OidcClientConfig

public class OidcClientConfig : @unchecked Sendable

Configuration class for OIDC client.

Important

This class is @unchecked Sendable and contains mutable var fields. Configure all properties before passing the instance to any client or workflow — do not mutate it afterwards, as it may be read concurrently from background threads.

  • OpenID configuration.

    Declaration

    Swift

    public private(set) var openId: OpenIdConfiguration? { get }

  • Token refresh threshold in seconds.

    Declaration

    Swift

    public var refreshThreshold: Int64

  • Logger instance for logging.

    Declaration

    Swift

    public var logger: Logger

  • Storage delegate for storing tokens.

    Declaration

    Swift

    public var storage: StorageDelegate<Token>

  • Discovery endpoint URL.

    Declaration

    Swift

    public var discoveryEndpoint: String

  • Client ID for OIDC.

    Declaration

    Swift

    public var clientId: String

  • Set of scopes for OIDC.

    Declaration

    Swift

    public var scopes: Set<String>

  • Redirect URI for OIDC.

    Declaration

    Swift

    public var redirectUri: String

  • Login hint for OIDC.

    Declaration

    Swift

    public var loginHint: String?

  • State parameter for OIDC.

    Declaration

    Swift

    public var state: String?

  • Nonce parameter for OIDC.

    Declaration

    Swift

    public var nonce: String?

  • Display parameter for OIDC.

    Declaration

    Swift

    public var display: String?

  • Prompt parameter for OIDC.

    Declaration

    Swift

    public var prompt: String?

  • UI locales parameter for OIDC.

    Declaration

    Swift

    public var uiLocales: String?

  • ACR values parameter for OIDC.

    Declaration

    Swift

    public var acrValues: String?

  • Additional parameters for OIDC.

    Declaration

    Swift

    public var additionalParameters: [String : String]
  • par

    Enable PAR (Pushed Authorization Request) RFC 9126. When enabled, authorization parameters are pushed to the server before authorization.

    Declaration

    Swift

    public var par: Bool

  • HTTP client for making network requests.

    Declaration

    Swift

    public var httpClient: (any HttpClientProtocol)?

  • Called once after OpenID discovery completes, allowing callers to patch any field on the discovered OpenIdConfiguration before it is used (e.g. override deviceAuthorizationEndpoint for a non-standard server).

    Declaration

    Swift

    public var openIdOverride: ((inout OpenIdConfiguration) -> Void)?

  • Initializes a new OidcClientConfig instance.

    Declaration

    Swift

    public init()

  • Adds a scope to the set of scopes.

    Declaration

    Swift

    public func scope(_ scope: String)

    Parameters

    scope

    The scope to add.

  • Updates the agent with the provided configuration.

    Declaration

    Swift

    public func updateAgent<T>(_ agent: any Agent<T>, config: (T) -> Void = {_ in })

    Parameters

    agent

    The agent to update.
    config

    The configuration block for the agent.
  • oidcInitialize() Asynchronous

    Initializes the lazy properties to their default values.

    Declaration

    Swift

    public func oidcInitialize() async throws

  • Creates an OidcClientConfig from an oidc sub-dictionary and a pre-resolved logger. Used by all createXxx(json:) factories to avoid repeating the same construction sequence.

    Declaration

    Swift

    public static func from(oidcJson: [String : Any], logger: Logger) throws -> OidcClientConfig

  • Clones the current configuration.

    Declaration

    Swift

    public func clone() -> OidcClientConfig

    Return Value

    A new instance of OidcClientConfig with the same properties.

  • Merges another configuration into this one.

    Important

    This method is intended for module wiring only — it is called by the createXxx(json:) and createXxx(block:) factories to propagate a parsed config into a workflow module. Do not call this on an OidcClientConfig that has already been passed to a running workflow or client: it replaces every field including storage and openId, which can cause in-flight token reads to hit an unexpected (empty) keychain slot.

    Declaration

    Swift

    public func update(with other: OidcClientConfig)

    Parameters

    other

    The other configuration to merge.

  • Applies a unified JSON configuration dictionary to this instance.

    Validates all required fields and writes every recognised field directly to self. Unknown fields (including signOutRedirectUri) are silently ignored for forward compatibility.

    Important

    If the JSON contains an openId sub-object, this method merges the JSON-derived endpoint overrides with any existing openIdOverride. The existing closure runs first, then the JSON-derived overrides are applied on top, so the JSON values win for any endpoint key they cover. If the JSON contains no openId key, openIdOverride is left unchanged.

    Throws

    JsonConfigError if a required field is absent or a field has the wrong type.

    Declaration

    Swift

    public func apply(json: [String : Any]) throws

    Parameters

    json

    The oidc sub-dictionary from the unified SDK configuration schema.

  • Builds OIDC authorization request parameters using the provided configuration. This function populates all required and optional OAuth2/OIDC parameters for an authorization request.

    Declaration

    Swift

    public func buildAuthorizeParams(
    pkce: Pkce,
    extraParameters: [String: String] = [:],
    onParam: (String, String) -> Void
)

    Parameters

    pkce

    PKCE parameters for enhanced security.
    extraParameters

    Additional parameters specific to this authorization request.
    onParam

    Callback function to handle each parameter (name, value) pair.

  • Populates an OIDC authorization request handling both standard and PAR (RFC 9126) flows.

    Standard Flow: Builds authorization URL with all parameters in the query string. PAR Flow: POSTs parameters to the PAR endpoint, then uses the returned request_uri in the authorization request.

    Declaration

    Swift

    public func populateRequest(
    request: Request,
    pkce: Pkce,
    responseMode: String = OidcClient.Constants.piflow
) async throws -> Request

    Parameters

    request

    The request to populate.
    pkce

    PKCE parameters for enhanced security.
    responseMode

    The response mode to use.

    Return Value

    The populated request ready for execution.