fish.payara.security.annotations

Annotation Type AzureAuthenticationDefinition

@Target(value=TYPE)
 @Retention(value=RUNTIME)
public @interface AzureAuthenticationDefinition

Author:

Gaurav Gupta

Field Summary

Fields

Modifier and Type	Fields and Description
static String	OPENID_MP_AZURE_TENANT_ID The Microprofile Config key for the azure tenantId is "payara.security.openid.azure.tenantId"

Optional Element Summary

Optional Elements

Modifier and Type	Optional Element and Description
ClaimsDefinition	claimsDefinition Optional.
String	clientId Required.
String	clientSecret Required.
DisplayType	display Optional.
String[]	extraParameters An array of extra options that will be sent to the OAuth provider.
int	jwksConnectTimeout Optional.
int	jwksReadTimeout Optional.
LogoutDefinition	logout Optional.
PromptType[]	prompt Optional.
OpenIdProviderMetadata	providerMetadata To override the openid connect provider's metadata property discovered via providerUri.
String	providerURI Optional.
String	redirectURI The redirect URI to which the response will be sent by OpenId Connect Provider.
String	responseMode Optional.
String	responseType Optional.
String[]	scope Optional.
String	tenantId Required.
boolean	tokenAutoRefresh Optional.
int	tokenMinValidity Optional.Sets the minimum validity time in milliseconds the Access Token must be valid before it is considered expired.
boolean	useNonce Optional.
boolean	useSession Optional.

Field Detail

OPENID_MP_AZURE_TENANT_ID

public static final String OPENID_MP_AZURE_TENANT_ID

The Microprofile Config key for the azure tenantId is "payara.security.openid.azure.tenantId"

Element Detail

tenantId

public abstract String tenantId

Required. Azure tenant id

Returns:

Default:

""

providerURI

public abstract String providerURI

Optional. The provider uri ( http://openid.net/specs/openid-connect-discovery-1_0.html ) to read / discover the metadata of the openid provider.

Returns:

Default:

"https://login.microsoftonline.com/{tenantid}/v2.0"

providerMetadata

public abstract OpenIdProviderMetadata providerMetadata

To override the openid connect provider's metadata property discovered via providerUri.

Returns:

Default:

@fish.payara.security.annotations.OpenIdProviderMetadata

claimsDefinition

public abstract ClaimsDefinition claimsDefinition

Optional. The claims definition defines the custom claims mapping of caller name and groups.

Returns:

Default:

@fish.payara.security.annotations.ClaimsDefinition

logout

public abstract LogoutDefinition logout

Optional. The Logout definition defines the logout and RP session management configuration.

Returns:

Default:

@fish.payara.security.annotations.LogoutDefinition

clientId

public abstract String clientId

Required. The client identifier issued when the application was registered

To set this using Microprofile Config use payara.security.openid.cliendId

Returns:

the client identifier

Default:

""

clientSecret

public abstract String clientSecret

Required. The client secret

It is recommended to set this using an alias.

To set this using Microprofile Config use payara.security.openid.clientSecret

Returns:

See Also:

Payara Password Aliases Documentation

Default:

""

redirectURI

public abstract String redirectURI

The redirect URI to which the response will be sent by OpenId Connect Provider. This URI must exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider. To set this using Microprofile Config use payara.security.openid.redirectURI

Returns:

Default:

"${baseURL}/Callback"

scope

public abstract String[] scope

Optional. The scope value defines the access privileges. The basic (and required) scope for OpenID Connect is the openid scope.

Returns:

Default:

{"openid", "email", "profile"}

responseType

public abstract String responseType

Optional. Response Type value defines the processing flow to be used. By default, the value is code (Authorization Code Flow).

Returns:

Default:

"code"

responseMode

public abstract String responseMode

Optional. Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.

Returns:

Default:

""

prompt

public abstract PromptType[] prompt

Optional. The prompt value specifies whether the authorization server prompts the user for reauthentication and consent. If no value is specified and the user has not previously authorized access, then the user is shown a consent screen.

Returns:

Default:

{}

display

public abstract DisplayType display

Optional. The display value specifying how the authorization server displays the authentication and consent user interface pages.

Returns:

Default:

fish.payara.security.openid.api.DisplayType.PAGE

useNonce

public abstract boolean useNonce

Optional. Enables string value used to mitigate replay attacks.

Returns:

Default:

true

useSession

public abstract boolean useSession

Optional. If enabled state & nonce value stored in session otherwise in cookies.

Returns:

Default:

true

extraParameters

public abstract String[] extraParameters

An array of extra options that will be sent to the OAuth provider.

These must be in the form of "key=value" i.e. extraParameters={"key1=value", "key2=value2"}

Returns:

Default:

{}

jwksConnectTimeout

public abstract int jwksConnectTimeout

Optional. Sets the connect timeout(in milliseconds) for Remote JWKS retrieval. Value must not be negative and if value is zero then infinite timeout.

Returns:

Default:

500

jwksReadTimeout

public abstract int jwksReadTimeout

Optional. Sets the read timeout(in milliseconds) for Remote JWKS retrieval. Value must not be negative and if value is zero then infinite timeout.

Returns:

Default:

500

tokenAutoRefresh

public abstract boolean tokenAutoRefresh

Optional. Enables or disables the automatically performed refresh of Access and Refresh Token.

Returns:

true, if Access and Refresh Token shall be refreshed automatically when they are expired.

Default:

true

tokenMinValidity

public abstract int tokenMinValidity

Optional.Sets the minimum validity time in milliseconds the Access Token must be valid before it is considered expired. Value must not be negative and if value is zero then infinite timeout.

Returns:

Default:

10000