Package org.apache.juneau.rest.auth.oauth.flow

Class OAuthAuthorizationCodeFlow

java.lang.Object
org.apache.juneau.rest.auth.oauth.flow.OAuthAuthorizationCodeFlow
public class OAuthAuthorizationCodeFlow extends Object
Authorization-code grant (RFC 6749 §4.1) flow helper with mandatory PKCE per RFC 7636.

Wraps Nimbus's AuthorizationRequest (for URL construction) + AuthorizationCodeGrant + TokenRequest (for the exchange) + PKCE S256 challenge generation. buildAuthorizationUrl(String, CodeChallenge) emits a plain OAuth 2.0 authorization request; buildAuthenticationUrl(String, CodeChallenge, String, Consumer) emits an OpenID Connect authentication request carrying a nonce. Supports RFC 8707 resource-indicator binding via OAuthAuthorizationCodeFlow.Builder.resource(URI).

Usage

var flow = OAuthAuthorizationCodeFlow.create() .authorizationEndpoint(URI.create("https://idp.example.com/oauth2/authorize")) .tokenEndpoint(URI.create("https://idp.example.com/oauth2/token")) .clientId("web-app") .redirectUri(URI.create("https://app.example.com/callback")) .scope("openid", "profile") .build(); var verifier = new CodeVerifier(); var challenge = CodeChallenge.compute(CodeChallengeMethod.S256, verifier); var authUrl = flow.buildAuthorizationUrl("some-state", challenge); // After the IdP redirects back with ?code=... var token = flow.exchange(code, verifier);

The flow does NOT manage state / PKCE-verifier storage; that's the caller's responsibility.

Since:
10.0.0

  • Constructor Details

  • Method Details

    • create

      public static OAuthAuthorizationCodeFlow.Builder create()
      Static creator.
      Returns:
      A new builder.

    • buildAuthorizationUrl

      public URI buildAuthorizationUrl(String state, com.nimbusds.oauth2.sdk.pkce.CodeChallenge codeChallenge)
      Builds the authorize?... URL the user-agent should be redirected to.
      Parameters:
      state - The opaque state parameter (CSRF protection). Must not be null or blank.
      codeChallenge - The PKCE code challenge. Must not be null. Always uses S256.
      Returns:
      The authorization URL.

    • buildAuthenticationUrl

      public URI buildAuthenticationUrl(String state, com.nimbusds.oauth2.sdk.pkce.CodeChallenge codeChallenge, String nonce, Consumer<com.nimbusds.openid.connect.sdk.AuthenticationRequest.Builder> customizer)
      Builds an OpenID Connect authorize?... URL carrying an OIDC nonce parameter.

      Unlike buildAuthorizationUrl(String, CodeChallenge) (which emits a plain OAuth 2.0 AuthorizationRequest with no nonce), this method emits an OIDC AuthenticationRequest so the IdP echoes the supplied nonce back inside the issued ID token. An OpenID Connect relying party stores the nonce before the redirect and verifies the nonce claim on the returned ID token to defeat token replay.

      The configured scope(...) set is used as-is; OIDC requires it to contain openid. The optional customizer receives the underlying AuthenticationRequest.Builder so callers can set OIDC-specific parameters (e.g. prompt, max_age, acr_values) without this module needing to surface each one.

      Parameters:
      state - The opaque state parameter (CSRF protection). Must not be null or blank.
      codeChallenge - The PKCE code challenge. Must not be null. Always uses S256.
      nonce - The OIDC nonce value. Must not be null or blank.
      customizer - Optional hook on the AuthenticationRequest.Builder for OIDC-specific parameters. May be null.
      Returns:
      The authorization URL.

    • exchange

      public OAuthToken exchange(String code, com.nimbusds.oauth2.sdk.pkce.CodeVerifier codeVerifier)
      Exchanges the authorization code returned by the IdP for an access token.
      Parameters:
      code - The code query parameter from the IdP redirect. Must not be null or blank.
      codeVerifier - The PKCE verifier matching the challenge passed to buildAuthorizationUrl(String, CodeChallenge). Must not be null.
      Returns:
      The acquired token.

    • getAuthorizationEndpoint

      public URI getAuthorizationEndpoint()
      Returns the authorization endpoint URL.
      Returns:
      The endpoint.

    • getTokenEndpoint

      public URI getTokenEndpoint()
      Returns the token endpoint URL.
      Returns:
      The endpoint.

    • getClientId

      public String getClientId()
      Returns the client ID.
      Returns:
      The client ID.

    • getRedirectUri

      public URI getRedirectUri()
      Returns the redirect URI.
      Returns:
      The redirect URI.

    • getScopes

      public Set<String> getScopes()
      Returns the requested scopes.
      Returns:
      An unmodifiable view.