ktor-server-auth-oidc/io.ktor.server.auth.oidc/OidcOAuthConfig

OidcOAuthConfig

OAuth/OpenID Connect configuration.

OAuth installs a provider-specific login route and callback route. The callback requires an ID token and the openid scope, then passes the verified OidcToken.Id to onAuthenticated.

Browser sessions are enabled by default. Customize them with sessions or opt out with disableSessions. Plugin-managed refresh and logout routes require sessions. When sessions are disabled, onAuthenticated is required so verified token material is not discarded.

Report a problem

Properties

clientId

lateinit var clientId: String

OAuth client ID. Required when OAuth is configured.

clientSecret

lateinit var clientSecret: String

OAuth client secret. Required when OAuth is configured.

codeChallengeMethod

var codeChallengeMethod: CodeChallengeMethod?

Code challenge method used for PKCE (RFC 7636) during the authorization code flow.

fetchUserInfo

var fetchUserInfo: Boolean

When true, requests the OpenID Provider UserInfo endpoint after token exchange and uses that response for OidcToken.Id.userInfo.

loginUri

var loginUri: URLBuilder.() -> Unit

Configures the OAuth login route URI.

redirectUri

var redirectUri: URLBuilder.() -> Unit

Configures the OAuth callback route URI.

resourceIndicators

var resourceIndicators: List<String>

Optional resource indicators added to authorization, token, and refresh requests.

scopes

var scopes: List<String>

OAuth scopes requested during authorization.

stateEncryptionKey

var stateEncryptionKey: OidcStateEncryptionKey?

Symmetric key used to encrypt the in-flight OAuth state cookie carrying state, nonce, and the PKCE code verifier between the login redirect and the callback.

tokenEndpointAuthMethod

var tokenEndpointAuthMethod: ClientAuthenticationMethod?

Client authentication method for token endpoint requests: authorization code exchange and token refresh.

Functions

disableSessions

fun disableSessions()

Disables browser sessions for this OAuth flow.

logout

fun logout(path: String = "/oidc/", onLogout: suspend RoutingContext.() -> Unit = {})

Configures the plugin-managed logout route.

fun logout(path: String = "/oidc/", postLogoutRedirectUri: URLBuilder.() -> Unit, onLogout: suspend RoutingContext.() -> Unit = {})

Configures the plugin-managed logout route and includes post_logout_redirect_uri in RP-initiated logout.

onAuthenticated

fun onAuthenticated(block: OidcOAuthAuthenticatedHandler)

Sets the handler called after a successful OAuth/OIDC login.

onAuthenticationFailed

fun onAuthenticationFailed(block: UnauthorizedHandler)

Sets the handler called when OIDC verification fails after token exchange.

refresh

fun refresh(path: String = "/oidc/", onRefresh: suspend RoutingContext.() -> Unit = {})

Configures the plugin-managed session refresh route.

sessions

fun sessions(configure: OidcSessionsConfig.() -> Unit = {})

Configures the OIDC session for this OAuth flow, including cookie transport and CSRF protection.