Package io.quarkus.oidc.common.runtime

Class OidcClientCommonConfig.Credentials.Jwt

java.lang.Object

io.quarkus.oidc.common.runtime.OidcClientCommonConfig.Credentials.Jwt

All Implemented Interfaces:

OidcClientCommonConfig.Credentials.Jwt

Enclosing class:

OidcClientCommonConfig.Credentials

public static class OidcClientCommonConfig.Credentials.Jwt
extends Object
implements OidcClientCommonConfig.Credentials.Jwt

Supports the client authentication `client_secret_jwt` and `private_key_jwt` methods, which involves sending a JWT token assertion signed with a client secret or private key. JWT Bearer client authentication is also supported.

See Also:

• https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	OidcClientCommonConfig.Credentials.Jwt.Source

Field Summary

Fields

Modifier and Type	Field	Description
boolean	assertion	If true then the client authentication token is a JWT bearer grant assertion.
Optional<String>	audience	The JWT audience (`aud`) claim value.
Map<String,String>	claims	Additional claims.
Optional<String>	issuer	The issuer of the signing key added as a JWT `iss` claim.
Optional<String>	key	String representation of a private key.
Optional<String>	keyFile	If provided, indicates that JWT is signed using a private key in PEM or JWK format.
Optional<String>	keyId	The private key id or alias.
Optional<String>	keyPassword	The private key password.
Optional<String>	keyStoreFile	If provided, indicates that JWT is signed using a private key from a keystore.
Optional<String>	keyStorePassword	A parameter to specify the password of the keystore file.
int	lifespan	The JWT lifespan in seconds.
Optional<String>	secret	If provided, indicates that JWT is signed using a secret key.
OidcClientCommonConfig.Credentials.Provider	secretProvider	If provided, indicates that JWT is signed using a secret key provided by Secret CredentialsProvider.
Optional<String>	signatureAlgorithm	The signature algorithm used for the keyFile property.
OidcClientCommonConfig.Credentials.Jwt.Source	source	JWT token source: OIDC provider client or an existing JWT bearer token.
Optional<String>	subject	Subject of the signing key added as a JWT `sub` claim The default value is the client id.
Optional<String>	tokenKeyId	The key identifier of the signing key added as a JWT `kid` header.

Constructor Summary

Constructors

Constructor	Description
Jwt()

Method Summary

Modifier and Type	Method	Description
boolean	assertion()	If true then the client authentication token is a JWT bearer grant assertion.
Optional<String>	audience()	The JWT audience (`aud`) claim value.
Map<String,String>	claims()	Additional claims.
Optional<String>	getAudience()
Map<String,String>	getClaims()
Optional<String>	getKey()
Optional<String>	getKeyFile()
int	getLifespan()
Optional<String>	getSecret()
OidcClientCommonConfig.Credentials.Provider	getSecretProvider()
Optional<String>	getSignatureAlgorithm()
OidcClientCommonConfig.Credentials.Jwt.Source	getSource()
Optional<String>	getTokenKeyId()
boolean	isAssertion()
Optional<String>	issuer()	The issuer of the signing key added as a JWT `iss` claim.
Optional<String>	key()	String representation of a private key.
Optional<String>	keyFile()	If provided, indicates that JWT is signed using a private key in PEM or JWK format.
Optional<String>	keyId()	The private key id or alias.
Optional<String>	keyPassword()	The private key password.
Optional<String>	keyStoreFile()	If provided, indicates that JWT is signed using a private key from a keystore.
Optional<String>	keyStorePassword()	A parameter to specify the password of the keystore file.
int	lifespan()	The JWT lifespan in seconds.
Optional<String>	secret()	If provided, indicates that JWT is signed using a secret key.
OidcClientCommonConfig.Credentials.Provider	secretProvider()	If provided, indicates that JWT is signed using a secret key provided by Secret CredentialsProvider.
void	setAssertion(boolean assertion)
void	setAudience(String audience)
void	setClaims(Map<String,String> claims)
void	setKey(String key)
void	setKeyFile(String keyFile)
void	setLifespan(int lifespan)
void	setSecret(String secret)
void	setSecretProvider(OidcClientCommonConfig.Credentials.Provider secretProvider)
void	setSignatureAlgorithm(String signatureAlgorithm)
void	setSource(OidcClientCommonConfig.Credentials.Jwt.Source source)
void	setTokenKeyId(String tokenKeyId)
Optional<String>	signatureAlgorithm()	The signature algorithm used for the OidcClientCommonConfig.Credentials.Jwt.keyFile() property.
OidcClientCommonConfig.Credentials.Jwt.Source	source()	JWT token source: OIDC provider client or an existing JWT bearer token.
Optional<String>	subject()	Subject of the signing key added as a JWT `sub` claim The default value is the client id.
Optional<String>	tokenKeyId()	The key identifier of the signing key added as a JWT `kid` header.
Optional<Path>	tokenPath()	Path to a file with a JWT bearer token that should be used as a client assertion.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

source

public OidcClientCommonConfig.Credentials.Jwt.Source source

JWT token source: OIDC provider client or an existing JWT bearer token.

