Package io.quarkus.oidc

Class OidcTenantConfig.Authentication

java.lang.Object
io.quarkus.oidc.OidcTenantConfig.Authentication
Enclosing class:
OidcTenantConfig
public static class OidcTenantConfig.Authentication extends Object
Defines the authorization request properties when authenticating users using the Authorization Code Grant Type.

  • Field Details

    • responseMode

      @ConfigItem(defaultValueDocumentation="query") public Optional<OidcTenantConfig.Authentication.ResponseMode> responseMode
      Authorization code flow response mode.

    • redirectPath

      @ConfigItem public Optional<String> redirectPath
      The relative path for calculating a `redirect_uri` query parameter. It has to start from a forward slash and is appended to the request URI's host and port. For example, if the current request URI is `https://localhost:8080/service`, a `redirect_uri` parameter is set to `https://localhost:8080/` if this property is set to `/` and be the same as the request URI if this property has not been configured. Note the original request URI is restored after the user has authenticated if `restorePathAfterRedirect` is set to `true`.

    • restorePathAfterRedirect

      @ConfigItem(defaultValue="false") public boolean restorePathAfterRedirect
      If this property is set to `true`, the original request URI which was used before the authentication is restored after the user has been redirected back to the application. Note if `redirectPath` property is not set, the original request URI is restored even if this property is disabled.

    • removeRedirectParameters

      @ConfigItem(defaultValue="true") public boolean removeRedirectParameters
      Remove the query parameters such as `code` and `state` set by the OIDC server on the redirect URI after the user has authenticated by redirecting a user to the same URI but without the query parameters.

    • errorPath

      @ConfigItem public Optional<String> errorPath
      Relative path to the public endpoint which processes the error response from the OIDC authorization endpoint. If the user authentication has failed, the OIDC provider returns an `error` and an optional `error_description` parameters, instead of the expected authorization `code`. If this property is set, the user is redirected to the endpoint which can return a user-friendly error description page. It has to start from a forward slash and is appended to the request URI's host and port. For example, if it is set as `/error` and the current request URI is `https://localhost:8080/callback?error=invalid_scope`, a redirect is made to `https://localhost:8080/error?error=invalid_scope`. If this property is not set, HTTP 401 status is returned in case of the user authentication failure.

    • verifyAccessToken

      @ConfigItem(defaultValue="false") public boolean verifyAccessToken
      Both ID and access tokens are fetched from the OIDC provider as part of the authorization code flow. ID token is always verified on every user request as the primary token which is used to represent the principal and extract the roles. Access token is not verified by default since it is meant to be propagated to the downstream services. The verification of the access token should be enabled if it is injected as a JWT token. Access tokens obtained as part of the code flow are always verified if `quarkus.oidc.roles.source` property is set to `accesstoken` which means the authorization decision is based on the roles extracted from the access token. Bearer access tokens are always verified.

    • forceRedirectHttpsScheme

      @ConfigItem(defaultValueDocumentation="false") public Optional<Boolean> forceRedirectHttpsScheme
      Force `https` as the `redirect_uri` parameter scheme when running behind an SSL/TLS terminating reverse proxy. This property, if enabled, also affects the logout `post_logout_redirect_uri` and the local redirect requests.

    • scopes

      @ConfigItem public Optional<List<String>> scopes
      List of scopes

    • nonceRequired

      @ConfigItem(defaultValue="false") public boolean nonceRequired
      Require that ID token includes a `nonce` claim which must match `nonce` authentication request query parameter. Enabling this property can help mitigate replay attacks. Do not enable this property if your OpenId Connect provider does not support setting `nonce` in ID token or if you work with OAuth2 provider such as `GitHub` which does not issue ID tokens.

    • addOpenidScope

      @ConfigItem(defaultValueDocumentation="true") public Optional<Boolean> addOpenidScope
      Add the `openid` scope automatically to the list of scopes. This is required for OpenId Connect providers, but does not work for OAuth2 providers such as Twitter OAuth2, which do not accept this scope and throw errors.

