Package io.quarkus.oidc

Class OidcTenantConfig.Authentication

java.lang.Object
io.quarkus.oidc.OidcTenantConfig.Authentication
All Implemented Interfaces:
OidcTenantConfig.Authentication
Enclosing class:
OidcTenantConfig
@Deprecated(since="3.18", forRemoval=true) public static class OidcTenantConfig.Authentication extends Object implements OidcTenantConfig.Authentication
Deprecated, for removal: This API element is subject to removal in a future version.
use the AuthenticationConfigBuilder builder
Defines the authorization request properties when authenticating users using the Authorization Code Grant Type.

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Class
    Description
    static enum 
    OidcTenantConfig.Authentication.CookieSameSite
    Deprecated, for removal: This API element is subject to removal in a future version.
    SameSite attribute values for the session cookie.
    static enum 
    OidcTenantConfig.Authentication.ResponseMode
    Deprecated, for removal: This API element is subject to removal in a future version.
    Authorization code flow response mode

    Nested classes/interfaces inherited from interface io.quarkus.oidc.runtime.OidcTenantConfig.Authentication

    OidcTenantConfig.Authentication.CacheControl

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    Optional<Boolean>
    addOpenidScope
    Deprecated, for removal: This API element is subject to removal in a future version.
    Add the `openid` scope automatically to the list of scopes.
    boolean
    allowMultipleCodeFlows
    Deprecated, for removal: This API element is subject to removal in a future version.
    If a state cookie is present, a `state` query parameter must also be present and both the state cookie name suffix and state cookie value must match the value of the `state` query parameter when the redirect path matches the current path.
    Optional<Set<OidcTenantConfig.Authentication.CacheControl>>
    cacheControl
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<String>
    cookieDomain
    Deprecated, for removal: This API element is subject to removal in a future version.
    Cookie domain parameter value which, if set, is used for the session, state and post logout cookies.
    boolean
    cookieForceSecure
    Deprecated, for removal: This API element is subject to removal in a future version.
    If enabled the state, session, and post logout cookies have their `secure` parameter set to `true` when HTTP is used.
    String
    cookiePath
    Deprecated, for removal: This API element is subject to removal in a future version.
    Cookie path parameter value which, if set, is used to set a path parameter for the session, state and post logout cookies.
    Optional<String>
    cookiePathHeader
    Deprecated, for removal: This API element is subject to removal in a future version.
    Cookie path header parameter value which, if set, identifies the incoming HTTP header whose value is used to set a path parameter for the session, state and post logout cookies.
    OidcTenantConfig.Authentication.CookieSameSite
    cookieSameSite
    Deprecated, for removal: This API element is subject to removal in a future version.
    SameSite attribute for the session cookie.
    Optional<String>
    cookieSuffix
    Deprecated, for removal: This API element is subject to removal in a future version.
    Cookie name suffix.
    Optional<String>
    errorPath
    Deprecated, for removal: This API element is subject to removal in a future version.
    Relative path to the public endpoint which processes the error response from the OIDC authorization endpoint.
    Map<String,String>
    extraParams
    Deprecated, for removal: This API element is subject to removal in a future version.
    Additional properties added as query parameters to the authentication redirect URI.
    boolean
    failOnMissingStateParam
    Deprecated, for removal: This API element is subject to removal in a future version.
    Fail with the HTTP 401 error if the state cookie is present but no state query parameter is present.
    boolean
    failOnUnresolvedKid
    Deprecated, for removal: This API element is subject to removal in a future version.
    Fail with the HTTP 401 error if the ID token signature can not be verified during the re-authentication only due to an unresolved token key identifier (`kid`).
    Optional<Boolean>
    forceRedirectHttpsScheme
    Deprecated, for removal: This API element is subject to removal in a future version.
    Force `https` as the `redirect_uri` parameter scheme when running behind an SSL/TLS terminating reverse proxy.
    Optional<List<String>>
    forwardParams
    Deprecated, for removal: This API element is subject to removal in a future version.
    Request URL query parameters which, if present, are added to the authentication redirect URI.
    Optional<Boolean>
    idTokenRequired
    Deprecated, for removal: This API element is subject to removal in a future version.
    Requires that ID token is available when the authorization code flow completes.
    Optional<Duration>
    internalIdTokenLifespan
    Deprecated, for removal: This API element is subject to removal in a future version.
    Internal ID token lifespan.
    boolean
    javaScriptAutoRedirect
    Deprecated, for removal: This API element is subject to removal in a future version.
    If this property is set to `true`, a normal 302 redirect response is returned if the request was initiated by a JavaScript API such as XMLHttpRequest or Fetch and the current user needs to be (re)authenticated, which might not be desirable for Single-page applications (SPA) since it automatically following the redirect might not work given that OIDC authorization endpoints typically do not support CORS.
    boolean
    nonceRequired
    Deprecated, for removal: This API element is subject to removal in a future version.
    Require that ID token includes a `nonce` claim which must match `nonce` authentication request query parameter.
    Optional<Boolean>
    pkceRequired
    Deprecated, for removal: This API element is subject to removal in a future version.
    Requires that a Proof Key for Code Exchange (PKCE) is used.
    Optional<String>
    pkceSecret
    Deprecated.
    This field is deprecated.
    Optional<String>
    redirectPath
    Deprecated, for removal: This API element is subject to removal in a future version.
    The relative path for calculating a `redirect_uri` query parameter.
    boolean
    removeRedirectParameters
    Deprecated, for removal: This API element is subject to removal in a future version.
    Remove the query parameters such as `code` and `state` set by the OIDC server on the redirect URI after the user has authenticated by redirecting a user to the same URI but without the query parameters.
    Optional<OidcTenantConfig.Authentication.ResponseMode>
    responseMode
    Deprecated, for removal: This API element is subject to removal in a future version.
    Authorization code flow response mode.
    boolean
    restorePathAfterRedirect
    Deprecated, for removal: This API element is subject to removal in a future version.
    If this property is set to `true`, the original request URI which was used before the authentication is restored after the user has been redirected back to the application.
    Optional<List<String>>
    scopes
    Deprecated, for removal: This API element is subject to removal in a future version.
    List of scopes
    Optional<String>
    scopeSeparator
    Deprecated, for removal: This API element is subject to removal in a future version.
    The separator which is used when more than one scope is configured.
    Optional<Duration>
    sessionAgeExtension
    Deprecated, for removal: This API element is subject to removal in a future version.
    Session age extension in minutes.
    Optional<String>
    sessionExpiredPath
    Deprecated, for removal: This API element is subject to removal in a future version.
    Relative path to the public endpoint which an authenticated user is redirected to when the session has expired.
    Duration
    stateCookieAge
    Deprecated, for removal: This API element is subject to removal in a future version.
    State cookie age in minutes.
    Optional<String>
    stateSecret
    Deprecated, for removal: This API element is subject to removal in a future version.
    Secret used to encrypt Proof Key for Code Exchange (PKCE) code verifier and/or nonce in the code flow state.
    Optional<Boolean>
    userInfoRequired
    Deprecated, for removal: This API element is subject to removal in a future version.
    If this property is set to `true`, an OIDC UserInfo endpoint is called.
    boolean
    verifyAccessToken
    Deprecated, for removal: This API element is subject to removal in a future version.
    Both ID and access tokens are fetched from the OIDC provider as part of the authorization code flow.

