to an OIDC provider within a single authentication attempt |
optional | VALUE | Boolean | false | Whether authentication is required |
outbound | LIST | i.h.s.p.c.OutboundTarget | Add a new target configuration | |
outbound-type | VALUE | i.h.s.p.o.c.OidcOutboundType | USER_JWT | Type of the OIDC outbound |
pkce-challenge-method | VALUE | i.h.s.p.o.c.PkceChallengeMethod | S256 | Proof Key Code Exchange (PKCE) challenge creation method |
pkce-enabled | VALUE | Boolean | false | Whether this provider should support PKCE |
propagate | VALUE | Boolean | false | Whether to propagate identity |
proxy-port | VALUE | Integer | 80 | Proxy port |
query-id-token-param-name | VALUE | String | id_token | Name of a query parameter that contains the JWT id token when parameter is used |
query-param-name | VALUE | String | accessToken | Name of a query parameter that contains the JWT access token when parameter is used |
query-param-tenant-name | VALUE | String | h_tenant | Name of a query parameter that contains the tenant name when the parameter is used |
query-param-use | VALUE | Boolean | false | Whether to use a query parameter to send JWT token from application to this server |
redirect | VALUE | Boolean | false | By default, the client should redirect to the identity server for the user to log in |
redirect-attempt-param | VALUE | String | h_ra | Configure the parameter used to store the number of attempts in redirect |
redirect-uri | VALUE | String | /oidc/redirect | URI to register web server component on, used by the OIDC server to redirect authorization requests to after a user logs in or approves scopes |
tenants | VALUE | i.h.s.p.o.c.TenantConfig | Configurations of the tenants | |
token-signature-validation | VALUE | Boolean | true | Whether access token signature check should be enabled |
use-jwt-groups | VALUE | Boolean | true | Claim groups from JWT will be used to automatically add groups to current subject (may be used with jakarta.annotation.security.RolesAllowed annotation) |
webclient | VALUE | i.h.w.a.WebClient | WebClient configuration used for outbound requests to the identity server. This configuration sets the values to the OIDC WebClient default configuration |
Deprecated Options
See the manifest for all available types.