Package org.forgerock.openig.filter.oauth2.client

Class ClientRegistration

java.lang.Object
org.forgerock.openig.filter.oauth2.client.ClientRegistration
public final class ClientRegistration extends Object
A configuration for an OpenID Connect Provider. Options: 
 
 {
   "clientId"                        : expression        [REQUIRED]
   "issuer"                          : String / Issuer   [REQUIRED - the issuer name, or its inlined declaration. ]
   "pkceMethod"                      : expression        [OPTIONAL - set the Proof Key for Code Exchange (PKCE)
                                                                     method, 'none' or 'S256'. Defaults to 'S256'.]
   "scopes"                          : [ expressions ]   [OPTIONAL - specific scopes to use for this client
                                                                     registration. ]
   "registrationHandler"             : handler           [OPTIONAL - handler to use during client registration to
                                                                     access endpoints that do not require client
                                                                     authentication. As such, this handler should not
                                                                     be configured with a client authentication filter
                                                                     (1). By default this uses the 'ClientHandler'
                                                                     provided in heap. ]
   "authenticatedRegistrationHandler": handler           [OPTIONAL - handler to use during client registration to
                                                                     access endpoints that do require client
                                                                     authentication for the 'clientId'. This handler
                                                                     should be configured with a client authentication
                                                                     filter (1). By default the 'registrationHandler'
                                                                     is reused as-is, with no authentication filter. ]
   "clientSecretUsage"               : EnumExpression    [OPTIONAL - explains how to use the clientSecret :
                                                                      - ID_TOKEN_VALIDATION_ONLY
                                                                      - CLIENT_AUTHENTICATION_ONLY (default)
                                                                      - ID_TOKEN_VALIDATION_AND_CLIENT_AUTHENTICATION
   "clientSecretId"                  : GenericSecretId   [OPTIONAL - required when the ID Token is signed with
                                                                     symmetric encryption.]
   "secretsProvider"                 : secretsProvider   [OPTIONAL - required when the ID Token is signed with
                                                                     symmetric encryption.]
   "skipSignatureVerification"       : booleanExpression [OPTIONAL - permit to skip ID Token signature verification.
                                                                     Should only be 'true' when the connection between
                                                                     Issuer and Client is direct and well secured.
                                                                     Defaults to 'true' for backward compatibility.]
 }
  1. See ClientSecretBasicAuthenticationFilterHeaplet, ClientSecretPostAuthenticationFilterHeaplet, PrivateKeyJwtClientAuthenticationFilterHeaplet, and EncryptedPrivateKeyJwtClientAuthenticationFilterHeaplet
Example of use: 
 
 {
     "name": "MyClientRegistration",
     "type": "ClientRegistration",
     "config": {
         "clientId": "OpenIG",
         "scopes": [
             "openid",
             "profile"
         ],
         "issuer": "OpenAM",
         "authenticatedRegistrationHandler": "FRClientHandlerWithClientSecretBASICFilter"
         }
     }
 
 }
or, with inlined Issuer declaration: 
 
 {
     "name": "MyClientRegistration",
     "type": "ClientRegistration",
     "config": {
         "clientId": "OpenIG",
         "scopes": [
             "openid",
             "profile"
         ],
         "issuer": {
             "name": "myIssuer",
             "type": "Issuer",
             "config": {
                 "wellKnownEndpoint": "http://server.com:8090/openam/oauth2/.well-known/openid-configuration"
             }
         },
         "authenticatedRegistrationHandler": "FRClientHandlerWithClientSecretPOSTFilter"
     }
 }
or, with inlined 'client_secret_basic' authentication: 
 
 {
     "name": "MyClientRegistration",
     "type": "ClientRegistration",
     "config": {
         "clientId": "OpenIG",
         "scopes": [
             "openid",
             "profile"
         ],
         "issuer": "OpenAM",
         "authenticatedRegistrationHandler": {
             "type": "Chain",
             "config": {
                 "filters": [ {
                     "type": "ClientSecretBasicAuthenticationFilter",
                     "config": {
                         "clientId": "OpenIG",
                         "clientSecretId": "client.secret.id",
                         "secretsProvider" : "SystemAndEnvSecretStore-1"
                     }
                 } ],
                 "handler": "ForgeRockClientHandler"
             }
         }
     }
 }
The following client authentication configuration is deprecated as of IG 7.2:
  • tokenEndpointAuthMethod: previously, the indicator of the type of client authentication to apply - with default of 'client_secret_basic'.
  • clientSecretId: previously, a label of a Purpose required to read a GenericSecret required to authenticate the client when using authentication method 'client_secret_basic' or 'client_secret_post'.
  • privateKeyJwtSecretId: previously the label of a Purpose identifying the secret used with 'private_key_jwt' authentication.
  • tokenEndpointAuthSigningAlg: previously the signing algorithm used with 'private_key_jwt' authentication - with default of RS256.
  • claims: previously, claims used in 'private_key_jwt' authentication. The "aud" claim would default to the URL of the Authorization Server's Token endpoint.
  • jwtExpirationTimeout: previously, the JWT expiration duration when using 'private_key_jwt' authentication - with a default of 1 minute.
See Also: