Class OAuthTokenValidationConfig

java.lang.Object
org.apache.camel.spi.OAuthTokenValidationConfig
public class OAuthTokenValidationConfig extends Object
Configuration for validating incoming OAuth 2.0 bearer tokens.

Used by OAuthTokenValidationFactory to validate JWT tokens locally via JWKS or opaque tokens via RFC 7662 introspection.

Since:
4.21

  • Constructor Details

    • OAuthTokenValidationConfig

      public OAuthTokenValidationConfig()

    • OAuthTokenValidationConfig

      public OAuthTokenValidationConfig(OAuthTokenValidationConfig source)
      Creates a copy of the source configuration.
      Since:
      4.21

  • Method Details

    • copy

      public OAuthTokenValidationConfig copy()
      Returns a copy of this configuration.
      Since:
      4.21

    • getJwksEndpoint

      public @Nullable String getJwksEndpoint()
      JWKS endpoint used to validate JWT signatures.
      Since:
      4.21

    • setJwksEndpoint

      public OAuthTokenValidationConfig setJwksEndpoint(@Nullable String jwksEndpoint)
      Sets the JWKS endpoint used to validate JWT signatures.
      Since:
      4.21

    • getIntrospectionEndpoint

      public @Nullable String getIntrospectionEndpoint()
      RFC 7662 introspection endpoint used to validate opaque tokens.
      Since:
      4.21

    • setIntrospectionEndpoint

      public OAuthTokenValidationConfig setIntrospectionEndpoint(@Nullable String introspectionEndpoint)
      Sets the RFC 7662 introspection endpoint used to validate opaque tokens.
      Since:
      4.21

    • getIntrospectionClientId

      public @Nullable String getIntrospectionClientId()
      Client identifier used for token introspection.
      Since:
      4.21

    • setIntrospectionClientId

      public OAuthTokenValidationConfig setIntrospectionClientId(@Nullable String introspectionClientId)
      Sets the client identifier used for token introspection.
      Since:
      4.21

    • getIntrospectionClientSecret

      public @Nullable String getIntrospectionClientSecret()
      Client secret used for token introspection.
      Since:
      4.21

    • setIntrospectionClientSecret

      public OAuthTokenValidationConfig setIntrospectionClientSecret(@Nullable String introspectionClientSecret)
      Sets the client secret used for token introspection.
      Since:
      4.21

    • getExpectedIssuer

      public @Nullable String getExpectedIssuer()
      Expected issuer claim.
      Since:
      4.21

    • setExpectedIssuer

      public OAuthTokenValidationConfig setExpectedIssuer(@Nullable String expectedIssuer)
      Sets the expected issuer claim.
      Since:
      4.21

    • getExpectedAudience

      public @Nullable String getExpectedAudience()
      First configured expected audience claim, or null when no audience is configured.

      Prefer getExpectedAudiences() for new code that accepts multiple audiences.

      Since:
      4.21

    • setExpectedAudience

      public OAuthTokenValidationConfig setExpectedAudience(@Nullable String expectedAudience)
      Sets a single accepted audience claim.
      Since:
      4.21

    • getExpectedAudiences

      public Set<String> getExpectedAudiences()
      Accepted audience claim values. When non-empty, the token aud claim must contain at least one of these values.
      Since:
      4.21

    • setExpectedAudiences

      public OAuthTokenValidationConfig setExpectedAudiences(@Nullable Set<String> expectedAudiences)
      Sets the accepted audience claim values.
      Since:
      4.21

    • getExpectedTokenType

      public @Nullable String getExpectedTokenType()
      Expected JWT typ header, for example at+jwt. When set, JWT tokens without this type are rejected.
      Since:
      4.21

    • setExpectedTokenType

      public OAuthTokenValidationConfig setExpectedTokenType(@Nullable String expectedTokenType)
      Sets the expected JWT typ header.
      Since:
      4.21

    • getClockSkewSeconds

      public int getClockSkewSeconds()
      Clock skew leeway in seconds for temporal claims.
      Since:
      4.21

    • setClockSkewSeconds

      public OAuthTokenValidationConfig setClockSkewSeconds(int clockSkewSeconds)
      Sets clock skew leeway in seconds for temporal claims.
      Since:
      4.21

    • getJwksCacheTtlSeconds

      public long getJwksCacheTtlSeconds()
      JWKS cache TTL in seconds.
      Since:
      4.21

