Package dev.relism.flash.ext.security.oidc

Class OidcExtension

java.lang.Object
dev.relism.flash.ext.security.oidc.OidcExtension
All Implemented Interfaces:
dev.relism.flash.ext.security.AuthenticationMechanism, dev.relism.flash.extension.FlashExtension
public final class OidcExtension extends Object implements dev.relism.flash.extension.FlashExtension, dev.relism.flash.ext.security.AuthenticationMechanism
OpenID Connect: bearer access tokens from any configured provider, and browser sign-in through the authorization code flow with PKCE, which ends in a SecurityExtension session renewed with the refresh token. 

 app.install(new SecurityExtension())
    .install(new OidcExtension(OidcProvider.of("sso", "https://id.example.com/realms/acme", "app", secret)));

Routes: GET /auth/oidc/{provider}/login?redirect=/path and its callback. A bearer token is matched to its provider by iss before its signature is checked against that provider's keys, so any number of providers costs one lookup; a token from an issuer not configured here is left to other mechanisms.

  • Constructor Details

    • OidcExtension

      public OidcExtension(OidcProvider... providers)

  • Method Details

    • allowLocalProviders

      public OidcExtension allowLocalProviders()
      Lets register(dev.relism.flash.ext.security.oidc.OidcProvider) accept http and private addresses — for a provider on a developer's machine, never in production.

    • register

      public void register(OidcProvider config)
      Trusts another provider from now on — an organization connecting its own. Discovery runs here, so a bad provider fails this call. It serves bearer tokens and /auth/oidc/{id}/login, but is not listed at /auth/methods: which provider a user signs in with is the application's call.
      Throws:
      IllegalArgumentException - the provider, or an endpoint it names, is not https on a public address, or its id is a configured provider's, which it would otherwise replace

    • verify

      public void verify(OidcProvider config, String origin)
      Checks a provider before trusting it: discovery, the client ID and secret, and the redirect URI a sign-in from origin will send. Registers nothing, and holds register(dev.relism.flash.ext.security.oidc.OidcProvider)'s address rules.
      Parameters:
      origin - where users will sign in from, as SecurityExtension.origin(Request) gives it
      Throws:
      IllegalArgumentException - naming what the provider refused
      IllegalStateException - the provider could not be reached

    • unregister

      public void unregister(String id)
      Stops trusting a provider: its tokens are no longer this mechanism's, its sessions stop renewing.

    • configure

      public void configure(dev.relism.flash.extension.FlashRegistrar<?> app, dev.relism.flash.extension.FlashContext ctx)
      Specified by:
      configure in interface dev.relism.flash.extension.FlashExtension

    • schemes

      public List<dev.relism.flash.ext.security.SecurityScheme> schemes()
      One per configured provider; one registered at runtime is the application's to name, never listed.
      Specified by:
      schemes in interface dev.relism.flash.ext.security.AuthenticationMechanism

    • authenticate

      public dev.relism.flash.ext.security.Principal authenticate(dev.relism.flash.models.Request req)
      Specified by:
      authenticate in interface dev.relism.flash.ext.security.AuthenticationMechanism