All Classes and Interfaces
Class
Description
Abstract request with client authentication.
The base abstract class for OAuth 2.0 and OpenID Connect configuration
requests.
Abstract confirmation.
Abstract JSON Web Token (JWT) validator for ID tokens and logout tokens.
Abstract request with optional client authentication.
Abstract request with optional client authentication or client
identification.
The base abstract class for requests.
The base abstract class for access tokens.
Access token hash (
at_hash
).Access token response from the Token endpoint.
Access token type.
DPoP related access token validation exception.
Access token validator, using the
at_hash
ID token claim.Authentication Context Class Reference (
acr
).Resolved authentication Context Class Reference (ACR) request.
Action.
Authorised actor in impersonation and delegation cases.
Add (add) operation.
UserInfo address claims set, serialisable to a JSON object.
Aggregated OpenID claims set.
Already used exception.
Authentication Method Reference (
amr
).Enumeration of OpenID Connect client application types.
Common assertion details used in JWT bearer assertions and SAML 2.0 bearer
assertions.
Assertion grant.
Identity evidence attachment.
Evidence attachment type.
Attestation.
Audience identifier.
OpenID Connect authentication error response.
OpenID Connect authentication request.
Builder for constructing OpenID Connect authentication requests.
OpenID authentication request detector.
AuthenticationRequestResolver<C extends com.nimbusds.jose.proc.SecurityContext>
Resolves the final OpenID Connect authentication request by superseding its
parameters with those found in the optional OpenID Connect request object.
OpenID Connect authentication response.
Parser of OpenID Connect authentication response messages.
OpenID Connect authentication success response.
Authorisation code.
Authorisation code grant.
Authorisation code validator, using the
c_hash
ID token claim.Authorisation detail.
Builder for constructing authorisation details.
Authorisation error response.
Authorisation grant.
Authorisation request.
Builder for constructing authorisation requests.
The base abstract class for authorisation success and error responses.
OAuth 2.0 Authorisation Server (AS) configuration request.
OAuth 2.0 Authorisation Server (AS) endpoint metadata.
OAuth 2.0 Authorisation Server (AS) metadata.
Authorisation success response.
OAuth 2.0 Rich Authorisation Request (RAR) detail type.
Deprecated.
OAuth 2.0 client authorized to use the ID Token as an OAuth access token,
if different than the client that requested the ID Token (
azp
).CIBA request ID (
auth_req_id
).Back-channel logout request initiated by an OpenID provider (OP).
CIBA token delivery mode.
Common bad JWT exceptions.
Bad SAML 2.0 assertion exception.
Bearer access token.
OAuth 2.0 bearer token error.
Birthplace claims set, serialisable to a JSON object.
Boolean configuration.
Boolean operation.
CIBA specific errors.
CIBA error push delivery to the client notification endpoint.
CIBA error response from an OpenID provider / OAuth 2.0 authorisation server
backend authentication endpoint.
CIBA grant.
The hint type in a CIBA request.
CIBA ping callback to a client notification endpoint.
CIBA push callback to the client notification endpoint.
CIBA request to an OpenID provider / OAuth 2.0 authorisation server
backend authentication endpoint.
Builder for constructing CIBA requests.
Successful CIBA request acknowledgement from an OpenID provider / OAuth 2.0
authorisation server backend authentication endpoint.
CIBA response from an OpenID provider / OAuth 2.0 authorisation server
backend authentication endpoint.
CIBA signed request claims set, serialisable to a JSON object.
CIBA token push delivery to the client notification endpoint.
Enumeration of the claim requirement types.
Deprecated.
Individual OpenID claim request.
Claims set with basic getters and setters, serialisable to a JSON object.
OpenID Connect claims set request, intended to represent the
userinfo
and id_token
elements in a
claims
request
parameter.Individual OpenID claim request.
Enumeration of the available claims transports.
Enumeration of the claim types.
Base abstract class for client authentication at the Token endpoint.
Client authentication method at the Token endpoint.
Client authentication verifier.
Client credentials grant.
Client credentials parser.
Selector of client credential candidates for client authentication
verification.
Client delete request.
Client identifier.
Client information.
Client information response.
Client metadata.
Client read request.
Client registration error response.
Client registration request.
The base abstract for client registration responses.
OpenID Connect Federation 1.0 client registration type.
Client secret basic authentication at the Token endpoint.
Client secret JWT authentication at the Token endpoint.
