http4k-security-oauth/org.http4k.security.oauth.client

Package-level declarations

Types

AccessTokens

interface AccessTokens

AuthServerDiscovery

fun interface AuthServerDiscovery

How an authentication client can get the information about the authorization server

OAuthAuthorizationServer

data class OAuthAuthorizationServer(val serverUri: Uri, val serverMetadata: ServerMetadata)

OAuthOfflineRequestAuthorizer

class OAuthOfflineRequestAuthorizer(config: OAuthProviderConfig, accessTokens: AccessTokens, backend: HttpHandler, authRequestFilter: Filter, gracePeriod: Duration = Duration.ofSeconds(10), clock: Clock = Clock.systemUTC(), accessTokenExtractor: AccessTokenExtractor = ContentTypeJsonOrForm())

TokenRequest

data class TokenRequest(val grant_type: String, val refresh_token: String?, val client_id: String?, val code: String?, val redirect_uri: Uri?)

Properties

tokenRequestLens

val tokenRequestLens: BiDiBodyLens<TokenRequest>

Functions

AutoDiscoveryOAuthToken

fun ClientFilters.AutoDiscoveryOAuthToken(authServerDiscovery: AuthServerDiscovery, backend: HttpHandler, oAuthFlowFilter: Filter, oAuthRefreshFilter: (RefreshToken) -> Filter, clock: Clock = Clock.systemUTC(), gracePeriod: Duration = Duration.ofSeconds(10)): Filter

Discovers the authorization server and obtains tokens with fully pluggable grant and refresh flows. Use for scenarios where neither the initial grant nor refresh use client credentials (e.g. JWT assertions).

fun ClientFilters.AutoDiscoveryOAuthToken(authServerDiscovery: AuthServerDiscovery, clientCredentials: Credentials, backend: HttpHandler, clock: Clock = Clock.systemUTC(), scopes: List<String> = emptyList(), resourceUri: Uri? = null, gracePeriod: Duration = Duration.ofSeconds(10)): Filter

Discovers the authorization server and obtains tokens using the standard client_credentials grant. Suitable for machine-to-machine scenarios with a client ID and secret.

fun ClientFilters.AutoDiscoveryOAuthToken(authServerDiscovery: AuthServerDiscovery, clientCredentials: Credentials, backend: HttpHandler, oAuthFlowFilter: Filter, clock: Clock = Clock.systemUTC(), scopes: List<String> = emptyList(), resourceUri: Uri? = null, gracePeriod: Duration = Duration.ofSeconds(10)): Filter

Discovers the authorization server and obtains tokens using a custom initial grant flow but standard client_credentials-based refresh. Use when the initial grant is non-standard (e.g. JWT assertion) but refresh still uses client credentials.

InMemory

fun AccessTokens.Companion.InMemory(): AccessTokens

None

fun AccessTokens.Companion.None(): AccessTokens

OAuthClientCredentials

fun ClientFilters.OAuthClientCredentials(clientCredentials: Credentials, scopes: List<String> = emptyList(), resource: Uri? = null): Filter

fun ClientFilters.OAuthClientCredentials(config: OAuthProviderConfig, scopes: List<String> = emptyList(), resourceUri: Uri? = null): Filter

OAuthJwtAssertion

fun ClientFilters.OAuthJwtAssertion(assertion: String, scopes: List<String> = emptyList(), resource: Uri? = null): Filter

OAuth JWT Bearer assertion grant (RFC 7523). Used for enterprise auth flows where the client authenticates with a JWT instead of client credentials.

OAuthOffline

fun ClientFilters.OAuthOffline(config: OAuthProviderConfig, refreshToken: RefreshToken, backend: HttpHandler, accessTokens: AccessTokens = AccessTokens.None(), authRequestFilter: Filter = BasicAuth(config.credentials)): Filter

OAuthRefreshToken

fun ClientFilters.OAuthRefreshToken(clientCredentials: Credentials, token: RefreshToken, scopes: List<String> = emptyList(), resource: Uri? = null): Filter

fun ClientFilters.OAuthRefreshToken(config: OAuthProviderConfig, token: RefreshToken, scopes: List<String> = emptyList(), resource: Uri? = null): Filter

OAuthUserCredentials

fun ClientFilters.OAuthUserCredentials(clientCredentials: Credentials, userCredentials: Credentials, scopes: List<String>, resource: Uri? = null): Filter

OAuth Resource Owner Password Credentials grant with explicit client credentials.

fun ClientFilters.OAuthUserCredentials(config: OAuthProviderConfig, userCredentials: Credentials, scopes: List<String>, resourceUri: Uri? = null): Filter

OAuth Resource Owner Password Credentials grant. Authenticates with both client credentials and end-user username/password. Generally discouraged in favour of authorization code flow, but useful for legacy systems or trusted first-party clients.

RefreshingOAuthToken

fun ClientFilters.RefreshingOAuthToken(config: OAuthProviderConfig, backend: HttpHandler, gracePeriod: Duration = Duration.ofSeconds(10), clock: Clock = Clock.systemUTC(), scopes: List<String> = emptyList(), resourceUri: Uri? = null): Filter

Obtains and refreshes OAuth tokens using the standard client_credentials grant from the provider config. Suitable for machine-to-machine scenarios with a client ID and secret.

fun ClientFilters.RefreshingOAuthToken(clientCredentials: Credentials, tokenUri: Uri, backend: HttpHandler, gracePeriod: Duration = Duration.ofSeconds(10), clock: Clock = Clock.systemUTC(), scopes: List<String> = emptyList(), resourceUri: Uri? = null): Filter

Obtains and refreshes OAuth tokens using the standard client_credentials grant. Suitable for machine-to-machine scenarios with a client ID and secret.

fun ClientFilters.RefreshingOAuthToken(tokenUri: Uri, backend: HttpHandler, oAuthFlowFilter: Filter, oAuthRefreshFilter: (RefreshToken) -> Filter, gracePeriod: Duration = Duration.ofSeconds(10), clock: Clock = Clock.systemUTC(), tokenExtractor: AccessTokenExtractor = ContentTypeJsonOrForm()): Filter

Obtains and refreshes OAuth tokens with fully pluggable grant and refresh flows. Use for scenarios where neither the initial grant nor refresh use client credentials (e.g. JWT assertions, ID-JAG).

fun ClientFilters.RefreshingOAuthToken(clientCredentials: Credentials, tokenUri: Uri, backend: HttpHandler, oAuthFlowFilter: Filter, gracePeriod: Duration = Duration.ofSeconds(10), clock: Clock = Clock.systemUTC(), tokenExtractor: AccessTokenExtractor = ContentTypeJsonOrForm(), scopes: List<String> = emptyList(), resourceUri: Uri? = null): Filter

Obtains and refreshes OAuth tokens with a custom initial grant flow but standard client_credentials-based refresh. Use when the initial grant is non-standard but the client has credentials for refreshing tokens.