  • Constructor Summary

    Constructors
    Constructor
    Description
    Authentication()
    Deprecated, for removal: This API element is subject to removal in a future version.
     

  • Method Summary

    Modifier and Type
    Method
    Description
    Optional<Boolean>
    addOpenidScope()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Add the `openid` scope automatically to the list of scopes.
    boolean
    allowMultipleCodeFlows()
    Deprecated, for removal: This API element is subject to removal in a future version.
    If a state cookie is present, a `state` query parameter must also be present and both the state cookie name suffix and state cookie value must match the value of the `state` query parameter when the redirect path matches the current path.
    Optional<Set<OidcTenantConfig.Authentication.CacheControl>>
    cacheControl()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Set of cache-control directives that must be set when a new session cookie is created, either after a successful authorization code completion or token refresh.
    Optional<String>
    cookieDomain()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Cookie domain parameter value which, if set, is used for the session, state and post logout cookies.
    boolean
    cookieForceSecure()
    Deprecated, for removal: This API element is subject to removal in a future version.
    If enabled the state, session, and post logout cookies have their `secure` parameter set to `true` when HTTP is used.
    String
    cookiePath()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Cookie path parameter value which, if set, is used to set a path parameter for the session, state and post logout cookies.
    Optional<String>
    cookiePathHeader()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Cookie path header parameter value which, if set, identifies the incoming HTTP header whose value is used to set a path parameter for the session, state and post logout cookies.
    OidcTenantConfig.Authentication.CookieSameSite
    cookieSameSite()
    Deprecated, for removal: This API element is subject to removal in a future version.
    SameSite attribute for the session cookie.
    Optional<String>
    cookieSuffix()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Cookie name suffix.
    Optional<String>
    errorPath()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Relative path to the public endpoint which processes the error response from the OIDC authorization endpoint.
    Map<String,String>
    extraParams()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Additional properties added as query parameters to the authentication redirect URI.
    boolean
    failOnMissingStateParam()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Fail with the HTTP 401 error if the state cookie is present but no state query parameter is present.
    boolean
    failOnUnresolvedKid()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Fail with the HTTP 401 error if the ID token signature can not be verified during the re-authentication only due to an unresolved token key identifier (`kid`).
    Optional<Boolean>
    forceRedirectHttpsScheme()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Force `https` as the `redirect_uri` parameter scheme when running behind an SSL/TLS terminating reverse proxy.
    Optional<List<String>>
    forwardParams()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Request URL query parameters which, if present, are added to the authentication redirect URI.
    Optional<String>
    getCookieDomain()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    String
    getCookiePath()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<String>
    getCookiePathHeader()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    OidcTenantConfig.Authentication.CookieSameSite
    getCookieSameSite()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<String>
    getCookieSuffix()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<String>
    getErrorPath()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Map<String,String>
    getExtraParams()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<List<String>>
    getForwardParams()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<Duration>
    getInternalIdTokenLifespan()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<String>
    getPkceSecret()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Optional<String>
    getRedirectPath()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<OidcTenantConfig.Authentication.ResponseMode>
    getResponseMode()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<List<String>>
    getScopes()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<String>
    getScopeSeparator()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<Duration>
    getSessionAgeExtension()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<String>
    getSessionExpiredPath()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Duration
    getStateCookieAge()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<String>
    getStateSecret()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<Boolean>
    idTokenRequired()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Requires that ID token is available when the authorization code flow completes.
    Optional<Duration>
    internalIdTokenLifespan()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Internal ID token lifespan.
    Optional<Boolean>
    isAddOpenidScope()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    boolean
    isAllowMultipleCodeFlows()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    boolean
    isCookieForceSecure()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<Boolean>
    isForceRedirectHttpsScheme()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<Boolean>
    isIdTokenRequired()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    boolean
    isJavaScriptAutoRedirect()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    boolean
    isNonceRequired()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<Boolean>
    isPkceRequired()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    boolean
    isRemoveRedirectParameters()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    boolean
    isRestorePathAfterRedirect()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Optional<Boolean>
    isUserInfoRequired()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    boolean
    isVerifyAccessToken()
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    boolean
    javaScriptAutoRedirect()
    Deprecated, for removal: This API element is subject to removal in a future version.
    If this property is set to `true`, a normal 302 redirect response is returned if the request was initiated by a JavaScript API such as XMLHttpRequest or Fetch and the current user needs to be (re)authenticated, which might not be desirable for Single-page applications (SPA) since it automatically following the redirect might not work given that OIDC authorization endpoints typically do not support CORS.
    boolean
    nonceRequired()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Require that ID token includes a `nonce` claim which must match `nonce` authentication request query parameter.
    OidcTenantConfig.PushedAuthorizationRequest
    par()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Configuration for the pushed authorization request (PAR) as defined by the RFC 9126.
    Optional<Boolean>
    pkceRequired()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Requires that a Proof Key for Code Exchange (PKCE) is used.
    Optional<String>
    pkceSecret()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Secret used to encrypt a Proof Key for Code Exchange (PKCE) code verifier in the code flow state.
    Optional<String>
    redirectPath()
    Deprecated, for removal: This API element is subject to removal in a future version.
    The relative path for calculating a `redirect_uri` query parameter.
    boolean
    removeRedirectParameters()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Remove the query parameters such as `code` and `state` set by the OIDC server on the redirect URI after the user has authenticated by redirecting a user to the same URI but without the query parameters.
    Optional<OidcTenantConfig.Authentication.ResponseMode>
    responseMode()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Authorization code flow response mode.
    boolean
    restorePathAfterRedirect()
    Deprecated, for removal: This API element is subject to removal in a future version.
    If this property is set to `true`, the original request URI which was used before the authentication is restored after the user has been redirected back to the application.
    Optional<List<String>>
    scopes()
    Deprecated, for removal: This API element is subject to removal in a future version.
    List of scopes
    Optional<String>
    scopeSeparator()
    Deprecated, for removal: This API element is subject to removal in a future version.
    The separator which is used when more than one scope is configured.
    Optional<Duration>
    sessionAgeExtension()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Session age extension in minutes.
    Optional<String>
    sessionExpiredPath()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Relative path to the public endpoint which an authenticated user is redirected to when the session has expired.
    void
    setAddOpenidScope(boolean addOpenidScope)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setAllowMultipleCodeFlows(boolean allowMultipleCodeFlows)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setCookieDomain(String cookieDomain)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setCookieForceSecure(boolean cookieForceSecure)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setCookiePath(String cookiePath)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setCookiePathHeader(String cookiePathHeader)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setCookieSameSite(OidcTenantConfig.Authentication.CookieSameSite cookieSameSite)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setCookieSuffix(String cookieSuffix)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setErrorPath(String errorPath)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setExtraParams(Map<String,String> extraParams)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setForceRedirectHttpsScheme(boolean forceRedirectHttpsScheme)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setForwardParams(List<String> forwardParams)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setIdTokenRequired(boolean idTokenRequired)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setInternalIdTokenLifespan(Duration internalIdTokenLifespan)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setJavaScriptAutoredirect(boolean autoRedirect)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setNonceRequired(boolean nonceRequired)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setPkceRequired(boolean pkceRequired)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setPkceSecret(String pkceSecret)
    Deprecated, for removal: This API element is subject to removal in a future version.
    void
    setRedirectPath(String redirectPath)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setRemoveRedirectParameters(boolean removeRedirectParameters)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setResponseMode(OidcTenantConfig.Authentication.ResponseMode responseMode)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setRestorePathAfterRedirect(boolean restorePathAfterRedirect)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setScopes(List<String> scopes)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setScopeSeparator(String scopeSeparator)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setSessionAgeExtension(Duration sessionAgeExtension)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setSessionExpiredPath(String sessionExpiredPath)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setStateCookieAge(Duration stateCookieAge)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setStateSecret(Optional<String> stateSecret)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setUserInfoRequired(boolean userInfoRequired)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    void
    setVerifyAccessToken(boolean verifyAccessToken)
    Deprecated, for removal: This API element is subject to removal in a future version.
     
