001/* 002 * oauth2-oidc-sdk 003 * 004 * Copyright 2012-2021, Connect2id Ltd and contributors. 005 * 006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use 007 * this file except in compliance with the License. You may obtain a copy of the 008 * License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software distributed 013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR 014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the 015 * specific language governing permissions and limitations under the License. 016 */ 017 018package com.nimbusds.openid.connect.sdk.op; 019 020 021import java.net.URI; 022import java.util.List; 023import java.util.Map; 024 025import com.nimbusds.jose.EncryptionMethod; 026import com.nimbusds.jose.JWEAlgorithm; 027import com.nimbusds.jose.JWSAlgorithm; 028import com.nimbusds.langtag.LangTag; 029import com.nimbusds.oauth2.sdk.as.ReadOnlyAuthorizationServerMetadata; 030import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod; 031import com.nimbusds.openid.connect.sdk.Display; 032import com.nimbusds.openid.connect.sdk.SubjectType; 033import com.nimbusds.openid.connect.sdk.assurance.IdentityTrustFramework; 034import com.nimbusds.openid.connect.sdk.assurance.evidences.*; 035import com.nimbusds.openid.connect.sdk.assurance.evidences.attachment.AttachmentType; 036import com.nimbusds.openid.connect.sdk.assurance.evidences.attachment.HashAlgorithm; 037import com.nimbusds.openid.connect.sdk.claims.ACR; 038import com.nimbusds.openid.connect.sdk.claims.ClaimType; 039import com.nimbusds.openid.connect.sdk.federation.registration.ClientRegistrationType; 040 041 042/** 043 * Read-only OpenID Provider (OP) metadata. 044 * 045 * <p>Related specifications: 046 * 047 * <ul> 048 * <li>OpenID Connect Discovery 1.0, section 3 049 * <li>OpenID Connect Session Management 1.0, section 2.1 (draft 28) 050 * <li>OpenID Connect Front-Channel Logout 1.0, section 3 (draft 02) 051 * <li>OpenID Connect Back-Channel Logout 1.0, section 2.1 (draft 04) 052 * <li>OpenID Connect for Identity Assurance 1.0 (draft 12) 053 * <li>OpenID Connect Federation 1.0 (draft 12) 054 * <li>OAuth 2.0 Authorization Server Metadata (RFC 8414) 055 * <li>OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound 056 * Access Tokens (RFC 8705) 057 * <li>Financial-grade API: JWT Secured Authorization Response Mode for 058 * OAuth 2.0 (JARM) 059 * <li>OAuth 2.0 Authorization Server Issuer Identification (RFC 9207) 060 * </ul> 061 */ 062public interface ReadOnlyOIDCProviderMetadata extends ReadOnlyAuthorizationServerMetadata, ReadOnlyOIDCProviderEndpointMetadata { 063 064 065 @Override 066 ReadOnlyOIDCProviderEndpointMetadata getReadOnlyMtlsEndpointAliases(); 067 068 069 /** 070 * Gets the supported Authentication Context Class References (ACRs). 071 * Corresponds to the {@code acr_values_supported} metadata field. 072 * 073 * @return The supported ACRs, {@code null} if not specified. 074 */ 075 List<ACR> getACRs(); 076 077 078 /** 079 * Gets the supported subject types. Corresponds to the 080 * {@code subject_types_supported} metadata field. 081 * 082 * @return The supported subject types. 083 */ 084 List<SubjectType> getSubjectTypes(); 085 086 087 /** 088 * Gets the supported JWS algorithms for ID tokens. Corresponds to the 089 * {@code id_token_signing_alg_values_supported} metadata field. 090 * 091 * @return The supported JWS algorithms, {@code null} if not specified. 092 */ 093 List<JWSAlgorithm> getIDTokenJWSAlgs(); 094 095 096 /** 097 * Gets the supported JWE algorithms for ID tokens. Corresponds to the 098 * {@code id_token_encryption_alg_values_supported} metadata field. 099 * 100 * @return The supported JWE algorithms, {@code null} if not specified. 101 */ 102 List<JWEAlgorithm> getIDTokenJWEAlgs(); 103 104 105 /** 106 * Gets the supported encryption methods for ID tokens. Corresponds to 107 * the {@code id_token_encryption_enc_values_supported} metadata field. 108 * 109 * @return The supported encryption methods, {@code null} if not 110 * specified. 111 */ 112 List<EncryptionMethod> getIDTokenJWEEncs(); 113 114 115 /** 116 * Gets the supported JWS algorithms for UserInfo JWTs. Corresponds to 117 * the {@code userinfo_signing_alg_values_supported} metadata field. 118 * 119 * @return The supported JWS algorithms, {@code null} if not specified. 