001/* 002 * oauth2-oidc-sdk 003 * 004 * Copyright 2012-2021, Connect2id Ltd and contributors. 005 * 006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use 007 * this file except in compliance with the License. You may obtain a copy of the 008 * License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software distributed 013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR 014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the 015 * specific language governing permissions and limitations under the License. 016 */ 017 018package com.nimbusds.oauth2.sdk.as; 019 020 021import java.net.URI; 022import java.util.List; 023 024import net.minidev.json.JSONObject; 025 026import com.nimbusds.jose.EncryptionMethod; 027import com.nimbusds.jose.JWEAlgorithm; 028import com.nimbusds.jose.JWSAlgorithm; 029import com.nimbusds.langtag.LangTag; 030import com.nimbusds.oauth2.sdk.GrantType; 031import com.nimbusds.oauth2.sdk.ResponseMode; 032import com.nimbusds.oauth2.sdk.ResponseType; 033import com.nimbusds.oauth2.sdk.Scope; 034import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod; 035import com.nimbusds.oauth2.sdk.ciba.BackChannelTokenDeliveryMode; 036import com.nimbusds.oauth2.sdk.client.ClientType; 037import com.nimbusds.oauth2.sdk.id.Issuer; 038import com.nimbusds.oauth2.sdk.pkce.CodeChallengeMethod; 039 040 041/** 042 * Read-only OAuth 2.0 Authorisation Server (AS) metadata. 043 * 044 * <p>Related specifications: 045 * 046 * <ul> 047 * <li>OAuth 2.0 Authorization Server Metadata (RFC 8414) 048 * <li>OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound 049 * Access Tokens (RFC 8705) 050 * <li>OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer 051 * (DPoP) (draft-ietf-oauth-dpop-02) 052 * <li>Financial-grade API: JWT Secured Authorization Response Mode for 053 * OAuth 2.0 (JARM) 054 * <li>OAuth 2.0 Authorization Server Issuer Identifier in Authorization 055 * Response (draft-ietf-oauth-iss-auth-resp-00) 056 * <li>Financial-grade API - Part 2: Read and Write API Security Profile 057 * <li>OAuth 2.0 Pushed Authorization Requests (RFC 9126) 058 * <li>OAuth 2.0 Device Authorization Grant (RFC 8628) 059 * <li>OpenID Connect Client Initiated Backchannel Authentication Flow - 060 * Core 1.0 (draft 03) 061 * <li>OAuth 2.0 Incremental Authorization 062 * (draft-ietf-oauth-incremental-authz-04) 063 * </ul> 064 */ 065public interface ReadOnlyAuthorizationServerMetadata extends ReadOnlyAuthorizationServerEndpointMetadata { 066 067 068 /** 069 * Gets the issuer identifier. Corresponds to the {@code issuer} 070 * metadata field. 071 * 072 * @return The issuer identifier. 073 */ 074 Issuer getIssuer(); 075 076 077 /** 078 * Gets the JSON Web Key (JWK) set URI. Corresponds to the 079 * {@code jwks_uri} metadata field. 080 * 081 * @return The JWK set URI, {@code null} if not specified. 082 */ 083 URI getJWKSetURI(); 084 085 086 /** 087 * Gets the supported scope values. Corresponds to the 088 * {@code scopes_supported} metadata field. 089 * 090 * @return The supported scope values, {@code null} if not specified. 091 */ 092 Scope getScopes(); 093 094 095 /** 096 * Gets the supported response type values. Corresponds to the 097 * {@code response_types_supported} metadata field. 098 * 099 * @return The supported response type values, {@code null} if not 100 * specified. 101 */ 102 List<ResponseType> getResponseTypes(); 103 104 105 /** 106 * Gets the supported response mode values. Corresponds to the 107 * {@code response_modes_supported}. 108 * 109 * @return The supported response mode values, {@code null} if not 110 * specified. 111 */ 112 List<ResponseMode> getResponseModes(); 113 114 115 /** 116 * Gets the supported OAuth 2.0 grant types. Corresponds to the 117 * {@code grant_types_supported} metadata field. 