    • extraParams

      @ConfigItem public Map<String,String> extraParams
      Additional properties added as query parameters to the authentication redirect URI.

    • forwardParams

      @ConfigItem @ConvertWith(io.quarkus.runtime.configuration.TrimmedStringConverter.class) public Optional<List<String>> forwardParams
      Request URL query parameters which, if present, are added to the authentication redirect URI.

    • cookieForceSecure

      @ConfigItem(defaultValue="false") public boolean cookieForceSecure
      If enabled the state, session, and post logout cookies have their `secure` parameter set to `true` when HTTP is used. It might be necessary when running behind an SSL/TLS terminating reverse proxy. The cookies are always secure if HTTPS is used, even if this property is set to false.

    • cookieSuffix

      @ConfigItem public Optional<String> cookieSuffix
      Cookie name suffix. For example, a session cookie name for the default OIDC tenant is `q_session` but can be changed to `q_session_test` if this property is set to `test`.

    • cookiePath

      @ConfigItem(defaultValue="/") public String cookiePath
      Cookie path parameter value which, if set, is used to set a path parameter for the session, state and post logout cookies. The `cookie-path-header` property, if set, is checked first.

    • cookiePathHeader

      @ConfigItem public Optional<String> cookiePathHeader
      Cookie path header parameter value which, if set, identifies the incoming HTTP header whose value is used to set a path parameter for the session, state and post logout cookies. If the header is missing, the `cookie-path` property is checked.

    • cookieDomain

      @ConfigItem public Optional<String> cookieDomain
      Cookie domain parameter value which, if set, is used for the session, state and post logout cookies.

    • cookieSameSite

      @ConfigItem(defaultValue="lax") public OidcTenantConfig.Authentication.CookieSameSite cookieSameSite
      SameSite attribute for the session cookie.

    • allowMultipleCodeFlows

      @ConfigItem(defaultValue="true") public boolean allowMultipleCodeFlows
      If a state cookie is present, a `state` query parameter must also be present and both the state cookie name suffix and state cookie value must match the value of the `state` query parameter when the redirect path matches the current path. However, if multiple authentications are attempted from the same browser, for example, from the different browser tabs, then the currently available state cookie might represent the authentication flow initiated from another tab and not related to the current request. Disable this property to permit only a single authorization code flow in the same browser.

    • failOnMissingStateParam

      @ConfigItem(defaultValue="false") public boolean failOnMissingStateParam
      Fail with the HTTP 401 error if the state cookie is present but no state query parameter is present.

      When either multiple authentications are disabled or the redirect URL matches the original request URL, the stale state cookie might remain in the browser cache from the earlier failed redirect to an OpenId Connect provider and be visible during the current request. For example, if Single-page application (SPA) uses XHR to handle redirects to the provider which does not support CORS for its authorization endpoint, the browser blocks it and the state cookie created by Quarkus remains in the browser cache. Quarkus reports an authentication failure when it detects such an old state cookie but find no matching state query parameter.

      Reporting HTTP 401 error is usually the right thing to do in such cases, it minimizes a risk of the browser redirect loop but also can identify problems in the way SPA or Quarkus application manage redirects. For example, enabling javaScriptAutoRedirect or having the provider redirect to URL configured with redirectPath might be needed to avoid such errors.

      However, setting this property to `false` might help if the above options are not suitable. It causes a new authentication redirect to OpenId Connect provider. Doing so might increase the risk of browser redirect loops.

    • userInfoRequired

      @ConfigItem(defaultValueDocumentation="false") public Optional<Boolean> userInfoRequired
      If this property is set to `true`, an OIDC UserInfo endpoint is called. This property is enabled if `quarkus.oidc.roles.source` is `userinfo`. or `quarkus.oidc.token.verify-access-token-with-user-info` is `true` or `quarkus.oidc.authentication.id-token-required` is set to `false`, you do not need to enable this property manually in these cases.

