Class CloudForgeManagerOidcIntegration

java.lang.Object

com.cloudforge.core.oidc.CloudForgeManagerOidcIntegration

All Implemented Interfaces:

OidcIntegration

public final class CloudForgeManagerOidcIntegration
extends Object
implements OidcIntegration

Deployment-time OIDC contract for CloudForge Manager.

The Manager server owns the authorization-code exchange and its cookie session; the browser is never given a client secret. ContainerFactory supplies the matching ManagerEnvKeys.OIDC_CLIENT_SECRET value from Secrets Manager.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CALLBACK_PATH	Callback handled by the Manager authorization-code endpoint.
static final String	START_PATH

Constructor Summary

Constructors

Constructor	Description
CloudForgeManagerOidcIntegration()

Method Summary

Modifier and Type	Method	Description
String	getAuthenticationType()	Returns the authentication type this integration uses.
String	getContainerStartupCommand()	The Manager image owns its Java entrypoint.
Map<String,String>	getEnvironmentVariables(OidcConfiguration config)	Returns environment variables needed for OIDC configuration.
String	getIntegrationMethod()	Returns the OIDC integration method for this application.
String	getOidcCallbackPath()	Returns the OIDC callback path for this application.
List<String>	getUserDataCommands(OidcConfiguration config, Ec2Context context)	Returns UserData commands for setting up OIDC integration.
boolean	isSupported()	Returns whether this application supports OIDC integration.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface OidcIntegration

getConfigurationFile, getConfigurationFilePath, getPostDeploymentInstructions, getSamlCertificateEnvVar, getSamlCertificateFilePath, getSamlCertificateMountPath, isDistroless, needsSamlCertificate, supportsAlbOidc, supportsApplicationOidc, supportsCognito, supportsIdentityCenterSaml

Field Details

CALLBACK_PATH

public static final String CALLBACK_PATH

Callback handled by the Manager authorization-code endpoint.

See Also:

• Constant Field Values

START_PATH

public static final String START_PATH

See Also:

• Constant Field Values

Constructor Details

CloudForgeManagerOidcIntegration

public CloudForgeManagerOidcIntegration()

Method Details

isSupported

public boolean isSupported()

Description copied from interface: OidcIntegration

Returns whether this application supports OIDC integration.

Specified by:

isSupported in interface OidcIntegration

Returns:

true if application has OIDC support

getIntegrationMethod

public String getIntegrationMethod()

Description copied from interface: OidcIntegration

Returns the OIDC integration method for this application.

Examples:

• jenkins: OIDC Plugin
• gitlab: Built-in OmniAuth
• grafana: Built-in generic_oauth
• sonarqube: OIDC Plugin

Specified by:

getIntegrationMethod in interface OidcIntegration

Returns:

integration method description

getEnvironmentVariables

public Map<String,String> getEnvironmentVariables(OidcConfiguration config)

Description copied from interface: OidcIntegration

Returns environment variables needed for OIDC configuration.

These are passed to the container or EC2 userdata script.

Example for Grafana:

GF_AUTH_GENERIC_OAUTH_ENABLED=true
GF_AUTH_GENERIC_OAUTH_NAME=Cognito
GF_AUTH_GENERIC_OAUTH_CLIENT_ID=${clientId}
GF_AUTH_GENERIC_OAUTH_AUTH_URL=${authUrl}

Specified by:

getEnvironmentVariables in interface OidcIntegration

Parameters:

config - OIDC configuration from provider

Returns:

map of environment variable name to value

getUserDataCommands

public List<String> getUserDataCommands(OidcConfiguration config,
 Ec2Context context)

Description copied from interface: OidcIntegration

Returns UserData commands for setting up OIDC integration.

These commands are added to the EC2 userdata script to configure OIDC integration during instance initialization.

Specified by:

getUserDataCommands in interface OidcIntegration

Parameters:

config - OIDC configuration from provider

context - EC2 context with stack information

Returns:

list of shell commands

getOidcCallbackPath

public String getOidcCallbackPath()

Description copied from interface: OidcIntegration

Returns the OIDC callback path for this application.

This is the path where the OIDC provider redirects after authentication. Each application has a different callback path based on its OIDC implementation.

Examples:

• Jenkins: /securityRealm/finishLogin
• Mattermost: /signup/gitlab/complete (uses GitLab OAuth provider for OIDC)
• GitLab: /users/auth/openid_connect/callback
• Grafana: /login/generic_oauth

Specified by:

getOidcCallbackPath in interface OidcIntegration

Returns:

callback path (e.g., "/securityRealm/finishLogin")

getContainerStartupCommand

public String getContainerStartupCommand()

The Manager image owns its Java entrypoint. OIDC is configured solely through environment variables, so a generic shell startup override would break it.

Specified by:

getContainerStartupCommand in interface OidcIntegration

Returns:

startup command path

getAuthenticationType

public String getAuthenticationType()

Description copied from interface: OidcIntegration

Returns the authentication type this integration uses.

Specified by:

getAuthenticationType in interface OidcIntegration

Returns:

"OIDC" or "SAML"