Deprecated API

Contents

• For Removal
• Interfaces
• Classes
• Fields
• Methods
• Constructors
• Enum Constants

For Removal

Element	Description
org.forgerock.http.header.SetCookie2Header	This header is no longer supported by browsers. Use SetCookieHeader instead.
org.forgerock.http.oauth2.AccessTokenResolver.resolve(Context, String)	Use AccessTokenResolver.resolve(Context, Supplier, String) instead.
org.forgerock.http.oauth2.EncryptedPrivateKeyJwtClientAuthenticationFilter.Builder.buildSecretReferences()	for removal with EncryptedPrivateKeyJwtClientAuthenticationFilter.Builder.withEncryptionPurpose(Purpose). Will be removed in winter 2021 season.
org.forgerock.http.oauth2.EncryptedPrivateKeyJwtClientAuthenticationFilter.Builder.withEncryptionPurpose(Purpose<DataEncryptionKey>)	Please use EncryptedPrivateKeyJwtClientAuthenticationFilter.Builder.withEncryptionSecretReference(SecretReference) instead. Will be removed in winter 2021 season.
org.forgerock.http.oauth2.PrivateKeyJwtClientAuthenticationFilter.Builder.buildSecretReferences()	for removal with PrivateKeyJwtClientAuthenticationFilter.Builder.withSigningPurpose(Purpose). Will be removed in winter 2021 season.
org.forgerock.http.oauth2.PrivateKeyJwtClientAuthenticationFilter.Builder.withSecretsProvider(SecretsProvider)	Please use SecretReference API instead. Will be removed in winter 2021 season.
org.forgerock.http.oauth2.PrivateKeyJwtClientAuthenticationFilter.Builder.withSigningPurpose(Purpose<SigningKey>)	Please use PrivateKeyJwtClientAuthenticationFilter.Builder.withSigningSecretReference(SecretReference) instead. Will be removed in winter 2021 season.
org.forgerock.openig.el.Functions.matches(String, String)	since 7.2.0, with OPENIG-5793. Use Functions.find(String, String) or Functions.matchesWithRegex(String, String) instead.
org.forgerock.openig.el.Functions.matchingGroups(String, String)	since 7.2.0, with OPENIG-5957. Use Functions.findGroups(String, String) instead.