    • sessionAgeExtension

      @ConfigItem(defaultValue="5M") public Duration sessionAgeExtension
      Session age extension in minutes. The user session age property is set to the value of the ID token life-span by default and the user is redirected to the OIDC provider to re-authenticate once the session has expired. If this property is set to a nonzero value, then the expired ID token can be refreshed before the session has expired. This property is ignored if the `token.refresh-expired` property has not been enabled.

    • javaScriptAutoRedirect

      @ConfigItem(defaultValue="true") public boolean javaScriptAutoRedirect
      If this property is set to `true`, a normal 302 redirect response is returned if the request was initiated by a JavaScript API such as XMLHttpRequest or Fetch and the current user needs to be (re)authenticated, which might not be desirable for Single-page applications (SPA) since it automatically following the redirect might not work given that OIDC authorization endpoints typically do not support CORS.

      If this property is set to `false`, a status code of `499` is returned to allow SPA to handle the redirect manually if a request header identifying current request as a JavaScript request is found. `X-Requested-With` request header with its value set to either `JavaScript` or `XMLHttpRequest` is expected by default if this property is enabled. You can register a custom JavaScriptRequestChecker to do a custom JavaScript request check instead.

    • idTokenRequired

      @ConfigItem(defaultValueDocumentation="true") public Optional<Boolean> idTokenRequired
      Requires that ID token is available when the authorization code flow completes. Disable this property only when you need to use the authorization code flow with OAuth2 providers which do not return ID token - an internal IdToken is generated in such cases.

    • internalIdTokenLifespan

      @ConfigItem(defaultValueDocumentation="5M") public Optional<Duration> internalIdTokenLifespan
      Internal ID token lifespan. This property is only checked when an internal IdToken is generated when Oauth2 providers do not return IdToken.

    • pkceRequired

      @ConfigItem(defaultValueDocumentation="false") public Optional<Boolean> pkceRequired
      Requires that a Proof Key for Code Exchange (PKCE) is used.

    • pkceSecret

      @ConfigItem @Deprecated(forRemoval=true) public Optional<String> pkceSecret
      Deprecated, for removal: This API element is subject to removal in a future version.
      This field is deprecated. Use stateSecret instead.
      Secret used to encrypt a Proof Key for Code Exchange (PKCE) code verifier in the code flow state. This secret should be at least 32 characters long.

    • stateSecret

      @ConfigItem public Optional<String> stateSecret
      Secret used to encrypt Proof Key for Code Exchange (PKCE) code verifier and/or nonce in the code flow state. This secret should be at least 32 characters long.

      If this secret is not set, the client secret configured with either `quarkus.oidc.credentials.secret` or `quarkus.oidc.credentials.client-secret.value` is checked. Finally, `quarkus.oidc.credentials.jwt.secret` which can be used for `client_jwt_secret` authentication is checked. A client secret is not be used as a state encryption secret if it is less than 32 characters long.

      The secret is auto-generated if it remains uninitialized after checking all of these properties.

      Error is reported if the secret length is less than 16 characters.

  • Constructor Details

    • Authentication

      public Authentication()

  • Method Details

    • getInternalIdTokenLifespan

      public Optional<Duration> getInternalIdTokenLifespan()

    • setInternalIdTokenLifespan

      public void setInternalIdTokenLifespan(Duration internalIdTokenLifespan)

    • isPkceRequired

      public Optional<Boolean> isPkceRequired()

    • setPkceRequired

      public void setPkceRequired(boolean pkceRequired)

    • getPkceSecret

      @Deprecated(forRemoval=true) public Optional<String> getPkceSecret()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setPkceSecret

      @Deprecated(forRemoval=true) public void setPkceSecret(String pkceSecret)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getErrorPath

      public Optional<String> getErrorPath()

    • setErrorPath

      public void setErrorPath(String errorPath)

    • isJavaScriptAutoRedirect

      public boolean isJavaScriptAutoRedirect()

