Package org.gcube.common.iam

Class OIDCBearerAuth

java.lang.Object

org.gcube.common.iam.AbstractIAMResponse

org.gcube.common.iam.D4ScienceIAMClientAuthn

org.gcube.common.iam.OIDCBearerAuth

All Implemented Interfaces:

IAMResponse

public class OIDCBearerAuth
extends D4ScienceIAMClientAuthn

OIDC Bearer authentication implementation for handling bearer tokens. Provides utility methods to construct authentication objects from various token formats.

Author:

Mauro Mugnaini (Nubisware S.r.l.)

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	OIDCBearerAuth(D4ScienceIAMClient iamClient, org.gcube.common.keycloak.model.TokenResponse tokenResponse)	Creates a new OIDC bearer authentication instance.

Method Summary

Modifier and Type	Method	Description
static OIDCBearerAuth	fromAccessTokenString(String accessToken)	Deprecated. see fromAuthorizationHeader(String)
static OIDCBearerAuth	fromAccessTokenString(String accessToken, D4ScienceIAMClient iamClient)	Constructs a new object from an access-token string bound to the given (configured, trusted) IAM client: nothing is taken from the token to choose the IAM server.
static OIDCBearerAuth	fromAuthorizationHeader(String authorizationHeader)	Deprecated. the realm is taken from the unverified iss claim of the token; use fromAccessTokenString(String, D4ScienceIAMClient) with the client of the configured IAM server and D4ScienceIAMClient.introspect(String, String, String) to validate it
static OIDCBearerAuth	fromBearerAuthorization(String bearerAuthorization)	Deprecated. see fromAuthorizationHeader(String)

Methods inherited from class org.gcube.common.iam.D4ScienceIAMClientAuthn

authorize, authorize

Methods inherited from class org.gcube.common.iam.AbstractIAMResponse

canBeRefreshed, exchange, exchangeForRefreshToken, getAccessToken, getAccessTokenExpiryMillis, getAccessTokenString, getAudience, getAuthorizedParty, getContactOrganization, getContactPerson, getContext, getContextRoles, getEmail, getExpiresIn, getFamilyName, getGivenName, getGlobalRoles, getIamClient, getIdTokenString, getName, getPreferredUsername, getRefreshExpiresIn, getRefreshTokenExpiryMillis, getRefreshTokenString, getResourceAccessRoles, getResourceRoles, getRoles, getSubject, getTokenResponse, isAccessTokenValid, isAccessTokenValid, isExpired, isRefreshTokenValid, isRefreshTokenValid, logout, logout, refresh, refresh, setIamClient, setTokenResponse, verifyAccessToken, verifyAccessToken, verifyRefreshToken, verifyRefreshToken

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

OIDCBearerAuth

protected OIDCBearerAuth(D4ScienceIAMClient iamClient,
 org.gcube.common.keycloak.model.TokenResponse tokenResponse)

Creates a new OIDC bearer authentication instance.

Parameters:

iamClient - the IAM client

tokenResponse - the token response

Method Details

fromAuthorizationHeader

@Deprecated
public static OIDCBearerAuth fromAuthorizationHeader(String authorizationHeader)

Deprecated.

the realm is taken from the unverified iss claim of the token; use fromAccessTokenString(String, D4ScienceIAMClient) with the client of the configured IAM server and D4ScienceIAMClient.introspect(String, String, String) to validate it

Constructs a new object from an HTTP authorization header containing the bearer token with an OIDC access-token.

Parameters:

authorizationHeader - the HTTP authorization header

Returns:

the auth object

fromBearerAuthorization

@Deprecated
public static OIDCBearerAuth fromBearerAuthorization(String bearerAuthorization)

Deprecated.

see fromAuthorizationHeader(String)

Constructs a new object from a bearer token with an OIDC access-token.

Parameters:

bearerAuthorization - the bearer token (with or without 'bearer ' prefix

Returns:

the auth object

fromAccessTokenString

@Deprecated
public static OIDCBearerAuth fromAccessTokenString(String accessToken)

Deprecated.

see fromAuthorizationHeader(String)

Constructs a new object from an OIDC base64 encoded access-token string.

Parameters:

accessToken - the OIDC base64 encoded access-token string

Returns:

the auth object

fromAccessTokenString

public static OIDCBearerAuth fromAccessTokenString(String accessToken,
 D4ScienceIAMClient iamClient)

Constructs a new object from an access-token string bound to the given (configured, trusted) IAM client: nothing is taken from the token to choose the IAM server. The token is NOT verified here: validate it with D4ScienceIAMClient.introspect(String, String, String).

Parameters:

accessToken - the OIDC base64 encoded access-token string

iamClient - the client of the IAM server the service trusts

Returns:

the auth object