Package org.apache.juneau.rest.server.auth.oauth

Class OAuthIntrospectionValidator.Builder

java.lang.Object
org.apache.juneau.rest.server.auth.oauth.OAuthIntrospectionValidator.Builder
Enclosing class:
OAuthIntrospectionValidator
public static class OAuthIntrospectionValidator.Builder extends Object
Builder for OAuthIntrospectionValidator.

  • Constructor Details

    • Builder

      protected Builder()
      Constructor.

  • Method Details

    • introspectionEndpoint

      public OAuthIntrospectionValidator.Builder introspectionEndpoint(URI value)
      Sets the introspection endpoint URL. Required.

      Each introspection call transmits the client secret (HTTP Basic) and the access token under validation to this endpoint, so the URL must use "https" or target a loopback host; a plaintext transport to a non-loopback host is rejected.

      Parameters:
      value - The endpoint URL. Must not be null and must use HTTPS or target a loopback host.
      Returns:
      This object.

    • clientId

      public OAuthIntrospectionValidator.Builder clientId(String value)
      Sets the OAuth client ID used for HTTP Basic auth against the introspection endpoint.
      Parameters:
      value - The client ID. Must not be null or blank.
      Returns:
      This object.

    • clientSecret

      public OAuthIntrospectionValidator.Builder clientSecret(String value)
      Sets the OAuth client secret as a literal string.

      Mutually exclusive with clientSecretSupplier(Supplier).

      Parameters:
      value - The client secret. Must not be null or blank.
      Returns:
      This object.

    • clientSecretSupplier

      public OAuthIntrospectionValidator.Builder clientSecretSupplier(Supplier<String> value)
      Sets the OAuth client secret via a supplier (useful for rotating secrets).
      Parameters:
      value - The supplier. Must not be null.
      Returns:
      This object.

    • tokenCache

      public OAuthIntrospectionValidator.Builder tokenCache(TokenCache value)
      Sets a custom token cache. Defaults to a BoundedLruTokenCache with 1000 entries.
      Parameters:
      value - The cache. Must not be null.
      Returns:
      This object.

    • cacheTtl

      public OAuthIntrospectionValidator.Builder cacheTtl(Duration value)
      Sets the cache TTL. Defaults to 5 minutes; capped at 1 hour. Capped by the token's own exp when shorter.
      Parameters:
      value - The TTL. Must be positive and not exceed 1 hour.
      Returns:
      This object.

    • requiredScopes

      public OAuthIntrospectionValidator.Builder requiredScopes(String... scopes)
      Adds required scopes (scope enforcement lives on the validator, not the filter).

      If any required scope is missing from the introspection response's scope claim, the validator throws AuthenticationException with WWW-Authenticate: Bearer error="insufficient_scope".

      Parameters:
      scopes - The required scopes. Must contain at least one non-blank entry.
      Returns:
      This object.

    • audience

      public OAuthIntrospectionValidator.Builder audience(String... values)
      Adds expected audience values (RFC 7662 aud) that a token must carry to be accepted.

      When at least one value is configured here (via this method or resource(String...)), the introspection response's aud claim must contain at least one matching value, or the token is rejected as invalid_token — even when active=true and required scopes match. This binds the token to the resource server it was minted for, so a token issued for a different API cannot be replayed against this one.

      When left unset (the default), no audience/resource check is performed: today's active + optional-required-scopes behavior is preserved unchanged.

      Parameters:
      values - The expected audience values. Must contain at least one non-blank entry.
      Returns:
      This object.

    • resource

      public OAuthIntrospectionValidator.Builder resource(String... values)
      Adds expected resource-indicator values (RFC 8707).

      Alias for audience(String...): RFC 8707 resource indicators are echoed back by conformant authorization servers in the same introspection aud claim as RFC 7662 audiences, so both methods add to the same expected-value set.

      Parameters:
      values - The expected resource values. Must contain at least one non-blank entry.
      Returns:
      This object.

    • clock

      public OAuthIntrospectionValidator.Builder clock(Clock value)
      Overrides the Clock used for cache expiry. Useful in tests.
      Parameters:
      value - The clock. Must not be null.
      Returns:
      This object.

    • httpRequestConfigurator

      public OAuthIntrospectionValidator.Builder httpRequestConfigurator(Consumer<com.nimbusds.oauth2.sdk.http.HTTPRequest> value)
      Sets a callback that customizes the Nimbus HTTPRequest before it is sent.

      This is the escape hatch for custom HTTP behavior (proxies, TLS overrides, timeouts). The callback is invoked on every introspection call.

      Parameters:
      value - The configurator callback. Must not be null.
      Returns:
      This object.

    • build

      public OAuthIntrospectionValidator build()
      Builds the validator.
      Returns:
      A new OAuthIntrospectionValidator.