120 */ 121 List<JWSAlgorithm> getUserInfoJWSAlgs(); 122 123 124 /** 125 * Gets the supported JWE algorithms for UserInfo JWTs. Corresponds to 126 * the {@code userinfo_encryption_alg_values_supported} metadata field. 127 * 128 * @return The supported JWE algorithms, {@code null} if not specified. 129 */ 130 List<JWEAlgorithm> getUserInfoJWEAlgs(); 131 132 133 /** 134 * Gets the supported encryption methods for UserInfo JWTs. Corresponds 135 * to the {@code userinfo_encryption_enc_values_supported} metadata 136 * field. 137 * 138 * @return The supported encryption methods, {@code null} if not 139 * specified. 140 */ 141 List<EncryptionMethod> getUserInfoJWEEncs(); 142 143 144 /** 145 * Gets the supported displays. Corresponds to the 146 * {@code display_values_supported} metadata field. 147 * 148 * @return The supported displays, {@code null} if not specified. 149 */ 150 List<Display> getDisplays(); 151 152 153 /** 154 * Gets the supported claim types. Corresponds to the 155 * {@code claim_types_supported} metadata field. 156 * 157 * @return The supported claim types, {@code null} if not specified. 158 */ 159 List<ClaimType> getClaimTypes(); 160 161 162 /** 163 * Gets the supported claims names. Corresponds to the 164 * {@code claims_supported} metadata field. 165 * 166 * @return The supported claims names, {@code null} if not specified. 167 */ 168 List<String> getClaims(); 169 170 171 /** 172 * Gets the supported claims locales. Corresponds to the 173 * {@code claims_locales_supported} metadata field. 174 * 175 * @return The supported claims locales, {@code null} if not specified. 176 */ 177 List<LangTag> getClaimsLocales(); 178 179 180 /** 181 * Gets the support for the {@code claims} authorisation request 182 * parameter. Corresponds to the {@code claims_parameter_supported} 183 * metadata field. 184 * 185 * @return {@code true} if the {@code claim} parameter is supported, 186 * else {@code false}. 187 */ 188 boolean supportsClaimsParam(); 189 190 191 /** 192 * Gets the support for front-channel logout. Corresponds to the 193 * {@code frontchannel_logout_supported} metadata field. 194 * 195 * @return {@code true} if front-channel logout is supported, else 196 * {@code false}. 197 */ 198 boolean supportsFrontChannelLogout(); 199 200 201 /** 202 * Gets the support for front-channel logout with a session ID. 203 * Corresponds to the {@code frontchannel_logout_session_supported} 204 * metadata field. 205 * 206 * @return {@code true} if front-channel logout with a session ID is 207 * supported, else {@code false}. 208 */ 209 boolean supportsFrontChannelLogoutSession(); 210 211 212 /** 213 * Gets the support for back-channel logout. Corresponds to the 214 * {@code backchannel_logout_supported} metadata field. 215 * 216 * @return {@code true} if back-channel logout is supported, else 217 * {@code false}. 218 */ 219 boolean supportsBackChannelLogout(); 220 221 222 /** 223 * Gets the support for back-channel logout with a session ID. 224 * Corresponds to the {@code backchannel_logout_session_supported} 225 * metadata field. 226 * 227 * @return {@code true} if back-channel logout with a session ID is 228 * supported, else {@code false}. 229 */ 230 boolean supportsBackChannelLogoutSession(); 231 232 233 /** 234 * Gets support for verified claims. Corresponds to the 235 * {@code verified_claims_supported} metadata field. 236 * 237 * @return {@code true} if verified claims are supported, else 238 * {@code false}. 239 */ 240 boolean supportsVerifiedClaims(); 241 242 243 /** 244 * Gets the supported identity trust frameworks. Corresponds to the 245 * {@code trust_frameworks_supported} metadata field. 246 * 247 * @return The supported identity trust frameworks, {@code null} if not 248 * specified. 249 */ 250 List<IdentityTrustFramework> getIdentityTrustFrameworks(); 251 252 253 /** 254 * Gets the supported identity evidence types. Corresponds to the 255 * {@code evidence_supported} metadata field. 256 * 257 * @return The supported identity evidence types, {@code null} if not 258 * specified. 259 */ 260 List<IdentityEvidenceType> getIdentityEvidenceTypes(); 261 262 263 /** 264 * Gets the supported identity document types. Corresponds to the 265 * {@code documents_supported} metadata field. 