ClientRegistration class final

One client of one OAuth 2.0 or OpenID Connect provider: the client's id and secret there, the grant, the redirect URI, the scopes, and where the provider's endpoints are.

An application has one per provider it logs in with (keycloak, google) or calls APIs through. Usually they come from properties, and the ClientRegistrationRepository bean holds them:

spring.security.oauth2.client.registration.keycloak.client-id=neon-app
spring.security.oauth2.client.registration.keycloak.scope=openid,profile
spring.security.oauth2.client.registration.keycloak.redirect-uri=neonbooks:/oauth2/callback
spring.security.oauth2.client.provider.keycloak.issuer-uri=https://sso.example.com/realms/neon

Build one in code for a provider the properties cannot describe:

final registration = ClientRegistration.withRegistrationId('partner')
    .clientId('shop')
    .clientSecret(environment.getRequiredProperty('partner.secret'))
    .authorizationGrantType(AuthorizationGrantType.clientCredentials)
    .tokenUri('https://partner.example.com/oauth/token')
    .scope(['orders.read'])
    .build();

Spring (Java): ClientRegistration, with the same builder.

Properties

authorizationGrantType → AuthorizationGrantType
The grant: how tokens are obtained.
final
clientAuthenticationMethod → ClientAuthenticationMethod
How the client authenticates at the token endpoint.
final
clientId → String
The client's id at the provider.
final
clientName → String
A name to show users ("Log in with Google"); the registration id when not set.
final
clientSecret → String
The client's secret at the provider; empty for a public client (an app). A credential: never log it.
final
dpop → DPoPMode
Whether the tokens are DPoP-bound: DPoPMode.auto by default (when the provider announces it). Not in Spring (see DPoPMode).
final
hashCode → int
The hash code for this object.
no setterinherited
providerDetails → ProviderDetails
The provider's endpoints and metadata.
final
redirectUri → String?
The redirect URI template, such as {baseUrl}/{action}/oauth2/code/{registrationId} or neonbooks:/oauth2/callback; expandRedirectUri fills it in.
final
registrationId → String
The registration's id, such as keycloak: the <id> of the properties.
final
responseMode → ResponseMode
How the provider returns the authorization response: ResponseMode.query (the default of the code flow, a redirect with the code in the URI) or ResponseMode.formPost (the browser posts it to the redirect URI). Not in Spring (see ResponseMode).
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
scopes → Set<String>
The scopes asked for; cannot be modified.
final

Methods

noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toString() → String
A string representation of this object.
override
usesDPoP(DPoPKey key) → bool
Whether this registration uses DPoP with key: dpop decides; for DPoPMode.auto the key must outlive the program (DPoPKey.persistent: the apps' keys, not a server's key made in memory) and the provider's dpop_signing_alg_values_supported metadata must list its algorithm.

Operators

operator ==(Object other) → bool
The equality operator.
inherited

Static Methods

withClientRegistration(ClientRegistration registration) → ClientRegistrationBuilder
A builder holding everything of registration, to change some of it.
withRegistrationId(String registrationId) → ClientRegistrationBuilder
A builder for the registration registrationId.