    • setJwksCacheTtlSeconds

      public OAuthTokenValidationConfig setJwksCacheTtlSeconds(long jwksCacheTtlSeconds)
      Sets the JWKS cache TTL in seconds.
      Since:
      4.21

    • getOidcDiscoveryUrl

      public @Nullable String getOidcDiscoveryUrl()
      OIDC discovery URL used to resolve JWKS, introspection, and issuer metadata.
      Since:
      4.21

    • setOidcDiscoveryUrl

      public OAuthTokenValidationConfig setOidcDiscoveryUrl(@Nullable String oidcDiscoveryUrl)
      Sets the OIDC discovery URL used to resolve JWKS, introspection, and issuer metadata.
      Since:
      4.21

    • getOidcDiscoveryCacheTtlSeconds

      public long getOidcDiscoveryCacheTtlSeconds()
      OIDC discovery metadata cache TTL in seconds.
      Since:
      4.21

    • setOidcDiscoveryCacheTtlSeconds

      public OAuthTokenValidationConfig setOidcDiscoveryCacheTtlSeconds(long oidcDiscoveryCacheTtlSeconds)
      Sets the OIDC discovery metadata cache TTL in seconds.
      Since:
      4.21

    • getConnectTimeoutSeconds

      public int getConnectTimeoutSeconds()
      Network connect timeout in seconds for outbound HTTP calls (JWKS fetch, OIDC discovery, introspection).
      Since:
      4.21

    • setConnectTimeoutSeconds

      public OAuthTokenValidationConfig setConnectTimeoutSeconds(int connectTimeoutSeconds)
      Sets the network connect timeout in seconds for outbound HTTP calls.
      Since:
      4.21

    • getReadTimeoutSeconds

      public int getReadTimeoutSeconds()
      Network read timeout in seconds for outbound HTTP calls (JWKS fetch, OIDC discovery, introspection).
      Since:
      4.21

    • setReadTimeoutSeconds

      public OAuthTokenValidationConfig setReadTimeoutSeconds(int readTimeoutSeconds)
      Sets the network read timeout in seconds for outbound HTTP calls.
      Since:
      4.21

    • isRequireExpiration

      public boolean isRequireExpiration()
      Whether to require the exp claim in JWT tokens. When true (default), JWTs without an expiration claim are rejected.
      Since:
      4.21

    • setRequireExpiration

      public OAuthTokenValidationConfig setRequireExpiration(boolean requireExpiration)
      Sets whether JWT tokens must contain an exp claim.
      Since:
      4.21

    • getAllowedJwsAlgorithms

      public @Nullable Set<String> getAllowedJwsAlgorithms()
      Allowed JWS algorithms for JWT validation. When set, JWTs signed with algorithms not in this set are rejected. When null (default), any RSA or EC algorithm supported by the verifier is accepted.
      Since:
      4.21

    • setAllowedJwsAlgorithms

      public OAuthTokenValidationConfig setAllowedJwsAlgorithms(@Nullable Set<String> allowedJwsAlgorithms)
      Sets the allowed JWS algorithms for JWT validation. Blank values are ignored.
      Since:
      4.21

    • isAllowMissingAudience

      public boolean isAllowMissingAudience()
      Whether token validation may proceed without configured accepted audiences.
      Since:
      4.21

    • setAllowMissingAudience

      public OAuthTokenValidationConfig setAllowMissingAudience(boolean allowMissingAudience)
      Sets whether token validation may proceed without configured accepted audiences.
      Since:
      4.21

    • isAllowMissingIssuer

      public boolean isAllowMissingIssuer()
      Whether token validation may proceed without an expected issuer.
      Since:
      4.21

    • setAllowMissingIssuer

      public OAuthTokenValidationConfig setAllowMissingIssuer(boolean allowMissingIssuer)
      Sets whether token validation may proceed without an expected issuer.
      Since:
      4.21

    • isAllowInsecureHttp

      public boolean isAllowInsecureHttp()
      Whether JWKS, OIDC discovery, or introspection endpoints may use plain HTTP.
      Since:
      4.21

    • setAllowInsecureHttp

      public OAuthTokenValidationConfig setAllowInsecureHttp(boolean allowInsecureHttp)
      Sets whether JWKS, OIDC discovery, or introspection endpoints may use plain HTTP.
      Since:
      4.21