266 * 267 * @return The supported identity document types, {@code null} if not 268 * specified. 269 */ 270 List<DocumentType> getDocumentTypes(); 271 272 273 /** 274 * Gets the supported identity document types. Corresponds to the 275 * {@code id_documents_supported} metadata field. 276 * 277 * @return The supported identity documents types, {@code null} if not 278 * specified. 279 * @deprecated Use {@link #getDocumentTypes} instead. 280 */ 281 @Deprecated 282 List<IDDocumentType> getIdentityDocumentTypes(); 283 284 285 /** 286 * Gets the supported coarse identity verification methods for 287 * evidences of type document. Corresponds to the 288 * {@code documents_methods_supported} metadata field. 289 * 290 * @return The supported identity verification methods for document 291 * evidences, {@code null} if not specified. 292 */ 293 List<IdentityVerificationMethod> getDocumentMethods(); 294 295 296 /** 297 * Gets the supported validation methods for evidences of type 298 * document. Corresponds to the 299 * {@code documents_validation_methods_supported} metadata field. 300 * 301 * @return The validation methods for document evidences, {@code null} 302 * if not specified. 303 */ 304 List<ValidationMethodType> getDocumentValidationMethods(); 305 306 307 /** 308 * Gets the supported verification methods for evidences of type 309 * document. Corresponds to the 310 * {@code documents_verification_methods_supported} metadata field. 311 * 312 * @return The verification methods for document evidences, {@code null} 313 * if not specified. 314 */ 315 List<VerificationMethodType> getDocumentVerificationMethods(); 316 317 318 /** 319 * Gets the supported electronic record types. Corresponds to the 320 * {@code electronic_records_supported} metadata field. 321 * 322 * @return The supported electronic record types, {@code null} if not 323 * specified. 324 */ 325 List<ElectronicRecordType> getElectronicRecordTypes(); 326 327 328 /** 329 * Gets the supported identity verification methods. Corresponds to the 330 * {@code id_documents_verification_methods_supported} metadata field. 331 * 332 * @return The supported identity verification methods, {@code null} if 333 * not specified. 334 */ 335 @Deprecated 336 List<IdentityVerificationMethod> getIdentityVerificationMethods(); 337 338 339 /** 340 * Gets the names of the supported verified claims. Corresponds to the 341 * {@code claims_in_verified_claims_supported} metadata field. 342 * 343 * @return The supported verified claims names, {@code null} if not 344 * specified. 345 */ 346 List<String> getVerifiedClaims(); 347 348 349 /** 350 * Gets the supported evidence attachment types. Corresponds to the 351 * {@code attachments_supported} metadata field. 352 * 353 * @return The supported evidence attachment types, empty if 354 * attachments are not supported, {@code null} if not 355 * specified. 356 */ 357 List<AttachmentType> getAttachmentTypes(); 358 359 360 /** 361 * Gets the supported digest algorithms for the external evidence 362 * attachments. Corresponds to the {@code digest_algorithms_supported} 363 * metadata field. 364 * 365 * @return The supported digest algorithms, {@code null} if not 366 * specified. 367 */ 368 List<HashAlgorithm> getAttachmentDigestAlgs(); 369 370 371 /** 372 * Gets the supported federation client registration types. Corresponds 373 * to the {@code client_registration_types_supported} metadata field. 374 * 375 * @return The supported client registration types, {@code null} if not 376 * specified. 377 */ 378 List<ClientRegistrationType> getClientRegistrationTypes(); 379 380 381 /** 382 * Gets the supported client authentication methods for automatic 383 * federation client registration. Corresponds to the 384 * {@code client_registration_authn_methods_supported} field. 385 * 386 * @return The supported authentication methods for automatic 387 * federation client registration, {@code null} if not 388 * specified. 389 */ 390 Map<EndpointName, List<ClientAuthenticationMethod>> getClientRegistrationAuthnMethods(); 391 392 393 /** 394 * Gets the organisation name (in federation). Corresponds to the 395 * {@code organization_name} metadata field. 396 * 397 * @return The organisation name, {@code null} if not specified. 398 */ 399 String getOrganizationName(); 400}