Package org.forgerock.openig.fapi.authorization

Interface AuthorizationRequest

public interface AuthorizationRequest
Interface to describe custom behavior about handling request during /authorize and /par.

  • Field Details

    • REQUEST_JWT_PARAM_NAME

      static final String REQUEST_JWT_PARAM_NAME
      Name of the parameter to locate the request object.
      See Also:

    • ALLOWED_REQUEST_PARAMETER_NAMES

      static final Set<String> ALLOWED_REQUEST_PARAMETER_NAMES
      Default allowed request parameters.

  • Method Details

    • findRequestObject

      Promise<Optional<String>,AuthorizationRequestException> findRequestObject()
      Retrieves a parameter from the HTTP Request.
      Returns:
      Promise which returns the param value as a String or an empty optional if the param does not exist or fails to be retrieved due to an exception.

    • removeExtraParameters

      default Promise<Void,AuthorizationRequestException> removeExtraParameters()
      Because FAPI requires the use of a JWT-Secured Authorized Request (JAR) in accordance with RFC 9101. That rfc states in section 6.3 of the RFC that: 
      The authorization server MUST extract the set of authorization request parameters from the Request Object
 value. The authorization server MUST only use the parameters in the Request Object, even if the same parameter is
 provided in the query parameter.
      This means that any parameters supplied with the request (both /par and /authorize requests) should ignore any parameters provided with the request, and use only the parameters supplied in the JAR object. The exceptions to the rule are those elements of the request required for the client authorization method, e.g. client_id for tls_client_auth type requests and client_assertion and client_assertion_type for private_key_jwt requests.

      This method removes all parameters except the following;

      • client_id
      • client_assertion
      • client_assertion_type
      • request_uri
      • request

      Due to issues in AM, this method will also leave the following parameters, although it shouldn't have to:

      • scope
      • response_type
      Returns:
      a Promise that will resolve when the method has completed

    • removeExtraParameters

      Promise<Void,AuthorizationRequestException> removeExtraParameters(Set<String> paramNamesToKeep)
      Implementation which removes parameter values that don't match an entry in paramNamesToKeep from the Request's Parameters.
      Parameters:
      paramNamesToKeep - the set of HTTP Request parameters to keep
      Returns:
      Promise