Class OidcClient

java.lang.Object
io.fluxzero.idp.client.OidcClient
public class OidcClient extends Object
Small OIDC client for authorization-code-with-PKCE application flows.

This client deliberately stops at protocol mechanics: building the authorization URL, exchanging a code for tokens and constructing a logout URL. It does not create application sessions, write cookies or map users. Fluxzero applications should keep that BFF responsibility in their own backend code so domain-specific user provisioning and roles stay close to the customer model.

  • Constructor Details

    • OidcClient

      public OidcClient(OidcTenantConfig config)
      Creates a client that discovers OIDC endpoints from the configured issuer.
      Parameters:
      config - tenant configuration for this application

    • OidcClient

      public OidcClient(OidcTenantConfig config, OidcDiscoveryDocument discovery)
      Creates a client with already discovered metadata.

      This constructor is useful for tests that want deterministic metadata without making a discovery HTTP request.

      Parameters:
      config - tenant configuration for this application
      discovery - resolved OIDC discovery document

  • Method Details

    • authorizationUrl

      public String authorizationUrl(Pkce pkce, String state)
      Builds the authorization endpoint URL for authorization-code flow with PKCE S256.
      Parameters:
      pkce - verifier/challenge pair for this login attempt
      state - CSRF correlation value stored by the application
      Returns:
      redirect URL for the user's browser

    • authorizationUrl

      public String authorizationUrl(OidcLoginState loginState)
      Builds the authorization endpoint URL from a stateless login transaction.
      Parameters:
      loginState - BFF login transaction with state and PKCE verifier
      Returns:
      redirect URL for the user's browser

    • exchangeCode

      public OidcClient.TokenResponse exchangeCode(String code, String codeVerifier)
      Exchanges an authorization code for ID and access tokens.
      Parameters:
      code - authorization code received on the application callback
      codeVerifier - PKCE verifier stored with the pending login
      Returns:
      token response from the tenant

    • endSessionUrl

      public String endSessionUrl(String postLogoutRedirectUri)
      Builds a tenant logout URL when the issuer advertises one.
      Parameters:
      postLogoutRedirectUri - application URL to return to after logout
      Returns:
      logout URL or the redirect URI when no logout endpoint is advertised

    • endSessionUrl

      public String endSessionUrl(String postLogoutRedirectUri, String idTokenHint)
      Builds a tenant logout URL with an optional ID token hint.
      Parameters:
      postLogoutRedirectUri - application URL to return to after logout
      idTokenHint - ID token for the session being closed
      Returns:
      logout URL or the redirect URI when no logout endpoint is advertised

    • config

      public OidcTenantConfig config()

    • discovery

      public OidcDiscoveryDocument discovery()