Package org.apache.juneau.rest.client.mcp.auth

Class McpAuthorizationCodeAcquirer.Builder

java.lang.Object

org.apache.juneau.rest.client.mcp.auth.McpAuthorizationCodeAcquirer.Builder

Enclosing class:

McpAuthorizationCodeAcquirer

public static class McpAuthorizationCodeAcquirer.Builder
extends Object

Builder.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	Builder()	Constructor.

Method Summary

Modifier and Type	Method	Description
McpAuthorizationCodeAcquirer.Builder	authorizationEndpoint(URI value)	Sets the authorization endpoint URL.
McpAuthorizationCodeAcquirer.Builder	browserLauncher(Consumer<URI> value)	Sets the callback invoked with the authorization URL so the caller can open it in a browser (or print it).
McpAuthorizationCodeAcquirer	build()	Builds the acquirer.
McpAuthorizationCodeAcquirer.Builder	clientId(String value)	Sets the OAuth client ID.
McpAuthorizationCodeAcquirer.Builder	clientSecret(String value)	Sets the client secret (omit for a public/native PKCE-only client).
McpAuthorizationCodeAcquirer.Builder	expectedIssuer(URI value)	Sets the expected issuer the callback iss parameter is validated against (SEP-2468).
McpAuthorizationCodeAcquirer.Builder	httpRequestConfigurator(Consumer<com.nimbusds.oauth2.sdk.http.HTTPRequest> value)	Sets a callback that customizes the Nimbus HTTPRequest for the token exchange.
McpAuthorizationCodeAcquirer.Builder	httpTimeout(Duration value)	Sets the connect/read timeout applied to the token-exchange request.
McpAuthorizationCodeAcquirer.Builder	offlineAccess(boolean value)	Requests the offline_access scope so the IdP issues a refresh token (SEP-2207).
McpAuthorizationCodeAcquirer.Builder	redirectPath(String value)	Sets the loopback redirect path.
McpAuthorizationCodeAcquirer.Builder	redirectPort(int value)	Sets a fixed loopback redirect port so the receiver binds exactly that port (the "bind-first" strategy for strict exact-match authorization servers).
McpAuthorizationCodeAcquirer.Builder	requireIssuerResponseParameter(boolean value)	Requires the authorization response to carry an iss parameter, rejecting a response that omits it.
McpAuthorizationCodeAcquirer.Builder	resource(URI value)	Sets the RFC 8707 resource indicator (the canonical MCP server URI).
McpAuthorizationCodeAcquirer.Builder	scope(String... values)	Adds requested scopes.
McpAuthorizationCodeAcquirer.Builder	skipIssuerValidation(boolean value)	Explicitly opts out of the SEP-2468 iss validation.
McpAuthorizationCodeAcquirer.Builder	store(EphemeralStore value)	Sets the ephemeral state/verifier store.
McpAuthorizationCodeAcquirer.Builder	tokenEndpoint(URI value)	Sets the token endpoint URL.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

Builder

protected Builder()

Constructor.

Method Details

authorizationEndpoint

public McpAuthorizationCodeAcquirer.Builder authorizationEndpoint(URI value)

Sets the authorization endpoint URL. Required.

Parameters:

value - The endpoint URL.

Returns:

This object.

tokenEndpoint

public McpAuthorizationCodeAcquirer.Builder tokenEndpoint(URI value)

Sets the token endpoint URL. Required.

Parameters:

value - The endpoint URL.

Returns:

This object.

clientId

public McpAuthorizationCodeAcquirer.Builder clientId(String value)

Sets the OAuth client ID. Required.

Parameters:

value - The client ID.

Returns:

This object.

clientSecret

public McpAuthorizationCodeAcquirer.Builder clientSecret(String value)

Sets the client secret (omit for a public/native PKCE-only client).

Parameters:

value - The client secret.

Returns:

This object.

scope

public McpAuthorizationCodeAcquirer.Builder scope(String... values)

Adds requested scopes.

Parameters:

values - The scopes.

