Interface UserManagerSettings

Settings used to configure the User Manager.

Required: authority, client_id, redirect_uri

See

User Manager Settings

Example

const settings: UserManagerSettings = {
  authority: `https://login.microsoftonline.com/${PUBLIC_AZURE_TENANT_ID}/v2.0`,
  client_id: PUBLIC_AZURE_CLIENT_ID,
  redirect_uri: 'http://localhost:5173/auth/callback/azure',
};

Hierarchy

  • UserManagerSettings
    • UserManagerSettings

Properties

accessTokenExpiringNotificationTimeInSeconds? acr_values? authority automaticSilentRenew? checkSessionIntervalInSeconds? client_authentication? client_id client_secret? clockSkewInSeconds? disablePKCE? display? extraHeaders? extraQueryParams? extraTokenParams? fetchRequestCredentials? filterProtocolClaims? iframeNotifyParentOrigin? iframeScriptOrigin? includeIdTokenInSilentRenew? includeIdTokenInSilentSignout? loadUserInfo? max_age? mergeClaims? metadata? metadataSeed? metadataUrl? monitorAnonymousSession? monitorSession? popupWindowFeatures? popupWindowTarget? popup_post_logout_redirect_uri? popup_redirect_uri? post_logout_redirect_uri? prompt? query_status_response_type? redirectMethod? redirectTarget? redirect_uri refreshTokenAllowedScope? refreshTokenCredentials? resource? response_mode? response_type? revokeTokenAdditionalContentTypes? revokeTokenTypes? revokeTokensOnSignout? scope? signingKeys? silentRequestTimeoutInSeconds? silent_redirect_uri? staleStateAgeInSeconds? stateStore? stopCheckSessionOnError? ui_locales? userInfoJwtIssuer? userStore? validateSubOnSilentRenew?

Properties

Optional accessTokenExpiringNotificationTimeInSeconds

accessTokenExpiringNotificationTimeInSeconds?: number

The number of seconds before an access token is to expire to raise the accessTokenExpiring event (default: 60)

Optional acr_values

acr_values?: string

optional protocol param

authority

authority: string

The URL of the OIDC/OAuth2 provider

Optional automaticSilentRenew

automaticSilentRenew?: boolean

Flag to indicate if there should be an automatic attempt to renew the access token prior to its expiration. The automatic renew attempt starts 1 minute before the access token expires (default: true)

Optional checkSessionIntervalInSeconds

checkSessionIntervalInSeconds?: number

Interval in seconds to check the user's session (default: 2)

Optional client_authentication

client_authentication?: "client_secret_basic" | "client_secret_post"

Client authentication method that is used to authenticate when using the token endpoint (default: "client_secret_post")

  • "client_secret_basic": using the HTTP Basic authentication scheme
  • "client_secret_post": including the client credentials in the request body

See https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

client_id

client_id: string

Your client application's identifier as registered with the OIDC/OAuth2

Optional client_secret

client_secret?: string

Optional clockSkewInSeconds

clockSkewInSeconds?: number

Deprecated

Unused

Optional disablePKCE

disablePKCE?: boolean

Will disable pkce validation, changing to true will not append to sign in request code_challenge and code_challenge_method. (default: false)

Optional display

display?: string

optional protocol param

Optional extraHeaders

extraHeaders?: Record<string, ExtraHeader>

An object containing additional header to be including in request.