    Duration
    stateCookieAge()
    Deprecated, for removal: This API element is subject to removal in a future version.
    State cookie age in minutes.
    Optional<String>
    stateSecret()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Secret used to encrypt Proof Key for Code Exchange (PKCE) code verifier and/or nonce in the code flow state.
    Optional<Boolean>
    userInfoRequired()
    Deprecated, for removal: This API element is subject to removal in a future version.
    If this property is set to `true`, an OIDC UserInfo endpoint is called.
    boolean
    verifyAccessToken()
    Deprecated, for removal: This API element is subject to removal in a future version.
    Both ID and access tokens are fetched from the OIDC provider as part of the authorization code flow.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • responseMode

      public Optional<OidcTenantConfig.Authentication.ResponseMode> responseMode
      Deprecated, for removal: This API element is subject to removal in a future version.
      Authorization code flow response mode.

    • redirectPath

      public Optional<String> redirectPath
      Deprecated, for removal: This API element is subject to removal in a future version.
      The relative path for calculating a `redirect_uri` query parameter. It has to start from a forward slash and is appended to the request URI's host and port. For example, if the current request URI is `https://localhost:8080/service`, a `redirect_uri` parameter is set to `https://localhost:8080/` if this property is set to `/` and be the same as the request URI if this property has not been configured. Note the original request URI is restored after the user has authenticated if `restorePathAfterRedirect` is set to `true`.

    • restorePathAfterRedirect

      public boolean restorePathAfterRedirect
      Deprecated, for removal: This API element is subject to removal in a future version.
      If this property is set to `true`, the original request URI which was used before the authentication is restored after the user has been redirected back to the application. Note if `redirectPath` property is not set, the original request URI is restored even if this property is disabled.

    • removeRedirectParameters

      public boolean removeRedirectParameters
      Deprecated, for removal: This API element is subject to removal in a future version.
      Remove the query parameters such as `code` and `state` set by the OIDC server on the redirect URI after the user has authenticated by redirecting a user to the same URI but without the query parameters.

    • errorPath

      public Optional<String> errorPath
      Deprecated, for removal: This API element is subject to removal in a future version.
      Relative path to the public endpoint which processes the error response from the OIDC authorization endpoint. If the user authentication has failed, the OIDC provider returns an `error` and an optional `error_description` parameters, instead of the expected authorization `code`. If this property is set, the user is redirected to the endpoint which can return a user-friendly error description page. It has to start from a forward slash and is appended to the request URI's host and port. For example, if it is set as `/error` and the current request URI is `https://localhost:8080/callback?error=invalid_scope`, a redirect is made to `https://localhost:8080/error?error=invalid_scope`. If this property is not set, HTTP 401 status is returned in case of the user authentication failure.

    • sessionExpiredPath

      public Optional<String> sessionExpiredPath
      Deprecated, for removal: This API element is subject to removal in a future version.
      Relative path to the public endpoint which an authenticated user is redirected to when the session has expired.

      When the OIDC session has expired and the session can not be refreshed, a user is redirected to the OIDC provider to re-authenticate. The user experience may not be ideal in this case as it may not be obvious to the authenticated user why an authentication challenge is returned.