118 * 119 * @return The supported grant types, {@code null} if not specified. 120 */ 121 List<GrantType> getGrantTypes(); 122 123 124 /** 125 * Gets the supported authorisation code challenge methods for PKCE. 126 * Corresponds to the {@code code_challenge_methods_supported} metadata 127 * field. 128 * 129 * @return The supported code challenge methods, {@code null} if not 130 * specified. 131 */ 132 List<CodeChallengeMethod> getCodeChallengeMethods(); 133 134 135 /** 136 * Gets the supported token endpoint authentication methods. 137 * Corresponds to the {@code token_endpoint_auth_methods_supported} 138 * metadata field. 139 * 140 * @return The supported token endpoint authentication methods, 141 * {@code null} if not specified. 142 */ 143 List<ClientAuthenticationMethod> getTokenEndpointAuthMethods(); 144 145 146 /** 147 * Gets the supported JWS algorithms for the {@code private_key_jwt} 148 * and {@code client_secret_jwt} token endpoint authentication methods. 149 * Corresponds to the 150 * {@code token_endpoint_auth_signing_alg_values_supported} metadata 151 * field. 152 * 153 * @return The supported JWS algorithms, {@code null} if not specified. 154 */ 155 List<JWSAlgorithm> getTokenEndpointJWSAlgs(); 156 157 158 /** 159 * Gets the supported introspection endpoint authentication methods. 160 * Corresponds to the 161 * {@code introspection_endpoint_auth_methods_supported} metadata 162 * field. 163 * 164 * @return The supported introspection endpoint authentication methods, 165 * {@code null} if not specified. 166 */ 167 List<ClientAuthenticationMethod> getIntrospectionEndpointAuthMethods(); 168 169 170 /** 171 * Gets the supported JWS algorithms for the {@code private_key_jwt} 172 * and {@code client_secret_jwt} introspection endpoint authentication 173 * methods. Corresponds to the 174 * {@code introspection_endpoint_auth_signing_alg_values_supported} 175 * metadata field. 176 * 177 * @return The supported JWS algorithms, {@code null} if not specified. 178 */ 179 List<JWSAlgorithm> getIntrospectionEndpointJWSAlgs(); 180 181 182 /** 183 * Gets the supported revocation endpoint authentication methods. 184 * Corresponds to the 185 * {@code revocation_endpoint_auth_methods_supported} metadata field. 186 * 187 * @return The supported revocation endpoint authentication methods, 188 * {@code null} if not specified. 189 */ 190 List<ClientAuthenticationMethod> getRevocationEndpointAuthMethods(); 191 192 193 /** 194 * Gets the supported JWS algorithms for the {@code private_key_jwt} 195 * and {@code client_secret_jwt} revocation endpoint authentication 196 * methods. Corresponds to the 197 * {@code revocation_endpoint_auth_signing_alg_values_supported} 198 * metadata field. 199 * 200 * @return The supported JWS algorithms, {@code null} if not specified. 201 */ 202 List<JWSAlgorithm> getRevocationEndpointJWSAlgs(); 203 204 205 /** 206 * Gets the supported JWS algorithms for request objects. Corresponds 207 * to the {@code request_object_signing_alg_values_supported} metadata 208 * field. 209 * 210 * @return The supported JWS algorithms, {@code null} if not specified. 211 */ 212 List<JWSAlgorithm> getRequestObjectJWSAlgs(); 213 214 215 /** 216 * Gets the supported JWE algorithms for request objects. Corresponds 217 * to the {@code request_object_encryption_alg_values_supported} 218 * metadata field. 219 * 220 * @return The supported JWE algorithms, {@code null} if not specified. 221 */ 222 List<JWEAlgorithm> getRequestObjectJWEAlgs(); 223 224 225 /** 226 * Gets the supported encryption methods for request objects. 227 * Corresponds to the 228 * {@code request_object_encryption_enc_values_supported} metadata 229 * field. 230 * 231 * @return The supported encryption methods, {@code null} if not 232 * specified. 