Package io.quarkus.oidc.common.runtime

Class OidcCommonConfig.Credentials.Jwt

java.lang.Object

io.quarkus.oidc.common.runtime.OidcCommonConfig.Credentials.Jwt

Enclosing class:

OidcCommonConfig.Credentials

public static class OidcCommonConfig.Credentials.Jwt
extends Object

Supports the client authentication `client_secret_jwt` and `private_key_jwt` methods, which involves sending a JWT token assertion signed with a client secret or private key. JWT Bearer client authentication is also supported.

See Also:

• https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	OidcCommonConfig.Credentials.Jwt.Source

Field Summary

Fields

Modifier and Type	Field	Description
Optional<String>	audience	The JWT audience (`aud`) claim value.
Map<String,String>	claims	Additional claims.
Optional<String>	issuer	The issuer of the signing key added as a JWT `iss` claim.
Optional<String>	key	String representation of a private key.
Optional<String>	keyFile	If provided, indicates that JWT is signed using a private key in PEM or JWK format.
Optional<String>	keyId	The private key id or alias.
Optional<String>	keyPassword	The private key password.
Optional<String>	keyStoreFile	If provided, indicates that JWT is signed using a private key from a keystore.
Optional<String>	keyStorePassword	A parameter to specify the password of the keystore file.
int	lifespan	The JWT lifespan in seconds.
Optional<String>	secret	If provided, indicates that JWT is signed using a secret key.
OidcCommonConfig.Credentials.Provider	secretProvider	If provided, indicates that JWT is signed using a secret key provided by Secret CredentialsProvider.
Optional<String>	signatureAlgorithm	The signature algorithm used for the keyFile property.
OidcCommonConfig.Credentials.Jwt.Source	source	JWT token source: OIDC provider client or an existing JWT bearer token.
Optional<String>	subject	Subject of the signing key added as a JWT `sub` claim The default value is the client id.
Optional<String>	tokenKeyId	The key identifier of the signing key added as a JWT `kid` header.

Constructor Summary

Constructors

Constructor	Description
Jwt()

Method Summary

Modifier and Type	Method	Description
Optional<String>	getAudience()
Map<String,String>	getClaims()
Optional<String>	getKey()
Optional<String>	getKeyFile()
int	getLifespan()
Optional<String>	getSecret()
OidcCommonConfig.Credentials.Provider	getSecretProvider()
Optional<String>	getSignatureAlgorithm()
OidcCommonConfig.Credentials.Jwt.Source	getSource()
Optional<String>	getTokenKeyId()
void	setAudience(String audience)
void	setClaims(Map<String,String> claims)
void	setKey(String key)
void	setKeyFile(String keyFile)
void	setLifespan(int lifespan)
void	setSecret(String secret)
void	setSecretProvider(OidcCommonConfig.Credentials.Provider secretProvider)
void	setSignatureAlgorithm(String signatureAlgorithm)
void	setSource(OidcCommonConfig.Credentials.Jwt.Source source)
void	setTokenKeyId(String tokenKeyId)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

source

@ConfigItem(defaultValue="client")
public OidcCommonConfig.Credentials.Jwt.Source source

JWT token source: OIDC provider client or an existing JWT bearer token.

secret

@ConfigItem
public Optional<String> secret

If provided, indicates that JWT is signed using a secret key.

secretProvider

@ConfigItem
public OidcCommonConfig.Credentials.Provider secretProvider

If provided, indicates that JWT is signed using a secret key provided by Secret CredentialsProvider.

key

@ConfigItem
public Optional<String> key

String representation of a private key. If provided, indicates that JWT is signed using a private key in PEM or JWK format. You can use the signatureAlgorithm property to override the default key algorithm, `RS256`.

keyFile

@ConfigItem
public Optional<String> keyFile

If provided, indicates that JWT is signed using a private key in PEM or JWK format. You can use the signatureAlgorithm property to override the default key algorithm, `RS256`.

keyStoreFile

@ConfigItem
public Optional<String> keyStoreFile

If provided, indicates that JWT is signed using a private key from a keystore.

keyStorePassword

@ConfigItem
public Optional<String> keyStorePassword

A parameter to specify the password of the keystore file.

keyId

@ConfigItem
public Optional<String> keyId

The private key id or alias.

keyPassword

@ConfigItem
public Optional<String> keyPassword

The private key password.

audience

@ConfigItem
public Optional<String> audience

The JWT audience (`aud`) claim value. By default, the audience is set to the address of the OpenId Connect Provider's token endpoint.

tokenKeyId

@ConfigItem
public Optional<String> tokenKeyId

The key identifier of the signing key added as a JWT `kid` header.

issuer

@ConfigItem
public Optional<String> issuer

The issuer of the signing key added as a JWT `iss` claim. The default value is the client id.

subject

@ConfigItem
public Optional<String> subject

Subject of the signing key added as a JWT `sub` claim The default value is the client id.

claims

@ConfigItem
@ConfigDocMapKey("claim-name")
public Map<String,String> claims

Additional claims.

signatureAlgorithm

@ConfigItem
public Optional<String> signatureAlgorithm

The signature algorithm used for the keyFile property. Supported values: `RS256` (default), `RS384`, `RS512`, `PS256`, `PS384`, `PS512`, `ES256`, `ES384`, `ES512`, `HS256`, `HS384`, `HS512`.

lifespan

@ConfigItem(defaultValue="10")
public int lifespan

The JWT lifespan in seconds. This value is added to the time at which the JWT was issued to calculate the expiration time.

Constructor Details

Jwt

public Jwt()

Method Details

getSecret

public Optional<String> getSecret()

setSecret

public void setSecret(String secret)

getLifespan

public int getLifespan()

setLifespan

public void setLifespan(int lifespan)

getTokenKeyId

public Optional<String> getTokenKeyId()

setTokenKeyId

public void setTokenKeyId(String tokenKeyId)

getSecretProvider

public OidcCommonConfig.Credentials.Provider getSecretProvider()

setSecretProvider

public void setSecretProvider(OidcCommonConfig.Credentials.Provider secretProvider)

getSignatureAlgorithm

public Optional<String> getSignatureAlgorithm()

setSignatureAlgorithm

public void setSignatureAlgorithm(String signatureAlgorithm)

getAudience

public Optional<String> getAudience()

setAudience

public void setAudience(String audience)

getKey

public Optional<String> getKey()

setKey

public void setKey(String key)

getKeyFile

public Optional<String> getKeyFile()

setKeyFile

public void setKeyFile(String keyFile)

getClaims

public Map<String,String> getClaims()

setClaims

public void setClaims(Map<String,String> claims)

getSource

public OidcCommonConfig.Credentials.Jwt.Source getSource()

setSource

public void setSource(OidcCommonConfig.Credentials.Jwt.Source source)