Class OAuth2AuthenticationMetaData

java.lang.Object
com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData
com.kingsrook.qqq.backend.core.model.metadata.authentication.OAuth2AuthenticationMetaData
All Implemented Interfaces:
MetaDataProducerOutput, QMetaDataObject, TopLevelMetaDataInterface, Serializable
public class OAuth2AuthenticationMetaData extends QAuthenticationMetaData
Meta-data to provide details of an OAuth2 Authentication module. baseUrl is used by the backend server for OIDC discovery and token exchange (server-to-server calls). In Kubernetes or environments behind a reverse proxy, this may be an internal/cluster-local URL (e.g., http://auth-service.auth.svc/). externalBaseUrl, if set, is the URL sent to the frontend/SPA for browser-based OAuth2 redirects. This is needed when the backend cannot reach the OAuth2 provider via the same URL that browsers use (e.g., Calico NetworkPolicy blocking pod-to-LoadBalancer traffic, or internal HTTP vs external HTTPS). If not set, baseUrl is used for both purposes (backwards compatible).
See Also:

  • Field Details

    • DEFAULT_REFRESH_TOKEN_SKEW_SECONDS

      public static final int DEFAULT_REFRESH_TOKEN_SKEW_SECONDS
      See Also:

  • Constructor Details

    • OAuth2AuthenticationMetaData

      public OAuth2AuthenticationMetaData()
      Default Constructor.

  • Method Details

    • validate

      public void validate(QInstance qInstance, QInstanceValidator qInstanceValidator)
      Overrides:
      validate in class QAuthenticationMetaData

    • withBaseUrl

      public OAuth2AuthenticationMetaData withBaseUrl(String baseUrl)
      Fluent setter, override to help fluent flows

    • getBaseUrl

      public String getBaseUrl()
      Getter for baseUrl

    • setBaseUrl

      public void setBaseUrl(String baseUrl)
      Setter for baseUrl

    • getExternalBaseUrl

      public String getExternalBaseUrl()
      Getter for externalBaseUrl

    • setExternalBaseUrl

      public void setExternalBaseUrl(String externalBaseUrl)
      Setter for externalBaseUrl

    • withExternalBaseUrl

      public OAuth2AuthenticationMetaData withExternalBaseUrl(String externalBaseUrl)
      Fluent setter for externalBaseUrl

    • withClientId

      public OAuth2AuthenticationMetaData withClientId(String clientId)
      Fluent setter, override to help fluent flows

    • getClientId

      public String getClientId()
      Getter for clientId

    • setClientId

      public void setClientId(String clientId)
      Setter for clientId

    • withClientSecret

      public OAuth2AuthenticationMetaData withClientSecret(String clientSecret)
      Fluent setter, override to help fluent flows

    • getClientSecret

      public String getClientSecret()
      Getter for clientSecret

    • setClientSecret

      public void setClientSecret(String clientSecret)
      Setter for clientSecret

    • getTokenUrl

      public String getTokenUrl()
      Getter for tokenUrl

    • setTokenUrl

      public void setTokenUrl(String tokenUrl)
      Setter for tokenUrl

    • withTokenUrl

      public OAuth2AuthenticationMetaData withTokenUrl(String tokenUrl)
      Fluent setter for tokenUrl

    • getUserSessionTableName

      public String getUserSessionTableName()
      Getter for userSessionTableName

    • setUserSessionTableName

      public void setUserSessionTableName(String userSessionTableName)
      Setter for userSessionTableName

    • withUserSessionTableName

      public OAuth2AuthenticationMetaData withUserSessionTableName(String userSessionTableName)
      Fluent setter for userSessionTableName

    • getRedirectStateTableName

      public String getRedirectStateTableName()
      Getter for redirectStateTableName

    • setRedirectStateTableName

      public void setRedirectStateTableName(String redirectStateTableName)
      Setter for redirectStateTableName

    • withRedirectStateTableName

      public OAuth2AuthenticationMetaData withRedirectStateTableName(String redirectStateTableName)
      Fluent setter for redirectStateTableName

    • getScopes

      public String getScopes()
      Getter for scopes

    • setScopes

      public void setScopes(String scopes)
      Setter for scopes

    • withScopes

      public OAuth2AuthenticationMetaData withScopes(String scopes)
      Fluent setter for scopes

    • getRefreshTokensEnabled

      public Boolean getRefreshTokensEnabled()
      Getter for refreshTokensEnabled - whether refresh tokens returned by the provider are stored server-side and used to renew expiring access tokens.

