...
tokenEndpointUri
: OAuth issuer token endpoint URIclientId
: supports OAuthclientcredentials
grant typeclientSecret
: supports OAuth'sclientcredentials
grantscope
: optional scope to reference in the call to the OAuth serverscopeClaimName
: optional override name of the scope claim; defaults toscope
subClaimName
: optional override name of the sub claim; defaults toscope
sub
loginConnectTimeoutMs
: optional value in milliseconds for HTTPS connect timeout; defaults to10000
loginReadTimeoutMs
: optional value in milliseconds for HTTPS read timeout; defaults to10000
loginAttempts
: optional number of attempts to make to connect to the OAuth/OIDC identity provider; defaults to3
loginRetryWaitMs
: optional value in milliseconds for the amount of time to wait between HTTPS call attempts; defaults to 250loginRetryMaxWaitMs
: optional value in milliseconds for the maximum wait between HTTPS call attempts (as described above); defaults to10000
...
jwksEndpointUri
: OAuth issuer's JWK Set endpoint URI from which to retrieve the set of JWKs managed by the provider; mutually exclusive withjwksFile
jwksEndpointRefreshIntervalMs
: optional value in milliseconds for how often to refresh the JWKS from the URL pointed to byjwksEndpointUri
. Only used when usingjwksEndpointUri
. Defaults to3600000
(1 hour)jwksFile
: specifies a locally-accessible file name that holds a file-based copy of the JWKS data. This allows the JWKS data to be updated on the file system and refreshed on the broker when the file is updated, thus avoiding any HTTP communication with the OAuth/OIDC provider; mutually exclusive withjwksEndpointUri
subClaimName
: name of the scope from which to extract the subject claim from the JWT; defaults to subtosub
scopeClaimName
: name of the scope from which to extract the scope claim from the JWT; defaults to scopetoscope
clockSkew
: optional value in seconds for the clock skew between the OAuth/OIDC provider and the broker. Only used when usingjwksEndpointUri
. Defaults to30
expectedAudience
: The (optional) comma-delimited setting for the broker to use to verify that the JWT was issued for one of the expected audiences. The JWT will be inspected for the standard OAuthaud
claim and if this configuration option is set, the broker will match the value from JWT'saud
claim to see if there is an exact match. If there is no match, the broker will reject the JWT and authentication will fail.expectedIssuer
: Optional setting for the broker to use to verify that the JWT was created by the expected issuer. The JWT will be inspected for the standard OAuthiss
claim and if this configuration option is set, the broker will match the value from JWT'siss
claim to see if there is an exact match. If there is no match, the broker will reject the JWT and authentication will fail.
...