Package org.forgerock.openig.filter.oauth2.client

Class ClientRegistration

java.lang.Object
org.forgerock.openig.filter.oauth2.client.ClientRegistration
public final class ClientRegistration extends Object
A configuration for an OpenID Connect Provider. Options: 
 
 {
   "clientId"                        : expression        [REQUIRED]
   "issuer"                          : String / Issuer   [REQUIRED - the issuer name, or its inlined declaration. ]
   "pkceMethod"                      : expression        [OPTIONAL - set the Proof Key for Code Exchange (PKCE)
                                                                     method, 'none' or 'S256'. Defaults to 'S256'.]
   "scopes"                          : [ expressions ]   [OPTIONAL - specific scopes to use for this client
                                                                     registration. ]
   "registrationHandler"             : handler           [OPTIONAL - handler to use during client registration to
                                                                     access endpoints that do not require client
                                                                     authentication. As such, this handler should not
                                                                     be configured with a client authentication filter
                                                                     (1). By default this uses the 'ClientHandler'
                                                                     provided in heap. ]
   "authenticatedRegistrationHandler": handler           [OPTIONAL - handler to use during client registration to
                                                                     access endpoints that do require client
                                                                     authentication for the 'clientId'. This handler
                                                                     should be configured with a client authentication
                                                                     filter (1). By default the 'registrationHandler'
                                                                     is reused as-is, with no authentication filter. ]
   "clientSecretId"                  : GenericSecretId   [OPTIONAL - required when the ID Token is signed with
                                                                     symmetric encryption.]
   "secretsProvider"                 : secretsProvider   [OPTIONAL - required when the ID Token is signed with
                                                                     symmetric encryption.]
   "skipSignatureVerification"       : booleanExpression [OPTIONAL - permit to skip ID Token signature verification.
                                                                     Should only be 'true' when the connection between
                                                                     Issuer and Client is direct and well secured.
                                                                     Defaults to 'true' for backward compatibility.]
 }
  1. See ClientSecretBasicAuthenticationFilterHeaplet, ClientSecretPostAuthenticationFilterHeaplet, PrivateKeyJwtClientAuthenticationFilterHeaplet, and EncryptedPrivateKeyJwtClientAuthenticationFilterHeaplet
Example of use: 
 
 {
     "name": "MyClientRegistration",
     "type": "ClientRegistration",
     "config": {
         "clientId": "OpenIG",
         "scopes": [
             "openid",
             "profile"
         ],
         "issuer": "OpenAM",
         "authenticatedRegistrationHandler": "FRClientHandlerWithClientSecretBASICFilter"
         }
     }
 
 }
or, with inlined Issuer declaration: 
 
 {
     "name": "MyClientRegistration",
     "type": "ClientRegistration",
     "config": {
         "clientId": "OpenIG",
         "scopes": [
             "openid",
             "profile"
         ],
         "issuer": {
             "name": "myIssuer",
             "type": "Issuer",
             "config": {
                 "wellKnownEndpoint": "http://server.com:8090/openam/oauth2/.well-known/openid-configuration"
             }
         },
         "authenticatedRegistrationHandler": "FRClientHandlerWithClientSecretPOSTFilter"
     }
 }
or, with inlined 'client_secret_basic' authentication: 
 
 {
     "name": "MyClientRegistration",
     "type": "ClientRegistration",
     "config": {
         "clientId": "OpenIG",
         "scopes": [
             "openid",
             "profile"
         ],
         "issuer": "OpenAM",
         "authenticatedRegistrationHandler": {
             "type": "Chain",
             "config": {
                 "filters": [ {
                     "type": "ClientSecretBasicAuthenticationFilter",
                     "config": {
                         "clientId": "OpenIG",
                         "clientSecretId": "client.secret.id",
                         "secretsProvider" : "SystemAndEnvSecretStore-1"
                     }
                 } ],
                 "handler": "ForgeRockClientHandler"
             }
         }
     }
 }
See Also: