ktor-server-auth-oidc/io.ktor.server.auth.oidc

Package-level declarations

Types

@SubclassOptInRequired(markerClass = [InternalKtorSubclassing::class])

Client authentication methods for provider endpoints that require client credentials, such as the token endpoint and the token introspection endpoint.

CodeChallengeMethod

@ExperimentalKtorApi

@SubclassOptInRequired(markerClass = [InternalKtorSubclassing::class])

interface CodeChallengeMethod

Oidc

@ExperimentalKtorApi

class Oidc

First-class OpenID Connect plugin for Ktor server authentication.

OidcBearerConfig

@ExperimentalKtorApi

class OidcBearerConfig

Access-token verification policy for resource-server Bearer authentication.

OidcDiscoveryException

@ExperimentalKtorApi

class OidcDiscoveryException(message: String, cause: Throwable? = null) : RuntimeException

Base exception for OpenID Connect discovery failures.

OidcEnvConfig

@ExperimentalKtorApi

@Serializable

data class OidcEnvConfig(val issuer: String, val clientId: String, val clientSecret: String, val scopes: List<String>)

Serializable OpenID Connect provider values commonly stored in application configuration.

OidcJwtConfig

@ExperimentalKtorApi

class OidcJwtConfig

JWT verification configuration shared by ID tokens and JWT access tokens.

OidcMetadataRefreshFailure

@ExperimentalKtorApi

class OidcMetadataRefreshFailure(val provider: OidcProvider, val consecutiveFailures: Int, val cause: Throwable)

Details of a failed periodic OpenID Connect discovery metadata refresh. Routes and token validation continue with the last successful discovery document.

OidcOAuthConfig

@ExperimentalKtorApi

class OidcOAuthConfig

OAuth/OpenID Connect configuration.

OidcPluginConfig

@ExperimentalKtorApi

class OidcPluginConfig

Configuration for the Oidc plugin.

OidcProvider

@ExperimentalKtorApi

class OidcProvider

Typed authentication capabilities for one configured OpenID Connect provider.

OidcProviderConfig

@ExperimentalKtorApi

class OidcProviderConfig

Configuration for a single OpenID Connect provider (issuer).

OidcSessionsConfig

@ExperimentalKtorApi

class OidcSessionsConfig

Configuration for OIDC session transport and CSRF protection.

OidcSigningKeyUnavailableException

@ExperimentalKtorApi

class OidcSigningKeyUnavailableException(message: String, cause: Throwable? = null) : RuntimeException

Thrown when the signing key for a token cannot be resolved because of a JWKS failure.

OidcStateEncryptionKey

@ExperimentalKtorApi

@JvmInline

value class OidcStateEncryptionKey

Symmetric key material used to encrypt the temporary OAuth state cookie.

OidcToken

@ExperimentalKtorApi

@SubclassOptInRequired(markerClass = [InternalKtorSubclassing::class])

interface OidcToken

Token material returned or validated by the OpenID Connect plugin.

OidcTokenExtractor

typealias OidcTokenExtractor = RoutingContext.() -> String?

Extracts a Bearer token candidate from an application call.

OidcTokenIntrospectionConfig

@ExperimentalKtorApi

class OidcTokenIntrospectionConfig

RFC 7662 token introspection configuration for Bearer authentication.

OidcTokenRefreshResult

@ExperimentalKtorApi

class OidcTokenRefreshResult(val accessToken: String, val refreshToken: String? = null, val expiresIn: Duration? = null, val tokenType: String, val scope: String? = null, val idToken: OidcToken.Id? = null)

Token response returned by refreshToken.

OidcTokenRefreshStrategy

@ExperimentalKtorApi

@SubclassOptInRequired(markerClass = [InternalKtorSubclassing::class])

interface OidcTokenRefreshStrategy

Strategy used to refresh OpenID Connect browser sessions.

OidcTokenRejectedException

@ExperimentalKtorApi

class OidcTokenRejectedException(val message: String, val cause: Throwable?) : RuntimeException

Thrown when a token fails OpenID Connect validation and must not be trusted.

