Syntax
oauth2Resource2:
'$ref': <string>
afterErrorUrl: <string>
afterLogoutUrl: <string>
appendAccessTokenToRequest: <boolean>
callbackPath: <string>
cookieOriginalExchangeStore: {}
customHeaderUserPropertyPrefix: <string>
github: {}
google: {}
inMemorySessionManager2: {}
jwtSessionManager: {}
loginParameters:
- <loginParameter>
logoutUrl: <string>
membrane: {}
memcachedOriginalExchangeStore: {}
memcachedSessionManager: {}
microsoftEntraID: {}
onlyRefreshToken: <boolean>
publicURL: <string>
redisOriginalExchangeStore: {}
redisSessionManager: {}
revalidateTokenAfter: <int>
sessionOriginalExchangeStore: {}
skipUserInfo: <boolean>
oauth2Resource2:
'$ref': <string>
afterErrorUrl: <string>
afterLogoutUrl: <string>
appendAccessTokenToRequest: <boolean>
callbackPath: <string>
cookieOriginalExchangeStore: {}
customHeaderUserPropertyPrefix: <string>
github: {}
google: {}
inMemorySessionManager2: {}
jwtSessionManager: {}
loginParameters:
- <loginParameter>
logoutUrl: <string>
membrane: {}
memcachedOriginalExchangeStore: {}
memcachedSessionManager: {}
microsoftEntraID: {}
onlyRefreshToken: <boolean>
publicURL: <string>
redisOriginalExchangeStore: {}
redisSessionManager: {}
revalidateTokenAfter: <int>
sessionOriginalExchangeStore: {}
skipUserInfo: <boolean>
Attributes
| Name | Required | Default | Description | Examples |
|---|---|---|---|---|
| $ref | false | - | Reference a component defined under components. | - |
| afterErrorUrl | false | - | URL a form POST carrying the error and error_description of a failed OAuth2 flow is sent to. Without it, the error response of the flow itself is returned to the client. | - |
| afterLogoutUrl | false | / | URL the user is redirected to after a logout request. | - |
| appendAccessTokenToRequest | false | false | Whether the access token from the OAuth2 answer is added to the forwarded request as an Authorization: Bearer header. | - |
| callbackPath | false | oauth2callback | the path used for the OAuth2 callback. ensure that it does not collide with any path used by the application | - |
| customHeaderUserPropertyPrefix | false | null | A user property prefix (e.g. "header"), which can be used to make the interceptor emit custom per-user headers. For example, if you have a user property "headerX: Y" on a user U, and the user U logs in, all requests belonging to this user will have an additional HTTP header "X: Y". If null, this feature is disabled. | - |
| logoutUrl | false | - | Path (as seen by the user agent) to call to trigger a log out. If the Authorization Server supports OpenID Connect RP-Initiated Logout 1.0, the user logout ("single log out") will be triggered there as well. | - |
| onlyRefreshToken | false | false | Whether a token response without an access_token is accepted. When enabled, the id token is verified in place of the access token and a refresh that returns only one of both tokens does not fail. Requires skipUserInfo to also be set. | - |
| revalidateTokenAfter | false | -1 | time in seconds until a oauth2 access token is revalidatet with authorization server. This is disabled for values < 0 | - |
| skipUserInfo | false | false | Whether the call to the userinfo endpoint is skipped when authorizing the session. When enabled, the access token is assumed to be a JWT and is verified locally instead. Required when onlyRefreshToken is enabled. | - |
Child Structure
| Element | Cardinality | Description |
|---|---|---|
| cookieOriginalExchangeStore | 0..1 | |
| github | 0..1 | |
| 0..1 | ||
| inMemorySessionManager2 | 0..1 | |
| jwtSessionManager | 0..1 | |
| loginParameter | 0..* | Parameters appended to the authorization request sent to the identity provider. A loginParameter with a value contributes that constant, one without forwards the incoming request's query parameter of the same name, if it is present. |
| membrane | 0..1 | |
| memcachedOriginalExchangeStore | 0..1 | |
| memcachedSessionManager | 0..1 | |
| microsoftEntraID | 0..1 | |
| publicURL | 0..1 | |
| redisOriginalExchangeStore | 0..1 | Used for storing exchanges temporarily in Redis. Supports authentication with or without password and username |
| redisSessionManager | 0..1 | |
| sessionOriginalExchangeStore | 0..1 |