Package org.forgerock.openig.fapi.token

Class FapiTokenFilterChainHeaplet

java.lang.Object
org.forgerock.openig.heap.GenericHeaplet
org.forgerock.openig.fapi.FapiGenericHeaplet
org.forgerock.openig.fapi.token.FapiTokenFilterChainHeaplet
All Implemented Interfaces:
Heaplet
public final class FapiTokenFilterChainHeaplet extends FapiGenericHeaplet
Filter chain to validate token requests and make sure they comply with the following FAPI specifications:

This filter is intended to front filter(s) rejecting requests that would result in an OAuth2 client being created that does not conform to the FAPI spec. 

 {
    "type": "FapiTokenFilterChain",
    "config": {
      "forwardedHost"        : String               [REQUIRED - The forwarded host added to the endpoint request. ]
      "clientCertificate"    : Runtime Expression   [REQUIRED - A runtime expression which will yield the client TLS
                                                                certificate and is evaluated on EVERY request. ]
      "auditService"         : AuditService         [OPTIONAL - Reference to a {@link AuditService}]
      "apiClientService"     : ApiClientService     [REQUIRED - Reference to a {@link ApiClientService}]
      "accessTokenResolver"  : accessTokenResolver  [REQUIRED - Reference to a {@link AccessTokenResolver}]
      "clientIdClaim"        : String               [OPTIONAL - The claim used to retrieve the client_id from the
                                                                access_token. Default is 'aud'.]
    }
  }
 
 
 
 {
     "name": "fapiTokenFilterChain",
     "type": "FapiTokenFilterChain",
     "config": {
       "forwardedHost" : "&{as.fqdn}",
       "clientCertificate": "${pemCertificate(urlDecode(request.headers['ssl-client-cert'][0]))}",
       "auditService" : "auditService",
       "apiClientService" : "apiClientService",
       "accessTokenResolver" : "accessTokenResolver",
       "clientIdClaim" : "aud"
     }
 }