OpenIdProviderMetadata

@ExperimentalKtorApi

@Serializable

class OpenIdProviderMetadata(val issuer: String, val authorizationEndpoint: String, val tokenEndpoint: String, val userInfoEndpoint: String? = null, val jwksUri: String, val registrationEndpoint: String? = null, val scopesSupported: List<String>? = null, val responseTypesSupported: List<String>? = null, val responseModesSupported: List<String>? = null, val grantTypesSupported: List<String>? = null, val acrValuesSupported: List<String>? = null, val subjectTypesSupported: List<String>? = null, val idTokenSigningAlgValuesSupported: List<String>? = null, val idTokenEncryptionAlgValuesSupported: List<String>? = null, val idTokenEncryptionEncValuesSupported: List<String>? = null, val userinfoSigningAlgValuesSupported: List<String>? = null, val userinfoEncryptionAlgValuesSupported: List<String>? = null, val userinfoEncryptionEncValuesSupported: List<String>? = null, val requestObjectSigningAlgValuesSupported: List<String>? = null, val requestObjectEncryptionAlgValuesSupported: List<String>? = null, val requestObjectEncryptionEncValuesSupported: List<String>? = null, val tokenEndpointAuthMethodsSupported: List<String>? = null, val tokenEndpointAuthSigningAlgValuesSupported: List<String>? = null, val displayValuesSupported: List<String>? = null, val claimTypesSupported: List<String>? = null, val claimsSupported: List<String>? = null, val claimsLocalesSupported: List<String>? = null, val uiLocalesSupported: List<String>? = null, val claimsParameterSupported: Boolean? = null, val requestParameterSupported: Boolean? = null, val requestUriParameterSupported: Boolean? = null, val requireRequestUriRegistration: Boolean? = null, val authorizationResponseIssParameterSupported: Boolean? = null, val opPolicyUri: String? = null, val opTosUri: String? = null, val endSessionEndpoint: String? = null, val checkSessionIframe: String? = null)

OpenID Connect discovery document containing OAuth 2.0 authorization server metadata.

OpenIdTestAccessTokenBuilder

@ExperimentalKtorApi

class OpenIdTestAccessTokenBuilder : OpenIdTestTokenBuilder

Builder for access tokens issued by OpenIdTestKeys.

OpenIdTestIdTokenBuilder

@ExperimentalKtorApi

class OpenIdTestIdTokenBuilder : OpenIdTestTokenBuilder

Builder for ID tokens issued by OpenIdTestKeys.

OpenIdTestKeys

@ExperimentalKtorApi

class OpenIdTestKeys

Local signing keys for OpenID Connect tests.

OpenIdTestTokenBuilder

@ExperimentalKtorApi

abstract class OpenIdTestTokenBuilder

Base claim builder for test JWTs issued by OpenIdTestKeys.

ProtectedResourceMetadata

@ExperimentalKtorApi

@Serializable

class ProtectedResourceMetadata(val resource: String, val authorizationServers: List<String>? = null, val jwksUri: String? = null, val scopesSupported: List<String>? = null, val bearerMethodsSupported: List<String>? = null, val resourceSigningAlgValuesSupported: List<String>? = null, val resourceName: String? = null, val resourceDocumentation: String? = null, val resourcePolicyUri: String? = null, val resourceTosUri: String? = null, val tlsClientCertificateBoundAccessTokens: Boolean? = null, val authorizationDetailsTypesSupported: List<String>? = null, val dpopSigningAlgValuesSupported: List<String>? = null, val dpopBoundAccessTokensRequired: Boolean? = null)

OAuth 2.0 Protected Resource Metadata as defined in RFC 9728.

ProtectedResourceMetadataConfig

@ExperimentalKtorApi

class ProtectedResourceMetadataConfig

Configuration for OAuth 2.0 Protected Resource Metadata (RFC 9728).

TokenClaims

@ExperimentalKtorApi

class TokenClaims

Structured JWT claims access.

TokenIntrospection

@ExperimentalKtorApi

@Serializable

class TokenIntrospection(val active: Boolean, val scope: String? = null, val clientId: String? = null, val username: String? = null, val tokenType: String? = null, val expiresAt: Long? = null, val issuedAt: Long? = null, val notBefore: Long? = null, val subject: String? = null, val audience: List<String> = emptyList(), val issuer: String? = null, val jwtId: String? = null, val claims: JsonObject = JsonObject(emptyMap()))

Normalized RFC 7662 token introspection response.

Properties

OidcMetadataRefreshFailed

@ExperimentalKtorApi

val OidcMetadataRefreshFailed: EventDefinition<OidcMetadataRefreshFailure>

Monitor event raised when a periodic OpenID Connect discovery metadata refresh fails.

Functions

fetchOpenIdMetadata

@ExperimentalKtorApi

suspend fun HttpClient.fetchOpenIdMetadata(issuer: String): OpenIdProviderMetadata

Fetches OpenID Connect discovery document from the authorization server.