public class OAuthIntrospectionValidator extends java.lang.Object implements TokenValidator
It works by sending the token to the configured authorization server's introspection endpoint. The endpoint returns a response with whether the token is valid or not, and it usually also returns additional attributes, that can be used to enforce additional constraints, and prevent some otherwise valid tokens from authenticating.
Constructor and Description |
---|
OAuthIntrospectionValidator(java.lang.String introspectionEndpointUri,
javax.net.ssl.SSLSocketFactory socketFactory,
javax.net.ssl.HostnameVerifier verifier,
PrincipalExtractor principalExtractor,
java.lang.String issuerUri,
java.lang.String userInfoUri,
java.lang.String validTokenType,
java.lang.String clientId,
java.lang.String clientSecret,
java.lang.String audience,
java.lang.String customClaimCheck)
Create a new instance.
|
Modifier and Type | Method and Description |
---|---|
TokenInfo |
validate(java.lang.String token) |
public OAuthIntrospectionValidator(java.lang.String introspectionEndpointUri, javax.net.ssl.SSLSocketFactory socketFactory, javax.net.ssl.HostnameVerifier verifier, PrincipalExtractor principalExtractor, java.lang.String issuerUri, java.lang.String userInfoUri, java.lang.String validTokenType, java.lang.String clientId, java.lang.String clientSecret, java.lang.String audience, java.lang.String customClaimCheck)
introspectionEndpointUri
- The introspection endpoint url at the authorization serversocketFactory
- The optional SSL socket factory to use when establishing the connection to authorization serververifier
- The optional hostname verifier used to validate the TLS certificate by the authorization serverprincipalExtractor
- The object used to extract the username from the attributes in the server's responseissuerUri
- The required value of the 'iss' claim in JWT tokenuserInfoUri
- The optional user info endpoint url at the authorization server, used as a failover when user id can't be extracted from the introspection endpoint responsevalidTokenType
- The optional token type enforcement - only the specified token type is accepted as validclientId
- The clientId of the OAuth2 client representing this Kafka broker - needed to authenticate to the introspection endpointclientSecret
- The secret of the OAuth2 client representing this Kafka broker - needed to authenticate to the introspection endpointaudience
- The optional audience check. If specified, the 'aud' attributie of the introspection endpoint response needs to contain the configured clientIdcustomClaimCheck
- The optional JSONPath filter query for additional custom attribute checkingpublic TokenInfo validate(java.lang.String token)
validate
in interface TokenValidator
Copyright © 2021. All rights reserved.