      Set this property if you would like the user whose session has expired be redirected to a public application specific page instead, which can inform that the session has expired and advise the user to re-authenticated by following a link to the secured initial entry page.

    • verifyAccessToken

      public boolean verifyAccessToken
      Deprecated, for removal: This API element is subject to removal in a future version.
      Both ID and access tokens are fetched from the OIDC provider as part of the authorization code flow.

      ID token is always verified on every user request as the primary token which is used to represent the principal and extract the roles.

      Authorization code flow access token is meant to be propagated to downstream services and is not verified by default unless `quarkus.oidc.roles.source` property is set to `accesstoken` which means the authorization decision is based on the roles extracted from the access token.

      Authorization code flow access token verification is also enabled if this token is injected as JsonWebToken. Set this property to `false` if it is not required.

      Bearer access token is always verified.

    • forceRedirectHttpsScheme

      public Optional<Boolean> forceRedirectHttpsScheme
      Deprecated, for removal: This API element is subject to removal in a future version.
      Force `https` as the `redirect_uri` parameter scheme when running behind an SSL/TLS terminating reverse proxy. This property, if enabled, also affects the logout `post_logout_redirect_uri` and the local redirect requests.

    • scopes

      public Optional<List<String>> scopes
      Deprecated, for removal: This API element is subject to removal in a future version.
      List of scopes

    • scopeSeparator

      public Optional<String> scopeSeparator
      Deprecated, for removal: This API element is subject to removal in a future version.
      The separator which is used when more than one scope is configured. A single space is used by default.

    • nonceRequired

      public boolean nonceRequired
      Deprecated, for removal: This API element is subject to removal in a future version.
      Require that ID token includes a `nonce` claim which must match `nonce` authentication request query parameter. Enabling this property can help mitigate replay attacks. Do not enable this property if your OpenId Connect provider does not support setting `nonce` in ID token or if you work with OAuth2 provider such as `GitHub` which does not issue ID tokens.

    • addOpenidScope

      public Optional<Boolean> addOpenidScope
      Deprecated, for removal: This API element is subject to removal in a future version.
      Add the `openid` scope automatically to the list of scopes. This is required for OpenId Connect providers, but does not work for OAuth2 providers such as Twitter OAuth2, which do not accept this scope and throw errors.

    • extraParams

      public Map<String,String> extraParams
      Deprecated, for removal: This API element is subject to removal in a future version.
      Additional properties added as query parameters to the authentication redirect URI.

    • forwardParams

      public Optional<List<String>> forwardParams
      Deprecated, for removal: This API element is subject to removal in a future version.
      Request URL query parameters which, if present, are added to the authentication redirect URI.

    • cookieForceSecure

      public boolean cookieForceSecure
      Deprecated, for removal: This API element is subject to removal in a future version.
      If enabled the state, session, and post logout cookies have their `secure` parameter set to `true` when HTTP is used. It might be necessary when running behind an SSL/TLS terminating reverse proxy. The cookies are always secure if HTTPS is used, even if this property is set to false.

    • cookieSuffix

      public Optional<String> cookieSuffix
      Deprecated, for removal: This API element is subject to removal in a future version.
      Cookie name suffix. For example, a session cookie name for the default OIDC tenant is `q_session` but can be changed to `q_session_test` if this property is set to `test`.

    • cookiePath

      public String cookiePath
      Deprecated, for removal: This API element is subject to removal in a future version.
      Cookie path parameter value which, if set, is used to set a path parameter for the session, state and post logout cookies. The `cookie-path-header` property, if set, is checked first.

    • cookiePathHeader

      public Optional<String> cookiePathHeader
      Deprecated, for removal: This API element is subject to removal in a future version.
      Cookie path header parameter value which, if set, identifies the incoming HTTP header whose value is used to set a path parameter for the session, state and post logout cookies. If the header is missing, the `cookie-path` property is checked.

    • cookieDomain

      public Optional<String> cookieDomain
      Deprecated, for removal: This API element is subject to removal in a future version.
      Cookie domain parameter value which, if set, is used for the session, state and post logout cookies.

    • cookieSameSite

      public OidcTenantConfig.Authentication.CookieSameSite cookieSameSite
      Deprecated, for removal: This API element is subject to removal in a future version.
      SameSite attribute for the session cookie.

    • allowMultipleCodeFlows

      public boolean allowMultipleCodeFlows
      Deprecated, for removal: This API element is subject to removal in a future version.
      If a state cookie is present, a `state` query parameter must also be present and both the state cookie name suffix and state cookie value must match the value of the `state` query parameter when the redirect path matches the current path. However, if multiple authentications are attempted from the same browser, for example, from the different browser tabs, then the currently available state cookie might represent the authentication flow initiated from another tab and not related to the current request. Disable this property to permit only a single authorization code flow in the same browser.

    • failOnMissingStateParam

      public boolean failOnMissingStateParam
      Deprecated, for removal: This API element is subject to removal in a future version.
      Fail with the HTTP 401 error if the state cookie is present but no state query parameter is present.

      When either multiple authentications are disabled or the redirect URL matches the original request URL, the stale state cookie might remain in the browser cache from the earlier failed redirect to an OpenId Connect provider and be visible during the current request. For example, if Single-page application (SPA) uses XHR to handle redirects to the provider which does not support CORS for its authorization endpoint, the browser blocks it and the state cookie created by Quarkus remains in the browser cache. Quarkus reports an authentication failure when it detects such an old state cookie but find no matching state query parameter.

      Reporting HTTP 401 error is usually the right thing to do in such cases, it minimizes a risk of the browser redirect loop but also can identify problems in the way SPA or Quarkus application manage redirects. For example, enabling javaScriptAutoRedirect or having the provider redirect to URL configured with redirectPath might be needed to avoid such errors.

      However, setting this property to `false` might help if the above options are not suitable. It causes a new authentication redirect to OpenId Connect provider. Doing so might increase the risk of browser redirect loops.

    • failOnUnresolvedKid

      public boolean failOnUnresolvedKid
      Deprecated, for removal: This API element is subject to removal in a future version.
      Fail with the HTTP 401 error if the ID token signature can not be verified during the re-authentication only due to an unresolved token key identifier (`kid`).

