All Classes and Interfaces
Class
Description
Accepted signed logout identity; only hashes, never the token or raw issuer/client/sid/jti.
Protected, in-process authorization-code flow above the eventless application-session Models.
Explicit access belongs only to the protected cookie/redirect adapter, never ordinary serialization.
Tokens remain server-side. csrf may be exposed only to the authenticated same-origin browser.
A consumed, denied or invalid login requires a fresh attempt; dependency failures are separate.
Local application logout and session-required back-channel logout.
Invalid logout evidence; contains no token, identifier or dependency failure details.
Protected session access, with single-owner token refresh and no authorization decisions.
In-process credential access, never a browser DTO or ordinary message.
A 256-bit opaque browser capability.
Cookie/CSRF policy shared by application BFFs; it never establishes identity or authorization.
AES-256-GCM session protection with a lazily supplied, application-scoped key ring.
Reusable application-session lifecycle, independent of IDP management, tenants and user mapping.
Spring Boot entry point.
Optional application HTTP integration.
Import this configuration in plain Spring; Spring Boot discovers it automatically.
Resolves browser requests through the registered
OidcIntegration.Claims from the validated ID token in the encrypted session; never implied application roles.
A hashed issuer/client/sid binding, including a terminal logout fence; never an identity session.
In-process value only.
The session mutation did not report a confirmed commit.
Local deterministic transitions only.
Replay identity and exact RP fence share one commit; external verification already completed.
Workload-owned authenticated encryption.
Only authenticated ciphertext and a non-secret key version may enter either Model document.
Fail-closed custody failure; no provider message, plaintext or key detail escapes this boundary.
Another request owns refresh.