Client secret post authentication at the Token endpoint.
Enumeration of the OAuth 2.0 client types.
Client registration request.
Deprecated.
Authorisation code challenge.
Method that was used to derive an authorisation code challenge.
Authorisation code hash (
c_hash
).Authorisation code verifier.
Collection utilities.
Common claims set.
Common federation claims set.
Content with type and optional description.
Content type matching.
Generic context for passing objects.
Abstract class for country codes.
Data type.
Date with optional timezone offset.
Default DPoP proof factory.
DPoP proof JWT single use checker.
The default entity statement retriever for resolving trust chains.
Default (default) value operation.
Validates the permitted combinations of known policy operations for a given
metadata parameter.
The default policy operation factory.
OAuth 2.0 device authorization error response.
OAuth 2.0 Device Authorization Grant specific errors.
Device authorisation request.
Builder for constructing authorisation requests.
Token endpoint response.
A device authorization response from the device authorization endpoint.
Device code.
Device code grant for the OAuth 2.0 Device Authorization Grant.
Device secret.
Device secret hash (
ds_hash
).Token
representation of a device secret.Device SSO scope value.
Cryptographic digest.
Digest mismatch exception.
Enumeration of the display types for authentication and consent UIs.
Distributed OpenID claims set.
Document details.
Document used as identity evidence.
Document issuer.
Document number.
Identity document type.
DPoP access token.
Unique identifier for a DPoP issuer.
DPoP proof JWT factory.
DPoP proof JWT verifier for a protected resource.
OAuth 2.0 DPoP token error.
DPoP proof JWT verifier for the OAuth 2.0 token endpoint of an authorisation
server.
DPoP utilities.
Electronic record details.
Electronic record used as identity evidence.
Electronic record source.
Electronic record type.
Electronic signature used as identity evidence.
Embedded attachment.
OpenID provider endpoint name, used in specifying the applicable request
authentication methods in automatic registration in OpenID Connect
Federation 1.0.
Federation entity identifier.
Entity ID constraint.
Entity listing error response.
Entity listing request.
Entity listing response.
Entity listing success response.
Federation entity metadata validator.
Entity role in a federation trust chain.
Federation entity statement / entity configuration.
Federation entity statement claims set, serialisable to a JSON object.
Entity statement claims verifier.
Entity statement retriever for resolving trust chains.
Federation entity type.
Error object, used to encapsulate OAuth 2.0 and other errors.
Response message indicating an error.
Default (default) value operation.
Exact match entity ID constraint.
Expended client authentication JWT ID
jti
claim checker.Explicit client registration request for a federation entity.
External attachment.
Federation API error.
Federation API request.
Federation entity configuration error response.
Federation entity configuration request.
Federation entity configuration response.
Federation entity configuration success response.
Federation entity metadata.
Fetch entity statement error response.
Fetch entity statement request.
Fetch entity statement response.
Fetch entity statement success response.
The end-user's gender: Values defined by the OpenID Connect specification
are
Gender.FEMALE
and Gender.MALE
(gender
).The base class for checked exceptions defined in this SDK.
Authorisation grant type.
Hash algorithm.
SHA-256 based encoder of pairwise subject identifiers.
The base class for SHA-2 based claims.
Hints intended for the client authentication verifier.
HTTP endpoint.
HTTP request with support for the parameters required to construct an
OAuth 2.0 request message
.Enumeration of the HTTP methods used in OAuth 2.0 requests.
HTTPRequest
instance configurator.HTTP request sender.
HTTP response with support for the parameters required to construct an
OAuth 2.0 response message
.Deprecated.
Deprecated.
Use
DocumentEvidence
instead.Deprecated.
The base class for representing identifiers.
The base class for representing identifiers with an optional URI
representation.
Identity assurance level.
Identity assurance process.
The base abstract class for identity evidences.
Identity evidence type.
Identity trust framework identifiers.
Identity verification.
Identity verification method.
Legal entity that performed an identity verification on behalf of an OpenID
provider.
ID token claims set, serialisable to a JSON object.
ID token claims verifier.
Validator of ID tokens issued by an OpenID Provider (OP).
Invalid client exception.
Invalid DPoP proof exception.
Invalid entity metadata exception.
Invalid access token / code hash exception.
Invalid pairwise subject exception.
Invalid software statement exception.
ISO 3166-1 alpha-2 (two-letter) country code.
ISO 3166-1 alpha-3 (three-letter) country code.