      This property might need to be disabled when multiple tab authentications are allowed, with one of the tabs keeping an expired ID token with its `kid` unresolved due to the verification key set refreshed due to another tab initiating an authorization code flow. In such cases, instead of failing with the HTTP 401 error, redirecting the user to re-authenticate with the HTTP 302 status may provide better user experience.

      Note that the HTTP 401 error is always returned if the ID token signature can not be verified due to an unresolved kid during an initial ID token verification following the authorization code flow completion, before a session cookie is created.

    • userInfoRequired

      public Optional<Boolean> userInfoRequired
      Deprecated, for removal: This API element is subject to removal in a future version.
      If this property is set to `true`, an OIDC UserInfo endpoint is called.

      This property is enabled automatically if `quarkus.oidc.roles.source` is set to `userinfo` or `quarkus.oidc.token.verify-access-token-with-user-info` is set to `true` or `quarkus.oidc.authentication.id-token-required` is set to `false`, the current OIDC tenant must support a UserInfo endpoint in these cases.

      It is also enabled automatically if `io.quarkus.oidc.UserInfo` injection point is detected but only if the current OIDC tenant supports a UserInfo endpoint.

    • sessionAgeExtension

      public Optional<Duration> sessionAgeExtension
      Deprecated, for removal: This API element is subject to removal in a future version.
      Session age extension in minutes. The user session age property is set to the value of the ID token life-span by default and the user is redirected to the OIDC provider to re-authenticate once the session has expired. If this property is set to a nonzero value, then the expired ID token can be refreshed before the session has expired. This property is ignored if the `token.refresh-expired` property has not been enabled.

    • stateCookieAge

      public Duration stateCookieAge
      Deprecated, for removal: This API element is subject to removal in a future version.
      State cookie age in minutes. State cookie is created every time a new authorization code flow redirect starts and removed when this flow is completed. State cookie name is unique by default, see allowMultipleCodeFlows. Keep its age to the reasonable minimum value such as 5 minutes or less.

    • javaScriptAutoRedirect

      public boolean javaScriptAutoRedirect
      Deprecated, for removal: This API element is subject to removal in a future version.
      If this property is set to `true`, a normal 302 redirect response is returned if the request was initiated by a JavaScript API such as XMLHttpRequest or Fetch and the current user needs to be (re)authenticated, which might not be desirable for Single-page applications (SPA) since it automatically following the redirect might not work given that OIDC authorization endpoints typically do not support CORS.

      If this property is set to `false`, a status code of `499` is returned to allow SPA to handle the redirect manually if a request header identifying current request as a JavaScript request is found. `X-Requested-With` request header with its value set to either `JavaScript` or `XMLHttpRequest` is expected by default if this property is enabled. You can register a custom JavaScriptRequestChecker to do a custom JavaScript request check instead.

    • idTokenRequired

      public Optional<Boolean> idTokenRequired
      Deprecated, for removal: This API element is subject to removal in a future version.
      Requires that ID token is available when the authorization code flow completes. Disable this property only when you need to use the authorization code flow with OAuth2 providers which do not return ID token - an internal IdToken is generated in such cases.

    • internalIdTokenLifespan

      public Optional<Duration> internalIdTokenLifespan
      Deprecated, for removal: This API element is subject to removal in a future version.
      Internal ID token lifespan. This property is only checked when an internal IdToken is generated when Oauth2 providers do not return IdToken.

    • pkceRequired

      public Optional<Boolean> pkceRequired
      Deprecated, for removal: This API element is subject to removal in a future version.
      Requires that a Proof Key for Code Exchange (PKCE) is used.

    • pkceSecret

      public Optional<String> pkceSecret
      Deprecated.
      This field is deprecated. Use stateSecret instead.
      Secret used to encrypt a Proof Key for Code Exchange (PKCE) code verifier in the code flow state. This secret should be at least 32 characters long.

    • stateSecret

      public Optional<String> stateSecret
      Deprecated, for removal: This API element is subject to removal in a future version.
      Secret used to encrypt Proof Key for Code Exchange (PKCE) code verifier and/or nonce in the code flow state. This secret should be at least 32 characters long.

      If this secret is not set, the client secret configured with either `quarkus.oidc.credentials.secret` or `quarkus.oidc.credentials.client-secret.value` is checked. Finally, `quarkus.oidc.credentials.jwt.secret` which can be used for `client_jwt_secret` authentication is checked. A client secret is not be used as a state encryption secret if it is less than 32 characters long.

      The secret is auto-generated if it remains uninitialized after checking all of these properties.

      Error is reported if the secret length is less than 16 characters.

    • cacheControl

      public Optional<Set<OidcTenantConfig.Authentication.CacheControl>> cacheControl
      Deprecated, for removal: This API element is subject to removal in a future version.

  • Constructor Details

    • Authentication

      public Authentication()
      Deprecated, for removal: This API element is subject to removal in a future version.

  • Method Details

    • responseMode

      public Optional<OidcTenantConfig.Authentication.ResponseMode> responseMode()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Authorization code flow response mode.
      Specified by:
      responseMode in interface OidcTenantConfig.Authentication

    • redirectPath

      public Optional<String> redirectPath()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      The relative path for calculating a `redirect_uri` query parameter. It has to start from a forward slash and is appended to the request URI's host and port. For example, if the current request URI is `https://localhost:8080/service`, a `redirect_uri` parameter is set to `https://localhost:8080/` if this property is set to `/` and be the same as the request URI if this property has not been configured. Note the original request URI is restored after the user has authenticated if `restorePathAfterRedirect` is set to `true`.
      Specified by:
      redirectPath in interface OidcTenantConfig.Authentication

    • restorePathAfterRedirect

      public boolean restorePathAfterRedirect()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      If this property is set to `true`, the original request URI which was used before the authentication is restored after the user has been redirected back to the application. Note if `redirectPath` property is not set, the original request URI is restored even if this property is disabled.
      Specified by:
      restorePathAfterRedirect in interface OidcTenantConfig.Authentication

