Package org.forgerock.openig.fapi.wellknown

Class FapiWellKnownFilterChainHeaplet

java.lang.Object
org.forgerock.openig.heap.GenericHeaplet
org.forgerock.openig.fapi.FapiGenericHeaplet
org.forgerock.openig.fapi.wellknown.FapiWellKnownFilterChainHeaplet
All Implemented Interfaces:
Heaplet
public final class FapiWellKnownFilterChainHeaplet extends FapiGenericHeaplet
Filters chain that validates well-known requests to make sure that they will produce OAuth2.0 clients that are compliant with the following FAPI specifications:

This filter is intended to front filter(s) rejecting requests that would result in an OAuth2 client being created which did not conform to the FAPI spec.

 {
    "type": "FapiWellKnownFilterChain",
    "config": {
      "forwardedHost"                     : String      [REQUIRED - The forwarded host added to the endpoint request.]
      "supportedTokenEndpointAuthMethods" : String[]    [OPTIONAL - Lists accepted OAuth2 token_endpoint_auth_method
                                                                    values - see (1). ]
      "mtlsEndpoints" : {                 : object      [REQUIRED - Well-known endpoint URIs to specify as mTLS (2). ]
        "endpointNames"                   : String[]    [REQUIRED - Array of endpoint well-known names to update. ]
        "mtlsHostname"                    : String      [REQUIRED - mTLS hostname to use. ]
      }
    }
 }

Notes:

  • '"supportedTokenEndpointAuthMethods"' configures which OAuth2 'token_endpoint_auth_method' values are accepted by FAPI. See Constants.FAPI_SUPPORTED_TOKEN_ENDPOINT_AUTH_METHODS for supported auth methods, which are used as default values if omitted.
  • '"mtlsEndpoints"' stipulates the well-known endpoint names that should be transformed to use the mTLS host URI.

Example config: 

 
 {
     "name": "fapiWellKnownFilterChain",
     "type": "FapiWellKnownFilterChain",
     "config": {
       "forwardedHost" : "&{as.fqdn}"
       "supportedTokenEndpointAuthMethods" : [ "tls_client_auth",
                                               "self_signed_tls_client_auth",
                                               "private_key_jwt" ],
       "mtlsEndpoints" : {
         "endpointNames" : [ "registration_endpoint", "token_endpoint", "authorization_endpoint" ],
         "mtlsHostname" : "&{as.mtls.fqdn}"
       }"
     }
 }