Top Description Methods
jakarta.security.enterprise.authentication.mechanism.http

public @Interface OpenIdAuthenticationMechanismDefinition

extends Annotation
Annotations
@Target:TYPE, METHOD
@Retention:RUNTIME
Static Imports
jakarta.security.enterprise.authentication.mechanism.http.openid.OpenIdConstant.CODE, .OpenIdConstant.EMAIL_SCOPE, .OpenIdConstant.OPENID_SCOPE, .OpenIdConstant.PROFILE_SCOPE, java.lang.annotation.ElementType.METHOD, .ElementType.TYPE, .RetentionPolicy.RUNTIME
Annotation used to define a container authentication mechanism that implements the Authorization Code flow and Refresh tokens as defined by the OpenId Connect specification and make that implementation available as an enabled CDI bean.

Attributes on this annotation make up the OpenID connect client configuration. Expression Language expressions in attributes of type String are evaluated.

It can make use of the user endpoint for retrieving claims about the user.

Note that in the OpenID terminology the authentication mechanism becomes a "Relying Party" (RP) that redirects the "End-User" (caller) to an "OpenId Connect Provider" (Identity Provider). Authentication takes place between the user and the Identity Provider, where the result of this authentication is communicated back to the authentication mechanism.

This is depicted in the following non-normative diagram: 

 +--------+                                                       +--------+
 |        |                                                       |        |
 |        |---------------(1) Authentication Request------------->|        |
 |        |                                                       |        |
 |        |       +--------+                                      |        |
 |        |       |  End-  |<--(2) Authenticates the End-User---->|        |
 |   RP   |       |  User  |                                      |   OP   |
 |        |       +--------+                                      |        |
 |        |                                                       |        |
 |        |<---------(3) Returns Authorization code---------------|        |
 |        |                                                       |        |
 |        |---------(3b)                                          |        |
 |        |           | Redirect to original resource (if any)    |        |
 |        |<----------+                                           |        |
 |        |                                                       |        |
 |        |------------------------------------------------------>|        |
 |        |   (4) Request to TokenEndpoint for Access / Id Token  |        |
 | OpenId |<------------------------------------------------------| OpenId |
 | Connect|                                                       | Connect|
 | Client | ----------------------------------------------------->|Provider|
 |        |   (5) Fetch JWKS to validate ID Token                 |        |
 |        |<------------------------------------------------------|        |
 |        |                                                       |        |
 |        |------------------------------------------------------>|        |
 |        |   (6) Request to UserInfoEndpoint for End-User Claims |        |
 |        |<------------------------------------------------------|        |
 |        |                                                       |        |
 +--------+                                                       +--------+

Because of the way this authentication mechanism and protocol works, there is no requirement to explicitly define an identity store. However, the authentication mechanism MUST validate the token received from the "TokenEndpoint" by calling the IdentityStoreHandler. This allows for extra identity stores and/or a custom IdentityStoreHandler to participate in the final authentication result (e.g. adding extra groups).

Authors
Gaurav Gupta, Rudy De Busscher
See Also
https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth, https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens

Method Summary

Modifier and TypeMethod and Description
public ClaimsDefinition
claimsDefinition()

Optional.

public String

Returns:

the client identifier
clientId()

Required.

public String

Returns:

The client secret
clientSecret()

Required.

public DisplayType
display()

Optional.

public String
displayExpression()

Optional.

public String[]
extraParameters()

An array of extra options that will be sent to the OAuth provider.

public String
extraParametersExpression()

Allows the extra parameters to be defined as a Jakarta Expression Language expression.

public int
jwksConnectTimeout()

Optional.

public String
jwksConnectTimeoutExpression()

Optional.

public int
jwksReadTimeout()

Optional.

public String
jwksReadTimeoutExpression()

Optional.

public LogoutDefinition
logout()

Optional.

public PromptType[]
prompt()

Optional.

public String
promptExpression()

Optional.

public OpenIdProviderMetadata

Returns:

OpenIdProviderMetadata instance.
providerMetadata()

To override the openid connect provider's metadata property discovered via providerUri.

public String

Returns:

provider URI to read from which to read metadata
providerURI()

Required, unless providerMetadata is specified.

public boolean
redirectToOriginalResource()

Optional.

public String
redirectToOriginalResourceExpression()

Optional.

public String
redirectURI()

The redirect URI (callback URI) to which the response will be sent by the OpenId Connect Provider.

public String
responseMode()

Optional.

public String
responseType()

Optional.

public String[]
scope()

Optional.

public String
scopeExpression()

Optional.

public boolean

Returns:

true, if Access and Refresh Token shall be refreshed automatically when they are expired.
tokenAutoRefresh()

Optional.

public String
tokenAutoRefreshExpression()

Optional.

public int
tokenMinValidity()

Optional.

public String
tokenMinValidityExpression()

Optional.

public boolean
useNonce()

Optional.

public String
useNonceExpression()

Optional.

public boolean
useSession()

Optional.

public String
useSessionExpression()

Optional.

Inherited from java.lang.annotation.Annotation:
annotationTypeequalshashCodetoString

Method Detail

claimsDefinitionback to summary
public ClaimsDefinition claimsDefinition()

Optional. The claims definition defines the custom claims mapping of caller name and groups.

clientIdback to summary
public String clientId()

Required. The client identifier issued when the application was registered.

Returns:String

the client identifier

clientSecretback to summary
public String clientSecret()

Required. The client secret.

Note that it is strongly recommended to set this using an Expression so that the value is not hardcoded within the code.