233 */ 234 List<EncryptionMethod> getRequestObjectJWEEncs(); 235 236 237 /** 238 * Gets the support for the {@code request} authorisation request 239 * parameter. Corresponds to the {@code request_parameter_supported} 240 * metadata field. 241 * 242 * @return {@code true} if the {@code reqeust} parameter is supported, 243 * else {@code false}. 244 */ 245 boolean supportsRequestParam(); 246 247 248 /** 249 * Gets the support for the {@code request_uri} authorisation request 250 * parameter. Corresponds to the 251 * {@code request_uri_parameter_supported} metadata field. 252 * 253 * @return {@code true} if the {@code request_uri} parameter is 254 * supported, else {@code false}. 255 */ 256 boolean supportsRequestURIParam(); 257 258 259 /** 260 * Gets the requirement for the {@code request_uri} parameter 261 * pre-registration. Corresponds to the 262 * {@code require_request_uri_registration} metadata field. 263 * 264 * @return {@code true} if the {@code request_uri} parameter values 265 * must be pre-registered, else {@code false}. 266 */ 267 boolean requiresRequestURIRegistration(); 268 269 270 /** 271 * Gets the support for the {@code iss} authorisation response 272 * parameter. Corresponds to the 273 * {@code authorization_response_iss_parameter_supported} metadata 274 * field. 275 * 276 * @return {@code true} if the {@code iss} authorisation response 277 * parameter is provided, else {@code false}. 278 */ 279 boolean supportsAuthorizationResponseIssuerParam(); 280 281 282 /** 283 * Gets the supported UI locales. Corresponds to the 284 * {@code ui_locales_supported} metadata field. 285 * 286 * @return The supported UI locales, {@code null} if not specified. 287 */ 288 List<LangTag> getUILocales(); 289 290 291 /** 292 * Gets the service documentation URI. Corresponds to the 293 * {@code service_documentation} metadata field. 294 * 295 * @return The service documentation URI, {@code null} if not 296 * specified. 297 */ 298 URI getServiceDocsURI(); 299 300 301 /** 302 * Gets the provider's policy regarding relying party use of data. 303 * Corresponds to the {@code op_policy_uri} metadata field. 304 * 305 * @return The policy URI, {@code null} if not specified. 306 */ 307 URI getPolicyURI(); 308 309 310 /** 311 * Gets the provider's terms of service. Corresponds to the 312 * {@code op_tos_uri} metadata field. 313 * 314 * @return The terms of service URI, {@code null} if not specified. 315 */ 316 URI getTermsOfServiceURI(); 317 318 319 /** 320 * Gets the aliases for communication with mutual TLS. Corresponds to 321 * the {@code mtls_endpoint_aliases} metadata field. 322 * 323 * @return The aliases for communication with mutual TLS, {@code null} 324 * when no aliases are defined. 325 */ 326 ReadOnlyAuthorizationServerEndpointMetadata getReadOnlyMtlsEndpointAliases(); 327 328 329 /** 330 * Gets the support for TLS client certificate bound access tokens. 331 * Corresponds to the 332 * {@code tls_client_certificate_bound_access_tokens} metadata field. 333 * 334 * @return {@code true} if TLS client certificate bound access tokens 335 * are supported, else {@code false}. 336 */ 337 boolean supportsTLSClientCertificateBoundAccessTokens(); 338 339 340 /** 341 * Gets the support for TLS client certificate bound access tokens. 342 * Corresponds to the 343 * {@code tls_client_certificate_bound_access_tokens} metadata field. 344 * 345 * @return {@code true} if TLS client certificate bound access tokens 346 * are supported, else {@code false}. 347 */ 348 @Deprecated 349 boolean supportsMutualTLSSenderConstrainedAccessTokens(); 350 351 352 /** 353 * Gets the supported JWS algorithms for Demonstrating 354 * Proof-of-Possession at the Application Layer (DPoP). Corresponds to 355 * the "dpop_signing_alg_values_supported" metadata field. 