ISO 3166-1 alpha (letter-based) country code.
Utility for mapping between ISO 3166-1 alpha-2 and alpha-3 country codes.
ISO 3166-3 country code for former countries and territories.
Issuer identifier.
HTTP Jakarta Servlet utilities.
JSON Web Token (JWT) encoded authorisation response claims verifier.
JWT Secured Authorization Response Mode for OAuth 2.0 (JARM) utilities.
Validator of JSON Web Token (JWT) secured authorisation responses (JARM).
JSON array helper methods for parsing and typed retrieval of values.
JSON object configuration.
JSON object helper methods for parsing and typed retrieval of member values.
JSON helper methods.
Jurisdiction.
JSON Web Key (JWK) SHA-256 thumbprint confirmation.
JSON Web Token (JWT) bearer assertion details (claims set) for OAuth 2.0
client authentication and authorisation grants.
JSON Web Token (JWT) bearer assertion details (claims set) verifier for
OAuth 2.0 client authentication and authorisation grants.
Static JWT bearer assertion factory.
The
client_secret_jwt
and private_key_jwt
audience (aud)
claim check.Base abstract class for JSON Web Token (JWT) based client authentication at
the Token endpoint.
JWT client authentication claims set, serialisable to a JSON object and JWT
claims set.
JWT bearer grant.
JSON Web Token (JWT) claims set utilities.
JSON Web Token (JWT) identifier.
Federation JWT utilities.
Leaf entity type constraint.
List utilities.
Location, such as resource server URI.
Login hint token.
Logout request initiated by an OpenID relying party (RP).
Back-channel logout token claims set, serialisable to a JSON object.
Logout token claims verifier.
Validator of logout tokens issued by an OpenID Provider (OP).
Map utilities.
Marker interface for OAuth 2.0 authorisation framework messages.
Policy for a federation entity metadata.
Policy entry for a metadata parameter.
Minimal verification spec.
Mobile subscriber ISDN number.
Multi-valued map utilities.
Access token of type not applicable (N/A), intended for use in OAuth 2.0
token exchange scenarios.
Name.
Nonce.
Number configuration.
Standard OAuth 2.0 authorisation and token endpoint errors.
Occupation.
Specifies individual OpenID claims to return from the UserInfo endpoint and
/ or in the ID Token.
OpenID Connect client information.
OpenID Connect client information response.
OpenID Connect client metadata.
OpenID Connect client registration request.
Parser of OpenID Connect client registration response messages.
OpenID Connect client registration request.
OpenID Connect specific errors.
OpenID Provider (OP) configuration request.
OpenID Provider (OP) endpoint metadata.
OpenID Provider (OP) metadata.
OpenID Connect
id_token
response type value constant.Standard OpenID Connect scope value.
OpenID Connect token response from the Token endpoint.
Parser of OpenID Connect token endpoint response messages.
ID token, access token and optional refresh token.
One-of (one_of) operation.
Policy operation name.
Ordered JSON object.
Organisation.
Encoder and decoder of pairwise subject identifiers.
The requirement level for a parameter.
Parse exception.
Personal number.
Person-specific claims set, intended to provide common getters and setters
for
OpenID Connect UserInfo
and
OpenID Connect Identity Assurance verified claims
.Client X.509 certificate binding verifier.
PKI mutual TLS client authentication at the Token endpoint.
Base abstract class for plain secret based client authentication at the
Token endpoint.
Policy.
Marker interface for policy configurations.
Federation policy operation.
Utility for applying a policy operation to a metadata parameter value.
Validates the permitted combinations of known policy operations for a given
metadata parameter.
Policy operation factory.
Policy violation exception.
Private key JWT authentication at the Token endpoint.
Privilege.
Procedure.
Prompts for end-user re-authentication and consent.
Enumeration of the prompt types.
Base abstract class for protected resource requests using an OAuth 2.0
access token.
Pushed authorisation error response.
Pushed authorisation request (PAR).
Pushed authorisation response.
Pushed authorisation success response.
Deprecated.
Use
ElectronicSignatureEvidence
instead.Read-only OAuth 2.0 Authorisation Server (AS) endpoint metadata.
Read-only OAuth 2.0 Authorisation Server (AS) metadata.
Read-only HTTP message.
Read-only HTTP request.
Read-only HTTP response.
Read-only OpenID Provider (OP) endpoint metadata.