    • setJavaScriptAutoredirect

      public void setJavaScriptAutoredirect(boolean autoRedirect)

    • getRedirectPath

      public Optional<String> getRedirectPath()

    • setRedirectPath

      public void setRedirectPath(String redirectPath)

    • getScopes

      public Optional<List<String>> getScopes()

    • setScopes

      public void setScopes(List<String> scopes)

    • getExtraParams

      public Map<String,String> getExtraParams()

    • setExtraParams

      public void setExtraParams(Map<String,String> extraParams)

    • setAddOpenidScope

      public void setAddOpenidScope(boolean addOpenidScope)

    • isAddOpenidScope

      public Optional<Boolean> isAddOpenidScope()

    • isForceRedirectHttpsScheme

      public Optional<Boolean> isForceRedirectHttpsScheme()

    • setForceRedirectHttpsScheme

      public void setForceRedirectHttpsScheme(boolean forceRedirectHttpsScheme)

    • isRestorePathAfterRedirect

      public boolean isRestorePathAfterRedirect()

    • setRestorePathAfterRedirect

      public void setRestorePathAfterRedirect(boolean restorePathAfterRedirect)

    • isCookieForceSecure

      public boolean isCookieForceSecure()

    • setCookieForceSecure

      public void setCookieForceSecure(boolean cookieForceSecure)

    • getCookiePath

      public String getCookiePath()

    • setCookiePath

      public void setCookiePath(String cookiePath)

    • getCookieDomain

      public Optional<String> getCookieDomain()

    • setCookieDomain

      public void setCookieDomain(String cookieDomain)

    • isUserInfoRequired

      public Optional<Boolean> isUserInfoRequired()

    • setUserInfoRequired

      public void setUserInfoRequired(boolean userInfoRequired)

    • isRemoveRedirectParameters

      public boolean isRemoveRedirectParameters()

    • setRemoveRedirectParameters

      public void setRemoveRedirectParameters(boolean removeRedirectParameters)

    • isVerifyAccessToken

      public boolean isVerifyAccessToken()

    • setVerifyAccessToken

      public void setVerifyAccessToken(boolean verifyAccessToken)

    • getSessionAgeExtension

      public Duration getSessionAgeExtension()

    • setSessionAgeExtension

      public void setSessionAgeExtension(Duration sessionAgeExtension)

    • getCookiePathHeader

      public Optional<String> getCookiePathHeader()

    • setCookiePathHeader

      public void setCookiePathHeader(String cookiePathHeader)

    • isIdTokenRequired

      public Optional<Boolean> isIdTokenRequired()

    • setIdTokenRequired

      public void setIdTokenRequired(boolean idTokenRequired)

    • getCookieSuffix

      public Optional<String> getCookieSuffix()

    • setCookieSuffix

      public void setCookieSuffix(String cookieSuffix)

    • getResponseMode

      public Optional<OidcTenantConfig.Authentication.ResponseMode> getResponseMode()

    • setResponseMode

      public void setResponseMode(OidcTenantConfig.Authentication.ResponseMode responseMode)

    • getForwardParams

      public Optional<List<String>> getForwardParams()

    • setForwardParams

      public void setForwardParams(List<String> forwardParams)

    • getCookieSameSite

      public OidcTenantConfig.Authentication.CookieSameSite getCookieSameSite()

    • setCookieSameSite

      public void setCookieSameSite(OidcTenantConfig.Authentication.CookieSameSite cookieSameSite)

    • isAllowMultipleCodeFlows

      public boolean isAllowMultipleCodeFlows()

    • setAllowMultipleCodeFlows

      public void setAllowMultipleCodeFlows(boolean allowMultipleCodeFlows)

    • isNonceRequired

      public boolean isNonceRequired()

    • setNonceRequired

      public void setNonceRequired(boolean nonceRequired)

    • getStateSecret

      public Optional<String> getStateSecret()

    • setStateSecret

      public void setStateSecret(Optional<String> stateSecret)