Package org.apache.juneau.rest.server.auth.oidc.rp

Class IdTokenValidatorAdapter.Builder

java.lang.Object

org.apache.juneau.rest.server.auth.oidc.rp.IdTokenValidatorAdapter.Builder

Enclosing class:

IdTokenValidatorAdapter

public static class IdTokenValidatorAdapter.Builder
extends Object

Builder.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	Builder()	Constructor.

Method Summary

Modifier and Type	Method	Description
IdTokenValidatorAdapter.Builder	algorithms(com.nimbusds.jose.JWSAlgorithm... values)	Sets the signing-algorithm allowlist.
IdTokenValidatorAdapter	build()	Builds the adapter.
IdTokenValidatorAdapter.Builder	clientId(String value)	Sets the OAuth client id (expected aud).
IdTokenValidatorAdapter.Builder	issuer(String value)	Sets the expected iss (issuer).
IdTokenValidatorAdapter.Builder	jwkSet(com.nimbusds.jose.jwk.JWKSet value)	Sets a fixed JWK set (useful for tests / static keys).
IdTokenValidatorAdapter.Builder	jwkSource(com.nimbusds.jose.jwk.source.JWKSource<com.nimbusds.jose.proc.SecurityContext> value)	Sets a custom JWKSource.
IdTokenValidatorAdapter.Builder	jwksUri(URI value)	Sets the JWKS endpoint URI the validator fetches signing keys from.
IdTokenValidatorAdapter.Builder	maxClockSkewSeconds(int value)	Sets the clock-skew tolerance (in seconds) for exp / iat validation.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

Builder

protected Builder()

Constructor.

Method Details

issuer

public IdTokenValidatorAdapter.Builder issuer(String value)

Sets the expected iss (issuer). Required.

Parameters:

value - The issuer. Must not be null or blank.

Returns:

This object.

clientId

public IdTokenValidatorAdapter.Builder clientId(String value)

Sets the OAuth client id (expected aud). Required.

Parameters:

value - The client id. Must not be null or blank.

Returns:

This object.

jwksUri

public IdTokenValidatorAdapter.Builder jwksUri(URI value)

Sets the JWKS endpoint URI the validator fetches signing keys from. Mutually exclusive with jwkSet(JWKSet) / jwkSource(JWKSource).

The URI must use "https" or target a loopback host; the signing-key material fetched from this endpoint is the trust anchor for every ID token, so a plaintext transport to a non-loopback host is rejected.

Parameters:

value - The JWKS URI. Must not be null and must use HTTPS or target a loopback host.

Returns:

This object.

jwkSet

public IdTokenValidatorAdapter.Builder jwkSet(com.nimbusds.jose.jwk.JWKSet value)

Sets a fixed JWK set (useful for tests / static keys). Mutually exclusive with jwksUri(URI) / jwkSource(JWKSource).

Parameters:

value - The JWK set. Must not be null.

Returns:

This object.

jwkSource

public IdTokenValidatorAdapter.Builder jwkSource(com.nimbusds.jose.jwk.source.JWKSource<com.nimbusds.jose.proc.SecurityContext> value)

Sets a custom JWKSource. Mutually exclusive with jwksUri(URI) / jwkSet(JWKSet).

Parameters:

value - The JWK source. Must not be null.

Returns:

This object.

algorithms

public IdTokenValidatorAdapter.Builder algorithms(com.nimbusds.jose.JWSAlgorithm... values)

Sets the signing-algorithm allowlist. Replaces the default [RS256, ES256].

Parameters:

values - The allowed algorithms. Must be non-empty and must not contain Algorithm.NONE.

Returns:

This object.

maxClockSkewSeconds

public IdTokenValidatorAdapter.Builder maxClockSkewSeconds(int value)

Sets the clock-skew tolerance (in seconds) for exp / iat validation.

Parameters:

value - The tolerance in seconds. Must be non-negative.

Returns:

This object.

build

public IdTokenValidatorAdapter build()

Builds the adapter.

Returns:

A new IdTokenValidatorAdapter.