You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# see https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes#configuring-automatically-generated-release-notes
Copy file name to clipboardExpand all lines: README.md
+45-25Lines changed: 45 additions & 25 deletions
Original file line number
Diff line number
Diff line change
@@ -17,40 +17,60 @@ support for [PKCE](https://datatracker.ietf.org/doc/html/rfc8252#section-8.1) an
17
17
18
18
## Usage
19
19
20
-
Configure your authorization server to allow `http://127.0.0.1/*` as a redirect target and look up these configuration values:
20
+
This library requires an instance of [`java.net.http.HttpClient`](https://docs.oracle.com/en/java/javase/21/docs/api/java.net.http/java/net/http/HttpClient.html).
21
21
22
-
* client identifier
23
-
* token endpoint
24
-
* authorization endpoint
22
+
```java
23
+
// usually the default is sufficent:
24
+
var httpClient =HttpClient.newHttpClient();
25
+
26
+
// but feel free to adjust it to your needs, e.g. by applying custom proxy settings:
// from this point onwards, please proceed with the JSON/JWT parser of your choice:
35
-
if (httpResponse.statusCode() ==200) {
36
-
var jsonString = httpResponse.body()
37
-
var bearerToken = parseJson(jsonString).get("access_token");
38
-
// ...
39
-
}
41
+
Next, continue with a specific grant type by invoking `.authorizationCodeGrant(...)` or `.clientCredentialsGrant(...)` (more may be added eventually).
42
+
43
+
### Authorization Code Grant
44
+
Usually, you would want to use the [Authorization Code Grant](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1) type to obtain access tokens.
45
+
Configure your Authorization Server to allow `http://127.0.0.1/*` as a redirect target and look up the authorization endpoint:
46
+
47
+
```java
48
+
// this library will just perform the Authorization Flow:
49
+
var httpResponse = oauthClient.authorizationCodeGrant(URI.create("https://login.example.com/oauth2/authorize"))
50
+
.authorize(httpClient, uri ->System.out.println("Please login on "+ uri), "openid", "profile"); // optionally add scopes here);
40
51
```
41
52
42
-
If you wish to use a proxy or your own set of root certificates, provide your own JDK [http client](https://docs.oracle.com/en/java/javase/11/docs/api/java.net.http/java/net/http/HttpClient.html):
53
+
If your authorization server doesn't allow wildcards, you can also configure a fixed path (and even port) via e.g. `setRedirectPath("/callback")` and `setRedirectPorts(8080)` before calling `authorize(...)`.
54
+
55
+
### Client Credentials Grant
56
+
Alternatively, if your client shall act on behalf of a service account, use the [Client Credentials Grant](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4) type,
57
+
which allows the client to authenticate directly without further user interaction:
.authorize(httpClient, uri ->System.out.println("Please login on "+ uri));
60
+
var httpResponse = oauthClient.clientCredentialsGrant(UTF_8, "client secret")
61
+
.authorize(httpClient, "openid", "profile"); // optionally add scopes here
51
62
```
52
63
53
-
If your authorization server doesn't allow wildcards, you can also configure a fixed path (and even port) via e.g. `setRedirectPath("/callback")` and `setRedirectPorts(8080)`.
64
+
### Parsing the Response
65
+
For maximum flexibility and minimal attack surface, this library does not include or depend on a specific parser. Instead, use a JSON or JWT parser of your choice to parse the Authorization Server's response:
66
+
67
+
```java
68
+
if (httpResponse.statusCode() ==200) {
69
+
var jsonString = httpResponse.body()
70
+
var bearerToken = parseJson(jsonString).get("access_token");
0 commit comments