Package io.quarkus.oidc
Class OidcTenantConfig.Authentication
- java.lang.Object
-
- io.quarkus.oidc.OidcTenantConfig.Authentication
-
- Enclosing class:
- OidcTenantConfig
public static class OidcTenantConfig.Authentication extends Object
Defines the authorization request properties when authenticating users using the Authorization Code Grant Type.
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description static class
OidcTenantConfig.Authentication.CookieSameSite
SameSite attribute values for the session cookie.static class
OidcTenantConfig.Authentication.ResponseMode
Authorization code flow response mode
-
Field Summary
Fields Modifier and Type Field Description Optional<Boolean>
addOpenidScope
Add the 'openid' scope automatically to the list of scopes.boolean
allowMultipleCodeFlows
If a state cookie is present then a `state` query parameter must also be present and both the state cookie name suffix and state cookie value have to match the value of the `state` query parameter when the redirect path matches the current path.Optional<String>
cookieDomain
Cookie domain parameter value which, if set, will be used for the session, state and post logout cookies.boolean
cookieForceSecure
If enabled the state, session and post logout cookies will have their 'secure' parameter set to 'true' when HTTP is used.String
cookiePath
Cookie path parameter value which, if set, will be used to set a path parameter for the session, state and post logout cookies.Optional<String>
cookiePathHeader
Cookie path header parameter value which, if set, identifies the incoming HTTP header whose value will be used to set a path parameter for the session, state and post logout cookies.OidcTenantConfig.Authentication.CookieSameSite
cookieSameSite
SameSite attribute for the session cookie.Optional<String>
cookieSuffix
Cookie name suffix.Optional<String>
errorPath
Relative path to the public endpoint which will process the error response from the OIDC authorization endpoint.Map<String,String>
extraParams
Additional properties which will be added as the query parameters to the authentication redirect URI.boolean
failOnMissingStateParam
Fail with the HTTP 401 error if the state cookie is present but no state query parameter is present.Optional<Boolean>
forceRedirectHttpsScheme
Force 'https' as the 'redirect_uri' parameter scheme when running behind an SSL terminating reverse proxy.Optional<List<String>>
forwardParams
Request URL query parameters which, if present, will be added to the authentication redirect URI.Optional<Boolean>
idTokenRequired
Requires that ID token is available when the authorization code flow completes.Optional<Duration>
internalIdTokenLifespan
Internal ID token lifespan.boolean
javaScriptAutoRedirect
If this property is set to 'true' then a normal 302 redirect response will be returned if the request was initiated via JavaScript API such as XMLHttpRequest or Fetch and the current user needs to be (re)authenticated which may not be desirable for Single-page applications (SPA) since it automatically following the redirect may not work given that OIDC authorization endpoints typically do not support CORS.boolean
nonceRequired
Require that ID token includes a `nonce` claim which must match `nonce` authentication request query parameter.Optional<Boolean>
pkceRequired
Requires that a Proof Key for Code Exchange (PKCE) is used.Optional<String>
pkceSecret
Deprecated, for removal: This API element is subject to removal in a future version.UsestateSecret
property instead.Optional<String>
redirectPath
Relative path for calculating a "redirect_uri" query parameter.boolean
removeRedirectParameters
Remove the query parameters such as 'code' and 'state' set by the OIDC server on the redirect URI after the user has authenticated by redirecting a user to the same URI but without the query parameters.Optional<OidcTenantConfig.Authentication.ResponseMode>
responseMode
Authorization code flow response modeboolean
restorePathAfterRedirect
If this property is set to 'true' then the original request URI which was used before the authentication will be restored after the user has been redirected back to the application.Optional<List<String>>
scopes
List of scopesDuration
sessionAgeExtension
Session age extension in minutes.Optional<String>
stateSecret
Secret which will be used to encrypt Proof Key for Code Exchange (PKCE) code verifier and/or nonce in the code flow state.Optional<Boolean>
userInfoRequired
If this property is set to 'true' then an OIDC UserInfo endpoint will be called.boolean
verifyAccessToken
Both ID and access tokens are fetched from the OIDC provider as part of the authorization code flow.
-
Constructor Summary
Constructors Constructor Description Authentication()
-
Method Summary
-
-
-
Field Detail
-
responseMode
@ConfigItem(defaultValueDocumentation="query") public Optional<OidcTenantConfig.Authentication.ResponseMode> responseMode
Authorization code flow response mode
-
redirectPath
@ConfigItem public Optional<String> redirectPath
Relative path for calculating a "redirect_uri" query parameter. It has to start from a forward slash and will be appended to the request URI's host and port. For example, if the current request URI is 'https://localhost:8080/service' then a 'redirect_uri' parameter will be set to 'https://localhost:8080/' if this property is set to '/' and be the same as the request URI if this property has not been configured. Note the original request URI will be restored after the user has authenticated if 'restorePathAfterRedirect' is set to 'true'.