Interfaces

Interface	Description
org.forgerock.http.session.SessionManager

Classes

Class	Description
org.forgerock.http.header.SetCookie2Header	This header is no longer supported by browsers. Use SetCookieHeader instead.
org.forgerock.http.oauth2.ClientSecretBasicAuthenticationFilter	since 26.2. See Filters.newUrlEncodedHttpBasicAuthFilter(String, SecretReference) for a replacement.
org.forgerock.http.oauth2.resolver.OpenAmAccessTokenResolver	The “/oauth2/tokeninfo” endpoint was deprecated in AM 6.5. OpenAmAccessTokenResolver is deprecated and should not be used.
org.forgerock.json.jose.builders.SignedEncryptedJwsHeaderBuilder	Use EncryptedThenSignedJwtHeaderBuilder instead.
org.forgerock.json.jose.builders.SignedEncryptedJwtBuilder	Use EncryptedThenSignedJwtBuilder instead.
org.forgerock.json.jose.jwe.handlers.encryption.AbstractEncryptionHandler	Use ContentEncryptionHandler instead.
org.forgerock.json.jose.jwe.handlers.encryption.RSA15AES128CBCHS256EncryptionHandler	Use RSAEncryptionHandler and AESCBCHMACSHA2ContentEncryptionHandler instead.
org.forgerock.json.jose.jwe.handlers.encryption.RSA15AES256CBCHS512EncryptionHandler	Use RSAEncryptionHandler and AESCBCHMACSHA2ContentEncryptionHandler instead.
org.forgerock.json.jose.jws.handlers.ECDSASigningHandler	Use SecretECDSASigningHandler instead
org.forgerock.json.jose.jws.handlers.EdDSASigningHandler	Use SecretEdDSASigningHandler instead.
org.forgerock.json.jose.jws.handlers.HmacSigningHandler	Use SecretHmacSigningHandler instead
org.forgerock.json.jose.jws.handlers.NOPSigningHandler	This algorithm is inherently insecure and shouldn't be used.
org.forgerock.json.jose.jws.handlers.RSASigningHandler	Use SecretRSASigningHandler instead
org.forgerock.json.jose.jws.SignedEncryptedJwt	Use EncryptedThenSignedJwt instead.
org.forgerock.json.jose.tokenhandler.JwtTokenHandler	Prefer SecretsJwtTokenHandler instead.
org.forgerock.json.resource.AbstractRequestHandler	RequestHandler now has default methods which implement the not-supported behavior. This class is here for transition from pre-JDK8 impelementations.
org.forgerock.json.resource.http.SecurityContextFactory	This class will be removed once CAF has been migrated fully to CHF, at which point components should create SecurityContexts directly rather than via request attributes.
org.forgerock.openig.decoration.helper.AbstractHandlerAndFilterDecorator	in 7.1, use AbstractDecorator as a replacement along with the class service/factory.
org.forgerock.openig.filter.CryptoHeaderFilter	in 7.0, will be removed in future versions. See OPENIG-3704.
org.forgerock.openig.filter.oauth2.OpenAmAccessTokenResolverHeaplet	in 7.0. The "/oauth2/tokeninfo" endpoint was deprecated in AM 6.5.
org.forgerock.openig.handler.DesKeyGenHandler	Since 7.0.0 with no replacement
org.forgerock.openig.handler.saml.SamlFederationHandlerHeaplet	in 2023.4.0, use SamlFederationFilterHeaplet as a replacement
org.forgerock.openig.secrets.DefaultSecretsService	in 7.0, use SecretsProvider reference instead.
org.forgerock.openig.security.KeyManagerHeaplet	Use SecretsKeyManagerHeaplet instead.
org.forgerock.openig.security.KeyStoreHeaplet	Use KeyStoreSecretStoreHeaplet instead.
org.forgerock.openig.security.TrustManagerHeaplet	Use SecretsTrustManagerHeaplet instead.
org.forgerock.openig.tools.jwt.factory.UnsignedJwtFactory	Since 7.0 There is no replacement, as this feature is considered insecure.
org.forgerock.util.Utils	Use Strings, Closeables, Objects or Threads instead.

Fields

Field	Description
org.forgerock.openig.openam.AbstractConditionAdviceFilter.formatEncoder	Since 2023.6 - supports legacy behaviour only

