|
15 | 15 | */ |
16 | 16 | package org.springframework.security.oauth2.core.oidc; |
17 | 17 |
|
18 | | -import org.springframework.security.oauth2.core.ClaimAccessor; |
19 | | -import org.springframework.security.oauth2.core.ClientAuthenticationMethod; |
20 | | - |
21 | 18 | import java.time.Instant; |
22 | 19 | import java.util.List; |
23 | 20 |
|
| 21 | +import org.springframework.security.oauth2.core.ClaimAccessor; |
| 22 | +import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm; |
| 23 | + |
24 | 24 | /** |
25 | | - * A {@link ClaimAccessor} for the "claims" that can be returned |
26 | | - * in the OpenID Client Registration Response. |
| 25 | + * A {@link ClaimAccessor} for the "claims" that are contained |
| 26 | + * in the OpenID Client Registration Request and Response. |
27 | 27 | * |
28 | 28 | * @author Ovidiu Popa |
| 29 | + * @author Joe Grandja |
29 | 30 | * @since 0.1.1 |
30 | 31 | * @see ClaimAccessor |
31 | 32 | * @see OidcClientMetadataClaimNames |
|
35 | 36 | public interface OidcClientMetadataClaimAccessor extends ClaimAccessor { |
36 | 37 |
|
37 | 38 | /** |
38 | | - * Returns the redirect URI(s) that the client may use in redirect-based flows. |
| 39 | + * Returns the Client Identifier {@code (client_id)}. |
39 | 40 | * |
40 | | - * @return the {@code List} of redirect URI(s) |
| 41 | + * @return the Client Identifier |
41 | 42 | */ |
42 | | - default List<String> getRedirectUris() { |
43 | | - return getClaimAsStringList(OidcClientMetadataClaimNames.REDIRECT_URIS); |
| 43 | + default String getClientId() { |
| 44 | + return getClaimAsString(OidcClientMetadataClaimNames.CLIENT_ID); |
44 | 45 | } |
45 | 46 |
|
46 | 47 | /** |
47 | | - * Returns the OAuth 2.0 {@code response_type} values that the client may use. |
| 48 | + * Returns the time at which the Client Identifier was issued {@code (client_id_issued_at)}. |
48 | 49 | * |
49 | | - * @return the {@code List} of {@code response_type} |
| 50 | + * @return the time at which the Client Identifier was issued |
50 | 51 | */ |
51 | | - default List<String> getResponseTypes() { |
52 | | - return getClaimAsStringList(OidcClientMetadataClaimNames.RESPONSE_TYPES); |
| 52 | + default Instant getClientIdIssuedAt() { |
| 53 | + return getClaimAsInstant(OidcClientMetadataClaimNames.CLIENT_ID_ISSUED_AT); |
53 | 54 | } |
54 | 55 |
|
55 | 56 | /** |
56 | | - * Returns the authorization {@code grant_types} that the client may use. |
| 57 | + * Returns the Client Secret {@code (client_secret)}. |
57 | 58 | * |
58 | | - * @return the {@code List} of authorization {@code grant_types} |
| 59 | + * @return the Client Secret |
59 | 60 | */ |
60 | | - default List<String> getGrantTypes() { |
61 | | - return getClaimAsStringList(OidcClientMetadataClaimNames.GRANT_TYPES); |
| 61 | + default String getClientSecret() { |
| 62 | + return getClaimAsString(OidcClientMetadataClaimNames.CLIENT_SECRET); |
| 63 | + } |
| 64 | + |
| 65 | + /** |
| 66 | + * Returns the time at which the {@code client_secret} will expire {@code (client_secret_expires_at)}. |
| 67 | + * |
| 68 | + * @return the time at which the {@code client_secret} will expire |
| 69 | + */ |
| 70 | + default Instant getClientSecretExpiresAt() { |
| 71 | + return getClaimAsInstant(OidcClientMetadataClaimNames.CLIENT_SECRET_EXPIRES_AT); |
62 | 72 | } |
63 | 73 |
|
64 | 74 | /** |
65 | | - * Returns the {@code client_name}. |
| 75 | + * Returns the name of the Client to be presented to the End-User {@code (client_name)}. |
66 | 76 | * |
67 | | - * @return the {@code client_name} |
| 77 | + * @return the name of the Client to be presented to the End-User |
68 | 78 | */ |
69 | 79 | default String getClientName() { |
70 | 80 | return getClaimAsString(OidcClientMetadataClaimNames.CLIENT_NAME); |
71 | 81 | } |
72 | 82 |
|
73 | 83 | /** |
74 | | - * Returns the scope(s) that the client may use. |
| 84 | + * Returns the redirection {@code URI} values used by the Client {@code (redirect_uris)}. |
75 | 85 | * |