-
restorePathAfterRedirect
@ConfigItem(defaultValue="false") public boolean restorePathAfterRedirect
If this property is set to 'true' then the original request URI which was used before the authentication will be restored after the user has been redirected back to the application. Note if `redirectPath` property is not set, the original request URI will be restored even if this property is disabled.
-
removeRedirectParameters
@ConfigItem(defaultValue="true") public boolean removeRedirectParameters
Remove the query parameters such as 'code' and 'state' set by the OIDC server on the redirect URI after the user has authenticated by redirecting a user to the same URI but without the query parameters.
-
errorPath
@ConfigItem public Optional<String> errorPath
Relative path to the public endpoint which will process the error response from the OIDC authorization endpoint. If the user authentication has failed then the OIDC provider will return an 'error' and an optional 'error_description' parameters, instead of the expected authorization 'code'. If this property is set then the user will be redirected to the endpoint which can return a user-friendly error description page. It has to start from a forward slash and will be appended to the request URI's host and port. For example, if it is set as '/error' and the current request URI is 'https://localhost:8080/callback?error=invalid_scope' then a redirect will be made to 'https://localhost:8080/error?error=invalid_scope'. If this property is not set then HTTP 401 status will be returned in case of the user authentication failure.
-
verifyAccessToken
@ConfigItem(defaultValue="false") public boolean verifyAccessToken
Both ID and access tokens are fetched from the OIDC provider as part of the authorization code flow. ID token is always verified on every user request as the primary token which is used to represent the principal and extract the roles. Access token is not verified by default since it is meant to be propagated to the downstream services. The verification of the access token should be enabled if it is injected as a JWT token. Access tokens obtained as part of the code flow will always be verified if `quarkus.oidc.roles.source` property is set to `accesstoken` which means the authorization decision will be based on the roles extracted from the access token. Bearer access tokens are always verified.
-
forceRedirectHttpsScheme
@ConfigItem(defaultValueDocumentation="false") public Optional<Boolean> forceRedirectHttpsScheme
Force 'https' as the 'redirect_uri' parameter scheme when running behind an SSL terminating reverse proxy. This property, if enabled, will also affect the logout `post_logout_redirect_uri` and the local redirect requests.
-
scopes
@ConfigItem public Optional<List<String>> scopes
List of scopes
-
nonceRequired
@ConfigItem(defaultValue="false") public boolean nonceRequired
Require that ID token includes a `nonce` claim which must match `nonce` authentication request query parameter. Enabling this property can help mitigate replay attacks. Do not enable this property if your OpenId Connect provider does not support setting `nonce` in ID token or if you work with OAuth2 provider such as `GitHub` which does not issue ID tokens.
-
addOpenidScope
@ConfigItem(defaultValueDocumentation="true") public Optional<Boolean> addOpenidScope
Add the 'openid' scope automatically to the list of scopes. This is required for OpenId Connect providers but will not work for OAuth2 providers such as Twitter OAuth2 which does not accept that scope and throws an error.
-
extraParams
@ConfigItem public Map<String,String> extraParams
Additional properties which will be added as the query parameters to the authentication redirect URI.
-
forwardParams
@ConfigItem @ConvertWith(io.quarkus.runtime.configuration.TrimmedStringConverter.class) public Optional<List<String>> forwardParams
Request URL query parameters which, if present, will be added to the authentication redirect URI.
-
cookieForceSecure
@ConfigItem(defaultValue="false") public boolean cookieForceSecure
If enabled the state, session and post logout cookies will have their 'secure' parameter set to 'true' when HTTP is used. It may be necessary when running behind an SSL terminating reverse proxy. The cookies will always be secure if HTTPS is used even if this property is set to false.
-
cookieSuffix
@ConfigItem public Optional<String> cookieSuffix
Cookie name suffix. For example, a session cookie name for the default OIDC tenant is 'q_session' but can be changed to 'q_session_test' if this property is set to 'test'.
-
cookiePath
@ConfigItem(defaultValue="/") public String cookiePath
Cookie path parameter value which, if set, will be used to set a path parameter for the session, state and post logout cookies. The `cookie-path-header` property, if set, will be checked first.