    • setRefreshTokensEnabled

      public void setRefreshTokensEnabled(Boolean refreshTokensEnabled)
      Setter for refreshTokensEnabled

    • withRefreshTokensEnabled

      public OAuth2AuthenticationMetaData withRefreshTokensEnabled(Boolean refreshTokensEnabled)
      Fluent setter for refreshTokensEnabled

    • getRefreshTokenSkewSeconds

      public Integer getRefreshTokenSkewSeconds()
      Getter for refreshTokenSkewSeconds - how many seconds before an access token's expiry it is proactively refreshed.

    • setRefreshTokenSkewSeconds

      public void setRefreshTokenSkewSeconds(Integer refreshTokenSkewSeconds)
      Setter for refreshTokenSkewSeconds

    • withRefreshTokenSkewSeconds

      public OAuth2AuthenticationMetaData withRefreshTokenSkewSeconds(Integer refreshTokenSkewSeconds)
      Fluent setter for refreshTokenSkewSeconds

    • getMaxSessionLifetimeSeconds

      public Integer getMaxSessionLifetimeSeconds()
      Getter for maxSessionLifetimeSeconds - optional cap on how long (from the initial login) a session may be extended by refreshing. null = no cap.

    • setMaxSessionLifetimeSeconds

      public void setMaxSessionLifetimeSeconds(Integer maxSessionLifetimeSeconds)
      Setter for maxSessionLifetimeSeconds

    • withMaxSessionLifetimeSeconds

      public OAuth2AuthenticationMetaData withMaxSessionLifetimeSeconds(Integer maxSessionLifetimeSeconds)
      Fluent setter for maxSessionLifetimeSeconds

    • getRefreshTokenTableName

      public String getRefreshTokenTableName()
      Getter for refreshTokenTableName - the table where refresh tokens are kept (server-side only). When null, UserSessionRefreshToken.TABLE_NAME is used.

    • setRefreshTokenTableName

      public void setRefreshTokenTableName(String refreshTokenTableName)
      Setter for refreshTokenTableName

    • withRefreshTokenTableName

      public OAuth2AuthenticationMetaData withRefreshTokenTableName(String refreshTokenTableName)
      Fluent setter for refreshTokenTableName

    • getRefreshTokenEncryptionKey

      public String getRefreshTokenEncryptionKey()
      Getter for refreshTokenEncryptionKey - the base64 32-byte AES key (or a ${env.X} / ${prop.X} reference to one) that encrypts stored refresh tokens.

    • setRefreshTokenEncryptionKey

      public void setRefreshTokenEncryptionKey(String refreshTokenEncryptionKey)
      Setter for refreshTokenEncryptionKey

    • withRefreshTokenEncryptionKey

      public OAuth2AuthenticationMetaData withRefreshTokenEncryptionKey(String refreshTokenEncryptionKey)
      Fluent setter for refreshTokenEncryptionKey

    • getRefreshTokenEncryptionKeyId

      public String getRefreshTokenEncryptionKeyId()
      Getter for refreshTokenEncryptionKeyId - the id of the current key, stored with each encrypted value (default: RefreshTokenCipher.DEFAULT_KEY_ID).

    • setRefreshTokenEncryptionKeyId

      public void setRefreshTokenEncryptionKeyId(String refreshTokenEncryptionKeyId)
      Setter for refreshTokenEncryptionKeyId

    • withRefreshTokenEncryptionKeyId

      public OAuth2AuthenticationMetaData withRefreshTokenEncryptionKeyId(String refreshTokenEncryptionKeyId)
      Fluent setter for refreshTokenEncryptionKeyId

    • getPreviousRefreshTokenEncryptionKeys

      public Map<String,String> getPreviousRefreshTokenEncryptionKeys()
      Getter for previousRefreshTokenEncryptionKeys - map of key id to key (or a variable reference to one) for retired keys, which are only used to decrypt.

    • setPreviousRefreshTokenEncryptionKeys

      public void setPreviousRefreshTokenEncryptionKeys(Map<String,String> previousRefreshTokenEncryptionKeys)
      Setter for previousRefreshTokenEncryptionKeys

    • withPreviousRefreshTokenEncryptionKeys

      public OAuth2AuthenticationMetaData withPreviousRefreshTokenEncryptionKeys(Map<String,String> previousRefreshTokenEncryptionKeys)
      Fluent setter for previousRefreshTokenEncryptionKeys

    • getAllowPlaintextRefreshTokens

      public Boolean getAllowPlaintextRefreshTokens()
      Getter for allowPlaintextRefreshTokens - a local-development escape hatch: when true and no key is set, refresh tokens are stored unencrypted.

    • setAllowPlaintextRefreshTokens

      public void setAllowPlaintextRefreshTokens(Boolean allowPlaintextRefreshTokens)
      Setter for allowPlaintextRefreshTokens

    • withAllowPlaintextRefreshTokens

      public OAuth2AuthenticationMetaData withAllowPlaintextRefreshTokens(Boolean allowPlaintextRefreshTokens)
      Fluent setter for allowPlaintextRefreshTokens