    • removeRedirectParameters

      public boolean removeRedirectParameters()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Remove the query parameters such as `code` and `state` set by the OIDC server on the redirect URI after the user has authenticated by redirecting a user to the same URI but without the query parameters.
      Specified by:
      removeRedirectParameters in interface OidcTenantConfig.Authentication

    • errorPath

      public Optional<String> errorPath()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Relative path to the public endpoint which processes the error response from the OIDC authorization endpoint. If the user authentication has failed, the OIDC provider returns an `error` and an optional `error_description` parameters, instead of the expected authorization `code`. If this property is set, the user is redirected to the endpoint which can return a user-friendly error description page. It has to start from a forward slash and is appended to the request URI's host and port. For example, if it is set as `/error` and the current request URI is `https://localhost:8080/callback?error=invalid_scope`, a redirect is made to `https://localhost:8080/error?error=invalid_scope`. If this property is not set, HTTP 401 status is returned in case of the user authentication failure.
      Specified by:
      errorPath in interface OidcTenantConfig.Authentication

    • sessionExpiredPath

      public Optional<String> sessionExpiredPath()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Relative path to the public endpoint which an authenticated user is redirected to when the session has expired.

      When the OIDC session has expired and the session can not be refreshed, a user is redirected to the OIDC provider to re-authenticate. The user experience may not be ideal in this case as it may not be obvious to the authenticated user why an authentication challenge is returned.

      Set this property if you would like the user whose session has expired be redirected to a public application specific page instead, which can inform that the session has expired and advise the user to re-authenticated by following a link to the secured initial entry page.

      Specified by:
      sessionExpiredPath in interface OidcTenantConfig.Authentication

    • verifyAccessToken

      public boolean verifyAccessToken()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Both ID and access tokens are fetched from the OIDC provider as part of the authorization code flow.

      ID token is always verified on every user request as the primary token which is used to represent the principal and extract the roles.

      Authorization code flow access token is meant to be propagated to downstream services and is not verified by default unless `quarkus.oidc.roles.source` property is set to `accesstoken` which means the authorization decision is based on the roles extracted from the access token.

      Authorization code flow access token verification is also enabled if this token is injected as JsonWebToken. Set this property to `false` if it is not required.

      Bearer access token is always verified.

      Specified by:
      verifyAccessToken in interface OidcTenantConfig.Authentication

    • forceRedirectHttpsScheme

      public Optional<Boolean> forceRedirectHttpsScheme()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Force `https` as the `redirect_uri` parameter scheme when running behind an SSL/TLS terminating reverse proxy. This property, if enabled, also affects the logout `post_logout_redirect_uri` and the local redirect requests.
      Specified by:
      forceRedirectHttpsScheme in interface OidcTenantConfig.Authentication

    • scopes

      public Optional<List<String>> scopes()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      List of scopes
      Specified by:
      scopes in interface OidcTenantConfig.Authentication

    • scopeSeparator

      public Optional<String> scopeSeparator()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      The separator which is used when more than one scope is configured. A single space is used by default.
      Specified by:
      scopeSeparator in interface OidcTenantConfig.Authentication

    • nonceRequired

      public boolean nonceRequired()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Require that ID token includes a `nonce` claim which must match `nonce` authentication request query parameter. Enabling this property can help mitigate replay attacks. Do not enable this property if your OpenId Connect provider does not support setting `nonce` in ID token or if you work with OAuth2 provider such as `GitHub` which does not issue ID tokens.
      Specified by:
      nonceRequired in interface OidcTenantConfig.Authentication

    • addOpenidScope

      public Optional<Boolean> addOpenidScope()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Add the `openid` scope automatically to the list of scopes. This is required for OpenId Connect providers, but does not work for OAuth2 providers such as Twitter OAuth2, which do not accept this scope and throw errors.
      Specified by:
      addOpenidScope in interface OidcTenantConfig.Authentication

    • extraParams

      public Map<String,String> extraParams()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Additional properties added as query parameters to the authentication redirect URI.
      Specified by:
      extraParams in interface OidcTenantConfig.Authentication

    • forwardParams

      public Optional<List<String>> forwardParams()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Request URL query parameters which, if present, are added to the authentication redirect URI.
      Specified by:
      forwardParams in interface OidcTenantConfig.Authentication

    • cookieForceSecure

      public boolean cookieForceSecure()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      If enabled the state, session, and post logout cookies have their `secure` parameter set to `true` when HTTP is used. It might be necessary when running behind an SSL/TLS terminating reverse proxy. The cookies are always secure if HTTPS is used, even if this property is set to false.
      Specified by:
      cookieForceSecure in interface OidcTenantConfig.Authentication

    • cookieSuffix

      public Optional<String> cookieSuffix()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Cookie name suffix. For example, a session cookie name for the default OIDC tenant is `q_session` but can be changed to `q_session_test` if this property is set to `test`.
      Specified by:
      cookieSuffix in interface OidcTenantConfig.Authentication

    • cookiePath

      public String cookiePath()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Cookie path parameter value which, if set, is used to set a path parameter for the session, state and post logout cookies. The `cookie-path-header` property, if set, is checked first.
      Specified by:
      cookiePath in interface OidcTenantConfig.Authentication

    • cookiePathHeader

      public Optional<String> cookiePathHeader()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Cookie path header parameter value which, if set, identifies the incoming HTTP header whose value is used to set a path parameter for the session, state and post logout cookies. If the header is missing, the `cookie-path` property is checked.
      Specified by:
      cookiePathHeader in interface OidcTenantConfig.Authentication

    • cookieDomain

      public Optional<String> cookieDomain()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Cookie domain parameter value which, if set, is used for the session, state and post logout cookies.
      Specified by:
      cookieDomain in interface OidcTenantConfig.Authentication

    • cookieSameSite

      public OidcTenantConfig.Authentication.CookieSameSite cookieSameSite()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      SameSite attribute for the session cookie.
      Specified by:
      cookieSameSite in interface OidcTenantConfig.Authentication

    • allowMultipleCodeFlows

      public boolean allowMultipleCodeFlows()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      If a state cookie is present, a `state` query parameter must also be present and both the state cookie name suffix and state cookie value must match the value of the `state` query parameter when the redirect path matches the current path. However, if multiple authentications are attempted from the same browser, for example, from the different browser tabs, then the currently available state cookie might represent the authentication flow initiated from another tab and not related to the current request. Disable this property to permit only a single authorization code flow in the same browser.
      Specified by:
      allowMultipleCodeFlows in interface OidcTenantConfig.Authentication

    • failOnMissingStateParam

      public boolean failOnMissingStateParam()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Fail with the HTTP 401 error if the state cookie is present but no state query parameter is present.