-
cookiePathHeader
@ConfigItem public Optional<String> cookiePathHeader
Cookie path header parameter value which, if set, identifies the incoming HTTP header whose value will be used to set a path parameter for the session, state and post logout cookies. If the header is missing then the `cookie-path` property will be checked.
-
cookieDomain
@ConfigItem public Optional<String> cookieDomain
Cookie domain parameter value which, if set, will be used for the session, state and post logout cookies.
-
cookieSameSite
@ConfigItem(defaultValue="lax") public OidcTenantConfig.Authentication.CookieSameSite cookieSameSite
SameSite attribute for the session cookie.
-
allowMultipleCodeFlows
@ConfigItem(defaultValue="true") public boolean allowMultipleCodeFlows
If a state cookie is present then a `state` query parameter must also be present and both the state cookie name suffix and state cookie value have to match the value of the `state` query parameter when the redirect path matches the current path. However, if multiple authentications are attempted from the same browser, for example, from the different browser tabs, then the currently available state cookie may represent the authentication flow initiated from another tab and not related to the current request. Disable this property if you would like to avoid supporting multiple authorization code flows running in the same browser.
-
failOnMissingStateParam
@ConfigItem(defaultValue="true") public boolean failOnMissingStateParam
Fail with the HTTP 401 error if the state cookie is present but no state query parameter is present. When either multiple authentications are disabled or the redirect URL matches the original request URL, the stale state cookie might remain in the browser cache from the earlier failed redirect to an OpenId Connect provider and be visible during the current request. For example, if Single-page application (SPA) uses XHR to handle redirects to the provider which does not support CORS for its authorization endpoint, the browser will block it and the state cookie created by Quarkus will remain in the browser cache. Quarkus will report an authentication failure when it will detect such an old state cookie but find no matching state query parameter. Reporting HTTP 401 error is usually the right thing to do in such cases, it will minimize a risk of the browser redirect loop but also can identify problems in the way SPA or Quarkus application manage redirects. For example, enablingjavaScriptAutoRedirect
or having the provider redirect to URL configured withredirectPath
may be needed to avoid such errors. However, setting this property to `false` may help if the above options are not suitable. It will cause a new authentication redirect to OpenId Connect provider. Please be aware doing so may increase the risk of browser redirect loops.
-
userInfoRequired
@ConfigItem(defaultValueDocumentation="false") public Optional<Boolean> userInfoRequired
If this property is set to 'true' then an OIDC UserInfo endpoint will be called. This property will be enabled if `quarkus.oidc.roles.source` is `userinfo` or `quarkus.oidc.token.verify-access-token-with-user-info` is `true` or `quarkus.oidc.authentication.id-token-required` is set to `false`, you do not have to enable this property manually in these cases.
-
sessionAgeExtension
@ConfigItem(defaultValue="5M") public Duration sessionAgeExtension
Session age extension in minutes. The user session age property is set to the value of the ID token life-span by default and the user will be redirected to the OIDC provider to re-authenticate once the session has expired. If this property is set to a non-zero value then the expired ID token can be refreshed before the session has expired. This property will be ignored if the `token.refresh-expired` property has not been enabled.
-
javaScriptAutoRedirect
@ConfigItem(defaultValue="true") public boolean javaScriptAutoRedirect
If this property is set to 'true' then a normal 302 redirect response will be returned if the request was initiated via JavaScript API such as XMLHttpRequest or Fetch and the current user needs to be (re)authenticated which may not be desirable for Single-page applications (SPA) since it automatically following the redirect may not work given that OIDC authorization endpoints typically do not support CORS. If this property is set to 'false' then a status code of '499' will be returned to allow SPA to handle the redirect manually if a request header identifying current request as a JavaScript request is found. 'X-Requested-With' request header with its value set to either `JavaScript` or `XMLHttpRequest` is expected by default if this property is enabled. You can register a custom JavaScriptRequestChecker to do a custom JavaScript request check instead.
-
idTokenRequired
@ConfigItem(defaultValueDocumentation="true") public Optional<Boolean> idTokenRequired
Requires that ID token is available when the authorization code flow completes. Disable this property only when you need to use the authorization code flow with OAuth2 providers which do not return ID token - an internal IdToken will be generated in such cases.
-
internalIdTokenLifespan
@ConfigItem(defaultValueDocumentation="5M") public Optional<Duration> internalIdTokenLifespan
Internal ID token lifespan. This property is only checked when an internal IdToken is generated when Oauth2 providers do not return IdToken.