secret

public Optional<String> secret

If provided, indicates that JWT is signed using a secret key. It is mutually exclusive with key, keyFile and

invalid reference

#keyStore

properties.

secretProvider

public OidcClientCommonConfig.Credentials.Provider secretProvider

If provided, indicates that JWT is signed using a secret key provided by Secret CredentialsProvider.

key

public Optional<String> key

String representation of a private key. If provided, indicates that JWT is signed using a private key in PEM or JWK format. It is mutually exclusive with secret, keyFile and

invalid reference

#keyStore

properties. You can use the signatureAlgorithm property to override the default key algorithm, `RS256`.

keyFile

public Optional<String> keyFile

If provided, indicates that JWT is signed using a private key in PEM or JWK format. It is mutually exclusive with secret, key and

invalid reference

#keyStore

properties. You can use the signatureAlgorithm property to override the default key algorithm, `RS256`.

keyStoreFile

public Optional<String> keyStoreFile

If provided, indicates that JWT is signed using a private key from a keystore. It is mutually exclusive with secret, key and keyFile properties.

keyStorePassword

public Optional<String> keyStorePassword

A parameter to specify the password of the keystore file.

keyId

public Optional<String> keyId

The private key id or alias.

keyPassword

public Optional<String> keyPassword

The private key password.

audience

public Optional<String> audience

The JWT audience (`aud`) claim value. By default, the audience is set to the address of the OpenId Connect Provider's token endpoint.

tokenKeyId

public Optional<String> tokenKeyId

The key identifier of the signing key added as a JWT `kid` header.

issuer

public Optional<String> issuer

The issuer of the signing key added as a JWT `iss` claim. The default value is the client id.

subject

public Optional<String> subject

Subject of the signing key added as a JWT `sub` claim The default value is the client id.

claims

public Map<String,String> claims

Additional claims.

signatureAlgorithm

public Optional<String> signatureAlgorithm

The signature algorithm used for the keyFile property. Supported values: `RS256` (default), `RS384`, `RS512`, `PS256`, `PS384`, `PS512`, `ES256`, `ES384`, `ES512`, `HS256`, `HS384`, `HS512`.

lifespan

public int lifespan

The JWT lifespan in seconds. This value is added to the time at which the JWT was issued to calculate the expiration time.

assertion

public boolean assertion

If true then the client authentication token is a JWT bearer grant assertion. Instead of producing 'client_assertion' and 'client_assertion_type' form properties, only 'assertion' is produced. This option is only supported by the OIDC client extension.

Constructor Details

Jwt

public Jwt()

Method Details

source

public OidcClientCommonConfig.Credentials.Jwt.Source source()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

JWT token source: OIDC provider client or an existing JWT bearer token.

Specified by:

source in interface OidcClientCommonConfig.Credentials.Jwt

tokenPath

public Optional<Path> tokenPath()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

Path to a file with a JWT bearer token that should be used as a client assertion. This path can only be set when JWT source (OidcClientCommonConfig.Credentials.Jwt.source()) is set to OidcClientCommonConfig.Credentials.Jwt.Source.BEARER.

Specified by:

tokenPath in interface OidcClientCommonConfig.Credentials.Jwt

secret

public Optional<String> secret()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

If provided, indicates that JWT is signed using a secret key. It is mutually exclusive with OidcClientCommonConfig.Credentials.Jwt.key(), OidcClientCommonConfig.Credentials.Jwt.keyFile() and

invalid reference

#keyStore

properties.

Specified by:

secret in interface OidcClientCommonConfig.Credentials.Jwt

secretProvider

public OidcClientCommonConfig.Credentials.Provider secretProvider()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

If provided, indicates that JWT is signed using a secret key provided by Secret CredentialsProvider.

Specified by:

secretProvider in interface OidcClientCommonConfig.Credentials.Jwt

key

public Optional<String> key()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

String representation of a private key. If provided, indicates that JWT is signed using a private key in PEM or JWK format. It is mutually exclusive with OidcClientCommonConfig.Credentials.Jwt.secret(), OidcClientCommonConfig.Credentials.Jwt.keyFile() and

invalid reference

#keyStore

properties. You can use the OidcClientCommonConfig.Credentials.Jwt.signatureAlgorithm() property to override the default key algorithm, `RS256`.

