Package io.quarkus.oidc.common.runtime.config

Interface OidcClientCommonConfig.Credentials.Jwt

All Known Implementing Classes:
OidcClientCommonConfig.Credentials.Jwt
Enclosing interface:
OidcClientCommonConfig.Credentials
public static interface OidcClientCommonConfig.Credentials.Jwt
Supports the client authentication `client_secret_jwt` and `private_key_jwt` methods, which involves sending a JWT token assertion signed with a client secret or private key. JWT Bearer client authentication is also supported.
See Also:

  • Method Details

    • source

      @WithDefault("client") OidcClientCommonConfig.Credentials.Jwt.Source source()
      JWT token source: OIDC provider client or an existing JWT bearer token.

    • tokenPath

      Optional<Path> tokenPath()
      Path to a file with a JWT bearer token that should be used as a client assertion. This path can only be set when JWT source (source()) is set to OidcClientCommonConfig.Credentials.Jwt.Source.BEARER.

    • secret

      Optional<String> secret()
      If provided, indicates that JWT is signed using a secret key. It is mutually exclusive with key(), keyFile() and
      invalid reference 
      #keyStore
      properties.

    • secretProvider

      OidcClientCommonConfig.Credentials.Provider secretProvider()
      If provided, indicates that JWT is signed using a secret key provided by Secret CredentialsProvider.

    • key

      Optional<String> key()
      String representation of a private key. If provided, indicates that JWT is signed using a private key in PEM or JWK format. It is mutually exclusive with secret(), keyFile() and
      invalid reference 
      #keyStore
      properties. You can use the signatureAlgorithm() property to override the default key algorithm, `RS256`.

    • keyFile

      Optional<String> keyFile()
      If provided, indicates that JWT is signed using a private key in PEM or JWK format. It is mutually exclusive with secret(), key() and
      invalid reference 
      #keyStore
      properties. You can use the signatureAlgorithm() property to override the default key algorithm, `RS256`.

    • keyStoreFile

      Optional<String> keyStoreFile()
      If provided, indicates that JWT is signed using a private key from a keystore. It is mutually exclusive with secret(), key() and keyFile() properties.

    • keyStorePassword

      Optional<String> keyStorePassword()
      A parameter to specify the password of the keystore file.

    • keyId

      Optional<String> keyId()
      The private key id or alias.

    • keyPassword

      Optional<String> keyPassword()
      The private key password.

    • audience

      Optional<String> audience()
      The JWT audience (`aud`) claim value. By default, the audience is set to the address of the OpenId Connect Provider's token endpoint.

    • tokenKeyId

      Optional<String> tokenKeyId()
      The key identifier of the signing key added as a JWT `kid` header.

    • issuer

      Optional<String> issuer()
      The issuer of the signing key added as a JWT `iss` claim. The default value is the client id.

    • subject

      Optional<String> subject()
      Subject of the signing key added as a JWT `sub` claim The default value is the client id.

    • claims

      @ConfigDocMapKey("claim-name") Map<String,String> claims()
      Additional claims.

    • signatureAlgorithm

      Optional<String> signatureAlgorithm()
      The signature algorithm used for the keyFile() property. Supported values: `RS256` (default), `RS384`, `RS512`, `PS256`, `PS384`, `PS512`, `ES256`, `ES384`, `ES512`, `HS256`, `HS384`, `HS512`.

    • lifespan

      @WithDefault("10") int lifespan()
      The JWT lifespan in seconds. This value is added to the time at which the JWT was issued to calculate the expiration time.

    • assertion

      @WithDefault("false") boolean assertion()
      If true then the client authentication token is a JWT bearer grant assertion. Instead of producing 'client_assertion' and 'client_assertion_type' form properties, only 'assertion' is produced. This option is only supported by the OIDC client extension.