76 | | - * @return the scope(s) |
| 86 | + * @return the redirection {@code URI} values used by the Client |
77 | 87 | */ |
78 | | - default String getScope() { |
79 | | - return getClaimAsString(OidcClientMetadataClaimNames.SCOPE); |
| 88 | + default List<String> getRedirectUris() { |
| 89 | + return getClaimAsStringList(OidcClientMetadataClaimNames.REDIRECT_URIS); |
80 | 90 | } |
81 | 91 |
|
82 | 92 | /** |
83 | | - * Returns the {@link ClientAuthenticationMethod authentication method} that the client may use. |
| 93 | + * Returns the authentication method used by the Client for the Token Endpoint {@code (token_endpoint_auth_method)}. |
84 | 94 | * |
85 | | - * @return the {@link ClientAuthenticationMethod authentication method} |
| 95 | + * @return the authentication method used by the Client for the Token Endpoint |
86 | 96 | */ |
87 | 97 | default String getTokenEndpointAuthenticationMethod() { |
88 | 98 | return getClaimAsString(OidcClientMetadataClaimNames.TOKEN_ENDPOINT_AUTH_METHOD); |
89 | 99 | } |
90 | 100 |
|
91 | 101 | /** |
92 | | - * Returns the {@code client_id}. |
| 102 | + * Returns the OAuth 2.0 {@code grant_type} values that the Client will restrict itself to using {@code (grant_types)}. |
93 | 103 | * |
94 | | - * @return the {@code client_id} |
| 104 | + * @return the OAuth 2.0 {@code grant_type} values that the Client will restrict itself to using |
95 | 105 | */ |
96 | | - default String getClientId() { |
97 | | - return getClaimAsString(OidcClientMetadataClaimNames.CLIENT_ID); |
| 106 | + default List<String> getGrantTypes() { |
| 107 | + return getClaimAsStringList(OidcClientMetadataClaimNames.GRANT_TYPES); |
98 | 108 | } |
99 | 109 |
|
100 | 110 | /** |
101 | | - * Returns the {@code client_id_issued_at} timestamp. |
| 111 | + * Returns the OAuth 2.0 {@code response_type} values that the Client will restrict itself to using {@code (response_types)}. |
102 | 112 | * |
103 | | - * @return the {@code client_id_issued_at} timestamp |
| 113 | + * @return the OAuth 2.0 {@code response_type} values that the Client will restrict itself to using |
104 | 114 | */ |
105 | | - default Instant getClientIdIssuedAt() { |
106 | | - return getClaimAsInstant(OidcClientMetadataClaimNames.CLIENT_ID_ISSUED_AT); |
| 115 | + default List<String> getResponseTypes() { |
| 116 | + return getClaimAsStringList(OidcClientMetadataClaimNames.RESPONSE_TYPES); |
107 | 117 | } |
108 | 118 |
|
109 | 119 | /** |
110 | | - * Returns the {@code client_secret}. |
| 120 | + * Returns the OAuth 2.0 {@code scope} values that the Client will restrict itself to using {@code (scope)}. |
111 | 121 | * |
112 | | - * @return the {@code client_secret} |
| 122 | + * @return the OAuth 2.0 {@code scope} values that the Client will restrict itself to using |
113 | 123 | */ |
114 | | - default String getClientSecret() { |
115 | | - return getClaimAsString(OidcClientMetadataClaimNames.CLIENT_SECRET); |
| 124 | + default List<String> getScopes() { |
| 125 | + return getClaimAsStringList(OidcClientMetadataClaimNames.SCOPE); |
116 | 126 | } |
117 | 127 |
|
118 | 128 | /** |
119 | | - * Returns the {@code client_secret_expires_at} timestamp. |
| 129 | + * Returns the {@link SignatureAlgorithm JWS} algorithm required for signing the {@link OidcIdToken ID Token} issued to the Client {@code (id_token_signed_response_alg)}. |
120 | 130 | * |
121 | | - * @return the {@code client_secret_expires_at} timestamp |
| 131 | + * @return the {@link SignatureAlgorithm JWS} algorithm required for signing the {@link OidcIdToken ID Token} issued to the Client |
122 | 132 | */ |
123 | | - default Instant getClientSecretExpiresAt() { |
124 | | - return getClaimAsInstant(OidcClientMetadataClaimNames.CLIENT_SECRET_EXPIRES_AT); |
| 133 | + default String getIdTokenSignedResponseAlgorithm() { |
| 134 | + return getClaimAsString(OidcClientMetadataClaimNames.ID_TOKEN_SIGNED_RESPONSE_ALG); |
125 | 135 | } |
126 | 136 |
|
127 | | - |
128 | | - |
129 | | - |
130 | 137 | } |
0 commit comments