Methods

Method	Description
org.forgerock.http.filter.Filters.newSessionFilter(SessionManager)
org.forgerock.http.header.ContentTypeHeader.getAdditionalParameters()	Replaced by ContentTypeHeader.getDirectives()
org.forgerock.http.oauth2.AccessTokenResolver.resolve(Context, String)	Use AccessTokenResolver.resolve(Context, Supplier, String) instead.
org.forgerock.http.oauth2.EncryptedPrivateKeyJwtClientAuthenticationFilter.Builder.buildSecretReferences()	for removal with EncryptedPrivateKeyJwtClientAuthenticationFilter.Builder.withEncryptionPurpose(Purpose). Will be removed in winter 2021 season.
org.forgerock.http.oauth2.EncryptedPrivateKeyJwtClientAuthenticationFilter.Builder.withEncryptionPurpose(Purpose<DataEncryptionKey>)	Please use EncryptedPrivateKeyJwtClientAuthenticationFilter.Builder.withEncryptionSecretReference(SecretReference) instead. Will be removed in winter 2021 season.
org.forgerock.http.oauth2.OAuth2Error.toWWWAuthenticateHeader()	Use OAuth2Error.asWwwAuthenticateHeader() instead.
org.forgerock.http.oauth2.PrivateKeyJwtClientAuthenticationFilter.Builder.buildSecretReferences()	for removal with PrivateKeyJwtClientAuthenticationFilter.Builder.withSigningPurpose(Purpose). Will be removed in winter 2021 season.
org.forgerock.http.oauth2.PrivateKeyJwtClientAuthenticationFilter.Builder.withSecretsProvider(SecretsProvider)	Please use SecretReference API instead. Will be removed in winter 2021 season.
org.forgerock.http.oauth2.PrivateKeyJwtClientAuthenticationFilter.Builder.withSigningPurpose(Purpose<SigningKey>)	Please use PrivateKeyJwtClientAuthenticationFilter.Builder.withSigningSecretReference(SecretReference) instead. Will be removed in winter 2021 season.
org.forgerock.http.protocol.Cookie.getComment()	Only valid for RFC 2965 cookies ("Cookie2"), which have been deprecated and removed by most clients.
org.forgerock.http.protocol.Cookie.getCommentURL()	Only valid for RFC 2965 cookies ("Cookie2"), which have been deprecated and removed by most clients.
org.forgerock.http.protocol.Cookie.getDiscard()	Only valid for RFC 2965 cookies ("Cookie2"), which have been deprecated and removed by most clients.
org.forgerock.http.protocol.Cookie.getPort()	Only valid for RFC 2965 cookies ("Cookie2"), which have been deprecated and removed by most clients.
org.forgerock.http.protocol.Cookie.getVersion()	Only valid for RFC 2965 cookies ("Cookie2"), which have been deprecated and removed by most clients.
org.forgerock.http.protocol.Cookie.setComment(String)	Only valid for RFC 2965 cookies ("Cookie2"), which have been deprecated and removed by most clients.
org.forgerock.http.protocol.Cookie.setCommentURL(String)	Only valid for RFC 2965 cookies ("Cookie2"), which have been deprecated and removed by most clients.
org.forgerock.http.protocol.Cookie.setDiscard(Boolean)	Only valid for RFC 2965 cookies ("Cookie2"), which have been deprecated and removed by most clients.
org.forgerock.http.protocol.Cookie.setPort(List<Integer>)	Only valid for RFC 2965 cookies ("Cookie2"), which have been deprecated and removed by most clients.
org.forgerock.http.protocol.Cookie.setVersion(Integer)	Only valid for RFC 2965 cookies ("Cookie2"), which have been deprecated and removed by most clients.
org.forgerock.http.protocol.Form.fromRequestEntity(Request)	Because Entity content should be read asynchronously. Instead retrieve the Form with Entity.getFormAsync().
org.forgerock.http.protocol.Form.fromString(String)	use Form.fromFormString(String) instead.
org.forgerock.http.protocol.Form.toString()	use Form.toFormString() instead.
org.forgerock.http.protocol.Request.getForm()	Use Request.getQueryParams() or Entity.getForm()
org.forgerock.json.jose.builders.EncryptedJwtBuilder.sign(SigningHandler, JwsAlgorithm)	Use EncryptedJwtBuilder.signedWith(SigningHandler, JwsAlgorithm) instead.
org.forgerock.json.jose.builders.JweHeaderBuilder.epk(String)	Use JweHeaderBuilder.epk(JWK) instead.
org.forgerock.json.jose.builders.JwtBuilderFactory.jwe(Key)	Prefer JwtBuilderFactory.jwe(EncryptionKey) instead.
org.forgerock.json.jose.builders.JwtBuilderFactory.jwt()	This method provides no security at all and shouldn't be used.
