Package org.forgerock.openig.filter.oauth2.client

Class IdTokenValidationFilterHeaplet

java.lang.Object
org.forgerock.openig.heap.GenericHeaplet
org.forgerock.openig.filter.jwt.JwtValidationFilter.Heaplet
org.forgerock.openig.filter.oauth2.client.IdTokenValidationFilterHeaplet
All Implemented Interfaces:
Heaplet
public class IdTokenValidationFilterHeaplet extends JwtValidationFilter.Heaplet
An IdTokenValidationFilterHeaplet creates a filter that can be used to validate the given idToken according to the provided configuration by leveraging the JwtValidationFilter. If the Jwt is verified, the chain of execution continues, with an JwtValidationContext provided. If the Jwt is not valid, this filter directly exits the chain by returning either a 403 Forbidden response (by default) or the response built by the given failure handler. In case of errors, an JwtValidationErrorContext is provided.

Configuration options: 

 
 {
     "idToken"                : expression              [REQUIRED]
     "audience"               : expression              [REQUIRED - to validate the 'aud' attribute.]
     "failureHandler"         : handler                 [OPTIONAL - the failure handler - default is FORBIDDEN.]
     "issuer"                 : expression              [OPTIONAL - to validate the 'iss' attribute.]
     "skewAllowance"          : expression<duration>    [OPTIONAL - the skew allowance - defaults to zero.]
     "verificationSecretId"   : Secret ID               [OPTIONAL - to verify the signature of the IdToken.]
     "secretsProvider"        : SecretsProvider         [OPTIONAL - secrets provider used to obtain secrets. REQUIRED
                                                                    if 'verificationSecretId' is used.]
     "customizer"             : JwtValidatorCustomizer  [OPTIONAL - to add special claim checks. This will not
                                                                    override pre-defined constraints on "aud", "iss",
                                                                    "exp" and "iat"]
 }
Example of use for a SignedJwt: 
 
 {
    "type": "IdTokenValidationFilter",
    "config": {
         "idToken": "${attributes.openid.id_token}"
         "audience": "ForgeShop"
         "issuer": "http://openam.example.com:8090/openam/oauth2",
         "verificationSecretId": "signature.verification.secret.id",
         "secretsProvider": "SecretsProvider",
         "customizer": {
             "type": "ScriptableJwtValidatorCustomizer",
             "config": {
                 "type": "application/x-groovy",
                 "source": [
                     "builder.claim('myClaim', JsonValue::asString, isEqualTo('foobar'))"
                 ]
             }
         }
     }
 }
Note that also the issued at claim ('iat') must be present and before the actual date.
See Also: