Package org.apache.juneau.rest.server.auth.oidc.rp

package org.apache.juneau.rest.server.auth.oidc.rp

OpenID Connect Relying Party (RP) login support for Juneau REST servers.

This opt-in module turns a Juneau REST server into a complete OpenID Connect Relying Party — the "Log in with Google / Okta / Entra ID / Keycloak" end-to-end glue — sitting on top of juneau-rest-server-auth-oauth. It orchestrates the browser redirect → callback → session dance, owning the state / nonce / PKCE bookkeeping, strict ID-token validation, the session SPI, and the request-time session→identity binding.

The com.nimbusds:oauth2-oidc-sdk dependency is provided-scoped and contained at the module boundary — it never leaks transitively.

See Also:

• OidcRelyingParty
• OIDC Relying Party Login (juneau-rest-server-auth-oidc-rp)
• OpenID Connect Core 1.0

Class	Description
IdTokenValidatorAdapter	Wraps Nimbus's IDTokenValidator to validate an OpenID Connect ID token's signature and claims and project the verified claims onto a Juneau ClaimsPrincipal.
IdTokenValidatorAdapter.Builder	Builder.
InMemoryLoginStateStore	The shipped, single-node default LoginStateStore: a single-use, TTL-bounded, size-bounded in-memory store for the per-login state → LoginStateStore.PendingLogin association created during OidcRelyingParty.startLogin(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse) and consumed during OidcRelyingParty.completeLogin(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse).
InMemorySessionStore	In-memory SessionStore backed by a bounded-LRU map, indexed by sub and sid so it can satisfy back-channel logout.
LoginStateStore	SPI for the single-use, TTL-bounded state → (nonce, PKCE code_verifier, redirect target) association created during OidcRelyingParty.startLogin(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse) and consumed during OidcRelyingParty.completeLogin(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse).
LoginStateStore.PendingLogin	A pending-login association awaiting the IdP callback.
OidcRelyingParty	Facade orchestrating an OpenID Connect Authorization-Code-with-PKCE Relying Party login flow on top of the juneau-rest-server-auth-oauth building blocks.
OidcRelyingParty.Builder	Builder.
OidcSession	Immutable record describing a logged-in OpenID Connect Relying Party session.
OidcSessionAuthFilter	AuthFilter that resolves the OIDC Relying Party session cookie into a ClaimsPrincipal on each request, so RoleBasedRestGuard and @Auth Principal injection see the filter-resolved identity (via AuthenticatedRequestWrapper) with zero downstream changes.
SessionStore	SPI for persisting OidcSession instances and resolving them back from a session-cookie value.
SignedCookieSessionStore	Stateless SessionStore that serializes the session into an HMAC-signed compact JWT carried entirely in the session cookie.
SignedCookieSessionStore.Builder	Builder.