@finnairoyj/cdk-constructs-lib - v0.2.3
    Preparing search index...

    Interface OAuthOptions

    interface OAuthOptions {
        appDomainName: string;
        audience?: string[];
        authErrorPageUri?: string;
        clientId: string;
        domainHint?: string;
        issuer?: string[];
        logoutRedirectUri?: string;
        publicPathPrefixes?: string[];
        scopes: string[];
        sessionValidity: number;
        wellKnownUri: string;
    }
    Index

    Properties

    appDomainName audience? authErrorPageUri? clientId domainHint? issuer? logoutRedirectUri? publicPathPrefixes? scopes sessionValidity wellKnownUri

    Properties

    appDomainName: string

    Application domain name

    audience?: string[]

    Expected audience (aud) claim values for access_token validation. This may need to be configured if multiple audience values need to be supported, or if the IDP is returning a value that doesn't match the default. Providing this value will extend the default behavior: the clientId property is always an accepted aud claim value

    ${clientId} -- MS Entra ID OAuth v2 token aud claim matches the clientId property

    authErrorPageUri?: string

    URI to redirect to after authorization failure. The URI must be registered to the IDP as an allowed redirect URI. The URI must also be a public and require no authorization for it to work. If not defined, a generic error will be displayed by the IDP

    'https://app.example.com/public/auth-error.html'
    clientId: string

    The clientId passed to the IDP in the client_id property and is validated against the 'audience' (aud) claim of the JWT tokens. For example for EntraId, the clientId should be the Enterprise App ID related to this OIDC configuration

    domainHint?: string

    Providing a domain hint bypasses the email-based Home Realm Discovery (HRD) dialog during IDP authentication. This accelerates the UX for users that have multiple active logins, for example for MS EntraID

    'finnair.com'
    issuer?: string[]

    The issuer (iss) claim value(s) provided by the IDP for the access_token. Passing this value extends the info read from the .well-known endpoint. This may be required for example for EntraID which uses different issuer for the access_token

    `https://sts.windows.net/${tenantId}/` for MS Entra ID

    Issuer provided by the IDP's well-known endpoint
    logoutRedirectUri?: string

    URI to redirect the user after IDP logout. The logout URI must be registered to the IDP. If no redirect after logout is desired, set this to an empty string ''. In this case the user will be displayed a generic message by the IDP

    'https://app.example.com/' to redirect to the login page

    'https://app.example.com/public/logout.html' to redirect to static logout page
    publicPathPrefixes?: string[]

    List of URI path prefix for paths that bypass authentication. Set to empty array [] to require auth for all paths. Use for example for static error pages. The path entry must start and end with / character

    ['/public/']

    [] Authentication is required for all paths
    scopes: string[]

    OAuth 2.0 scopes to request from the IDP

    sessionValidity: number

    Max session validity to use for refresh token. This should match to the session validity set by the IDP in order to avoid refresh token errors from IDP. The sessionValidity should also be loner than the validity of the access_token set by the IDP

    86400 seconds
    wellKnownUri: string

    The well-known data endpoint for the IDP

    `https://login.microsoftonline.com/${tenantId}/v2.0/.well-known/openid-configuration` for MS Entra ID

    Settings

    Member Visibility

    On This Page

    Properties