public class OAuthIntrospectionValidator extends java.lang.Object implements TokenValidator
It works by sending the token to the configured authorization server's introspection endpoint. The endpoint returns a response with whether the token is valid or not, and it usually also returns additional attributes, that can be used to enforce additional constraints, and prevent some otherwise valid tokens from authenticating.
| Constructor and Description |
|---|
OAuthIntrospectionValidator(java.lang.String id,
java.lang.String introspectionEndpointUri,
javax.net.ssl.SSLSocketFactory socketFactory,
javax.net.ssl.HostnameVerifier verifier,
PrincipalExtractor principalExtractor,
java.lang.String groupsClaimQuery,
java.lang.String groupsClaimDelimiter,
java.lang.String issuerUri,
java.lang.String userInfoUri,
java.lang.String validTokenType,
java.lang.String clientId,
java.lang.String clientSecret,
java.lang.String audience,
java.lang.String customClaimCheck,
int connectTimeoutSeconds,
int readTimeoutSeconds,
boolean enableMetrics,
int retries,
long retryPauseMillis)
Create a new instance.
|
| Modifier and Type | Method and Description |
|---|---|
java.lang.String |
getValidatorId()
Return the id of this validator
|
TokenInfo |
validate(java.lang.String token)
Validate the passed access token return it wrapped in TokenInfo with
|
public OAuthIntrospectionValidator(java.lang.String id,
java.lang.String introspectionEndpointUri,
javax.net.ssl.SSLSocketFactory socketFactory,
javax.net.ssl.HostnameVerifier verifier,
PrincipalExtractor principalExtractor,
java.lang.String groupsClaimQuery,
java.lang.String groupsClaimDelimiter,
java.lang.String issuerUri,
java.lang.String userInfoUri,
java.lang.String validTokenType,
java.lang.String clientId,
java.lang.String clientSecret,
java.lang.String audience,
java.lang.String customClaimCheck,
int connectTimeoutSeconds,
int readTimeoutSeconds,
boolean enableMetrics,
int retries,
long retryPauseMillis)
id - A unique id to associate with this validator for the purpose of validator lifecycle and metrics trackingintrospectionEndpointUri - The introspection endpoint url at the authorization serversocketFactory - The optional SSL socket factory to use when establishing the connection to authorization serververifier - The optional hostname verifier used to validate the TLS certificate by the authorization serverprincipalExtractor - The object used to extract the username from the attributes in the server's responsegroupsClaimQuery - The JsonPath query for extracting groups from introspection endpoint responsegroupsClaimDelimiter - The delimiter used to parse groups from the result of applying groupQuery to what introspection endpoint returnsissuerUri - The required value of the 'iss' claim in the introspection endpoint responseuserInfoUri - The optional user info endpoint url at the authorization server, used as a failover when user id can't be extracted from the introspection endpoint responsevalidTokenType - The optional token type enforcement - only the specified token type is accepted as validclientId - The clientId of the OAuth2 client representing this Kafka broker - needed to authenticate to the introspection endpointclientSecret - The secret of the OAuth2 client representing this Kafka broker - needed to authenticate to the introspection endpointaudience - The optional audience check. If specified, the 'aud' attribute of the introspection endpoint response needs to contain the configured clientIdcustomClaimCheck - The optional JSONPath filter query for additional custom attribute checkingconnectTimeoutSeconds - The maximum time to wait for connection to authorization server to be established (in seconds)readTimeoutSeconds - The maximum time to wait for response from authorization server after connection has been established and request sent (in seconds)enableMetrics - The switch that enables metrics collectionretries - Maximum number of retries if request to the authorization server fails (0 means no retries)retryPauseMillis - Time to pause before retrying the request to the authorization serverpublic TokenInfo validate(java.lang.String token)
TokenValidatorvalidate in interface TokenValidatortoken - An access token to validatepublic java.lang.String getValidatorId()
TokenValidatorgetValidatorId in interface TokenValidatorCopyright © 2023. All rights reserved.