      When either multiple authentications are disabled or the redirect URL matches the original request URL, the stale state cookie might remain in the browser cache from the earlier failed redirect to an OpenId Connect provider and be visible during the current request. For example, if Single-page application (SPA) uses XHR to handle redirects to the provider which does not support CORS for its authorization endpoint, the browser blocks it and the state cookie created by Quarkus remains in the browser cache. Quarkus reports an authentication failure when it detects such an old state cookie but find no matching state query parameter.

      Reporting HTTP 401 error is usually the right thing to do in such cases, it minimizes a risk of the browser redirect loop but also can identify problems in the way SPA or Quarkus application manage redirects. For example, enabling OidcTenantConfig.Authentication.javaScriptAutoRedirect() or having the provider redirect to URL configured with OidcTenantConfig.Authentication.redirectPath() might be needed to avoid such errors.

      However, setting this property to `false` might help if the above options are not suitable. It causes a new authentication redirect to OpenId Connect provider. Doing so might increase the risk of browser redirect loops.

      Specified by:
      failOnMissingStateParam in interface OidcTenantConfig.Authentication

    • failOnUnresolvedKid

      public boolean failOnUnresolvedKid()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Fail with the HTTP 401 error if the ID token signature can not be verified during the re-authentication only due to an unresolved token key identifier (`kid`).

      This property might need to be disabled when multiple tab authentications are allowed, with one of the tabs keeping an expired ID token with its `kid` unresolved due to the verification key set refreshed due to another tab initiating an authorization code flow. In such cases, instead of failing with the HTTP 401 error, redirecting the user to re-authenticate with the HTTP 302 status may provide better user experience.

      Specified by:
      failOnUnresolvedKid in interface OidcTenantConfig.Authentication

    • userInfoRequired

      public Optional<Boolean> userInfoRequired()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      If this property is set to `true`, an OIDC UserInfo endpoint is called.

      This property is enabled automatically if `quarkus.oidc.roles.source` is set to `userinfo` or `quarkus.oidc.token.verify-access-token-with-user-info` is set to `true` or `quarkus.oidc.authentication.id-token-required` is set to `false`, the current OIDC tenant must support a UserInfo endpoint in these cases.

      It is also enabled automatically if `io.quarkus.oidc.UserInfo` injection point is detected but only if the current OIDC tenant supports a UserInfo endpoint.

      Specified by:
      userInfoRequired in interface OidcTenantConfig.Authentication

    • sessionAgeExtension

      public Optional<Duration> sessionAgeExtension()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Session age extension in minutes. The user session age property is set to the value of the ID token life-span by default and the user is redirected to the OIDC provider to re-authenticate once the session has expired. If this property is set to a nonzero value, then the expired ID token can be refreshed before the session has expired. This property is effective only if the `token.refresh-expired` property is enabled and a refresh token is available. It is set to 5 minutes by default.
      Specified by:
      sessionAgeExtension in interface OidcTenantConfig.Authentication

    • stateCookieAge

      public Duration stateCookieAge()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      State cookie age in minutes. State cookie is created every time a new authorization code flow redirect starts and removed when this flow is completed. State cookie name is unique by default, see OidcTenantConfig.Authentication.allowMultipleCodeFlows(). Keep its age to the reasonable minimum value such as 5 minutes or less.
      Specified by:
      stateCookieAge in interface OidcTenantConfig.Authentication

    • javaScriptAutoRedirect

      public boolean javaScriptAutoRedirect()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      If this property is set to `true`, a normal 302 redirect response is returned if the request was initiated by a JavaScript API such as XMLHttpRequest or Fetch and the current user needs to be (re)authenticated, which might not be desirable for Single-page applications (SPA) since it automatically following the redirect might not work given that OIDC authorization endpoints typically do not support CORS.

      If this property is set to `false`, a status code of `499` is returned to allow SPA to handle the redirect manually if a request header identifying current request as a JavaScript request is found. `X-Requested-With` request header with its value set to either `JavaScript` or `XMLHttpRequest` is expected by default if this property is enabled. You can register a custom JavaScriptRequestChecker to do a custom JavaScript request check instead.

      Specified by:
      javaScriptAutoRedirect in interface OidcTenantConfig.Authentication

    • idTokenRequired

      public Optional<Boolean> idTokenRequired()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Requires that ID token is available when the authorization code flow completes. Disable this property only when you need to use the authorization code flow with OAuth2 providers which do not return ID token - an internal IdToken is generated in such cases.
      Specified by:
      idTokenRequired in interface OidcTenantConfig.Authentication

    • internalIdTokenLifespan

      public Optional<Duration> internalIdTokenLifespan()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Internal ID token lifespan. This property is only checked when an internal IdToken is generated when OAuth2 providers do not return IdToken. If this property is not configured then an access token `expires_in` property in the OAuth2 authorization code flow response is used to set an internal IdToken lifespan.
      Specified by:
      internalIdTokenLifespan in interface OidcTenantConfig.Authentication

    • pkceRequired

      public Optional<Boolean> pkceRequired()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Requires that a Proof Key for Code Exchange (PKCE) is used.
      Specified by:
      pkceRequired in interface OidcTenantConfig.Authentication

    • pkceSecret

      public Optional<String> pkceSecret()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Secret used to encrypt a Proof Key for Code Exchange (PKCE) code verifier in the code flow state. This secret should be at least 32 characters long.
      Specified by:
      pkceSecret in interface OidcTenantConfig.Authentication

    • stateSecret

      public Optional<String> stateSecret()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Secret used to encrypt Proof Key for Code Exchange (PKCE) code verifier and/or nonce in the code flow state. This secret should be at least 32 characters long.