Read-only OpenID Provider (OP) metadata.
Redirection URI validator.
Reference number.
Refresh token.
Refresh token grant.
OAuth 2.0 client registration errors.
Request message, serialises to an HTTP request.
Deprecated.
Deprecated.
Deprecated.
Deprecated.
Resolve response claims set.
Resolve claims verifier.
Trust negotiation error response.
Resolve exception.
Resolve exception.
Resolve entity statement request.
Resolve entity statement response.
Resolve statement.
Resolve entity statement success response.
Resource owner password credentials grant.
Resource server URI utilities.
Response message, serialises to an HTTP response.
Authorisation response mode.
Authorisation response type.
Authorisation response type value.
Enumeration of the OAuth 2.0 roles.
SAML 2.0 bearer assertion details for OAuth 2.0 client authentication and
authorisation grants.
SAML 2.0 bearer assertion details verifier for OAuth 2.0 client
authentication and authorisation grants.
Static SAML 2.0 bearer assertion factory.
SAML 2.0 assertion validator.
SAML 2.0 bearer grant.
Authorisation scope.
Authorisation scope value.
Enumeration of the scope value requirements for
application-specific authorisation requests.
Secret.
Derives an AES secret key from a client secret.
Sector identifier.
Sector identifier URI validator.
Self-signed certificate mutual TLS client authentication at the Token
endpoint.
Serialization exception (unchecked).
Serial number.
HTTP Servlet utilities.
Session identifier.
Electronic signature type.
Simple date.
Single use checker interface.
SIV AES - based encoder / decoder of pairwise subject identifiers.
Identifier for an OAuth 2.0 client software.
SoftwareStatementProcessor<C extends com.nimbusds.jose.proc.SecurityContext>
Processor of software statements for client registrations.
Version identifier for an OAuth 2.0 client software.
The standard policy operations defined in OpenID Connect Federation 1.0.
Opaque value used to maintain state between a request and a callback.
State hash (
s_hash
).State validator, using the optional
s_hash
ID token claim.Status.
String configuration.
String list configuration.
String list operation.
String operation.
String utilities.
Subject (user) identifier.
Enumeration of the subject identifier types.
Subset-of (subset_of) operation.
Subtree entity ID constraint.
Response message indicating success.
Superset-of (superset_of) operation.
The base abstract class for mutual TLS client authentication at the Token
endpoint.
TLS / SSL utilities.
TLS version.
The base abstract class for access, refresh and other tokens.
Enumeration of the possible token encodings.
OAuth 2.0 Token error response.
OAuth 2.0 token exchange grant.
Token introspection error response.
Token introspection request.
Token introspection response.
Token introspection success response.
Builder for constructing token introspection success responses.
Token request.
Builder for constructing token requests.
Token endpoint response.
Token revocation request.
Access and optional refresh token.
The base abstract class for token scheme errors.
Token type URI.
Federation entity trust chain.
Trust chain constraints.
Trust chain resolver.
Trust chain
set with methods to get
the shortest chain
and filter the chains according to path
length and entity ID constraints
.Federation trust mark claims set, serialisable to a JSON object.
Trust mark entry.
Deprecated.
Trust mark status error response.
Trust mark status request.
Trust mark status response.
Trust mark status success response.
Transaction identifier.
Typeless access token, cannot be serialised.
Typeless (generic) token.
Untyped operation.
URI operations.
URL operations.
User code.
UserInfo claims set, serialisable to a JSON object.
UserInfo error response.
UserInfo request.
The base abstract class for UserInfo success and error responses.
UserInfo success response.
Deprecated.
Validation method establishing the authenticity of an evidence, such as a
document, electronic record, vouch, utility bill or electronic signature.
The type of method used to validate the authenticity of an evidence.
Values set (value) operation.
Verification method establishing a given user owns a set of provided claims.
The type of method used to verify that a person is the owner of a set of
claims.
Verification process identifier.
The
verification
sub-element within an OpenID Connect
request for verified claims
.Verified claims set.
Deprecated.
Use
VerifiedClaimsSetRequest
instead.OpenID Connect verified claims set request, intended to represent the
verified_claims
sub-element within a userinfo
or
id_token
element in a
claims
request
parameter.Voucher.
Vouch used as identity evidence.
Vouch type.
The strategy for composing a well-known URI path.
X.509 certificate SHA-256 confirmation.
X.509 certificate utilities.
PKIClientX509CertificateBindingVerifier