Class OidcAuthenticationFactory

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
com.cloudforgeci.api.core.annotation.BaseFactory
com.cloudforgeci.api.security.OidcAuthenticationFactory
All Implemented Interfaces:
software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
public class OidcAuthenticationFactory extends BaseFactory
OIDC Authentication Factory for ALB-based authentication with any OIDC provider. This factory handles OIDC authentication for manual endpoint configuration (IAM Identity Center, Okta, Auth0, or any external IdP). For Cognito User Pool authentication, use CognitoAuthenticationFactory instead. Provides: - Infrastructure-level authentication before requests reach the application - Integration with any OIDC-compliant identity provider via manual endpoint configuration - Compliance with security requirements (PCI-DSS Req 8, HIPAA ยง164.312(d), SOC 2 CC6.2, GDPR Art. 32) Configuration (MANUAL OIDC ENDPOINTS - Recommended): - authMode: "alb-oidc" to enable this factory - oidcIssuer: OIDC issuer URL from IAM Identity Center application - oidcAuthorizationEndpoint: Authorization endpoint URL - oidcTokenEndpoint: Token endpoint URL - oidcUserInfoEndpoint: UserInfo endpoint URL - oidcClientId: Client ID from IAM Identity Center application - oidcClientSecretName: Secrets Manager secret name (default: jenkins/oidc/client-secret) Setup steps for IAM Identity Center: 1. Go to AWS IAM Identity Center console 2. Navigate to "Applications" > "Add application" 3. Choose "I have an application I want to set up" > "OAuth 2.0" or "OIDC" 4. Configure the application: - Redirect URLs: https://your-domain.com/oauth2/idpresponse - Grant types: Authorization code - Scopes: openid 5. Copy the OIDC endpoints and client ID 6. Add them to your deployment-context.json 7. After deployment, update the client secret in AWS Secrets Manager Legacy Configuration (AUTO-CONSTRUCTED ENDPOINTS - Not recommended): - authMode: "alb-oidc" - ssoInstanceArn: AWS IAM Identity Center instance ARN Note: This auto-constructs endpoints but may not work with all IAM Identity Center configurations Note: For Cognito User Pool authentication, use CognitoAuthenticationFactory which provides native ALB Cognito integration without requiring Secrets Manager.

  • Nested Class Summary

    Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

    software.amazon.jsii.JsiiObject.InitializationMode

    Nested classes/interfaces inherited from interface software.constructs.IConstruct

    software.constructs.IConstruct.Jsii$Default, software.constructs.IConstruct.Jsii$Proxy

  • Field Summary

    Fields inherited from class BaseFactory

    cfc, config, ctx

  • Constructor Summary

    Constructors
    Constructor
    Description
    OidcAuthenticationFactory(software.constructs.Construct scope, String id)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    create()
    Abstract method that must be implemented by all factory subclasses.

    Methods inherited from class BaseFactory

    getDeploymentContext, getSecurityProfileConfiguration, getSystemContext

    Methods inherited from class software.constructs.Construct

    getNode, isConstruct, toString

    Methods inherited from class software.amazon.jsii.JsiiObject

    jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

    Methods inherited from interface software.amazon.jsii.JsiiSerializable

    $jsii$toJson

  • Constructor Details

    • OidcAuthenticationFactory

      public OidcAuthenticationFactory(software.constructs.Construct scope, String id)

  • Method Details

    • create

      public void create()
      Description copied from class: BaseFactory
      Abstract method that must be implemented by all factory subclasses. This method should contain the actual infrastructure creation logic.
      Specified by:
      create in class BaseFactory