Package org.apache.juneau.rest.server.auth.oauth

Class OAuthIntrospectionValidator

java.lang.Object

org.apache.juneau.rest.server.auth.oauth.OAuthIntrospectionValidator

All Implemented Interfaces:

TokenValidator

public class OAuthIntrospectionValidator
extends Object
implements TokenValidator

TokenValidator that validates opaque OAuth 2.0 access tokens via the RFC 7662 Token Introspection endpoint.

Wraps Nimbus's TokenIntrospectionRequest / TokenIntrospectionResponse for the HTTP round-trip and the JSON parsing. A TokenCache (default: bounded LRU cache) short-circuits the round-trip on repeated lookups within the configured TTL window.

Usage

var validator = OAuthIntrospectionValidator.create() .introspectionEndpoint(URI.create("https://idp.example.com/oauth2/introspect")) .clientId("api-server") .clientSecret("...") .requiredScopes("read:orders") .build();

Defaults

• Cache TTL: 5 minutes, capped at 1 hour.
• Cache size: 1000 entries.
• Required scopes: none (scope enforcement lives on the validator, not the filter).

See Also:

• OAuthFilter
• TokenValidator
• RFC 7662 — OAuth 2.0 Token Introspection

Since:

10.0.0

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	OAuthIntrospectionValidator.Builder	Builder for OAuthIntrospectionValidator.

Field Summary

Fields

Modifier and Type	Field	Description
static final Duration	DEFAULT_CACHE_TTL	Default cache TTL.
static final Duration	MAX_CACHE_TTL	Maximum cache TTL.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	OAuthIntrospectionValidator(OAuthIntrospectionValidator.Builder b)	Constructor.

Method Summary

Modifier and Type	Method	Description
static OAuthIntrospectionValidator.Builder	create()	Static creator.
Duration	getCacheTtl()	Returns the cache TTL.
String	getClientId()	Returns the configured OAuth client ID.
Set<String>	getExpectedAudiences()	Returns the configured expected audience / resource-indicator set.
URI	getIntrospectionEndpoint()	Returns the configured introspection endpoint URL.
Set<String>	getRequiredScopes()	Returns the required-scope set.
TokenCache	getTokenCache()	Returns the underlying token cache.
Principal	validate(String token)	Validates the supplied bearer token and returns the associated Principal.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_CACHE_TTL

public static final Duration DEFAULT_CACHE_TTL

Default cache TTL.

MAX_CACHE_TTL

public static final Duration MAX_CACHE_TTL

Maximum cache TTL.

Constructor Details

OAuthIntrospectionValidator

protected OAuthIntrospectionValidator(OAuthIntrospectionValidator.Builder b)

Constructor.

Parameters:

b - The builder.

Method Details

create

public static OAuthIntrospectionValidator.Builder create()

Static creator.

Returns:

A new builder.

getIntrospectionEndpoint

public URI getIntrospectionEndpoint()

Returns the configured introspection endpoint URL.

Returns:

The endpoint.

getClientId

public String getClientId()

Returns the configured OAuth client ID.

Returns:

The client ID.

getCacheTtl

public Duration getCacheTtl()

Returns the cache TTL.

Returns:

The TTL.

getRequiredScopes

public Set<String> getRequiredScopes()

Returns the required-scope set.

Returns:

An unmodifiable view.

getExpectedAudiences

public Set<String> getExpectedAudiences()

Returns the configured expected audience / resource-indicator set.

Returns:

An unmodifiable view. Empty when no audience/resource binding is configured (default).

getTokenCache

public TokenCache getTokenCache()

Returns the underlying token cache.

Returns:

The token cache.

validate

public Principal validate(String token)
                   throws AuthenticationException

Description copied from interface: TokenValidator

Validates the supplied bearer token and returns the associated Principal.

Specified by:

validate in interface TokenValidator

Parameters:

token - The raw token string from Authorization: Bearer <token>. Never null.

Returns:

The authenticated principal. Must not be null on success.

Throws:

AuthenticationException - If the token is invalid, expired, revoked, or otherwise unacceptable.