Class AbstractOAuth2Authenticator

java.lang.Object
org.frankframework.lifecycle.servlets.AbstractServletAuthenticator
org.frankframework.lifecycle.servlets.AbstractOAuth2Authenticator
All Implemented Interfaces:
IAuthenticator, org.springframework.beans.factory.Aware, org.springframework.context.ApplicationContextAware
Direct Known Subclasses:
BearerOnlyAuthenticator, OAuth2Authenticator
public abstract class AbstractOAuth2Authenticator extends AbstractServletAuthenticator
Abstract base class for OAuth2-based authenticators, providing shared configuration fields for JWT/OIDC-based authentication flows.
See Also:

  • Field Details

    • audience

      protected String audience
      Sets the expected audience claim of the JWT token to validate. If set, the JWT token must contain this value in its aud claim.

    • issuerUri

      protected String issuerUri
      The issuer identifier URI of the authorization server. This is used to validate the issuer claim in ID tokens.

      e.g. https://accounts.google.com

    • jwkSetUri

      protected String jwkSetUri
      The URI of the JSON Web Key (JWK) set containing the public keys used to verify any JWT token issued by the authorization server.

      e.g. https://www.googleapis.com/oauth2/v3/certs

    • userInfoUri

      protected String userInfoUri
      The URI of the user info endpoint used to retrieve information about the authenticated user.

      This is optional, as all required user info might already be present in the JWT token.

      e.g. https://www.googleapis.com/oauth2/v3/userinfo

    • userNameAttributeName

      protected String userNameAttributeName
      The attribute name used to extract the username from the OAuth2 user information or JWT token. Different OAuth2 providers may use different attribute names to identify the user.

      Common values include:

      • sub - The subject identifier
      • email - The user's email address
      • preferred_username - The user's preferred username

    • authoritiesClaimName

      protected String authoritiesClaimName

      The claim name in the JWT token that contains the authorities of the user. Defaults to any of JwtGrantedAuthoritiesConverter#WELL_KNOWN_AUTHORITIES_CLAIM_NAMES when this value is not set.

      For keycloak, "realm_access.roles" is the standard claim, this is a 'nested' value. When we encounter a dot (.) in the claim name, we assume it is a nested claim and use the custom mapper.

  • Constructor Details

    • AbstractOAuth2Authenticator

      public AbstractOAuth2Authenticator()

  • Method Details

    • configureBearerTokenResourceServer

      protected void configureBearerTokenResourceServer(org.springframework.security.config.annotation.web.builders.HttpSecurity http)
      Enables bearer-token (JWT) validation as an OAuth2 resource server on the given HttpSecurity. Validates the JWT configuration and installs the shared decoder + authority converter.

    • jwtAuthenticationTokenConverter

      protected org.springframework.security.authentication.AbstractAuthenticationToken jwtAuthenticationTokenConverter(org.springframework.security.oauth2.jwt.Jwt jwt)
      Our own implementation similar to Spring's JwtAuthenticationConverter. Unlike Spring's Converter this one is capable of:
      • Enriching the JWT claimset by calling the 'UserInfo' endpoint.
      • Splitting nested roles, eg. realm_access.roles.
      • Splitting a claim String on both `comma's` and `spaces`.
      • Splitting a single entry Claim list on both `comma's` and `spaces`.
      • Validating if the found Authorities may access the target resource.