Specified by:

key in interface OidcClientCommonConfig.Credentials.Jwt

keyFile

public Optional<String> keyFile()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

If provided, indicates that JWT is signed using a private key in PEM or JWK format. It is mutually exclusive with OidcClientCommonConfig.Credentials.Jwt.secret(), OidcClientCommonConfig.Credentials.Jwt.key() and

invalid reference

#keyStore

properties. You can use the OidcClientCommonConfig.Credentials.Jwt.signatureAlgorithm() property to override the default key algorithm, `RS256`.

Specified by:

keyFile in interface OidcClientCommonConfig.Credentials.Jwt

keyStoreFile

public Optional<String> keyStoreFile()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

If provided, indicates that JWT is signed using a private key from a keystore. It is mutually exclusive with OidcClientCommonConfig.Credentials.Jwt.secret(), OidcClientCommonConfig.Credentials.Jwt.key() and OidcClientCommonConfig.Credentials.Jwt.keyFile() properties.

Specified by:

keyStoreFile in interface OidcClientCommonConfig.Credentials.Jwt

keyStorePassword

public Optional<String> keyStorePassword()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

A parameter to specify the password of the keystore file.

Specified by:

keyStorePassword in interface OidcClientCommonConfig.Credentials.Jwt

keyId

public Optional<String> keyId()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

The private key id or alias.

Specified by:

keyId in interface OidcClientCommonConfig.Credentials.Jwt

keyPassword

public Optional<String> keyPassword()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

The private key password.

Specified by:

keyPassword in interface OidcClientCommonConfig.Credentials.Jwt

audience

public Optional<String> audience()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

The JWT audience (`aud`) claim value. By default, the audience is set to the address of the OpenId Connect Provider's token endpoint.

Specified by:

audience in interface OidcClientCommonConfig.Credentials.Jwt

tokenKeyId

public Optional<String> tokenKeyId()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

The key identifier of the signing key added as a JWT `kid` header.

Specified by:

tokenKeyId in interface OidcClientCommonConfig.Credentials.Jwt

issuer

public Optional<String> issuer()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

The issuer of the signing key added as a JWT `iss` claim. The default value is the client id.

Specified by:

issuer in interface OidcClientCommonConfig.Credentials.Jwt

subject

public Optional<String> subject()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

Subject of the signing key added as a JWT `sub` claim The default value is the client id.

Specified by:

subject in interface OidcClientCommonConfig.Credentials.Jwt

claims

public Map<String,String> claims()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

Additional claims.

Specified by:

claims in interface OidcClientCommonConfig.Credentials.Jwt

signatureAlgorithm

public Optional<String> signatureAlgorithm()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

The signature algorithm used for the OidcClientCommonConfig.Credentials.Jwt.keyFile() property. Supported values: `RS256` (default), `RS384`, `RS512`, `PS256`, `PS384`, `PS512`, `ES256`, `ES384`, `ES512`, `HS256`, `HS384`, `HS512`.

Specified by:

signatureAlgorithm in interface OidcClientCommonConfig.Credentials.Jwt

lifespan

public int lifespan()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

The JWT lifespan in seconds. This value is added to the time at which the JWT was issued to calculate the expiration time.

Specified by:

lifespan in interface OidcClientCommonConfig.Credentials.Jwt

assertion

public boolean assertion()

Description copied from interface: OidcClientCommonConfig.Credentials.Jwt

If true then the client authentication token is a JWT bearer grant assertion. Instead of producing 'client_assertion' and 'client_assertion_type' form properties, only 'assertion' is produced. This option is only supported by the OIDC client extension.

Specified by:

assertion in interface OidcClientCommonConfig.Credentials.Jwt

getSecret

public Optional<String> getSecret()

setSecret

public void setSecret(String secret)

getLifespan

public int getLifespan()

setLifespan

public void setLifespan(int lifespan)

getTokenKeyId

public Optional<String> getTokenKeyId()

setTokenKeyId

public void setTokenKeyId(String tokenKeyId)

getSecretProvider

public OidcClientCommonConfig.Credentials.Provider getSecretProvider()

setSecretProvider

public void setSecretProvider(OidcClientCommonConfig.Credentials.Provider secretProvider)

getSignatureAlgorithm

public Optional<String> getSignatureAlgorithm()

setSignatureAlgorithm

public void setSignatureAlgorithm(String signatureAlgorithm)

getAudience

public Optional<String> getAudience()

setAudience

public void setAudience(String audience)

getKey

public Optional<String> getKey()

setKey

public void setKey(String key)

getKeyFile

public Optional<String> getKeyFile()

setKeyFile

public void setKeyFile(String keyFile)

getClaims

public Map<String,String> getClaims()

setClaims

public void setClaims(Map<String,String> claims)

getSource

public OidcClientCommonConfig.Credentials.Jwt.Source getSource()

setSource

public void setSource(OidcClientCommonConfig.Credentials.Jwt.Source source)

isAssertion

public boolean isAssertion()

setAssertion

public void setAssertion(boolean assertion)