-
pkceRequired
@ConfigItem(defaultValueDocumentation="false") public Optional<Boolean> pkceRequired
Requires that a Proof Key for Code Exchange (PKCE) is used.
-
pkceSecret
@ConfigItem @Deprecated(forRemoval=true) public Optional<String> pkceSecret
Deprecated, for removal: This API element is subject to removal in a future version.UsestateSecret
property instead.Secret which will be used to encrypt a Proof Key for Code Exchange (PKCE) code verifier in the code flow state. This secret should be at least 32 characters long.
-
stateSecret
@ConfigItem public Optional<String> stateSecret
Secret which will be used to encrypt Proof Key for Code Exchange (PKCE) code verifier and/or nonce in the code flow state. This secret should be at least 32 characters long. If this secret is not set, the client secret configured with either `quarkus.oidc.credentials.secret` or `quarkus.oidc.credentials.client-secret.value` will be checked. Finally, `quarkus.oidc.credentials.jwt.secret` which can be used for `client_jwt_secret` authentication will be checked. Client secret will not be used as a state encryption secret if it is less than 32 characters long. The secret will be auto-generated if it remains uninitialized after checking all of these properties. Error will be reported if the secret length is less than 16 characters.
-
-
Method Detail
-
setInternalIdTokenLifespan
public void setInternalIdTokenLifespan(Duration internalIdTokenLifespan)
-
setPkceRequired
public void setPkceRequired(boolean pkceRequired)
-
getPkceSecret
@Deprecated(forRemoval=true) public Optional<String> getPkceSecret()
Deprecated, for removal: This API element is subject to removal in a future version.
-
setPkceSecret
@Deprecated(forRemoval=true) public void setPkceSecret(String pkceSecret)
Deprecated, for removal: This API element is subject to removal in a future version.
-
setErrorPath
public void setErrorPath(String errorPath)
-
isJavaScriptAutoRedirect
public boolean isJavaScriptAutoRedirect()
-
setJavaScriptAutoredirect
public void setJavaScriptAutoredirect(boolean autoRedirect)
-
setRedirectPath
public void setRedirectPath(String redirectPath)
-
setAddOpenidScope
public void setAddOpenidScope(boolean addOpenidScope)
-
setForceRedirectHttpsScheme
public void setForceRedirectHttpsScheme(boolean forceRedirectHttpsScheme)
-
isRestorePathAfterRedirect
public boolean isRestorePathAfterRedirect()
-
setRestorePathAfterRedirect
public void setRestorePathAfterRedirect(boolean restorePathAfterRedirect)
-
isCookieForceSecure
public boolean isCookieForceSecure()
-
setCookieForceSecure
public void setCookieForceSecure(boolean cookieForceSecure)
-
getCookiePath
public String getCookiePath()
-
setCookiePath
public void setCookiePath(String cookiePath)
-
setCookieDomain
public void setCookieDomain(String cookieDomain)
-
setUserInfoRequired
public void setUserInfoRequired(boolean userInfoRequired)
-
isRemoveRedirectParameters
public boolean isRemoveRedirectParameters()
-
setRemoveRedirectParameters
public void setRemoveRedirectParameters(boolean removeRedirectParameters)
-
isVerifyAccessToken
public boolean isVerifyAccessToken()
-
setVerifyAccessToken
public void setVerifyAccessToken(boolean verifyAccessToken)
-
getSessionAgeExtension
public Duration getSessionAgeExtension()
-
setSessionAgeExtension
public void setSessionAgeExtension(Duration sessionAgeExtension)
-
setCookiePathHeader
public void setCookiePathHeader(String cookiePathHeader)
-
setIdTokenRequired
public void setIdTokenRequired(boolean idTokenRequired)
-
setCookieSuffix
public void setCookieSuffix(String cookieSuffix)
-
getResponseMode
public Optional<OidcTenantConfig.Authentication.ResponseMode> getResponseMode()
-
setResponseMode
public void setResponseMode(OidcTenantConfig.Authentication.ResponseMode responseMode)
-
getCookieSameSite
public OidcTenantConfig.Authentication.CookieSameSite getCookieSameSite()
-
setCookieSameSite
public void setCookieSameSite(OidcTenantConfig.Authentication.CookieSameSite cookieSameSite)
-
isAllowMultipleCodeFlows
public boolean isAllowMultipleCodeFlows()
-
setAllowMultipleCodeFlows
public void setAllowMultipleCodeFlows(boolean allowMultipleCodeFlows)
-
isNonceRequired
public boolean isNonceRequired()
-
setNonceRequired
public void setNonceRequired(boolean nonceRequired)
-
-