io.helidon.security.providers.oidc.common.OidcConfig

Description

Open ID Connect configuration

Configuration options

Key	Type	Default	Description
access-token-ip-check	Boolean	true	Whether to check if current IP address matches the one access token was issued for
audience	String		Audience of issued tokens
authorization-endpoint-uri	URI		URI of an authorization endpoint used to redirect users to for logging-in
base-scopes	String	openid	Configure base scopes
check-audience	Boolean	true	Configure audience claim check
client-credentials-config	ClientCredentialsConfig		Set the configuration related to the client credentials flow
client-id	String		Client ID as generated by OIDC server
client-secret	String		Client secret as generated by OIDC server
client-timeout-millis	Duration	30000	Timeout of calls using web client
cookie-domain	String		Domain the cookie is valid for
cookie-encryption-enabled	Boolean	false	Whether to encrypt token cookie created by this microservice
cookie-encryption-id-enabled	Boolean	true	Whether to encrypt id token cookie created by this microservice
cookie-encryption-name	String		Name of the encryption configuration available through Security#encrypt(String, byte[]) and Security#decrypt(String, String)
cookie-encryption-password	List<String>		Master password for encryption/decryption of cookies
cookie-encryption-refresh-enabled	Boolean	true	Whether to encrypt refresh token cookie created by this microservice
cookie-encryption-state-enabled	Boolean	true	Whether to encrypt state cookie created by this microservice
cookie-encryption-tenant-enabled	Boolean	true	Whether to encrypt tenant name cookie created by this microservice
cookie-http-only	Boolean	true	When using cookie, if set to true, the HttpOnly attribute will be configured
cookie-max-age-seconds	Long		When using cookie, used to set MaxAge attribute of the cookie, defining how long the cookie is valid
cookie-name	String	JSESSIONID	Name of the cookie to use
cookie-name-id-token	String	JSESSIONID_2	Name of the cookie to use for id token
cookie-name-refresh-token	String	JSESSIONID_3	The name of the cookie to use for the refresh token
cookie-name-state	String	JSESSIONID_3	The name of the cookie to use for the state storage
cookie-name-tenant	String	HELIDON_TENANT	The name of the cookie to use for the tenant name
cookie-path	String	/	Path the cookie is valid for
cookie-same-site	SameSite	LAX	When using cookie, used to set the SameSite cookie value
cookie-secure	Boolean	false	When using cookie, if set to true, the Secure attribute will be configured
cookie-use	Boolean	true	Whether to use cookie to store JWT between requests
cors	CrossOriginConfig		Assign cross-origin resource sharing settings
decryption-keys			Configuration for decryption-keys
force-https-redirects	Boolean	false	Force HTTPS for redirects to identity provider
frontend-uri	String		Full URI of this application that is visible from user browser
header-token	TokenHandler		A TokenHandler to process header containing a JWT
header-use	Boolean	true	Whether to expect JWT in a header field
id-token-signature-validation	Boolean	true	Whether id token signature check should be enabled
identity-uri	URI		URI of the identity server, base used to retrieve OIDC metadata
introspect-endpoint-uri	URI		Endpoint to use to validate JWT
issuer	String		Issuer of issued tokens
max-redirects	Integer	5	Configure maximal number of redirects when redirecting to an OIDC provider within a single authentication attempt
oidc-metadata			Configuration for oidc-metadata
oidc-metadata-well-known	Boolean	true	If set to true, metadata will be loaded from default (well known) location, unless it is explicitly defined using oidc-metadata-resource
optional-audience	Boolean	false	Allow audience claim to be optional
outbound-type	OidcOutboundType	USER_JWT	Type of the OIDC outbound
pkce-challenge-method	PkceChallengeMethod	S256	Proof Key Code Exchange (PKCE) challenge creation method
pkce-enabled	Boolean	false	Whether this provider should support PKCE
proxy-port	Integer	80	Proxy port
query-id-token-param-name	String	id_token	Name of a query parameter that contains the JWT id token when parameter is used
query-param-name	String	accessToken	Name of a query parameter that contains the JWT access token when parameter is used
query-param-tenant-name	String	h_tenant	Name of a query parameter that contains the tenant name when the parameter is used
query-param-use	Boolean	false	Whether to use a query parameter to send JWT token from application to this server
redirect	Boolean	false	By default, the client should redirect to the identity server for the user to log in
redirect-attempt-param	String	h_ra	Configure the parameter used to store the number of attempts in redirect
redirect-uri	String	/oidc/redirect	URI to register web server component on, used by the OIDC server to redirect authorization requests to after a user logs in or approves scopes
scope-audience	String		Audience of the scope required by this application
server-type	String	@default	Configure one of the supported types of identity servers
sign-jwk			Configuration for sign-jwk
tenants	TenantConfig		Configurations of the tenants
token-endpoint-auth	ClientAuthentication	CLIENT_SECRET_BASIC	Type of authentication to use when invoking the token endpoint
token-endpoint-uri	URI		URI of a token endpoint used to obtain a JWT based on the authentication code
token-signature-validation	Boolean	true	Whether access token signature check should be enabled
validate-jwt-with-jwk	Boolean	true	Use JWK (a set of keys to validate signatures of JWT) to validate tokens
webclient	WebClient		WebClient configuration used for outbound requests to the identity server. This configuration sets the values to the OIDC WebClient default configuration

Deprecated Options

Key	Type	Default	Description
proxy-host	String		Proxy host to use
proxy-protocol	String	http	Proxy protocol to use when proxy is used
relative-uris	Boolean	false	Can be set to true to force the use of relative URIs in all requests, regardless of the presence or absence of proxies or no-proxy lists

Dependent Types

• io.helidon.security.providers.oidc.OidcProvider

Usages

• security.providers.idcs-role-mapper.oidc-config
• server.features.security.security.providers.idcs-role-mapper.oidc-config

---

See the manifest for all available types.