Package software.amazon.awscdk.services.elasticloadbalancingv2

Interface AuthenticateOidcOptions

All Superinterfaces:

software.amazon.jsii.JsiiSerializable

All Known Implementing Classes:

AuthenticateOidcOptions.Jsii$Proxy

@Generated(value="jsii-pacmak/1.119.0 (build 1634eac)",
           date="2025-11-20T23:37:21.585Z")
@Stability(Stable)
public interface AuthenticateOidcOptions
extends software.amazon.jsii.JsiiSerializable

Options for ListenerAction.authenciateOidc().

Example:

 ApplicationListener listener;
 ApplicationTargetGroup myTargetGroup;
 listener.addAction("DefaultAction", AddApplicationActionProps.builder()
         .action(ListenerAction.authenticateOidc(AuthenticateOidcOptions.builder()
                 .authorizationEndpoint("https://example.com/openid")
                 // Other OIDC properties here
                 .clientId("...")
                 .clientSecret(SecretValue.secretsManager("..."))
                 .issuer("...")
                 .tokenEndpoint("...")
                 .userInfoEndpoint("...")
                 // Next
                 .next(ListenerAction.forward(List.of(myTargetGroup)))
                 .build()))
         .build());
 

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static final class	AuthenticateOidcOptions.Builder	A builder for AuthenticateOidcOptions
static final class	AuthenticateOidcOptions.Jsii$Proxy	An implementation for AuthenticateOidcOptions

Method Summary

Modifier and Type	Method	Description
static AuthenticateOidcOptions.Builder	builder()
default Boolean	getAllowHttpsOutbound()	Allow HTTPS outbound traffic to communicate with the IdP.
default Map<String,String>	getAuthenticationRequestExtraParams()	The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
String	getAuthorizationEndpoint()	The authorization endpoint of the IdP.
String	getClientId()	The OAuth 2.0 client identifier.
SecretValue	getClientSecret()	The OAuth 2.0 client secret.
String	getIssuer()	The OIDC issuer identifier of the IdP.
ListenerAction	getNext()	What action to execute next.
default UnauthenticatedAction	getOnUnauthenticatedRequest()	The behavior if the user is not authenticated.
default String	getScope()	The set of user claims to be requested from the IdP.
default String	getSessionCookieName()	The name of the cookie used to maintain session information.
default Duration	getSessionTimeout()	The maximum duration of the authentication session.
String	getTokenEndpoint()	The token endpoint of the IdP.
String	getUserInfoEndpoint()	The user info endpoint of the IdP.

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Method Details

getAuthorizationEndpoint

@Stability(Stable)
@NotNull
String getAuthorizationEndpoint()

The authorization endpoint of the IdP.

This must be a full URL, including the HTTPS protocol, the domain, and the path.

getClientId

@Stability(Stable)
@NotNull
String getClientId()

The OAuth 2.0 client identifier.

getClientSecret

@Stability(Stable)
@NotNull
SecretValue getClientSecret()

The OAuth 2.0 client secret.

getIssuer

@Stability(Stable)
@NotNull
String getIssuer()

The OIDC issuer identifier of the IdP.

This must be a full URL, including the HTTPS protocol, the domain, and the path.

getNext

@Stability(Stable)
@NotNull
ListenerAction getNext()

What action to execute next.

getTokenEndpoint

@Stability(Stable)
@NotNull
String getTokenEndpoint()

The token endpoint of the IdP.

This must be a full URL, including the HTTPS protocol, the domain, and the path.

getUserInfoEndpoint

@Stability(Stable)
@NotNull
String getUserInfoEndpoint()

The user info endpoint of the IdP.

This must be a full URL, including the HTTPS protocol, the domain, and the path.

getAllowHttpsOutbound

@Stability(Stable)
@Nullable
default Boolean getAllowHttpsOutbound()

Allow HTTPS outbound traffic to communicate with the IdP.

Set this property to false if the IP address used for the IdP endpoint is identifiable and you want to control outbound traffic. Then allow HTTPS outbound traffic to the IdP's IP address using the listener's connections property.

Default: true

See Also:

• https://repost.aws/knowledge-center/elb-configure-authentication-alb

getAuthenticationRequestExtraParams

@Stability(Stable)
@Nullable
default Map<String,String> getAuthenticationRequestExtraParams()

The query parameters (up to 10) to include in the redirect request to the authorization endpoint.

Default: - No extra parameters

getOnUnauthenticatedRequest

@Stability(Stable)
@Nullable
default UnauthenticatedAction getOnUnauthenticatedRequest()

The behavior if the user is not authenticated.

Default: UnauthenticatedAction.AUTHENTICATE

getScope

@Stability(Stable)
@Nullable
default String getScope()

The set of user claims to be requested from the IdP.

To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.

Default: "openid"

getSessionCookieName

@Stability(Stable)
@Nullable
default String getSessionCookieName()

The name of the cookie used to maintain session information.

Default: "AWSELBAuthSessionCookie"

getSessionTimeout

@Stability(Stable)
@Nullable
default Duration getSessionTimeout()

The maximum duration of the authentication session.

Default: Duration.days(7)

builder

@Stability(Stable)
static AuthenticateOidcOptions.Builder builder()

Returns:

a AuthenticateOidcOptions.Builder of AuthenticateOidcOptions