org.forgerock.json.jose.builders.SignedJwtBuilderImpl.encrypt(Key)	Prefer SignedJwtBuilderImpl.encrypt(EncryptionKey) instead.
org.forgerock.json.jose.jwe.EncryptedJwt.decrypt(Key)	Prefer EncryptedJwt.decrypt(SecretsProvider, Purpose) instead.
org.forgerock.json.jose.jwe.EncryptedJwt.decryptRawPayload(Key)	Prefer EncryptedJwt.decryptRawPayload(SecretsProvider, Purpose) instead.
org.forgerock.json.jose.jwe.handlers.encryption.EncryptionHandler.decryptContentEncryptionKey(Key, byte[])	Use EncryptionHandler.decryptContentEncryptionKey(Key, byte[], JweHeader) instead.
org.forgerock.json.jose.jwe.handlers.encryption.EncryptionHandler.generateJWEEncryptedKey(Key, Key)	Use EncryptionHandler.generateJWEEncryptedKey(Key, Key, JweHeader) instead.
org.forgerock.json.jose.jwe.SignedThenEncryptedJwt.decryptAndVerify(Key, SigningHandler)	Prefer SignedThenEncryptedJwt.decryptAndVerify(SecretsProvider, Purpose, Purpose) instead.
org.forgerock.json.jose.jwk.EcJWK.getCurve()	replaced by EcJWK.getEllipticCurve().
org.forgerock.json.jose.jwk.JWK.Builder.x509Thumbnail(String)	Use JWK.Builder.x509Thumbprint(String) or JWK.Builder.x509ThumbprintS256(String) instead.
org.forgerock.json.jose.jwk.JWK.getAlgorithm()	replaced by JWK.getJwaAlgorithm()
org.forgerock.json.jose.jwk.JWK.getX509Thumbnail()	Use JWK.getX509Thumbprint() instead.
org.forgerock.json.jose.jwk.JWKSetParser.jwkSet(URL)	Use JWKSetParser.jwkSetAsync(URL) instead.
org.forgerock.json.jose.jwk.store.JwksStore.findJwk(Algorithm, String)	Use JwksStore.findJwkAsync(String) instead.
org.forgerock.json.jose.jwk.store.JwksStore.reloadJwks()	Use JwksStore.reloadJwksAsync() instead.
org.forgerock.json.jose.jwk.store.JwksStore.setJwkUrl(URL)	Use JwksStore.setJwkUrlAsync(URL) instead.
org.forgerock.json.jose.jwk.store.JwksStoreService.configureJwksStore(String, Duration, Duration, URL)	Use JwksStoreService.configureJwksStore(String, Duration, Duration, URL, Clock) with an explicit clock.
org.forgerock.json.jose.jws.EncryptedThenSignedJwt.decrypt(Key)	Prefer EncryptedThenSignedJwt.decrypt(SecretsProvider, Purpose) instead.
org.forgerock.json.jose.jws.JwsAlgorithm.getJwsAlgorithm(String)	Replaced by JwsAlgorithm.parseCryptographicAlgorithm(String)
org.forgerock.json.jose.jws.SigningManager.newEcdsaSigningHandler(PrivateKey)	use SigningManager.newEcdsaSigningHandler(SigningKey)} instead
org.forgerock.json.jose.jws.SigningManager.newEcdsaVerificationHandler(ECPublicKey)	use SigningManager.newEcdsaVerificationHandler(VerificationKey) instead
org.forgerock.json.jose.jws.SigningManager.newEdDsaSigningHandler(byte[])	Use SigningManager.newEdDsaSigningHandler(SigningKey) instead
org.forgerock.json.jose.jws.SigningManager.newEdDsaVerificationHandler(byte[])	Use SigningManager.newEdDsaVerificationHandler(VerificationKey) instead.
org.forgerock.json.jose.jws.SigningManager.newHmacSigningHandler(byte[])	use SigningManager.newHmacSigningHandler(SigningKey) instead
org.forgerock.json.jose.jws.SigningManager.newNopSigningHandler()	This method is inherently insecure and shouldn't be used.
org.forgerock.json.jose.jws.SigningManager.newRsaSigningHandler(Key)	use SigningManager.newRsaVerificationHandler(VerificationKey) instead
org.forgerock.json.jose.jws.SigningManager.newSigningHandler(Key)	Use SigningManager.newSigningHandler(SigningKey) instead
org.forgerock.json.jose.jws.SigningManager.newVerificationHandler(Key)	Use SigningManager.newVerificationHandler(VerificationKey) instead
org.forgerock.json.jose.utils.Utils.base64urlDecode(String)	Use Utils.decodeJwtComponent(String).
org.forgerock.json.jose.utils.Utils.base64urlEncode(String)	Use Utils.encodeJwtComponent(String).
org.forgerock.json.JsonValueFunctions.identity()	use JsonValue::copy directly instead
org.forgerock.json.resource.http.CrestHttp.newHttpHandler(ConnectionFactory)	Use CrestHttp.newHttpHandler(CrestApplication) instead.
org.forgerock.json.resource.ResourceException.getException(int)	in favor of ResourceException.newResourceException(int)
org.forgerock.json.resource.Resources.newAnnotatedRequestHandler(Object)	Use Resources.newHandler(Object) instead.
org.forgerock.json.resource.Resources.newCollection(Object)	Use Resources.newHandler(Object) instead.
