com.authlete.common.dto

Class IntrospectionRequest

java.lang.Object

com.authlete.common.dto.IntrospectionRequest

All Implemented Interfaces:

Serializable

public class IntrospectionRequest
extends Object
implements Serializable

Request to Authlete's /auth/introspection API.

token (REQUIRED)

An access token to introspect.

scopes (OPTIONAL)

Scopes that should be covered by the access token.

subject (OPTIONAL)

The subject that should be associated with the access token.

clientCertificate (OPTIONAL)

The client certificate used in the mutual TLS connection established between the client application and the protected resource endpoint. See RFC 8705 OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens for details.

dpop (OPTIONAL)

The value of the DPoP HTTP header. See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.

htm (OPTIONAL)

The HTTP method of the request to the protected resource endpoint. See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.

htu (OPTIONAL)

The URL of the protected resource endpoint. See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.

resources (OPTIONAL)

Resource indicators that should be covered by the access token. See RFC 8707 Resource Indicators for OAuth 2.0 for details.

Author:

Takahiko Kawasaki

See Also:

RFC 6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage, RFC 8705 OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens, RFC 8707 Resource Indicators for OAuth 2.0, OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP), Serialized Form

Constructor Summary

Constructors

Constructor and Description
IntrospectionRequest()

Method Summary

Modifier and Type	Method and Description
String	getClientCertificate() Get the client certificate used in the mutual TLS connection established between the client application and the protected resource endpoint.
String	getDpop() Get the DPoP header presented by the client during the request to the resource server.
String	getHtm() Get the HTTP method of the request from the client to the protected resource endpoint.
String	getHtu() Get the URL of the protected resource endpoint.
URI[]	getResources() Get the resource indicators that the access token should cover.
String[]	getScopes() Get the scopes which are required to access the protected resource endpoint.
String	getSubject() Get the subject (= end-user ID managed by the service implementation) which is required to access the protected resource endpoint.
String	getToken() Get the access token to introspect.
IntrospectionRequest	setClientCertificate(String clientCertificate) Set the client certificate used in the mutual TLS connection established between the client application and the protected resource endpoint.
IntrospectionRequest	setDpop(String dpop) Set the DPoP header presented by the client during the request to the resource server.
IntrospectionRequest	setHtm(String htm) Set the HTTP method of the request from the client to the protected resource endpoint.
IntrospectionRequest	setHtu(String htu) Set the URL of the protected resource endpoint.
IntrospectionRequest	setResources(URI[] resources) Set the resource indicators that the access token should cover.
IntrospectionRequest	setScopes(String[] scopes) Set the scopes which are required to access the protected resource endpoint.
IntrospectionRequest	setSubject(String subject) Set the subject (= end-user ID managed by the service implementation) which is required to access the protected resource endpoint.
IntrospectionRequest	setToken(String token) Set the access token to introspect.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

IntrospectionRequest

public IntrospectionRequest()

Method Detail

getToken

public String getToken()

Get the access token to introspect.

Returns:

The access token.

setToken

public IntrospectionRequest setToken(String token)

Set the access token to introspect.

Parameters:

token - The access token.

Returns:

this object.

getScopes

public String[] getScopes()

Get the scopes which are required to access the protected resource endpoint.

Returns:

Required scopes.

setScopes

public IntrospectionRequest setScopes(String[] scopes)

Set the scopes which are required to access the protected resource endpoint.

If the array contains a scope which is not covered by the access token, Authlete's /auth/introspection API returns FORBIDDEN as the action and insufficent_scope as the error code.

Parameters:

scopes - Scopes required to access the protected resource endpoint. If null is given, the /auth/introspection API does not perform scope checking.

Returns:

this object.

getSubject

public String getSubject()

Get the subject (= end-user ID managed by the service implementation) which is required to access the protected resource endpoint.

Returns:

Expected identifier of resource owner.

setSubject

public IntrospectionRequest setSubject(String subject)

Set the subject (= end-user ID managed by the service implementation) which is required to access the protected resource endpoint.

If the specified subject is different from the one associated with the access token, Authlete's /auth/introspection API returns FORBIDDEN as the action and invalid_request as the error code.

Parameters:

subject - Subject (= end-user ID managed by the service implementation) which is required to access the protected resource endpoint. If null is given, the /auth/introspection API does not perform subject checking.

Returns:

this object.

getClientCertificate

public String getClientCertificate()

Get the client certificate used in the mutual TLS connection established between the client application and the protected resource endpoint.

Returns:

The client certificate in PEM format.

Since:

2.14

See Also:

RFC 8705 OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens

setClientCertificate

public IntrospectionRequest setClientCertificate(String clientCertificate)

Set the client certificate used in the mutual TLS connection established between the client application and the protected resource endpoint.

If the access token is bound to a client certificate, this parameter is used for validation.

Parameters:

clientCertificate - The client certificate in PEM format.

Returns:

this object.

Since:

2.14

See Also:

RFC 8705 OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens

getDpop

public String getDpop()

Get the DPoP header presented by the client during the request to the resource server. This header contains a signed JWT which includes the public key that is paired with the private key used to sign it.

Returns:

The DPoP header string.

Since:

2.70

See Also:

OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)

setDpop

public IntrospectionRequest setDpop(String dpop)

Set the DPoP header presented by the client during the request to the resource server. This header contains a signed JWT which includes the public key that is paired with the private key used to sign it.

If the access token is bound to a public key via DPoP, this parameter is used for validation.

Parameters:

dpop - The DPoP header string.

Returns:

this object.

Since:

2.70

See Also:

OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)

getHtm

public String getHtm()

Get the HTTP method of the request from the client to the protected resource endpoint. This field is used to validate the DPoP header.

Returns:

The HTTP method as a string. For example, "GET".

Since:

2.70

See Also:

OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)

setHtm

public IntrospectionRequest setHtm(String htm)

Set the HTTP method of the request from the client to the protected resource endpoint. This field is used to validate the DPoP header.

If the access token is bound to a public key via DPoP, this parameter is used for validation.

Parameters:

htm - The HTTP method as a string. For example, "GET".

Returns:

this object.

Since:

2.70

See Also:

OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)

getHtu

public String getHtu()

Get the URL of the protected resource endpoint. This field is used to validate the DPoP header.

Returns:

The URL of the protected resource endpoint.

Since:

2.70

See Also:

OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)

setHtu

public IntrospectionRequest setHtu(String htu)

Set the URL of the protected resource endpoint. This field is used to validate the DPoP header.

If the access token is bound to a public key via DPoP, this parameter is used for validation.

Parameters:

htu - The URL of the protected resource endpoint.

Returns:

this object.

Since:

2.70

See Also:

OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)

getResources

public URI[] getResources()

Get the resource indicators that the access token should cover.

Returns:

The resource indicators.

Since:

3.1

See Also:

RFC 8707 Resource Indicators for OAuth 2.0

setResources

public IntrospectionRequest setResources(URI[] resources)

Set the resource indicators that the access token should cover.

Parameters:

resources - The resource indicators that the access token should cover to access the protected resource endpoint. If null is given, the /auth/introspection API does not perform resource indicator checking.

Returns:

this object.

Since:

3.3

See Also:

RFC 8707 Resource Indicators for OAuth 2.0