      If this secret is not set, the client secret configured with either `quarkus.oidc.credentials.secret` or `quarkus.oidc.credentials.client-secret.value` is checked. Finally, `quarkus.oidc.credentials.jwt.secret` which can be used for `client_jwt_secret` authentication is checked. A client secret is not be used as a state encryption secret if it is less than 32 characters long.

      The secret is auto-generated if it remains uninitialized after checking all of these properties.

      Error is reported if the secret length is less than 16 characters.

      Specified by:
      stateSecret in interface OidcTenantConfig.Authentication

    • par

      public OidcTenantConfig.PushedAuthorizationRequest par()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Configuration for the pushed authorization request (PAR) as defined by the RFC 9126.
      Specified by:
      par in interface OidcTenantConfig.Authentication

    • getInternalIdTokenLifespan

      public Optional<Duration> getInternalIdTokenLifespan()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setInternalIdTokenLifespan

      public void setInternalIdTokenLifespan(Duration internalIdTokenLifespan)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isPkceRequired

      public Optional<Boolean> isPkceRequired()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setPkceRequired

      public void setPkceRequired(boolean pkceRequired)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getPkceSecret

      @Deprecated(forRemoval=true) public Optional<String> getPkceSecret()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setPkceSecret

      @Deprecated(forRemoval=true) public void setPkceSecret(String pkceSecret)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getErrorPath

      public Optional<String> getErrorPath()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setErrorPath

      public void setErrorPath(String errorPath)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isJavaScriptAutoRedirect

      public boolean isJavaScriptAutoRedirect()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setJavaScriptAutoredirect

      public void setJavaScriptAutoredirect(boolean autoRedirect)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getRedirectPath

      public Optional<String> getRedirectPath()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setRedirectPath

      public void setRedirectPath(String redirectPath)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getScopes

      public Optional<List<String>> getScopes()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setScopes

      public void setScopes(List<String> scopes)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getExtraParams

      public Map<String,String> getExtraParams()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setExtraParams

      public void setExtraParams(Map<String,String> extraParams)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setAddOpenidScope

      public void setAddOpenidScope(boolean addOpenidScope)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isAddOpenidScope

      public Optional<Boolean> isAddOpenidScope()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isForceRedirectHttpsScheme

      public Optional<Boolean> isForceRedirectHttpsScheme()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setForceRedirectHttpsScheme

      public void setForceRedirectHttpsScheme(boolean forceRedirectHttpsScheme)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isRestorePathAfterRedirect

      public boolean isRestorePathAfterRedirect()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setRestorePathAfterRedirect

      public void setRestorePathAfterRedirect(boolean restorePathAfterRedirect)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isCookieForceSecure

      public boolean isCookieForceSecure()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setCookieForceSecure

      public void setCookieForceSecure(boolean cookieForceSecure)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getCookiePath

      public String getCookiePath()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setCookiePath

      public void setCookiePath(String cookiePath)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getCookieDomain

      public Optional<String> getCookieDomain()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setCookieDomain

      public void setCookieDomain(String cookieDomain)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isUserInfoRequired

      public Optional<Boolean> isUserInfoRequired()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setUserInfoRequired

      public void setUserInfoRequired(boolean userInfoRequired)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isRemoveRedirectParameters

      public boolean isRemoveRedirectParameters()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setRemoveRedirectParameters

      public void setRemoveRedirectParameters(boolean removeRedirectParameters)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isVerifyAccessToken

      public boolean isVerifyAccessToken()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setVerifyAccessToken

      public void setVerifyAccessToken(boolean verifyAccessToken)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getSessionAgeExtension

      public Optional<Duration> getSessionAgeExtension()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setSessionAgeExtension

      public void setSessionAgeExtension(Duration sessionAgeExtension)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getCookiePathHeader

      public Optional<String> getCookiePathHeader()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setCookiePathHeader

      public void setCookiePathHeader(String cookiePathHeader)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isIdTokenRequired

      public Optional<Boolean> isIdTokenRequired()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setIdTokenRequired

      public void setIdTokenRequired(boolean idTokenRequired)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getCookieSuffix

      public Optional<String> getCookieSuffix()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setCookieSuffix

      public void setCookieSuffix(String cookieSuffix)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getResponseMode

      public Optional<OidcTenantConfig.Authentication.ResponseMode> getResponseMode()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setResponseMode

      public void setResponseMode(OidcTenantConfig.Authentication.ResponseMode responseMode)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getForwardParams

      public Optional<List<String>> getForwardParams()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setForwardParams

      public void setForwardParams(List<String> forwardParams)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getCookieSameSite

      public OidcTenantConfig.Authentication.CookieSameSite getCookieSameSite()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setCookieSameSite

      public void setCookieSameSite(OidcTenantConfig.Authentication.CookieSameSite cookieSameSite)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isAllowMultipleCodeFlows

      public boolean isAllowMultipleCodeFlows()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setAllowMultipleCodeFlows

      public void setAllowMultipleCodeFlows(boolean allowMultipleCodeFlows)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • isNonceRequired

      public boolean isNonceRequired()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setNonceRequired

      public void setNonceRequired(boolean nonceRequired)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getStateSecret

      public Optional<String> getStateSecret()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setStateSecret

      public void setStateSecret(Optional<String> stateSecret)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getScopeSeparator

      public Optional<String> getScopeSeparator()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setScopeSeparator

      public void setScopeSeparator(String scopeSeparator)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getStateCookieAge

      public Duration getStateCookieAge()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setStateCookieAge

      public void setStateCookieAge(Duration stateCookieAge)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • getSessionExpiredPath

      public Optional<String> getSessionExpiredPath()
      Deprecated, for removal: This API element is subject to removal in a future version.

    • setSessionExpiredPath

      public void setSessionExpiredPath(String sessionExpiredPath)
      Deprecated, for removal: This API element is subject to removal in a future version.

    • cacheControl

      public Optional<Set<OidcTenantConfig.Authentication.CacheControl>> cacheControl()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: OidcTenantConfig.Authentication
      Set of cache-control directives that must be set when a new session cookie is created, either after a successful authorization code completion or token refresh.

      Currently, only a `no-store` directive that prohibits caching the session cookie anywhere in the client request chain can be configured.

      Specified by:
      cacheControl in interface OidcTenantConfig.Authentication