org.forgerock.json.resource.Resources.newSingleton(Object)	Use Resources.newHandler(Object) instead.
org.forgerock.json.resource.Responses.newRemainingResultsResponse(String, int)	Use Responses.newQueryResponse(String, CountPolicy, int) instead.
org.forgerock.openig.config.Environment.getBaseDirectory()	in 7.0, use Environment.getInstanceDirectory() as a replacement
org.forgerock.openig.el.Functions.matches(String, String)	since 7.2.0, with OPENIG-5793. Use Functions.find(String, String) or Functions.matchesWithRegex(String, String) instead.
org.forgerock.openig.el.Functions.matchingGroups(String, String)	since 7.2.0, with OPENIG-5957. Use Functions.findGroups(String, String) instead.
org.forgerock.openig.handler.saml.ChfHttpServletRequestAdapter.getRealPath(String)	As of Version 2.1 of the Java Servlet API, use ServletContext.getRealPath(java.lang.String) instead.
org.forgerock.openig.handler.saml.ChfHttpServletRequestAdapter.isRequestedSessionIdFromUrl()	As of Version 2.1 of the Java Servlet API, use ChfHttpServletRequestAdapter.isRequestedSessionIdFromURL() instead.
org.forgerock.openig.handler.saml.ChfHttpServletResponseAdapter.encodeRedirectUrl(String)	As of version 2.1, use encodeRedirectURL(String url) instead
org.forgerock.openig.handler.saml.ChfHttpServletResponseAdapter.encodeUrl(String)	As of version 2.1, use encodeURL(String url) instead
org.forgerock.openig.handler.saml.ChfHttpServletResponseAdapter.setStatus(int, String)	As of version 2.1, due to ambiguous meaning of the message parameter. To set a status code use setStatus(int), to send an error with a description use sendError(int, String). Sets the status code and message for this response.
org.forgerock.openig.heap.GenericHeaplet.getSecretService()	Use SecretsProvider instead.
org.forgerock.secrets.SecretBuilder.build(Class<T>)	Use SecretBuilder.build(Purpose) instead.
org.forgerock.util.encode.Base64.decodeFast(byte[])	Use Base64.decode(byte[]) instead.
org.forgerock.util.promise.Promise.getOrThrowUninterruptibly()	Since 25.0.0. Prefer using Promise.getOrThrow() and handle properly the InterruptedException in the calling code, or use Promise.getOrThrowIfInterrupted().
org.forgerock.util.promise.PromiseImpl.getOrThrowUninterruptibly()
org.forgerock.util.Reject.ifFalse(boolean)	Experience has shown that Reject.ifFalse can be hard to read. Prefer to use Reject.unless(boolean) (which works identically) or rewrite to use Reject.ifTrue(boolean) instead.
org.forgerock.util.thread.ExecutorServiceFactory.createCachedThreadPool()	ExecutorServiceFactory.createCachedThreadPool(String) or ExecutorServiceFactory.createCachedThreadPool(ThreadFactory) should be used so that threads have meaningful names.
org.forgerock.util.thread.ExecutorServiceFactory.createFixedThreadPool(int)	ExecutorServiceFactory.createFixedThreadPool(int, String) should be used so that threads have meaningful names.
org.forgerock.util.thread.ExecutorServiceFactory.createScheduledService(int)	ExecutorServiceFactory.createScheduledService(int, String) should be used so that threads have meaningful names.
org.forgerock.util.thread.ExecutorServiceFactory.createThreadPool(int, int, long, TimeUnit, BlockingQueue<Runnable>)	ExecutorServiceFactory.createThreadPool(int, int, long, TimeUnit, BlockingQueue, String) should be used so that threads have meaningful names.
org.forgerock.util.Utils.asEnum(String, Class<T>)	Use Strings.asEnum(String, Class)
org.forgerock.util.Utils.closeSilently(Closeable...)	Use Closeables.closeSilently(Closeable...)
org.forgerock.util.Utils.compareValues(Object, Object)	Use Objects.compareValues(Object, Object)
org.forgerock.util.Utils.isBlank(CharSequence)	Use Strings.isBlank(CharSequence)
org.forgerock.util.Utils.isCompatible(Object, Object)	Use Objects.isCompatible(Object, Object)
org.forgerock.util.Utils.isNullOrEmpty(String)	Use Strings.isNullOrEmpty(String)
org.forgerock.util.Utils.joinAsString(String, Object...)	Use Strings.joinAsString(String, Object...)
org.forgerock.util.Utils.newThreadFactory(ThreadGroup, String, boolean)	Use Threads.newThreadFactory(ThreadGroup, String, boolean)

