Package ai.vectros.resources.auth.requests

Interface IssuerRequest._FinalStage

All Known Implementing Classes:
IssuerRequest.Builder
Enclosing class:
IssuerRequest
public static interface IssuerRequest._FinalStage

  • Method Details

    • build

      IssuerRequest build()

    • additionalProperty

      IssuerRequest._FinalStage additionalProperty(String key, Object value)

    • additionalProperties

      IssuerRequest._FinalStage additionalProperties(Map<String,Object> additionalProperties)

    • subClaim

      IssuerRequest._FinalStage subClaim(Optional<String> subClaim)

      The claim in the IdP's token that carries the subject identifier. Defaults to sub if omitted.

    • subClaim

      IssuerRequest._FinalStage subClaim(String subClaim)

    • emailClaim

      IssuerRequest._FinalStage emailClaim(Optional<String> emailClaim)

      The claim in the IdP's token that carries the subject's email, used for first-login invite matching. Defaults to email if omitted.

    • emailClaim

      IssuerRequest._FinalStage emailClaim(String emailClaim)

    • userinfoUri

      IssuerRequest._FinalStage userinfoUri(Optional<String> userinfoUri)

      The IdP's OIDC userinfo endpoint. Optional. Presented tokens are access tokens, which under OIDC don't carry email unless the IdP was specifically configured to add it — if emailClaim misses on the presented token, and userinfoUri is configured, Vectros falls back to calling this endpoint (with the presented token as the bearer credential) and reads emailClaim from its JSON response instead. Omit to leave the fallback disabled — a token that doesn't carry the configured email claim then fails first-login exactly as it does today.

    • userinfoUri

      IssuerRequest._FinalStage userinfoUri(String userinfoUri)

    • selfSignupPolicies

      IssuerRequest._FinalStage selfSignupPolicies(Optional<List<SelfSignupPolicy>> selfSignupPolicies)

      Opt-in self-service signup: a list of {signup_type, role_id} pairs. When a first-time exchange caller presents no invite token but names a signup_type matching one of these (or omits signup_type and exactly one entry exists), a brand-new user is created and bound to that entry's role — no invite required. Every entry must, by construction, be something you're willing to grant to ANY caller who can present a token from this issuer: no entry may target a role carrying elevated (provisioning or wildcard) scope — rejected. Omit entirely to leave self-signup disabled (the default).

    • selfSignupPolicies

      IssuerRequest._FinalStage selfSignupPolicies(List<SelfSignupPolicy> selfSignupPolicies)