Returns:String

The client secret

displayback to summary
public DisplayType display()

Optional. The display value specifying how the authorization server displays the authentication and consent user interface pages.

displayExpressionback to summary
public String displayExpression()

Optional. Allows the display value to be specified as Jakarta Expression Language expression. If set, overrides the value defined by display.

extraParametersback to summary
public String[] extraParameters()

An array of extra options that will be sent to the OAuth provider.

These must be in the form of "key=value" i.e. extraParameters={"key1=value", "key2=value2"}

extraParametersExpressionback to summary
public String extraParametersExpression()

Allows the extra parameters to be defined as a Jakarta Expression Language expression. If set, overrides the extraParameters value.

jwksConnectTimeoutback to summary
public int jwksConnectTimeout()

Optional. Sets the connect timeout(in milliseconds) for Remote JWKS retrieval. Value must not be negative and if value is zero then infinite timeout.

jwksConnectTimeoutExpressionback to summary
public String jwksConnectTimeoutExpression()

Optional. Allows the connect timeout(in milliseconds) for Remote JWKS to be defined as Jakarta Expression Language expression. If set, overwrites the jwksConnectTimeout value.

jwksReadTimeoutback to summary
public int jwksReadTimeout()

Optional. Sets the read timeout(in milliseconds) for Remote JWKS retrieval. Value must not be negative and if value is zero then infinite timeout.

jwksReadTimeoutExpressionback to summary
public String jwksReadTimeoutExpression()

Optional. Allows the read timeout(in milliseconds) for Remote JWKS retrieval to be defined as Jakarta Expression Language expression. If set, overwrites the jwksReadTimeout value.

logoutback to summary
public LogoutDefinition logout()

Optional. The Logout definition defines the logout and Relaying Party session management configuration.

promptback to summary
public PromptType[] prompt()

Optional. The prompt value specifies whether the authorization server prompts the user for reauthentication and consent. If no value is specified and the user has not previously authorized access, then the user is shown a consent screen.

promptExpressionback to summary
public String promptExpression()

Optional. Allows the prompt value to be specified as Jakarta Expression Language expression. If Set, overirdes the value defined by the prompt value.

providerMetadataback to summary
public OpenIdProviderMetadata providerMetadata()

To override the openid connect provider's metadata property discovered via providerUri.

Returns:OpenIdProviderMetadata

OpenIdProviderMetadata instance.

providerURIback to summary
public String providerURI()

Required, unless providerMetadata is specified. The provider URI to read / discover the metadata of the openid provider.

Returns:String

provider URI to read from which to read metadata

See Also
http://openid.net/specs/openid-connect-discovery-1_0.html
redirectToOriginalResourceback to summary
public boolean redirectToOriginalResource()

Optional. Automatically redirects the caller (the end-user) from the redirect URI defined by the redirectURI attribute to the resource the end-user originally requested in a "login to continue" scenario.

After arriving at the original requested resource, the runtime restores the request as it originally happened, including cookies, headers, the request method and the request parameters in the same way as done when using the LoginToContinue feature.

redirectToOriginalResourceExpressionback to summary
public String redirectToOriginalResourceExpression()

Optional. Allows the redirectToOriginalResource to be specified as Jakarta Expression Language expression. If set, overrides the value defined by the redirectToOriginalResource value.

redirectURIback to summary
public String redirectURI()

The redirect URI (callback URI) to which the response will be sent by the OpenId Connect Provider. This URI must exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.

responseModeback to summary
public String responseMode()

Optional. Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.

responseTypeback to summary
public String responseType()

Optional. Response Type value defines the processing flow to be used. By default, the value is code (Authorization Code Flow).

scopeback to summary
public String[] scope()

Optional. The scope value defines the access privileges. The basic (and required) scope for OpenID Connect is the openid scope.

scopeExpressionback to summary
public String scopeExpression()

Optional. Allows The scope value to be specified as Jakarta Expression Language expression. If Set, overrides any values set by scope.

tokenAutoRefreshback to summary
public boolean tokenAutoRefresh()

Optional. Enables or disables the automatically performed refresh of Access and Refresh Token.

Returns:boolean

true, if Access and Refresh Token shall be refreshed automatically when they are expired.

tokenAutoRefreshExpressionback to summary
public String tokenAutoRefreshExpression()

Optional. Allows the automatically performed refresh of Access and Refresh Token to be defined as Jakarta Expression Language expression. If set, overwrites the value of tokenAutoRefresh.

tokenMinValidityback to summary
public int tokenMinValidity()

Optional. Sets the minimum validity time in milliseconds the Access Token must be valid before it is considered expired. Value must not be negative.

tokenMinValidityExpressionback to summary
public String tokenMinValidityExpression()

Optional. Allows the minimum validity time in milliseconds the Access Token must be valid before it is considered expired to be defined as Jakarta Expression Language expression. If Set, overwrites the tokenMinValidity value.

useNonceback to summary
public boolean useNonce()

Optional. Enables string value used to mitigate replay attacks.

useNonceExpressionback to summary
public String useNonceExpression()

Optional. Allows the nonce activation to be specified as Jakarta Expression Language expression. If set, overrides the value defined by the useNonce value.

useSessionback to summary
public boolean useSession()

Optional. If enabled the state, nonce values and original requested resource data are stored in an HTTP session otherwise in cookies.

useSessionExpressionback to summary
public String useSessionExpression()

Optional. Allows the configuration of the session through a Jakarta Expression Language expression. If set, overwrites the value of useSession value.