Constructors

Constructor	Description
org.forgerock.http.filter.TransactionIdInboundFilter()	Replaced by TransactionIdInboundFilter(boolean)
org.forgerock.http.header.ContentTypeHeader(String, String, String)	Replaced by ContentTypeHeader(String, Map)
org.forgerock.http.io.PipeBufferedStream()	Since 25.0.0. Prefer using PipeBufferedStream(Factory) to provide your own Buffer Factory
org.forgerock.http.oauth2.ResourceServerFilter(AccessTokenResolver, Clock, ResourceAccess, String)	The clock attribute is not used anymore. Use ResourceServerFilter(AccessTokenResolver, ResourceAccess, String) instead. Deprecated in 25.0.0.
org.forgerock.http.servlet.HttpFrameworkServlet(HttpApplication)	Replaced by HttpFrameworkServlet(HttpApplication, boolean, Clock), which explicitly sets the trustTransactionIdHeader field and the Clock to use.
org.forgerock.json.jose.builders.EncryptedJwtBuilder(Key)	Use JwtBuilderFactory.jwe(org.forgerock.secrets.keys.EncryptionKey) instead.
org.forgerock.json.jose.jwk.EcJWK(ECPublicKey, String, String)	Use the builder instead.
org.forgerock.json.jose.jwk.JWK(KeyType, String, String, String)	Use the builder instead.
org.forgerock.json.jose.jwk.OctJWK(String, String, String, String, String, String, List<String>)	Use the builder instead.
org.forgerock.json.jose.jwk.RsaJWK(String, String, String, String, String, String, String, List<String>)	Use the builder instead.
org.forgerock.json.jose.jwk.store.JwksStore(Duration, Duration, URL, JWKSetParser, Clock)	It is recommended to use JwksStore.newJwksStore(Duration, Duration, URL, JWKSetParser, Clock).
org.forgerock.json.jose.jwk.store.JwksStoreService()	Prefer using the constructor JwksStoreService(Client client) in which you provide your own instance of Client. This one does instantiate a specific instance of AsyncHttpClient but does not allow any custom filter processing, nor does it close it properly.
org.forgerock.json.jose.jws.handlers.RSASigningHandler(Key, SignatureUtil)	Please use RSASigningHandler(Key).
org.forgerock.json.jose.jws.SigningManager()	use SigningManager(SecretsProvider) instead
org.forgerock.json.jose.tokenhandler.SecretsJwtTokenHandler(JweAlgorithm, EncryptionMethod, JwsAlgorithm, Optional<Long>, KeyPair, SigningManager, Purpose<SigningKey>, Purpose<VerificationKey>, Clock)	Use SecretsJwtTokenHandler.builder() instead.
org.forgerock.json.JsonPointer()	Use JsonPointer.rootPtr() instead.
org.forgerock.secrets.SecretReference(SecretsProvider, Purpose<T>, Clock)	Use SecretsProvider.createActiveReference(Purpose) or SecretReference.active(SecretsProvider, Purpose, Clock) instead.
org.forgerock.secrets.SecretsProvider()	Prefer using SecretsProvider(Clock) and provide your own clock instance.
org.forgerock.services.context.RequestAuditContext(Context)	Prefer using RequestAuditContext(Context, Instant) not to rely on the system clock.
org.forgerock.util.time.Duration(Long, TimeUnit)	Prefer the use of Duration.duration(long, TimeUnit).

Enum Constants

Enum Constant	Description
org.forgerock.http.handler.HttpClientHandler.HostnameVerifier.ALLOW_ALL	this should never be used as it is a security risk.
org.forgerock.json.jose.jwe.JweAlgorithm.RSAES_PKCS1_V1_5	RSA1_5 is an insecure encryption mode. Use JweAlgorithm.RSA_OAEP_256 instead.
org.forgerock.json.jose.jws.JwsAlgorithm.NONE	This algorithm is inherently insecure and should not be used.
org.forgerock.json.jose.jws.JwsAlgorithmType.NONE	This algorithm is inherently insecure and shouldn't be used.