356 * 357 * @return The supported JWS algorithms for DPoP, {@code null} if none. 358 */ 359 List<JWSAlgorithm> getDPoPJWSAlgs(); 360 361 362 /** 363 * Gets the supported JWS algorithms for JWT-encoded authorisation 364 * responses. Corresponds to the 365 * {@code authorization_signing_alg_values_supported} metadata field. 366 * 367 * @return The supported JWS algorithms, {@code null} if not specified. 368 */ 369 List<JWSAlgorithm> getAuthorizationJWSAlgs(); 370 371 372 /** 373 * Gets the supported JWE algorithms for JWT-encoded authorisation 374 * responses. Corresponds to the 375 * {@code authorization_encryption_alg_values_supported} metadata 376 * field. 377 * 378 * @return The supported JWE algorithms, {@code null} if not specified. 379 */ 380 List<JWEAlgorithm> getAuthorizationJWEAlgs(); 381 382 383 /** 384 * Gets the supported encryption methods for JWT-encoded authorisation 385 * responses. Corresponds to the 386 * {@code authorization_encryption_enc_values_supported} metadata 387 * field. 388 * 389 * @return The supported encryption methods, {@code null} if not 390 * specified. 391 */ 392 List<EncryptionMethod> getAuthorizationJWEEncs(); 393 394 395 /** 396 * Gets the requirement for pushed authorisation requests (PAR). 397 * Corresponds to the {@code pushed_authorization_request_endpoint} 398 * metadata field. 399 * 400 * @return {@code true} if PAR is required, else {@code false}. 401 */ 402 boolean requiresPushedAuthorizationRequests(); 403 404 405 /** 406 * Gets the supported OAuth 2.0 client types for incremental 407 * authorisation. Corresponds to the 408 * {@code incremental_authz_types_supported} metadata field. 409 * 410 * @return The supported client types for incremental authorisation, 411 * {@code null} if not specified. 412 */ 413 List<ClientType> getIncrementalAuthorizationTypes(); 414 415 416 /** 417 * Gets the supported CIBA token delivery modes. Corresponds to the 418 * {@code backchannel_token_delivery_modes_supported} metadata field. 419 * 420 * @return The CIBA token delivery modes, {@code null} if not 421 * specified. 422 */ 423 List<BackChannelTokenDeliveryMode> getBackChannelTokenDeliveryModes(); 424 425 426 /** 427 * Gets the supported JWS algorithms for CIBA requests. Corresponds to 428 * the {@code backchannel_authentication_request_signing_alg_values_supported} 429 * metadata field. 430 * 431 * @return The supported JWS algorithms, {@code null} if not specified. 432 */ 433 List<JWSAlgorithm> getBackChannelAuthenticationRequestJWSAlgs(); 434 435 436 /** 437 * Gets the support for the {@code user_code} CIBA request parameter. 438 * Corresponds to the {@code backchannel_user_code_parameter_supported} 439 * metadata field. 440 * 441 * @return {@code true} if the {@code user_code} parameter is 442 * supported, else {@code false}. 443 */ 444 boolean supportsBackChannelUserCodeParam(); 445 446 447 /** 448 * Gets the specified custom (not registered) parameter. 449 * 450 * @param name The parameter name. Must not be {@code null}. 451 * @return The parameter value, {@code null} if not specified. 452 */ 453 Object getCustomParameter(String name); 454 455 456 /** 457 * Gets the specified custom (not registered) URI parameter. 458 * 459 * @param name The parameter name. Must not be {@code null}. 460 * @return The parameter URI value, {@code null} if not specified. 461 */ 462 URI getCustomURIParameter(String name); 463 464 465 /** 466 * Gets the custom (not registered) parameters. 467 * 468 * @return The custom parameters, empty JSON object if none. 469 */ 470 JSONObject getCustomParameters(); 471 472 473 /** 474 * Returns the JSON object representation of the metadata. 475 * 476 * @return The JSON object representation. 477 */ 478 JSONObject toJSONObject(); 479}