Returns:

This object.

offlineAccess

public McpAuthorizationCodeAcquirer.Builder offlineAccess(boolean value)

Requests the offline_access scope so the IdP issues a refresh token (SEP-2207).

Parameters:

value - true to add offline_access.

Returns:

This object.

resource

public McpAuthorizationCodeAcquirer.Builder resource(URI value)

Sets the RFC 8707 resource indicator (the canonical MCP server URI).

Parameters:

value - The canonical resource URI. Must not be null.

Returns:

This object.

expectedIssuer

public McpAuthorizationCodeAcquirer.Builder expectedIssuer(URI value)

Sets the expected issuer the callback iss parameter is validated against (SEP-2468).

Typically the issuer returned by OidcDiscoveryClient for the discovered authorization server.

Parameters:

value - The expected issuer. Must not be null.

Returns:

This object.

skipIssuerValidation

public McpAuthorizationCodeAcquirer.Builder skipIssuerValidation(boolean value)

Explicitly opts out of the SEP-2468 iss validation.

iss validation is on by default; build() requires expectedIssuer(URI) unless this is set to true. Only disable this against an authorization server known not to emit iss.

Parameters:

value - true to skip the iss check.

Returns:

This object.

requireIssuerResponseParameter

public McpAuthorizationCodeAcquirer.Builder requireIssuerResponseParameter(boolean value)

Requires the authorization response to carry an iss parameter, rejecting a response that omits it.

Set this when the discovered authorization-server metadata advertises authorization_response_iss_parameter_supported (RFC 9207); see OidcMetadata.authorizationResponseIssParameterSupported().

Parameters:

value - true to reject a response with no iss parameter.

Returns:

This object.

redirectPath

public McpAuthorizationCodeAcquirer.Builder redirectPath(String value)

Sets the loopback redirect path. Default /callback.

Parameters:

value - The path (must start with /). Must not be null or blank.

Returns:

This object.

redirectPort

public McpAuthorizationCodeAcquirer.Builder redirectPort(int value)

Sets a fixed loopback redirect port so the receiver binds exactly that port (the "bind-first" strategy for strict exact-match authorization servers).

Defaults to 0, meaning an ephemeral port (the RFC 8252 §7.3 port-agnostic strategy) — the simplest interoperable choice. Set a non-zero port only when the authorization server registration used a bind-first forPort redirect; McpClientRegistrations.configure(org.apache.juneau.rest.client.mcp.auth.McpAuthorizationCodeAcquirer.Builder, org.apache.juneau.rest.client.mcp.auth.McpClientRegistration) wires this automatically from such a registration.

Parameters:

value - The fixed loopback port in 1..65535, or 0 for an ephemeral port.

Returns:

This object.

browserLauncher

public McpAuthorizationCodeAcquirer.Builder browserLauncher(Consumer<URI> value)

Sets the callback invoked with the authorization URL so the caller can open it in a browser (or print it).

Parameters:

value - The launcher. Must not be null.

Returns:

This object.

store

public McpAuthorizationCodeAcquirer.Builder store(EphemeralStore value)

Sets the ephemeral state/verifier store. Defaults to a fresh EphemeralStore.

Parameters:

value - The store. Must not be null.

Returns:

This object.

httpTimeout

public McpAuthorizationCodeAcquirer.Builder httpTimeout(Duration value)

Sets the connect/read timeout applied to the token-exchange request. Default 10 seconds.

Parameters:

value - The timeout. Must not be null and must be positive.

Returns:

This object.

httpRequestConfigurator

public McpAuthorizationCodeAcquirer.Builder httpRequestConfigurator(Consumer<com.nimbusds.oauth2.sdk.http.HTTPRequest> value)

Sets a callback that customizes the Nimbus HTTPRequest for the token exchange.

Parameters:

value - The callback. Must not be null.

Returns:

This object.

build

public McpAuthorizationCodeAcquirer build()

Builds the acquirer.

Returns:

A new McpAuthorizationCodeAcquirer.