Optional extraQueryParams

extraQueryParams?: Record<string, string | number | boolean>

An object containing additional query string parameters to be including in the authorization request. E.g, when using Azure AD to obtain an access token an additional resource parameter is required. extraQueryParams: {resource:"some_identifier"}

Optional extraTokenParams

extraTokenParams?: Record<string, unknown>

Optional fetchRequestCredentials

fetchRequestCredentials?: RequestCredentials

Sets the credentials for fetch requests. (default: "same-origin") Use this if you need to send cookies to the OIDC/OAuth2 provider or if you are using a proxy that requires cookies

Optional filterProtocolClaims

filterProtocolClaims?: boolean | string[]

Should optional OIDC protocol claims be removed from profile or specify the ones to be removed (default: true) When true, the following claims are removed by default: ["nbf", "jti", "auth_time", "nonce", "acr", "amr", "azp", "at_hash"] When specifying claims, the following claims are not allowed: ["sub", "iss", "aud", "exp", "iat"]

Optional iframeNotifyParentOrigin

iframeNotifyParentOrigin?: string

The target to pass while calling postMessage inside iframe for callback (default: window.location.origin)

Optional iframeScriptOrigin

iframeScriptOrigin?: string

The script origin to check during 'message' callback execution while performing silent auth via iframe (default: window.location.origin)

Optional includeIdTokenInSilentRenew

includeIdTokenInSilentRenew?: boolean

Flag to control if id_token is included as id_token_hint in silent renew calls (default: false)

Optional includeIdTokenInSilentSignout

includeIdTokenInSilentSignout?: boolean

Flag to control if id_token is included as id_token_hint in silent signout calls (default: false)

Optional loadUserInfo

loadUserInfo?: boolean

Flag to control if additional identity data is loaded from the user info endpoint in order to populate the user's profile (default: false)

Optional max_age

max_age?: number

optional protocol param

Optional mergeClaims

mergeClaims?: boolean

Indicates if objects returned from the user info endpoint as claims (e.g. address) are merged into the claims from the id token as a single object. Otherwise, they are added to an array as distinct objects for the claim type. (default: false)

Optional metadata

metadata?: Partial<OidcMetadata>

Provide metadata when authority server does not allow CORS on the metadata endpoint

Optional metadataSeed

metadataSeed?: Partial<OidcMetadata>

Can be used to seed or add additional values to the results of the discovery request

Optional metadataUrl

metadataUrl?: string

Optional monitorAnonymousSession

monitorAnonymousSession?: boolean

Optional monitorSession

monitorSession?: boolean

Will raise events for when user has performed a signout at the OP (default: false)

Optional popupWindowFeatures

popupWindowFeatures?: PopupWindowFeatures

The features parameter to window.open for the popup signin window. By default, the popup is placed centered in front of the window opener. (default: { location: false, menubar: false, height: 640, closePopupWindowAfterInSeconds: -1 })

Optional popupWindowTarget

popupWindowTarget?: string

The target parameter to window.open for the popup signin window (default: "_blank")

Optional popup_post_logout_redirect_uri

popup_post_logout_redirect_uri?: string

Optional popup_redirect_uri

popup_redirect_uri?: string

The URL for the page containing the call to signinPopupCallback to handle the callback from the OIDC/OAuth2

Optional post_logout_redirect_uri

post_logout_redirect_uri?: string

The OIDC/OAuth2 post-logout redirect URI

Optional prompt

prompt?: string

optional protocol param

Optional query_status_response_type

query_status_response_type?: string

Optional redirectMethod

redirectMethod?: "replace" | "assign"

The methods window.location method used to redirect (default: "assign")

Optional redirectTarget

redirectTarget?: "self" | "top"

The methods target window being redirected (default: "self")

redirect_uri

redirect_uri: string

The redirect URI of your client application to receive a response from the OIDC/OAuth2 provider

Optional refreshTokenAllowedScope

refreshTokenAllowedScope?: string

Only scopes in this list will be passed in the token refresh request.

Optional refreshTokenCredentials

refreshTokenCredentials?: "include" | "same-origin" | "omit"

Deprecated

since version 2.1.0. Use fetchRequestCredentials instead.

Optional resource

resource?: string | string[]

optional protocol param

Optional response_mode

response_mode?: "query" | "fragment"

optional protocol param (default: "query")

Optional response_type

response_type?: string

The type of response desired from the OIDC/OAuth2 provider (default: "code")

Optional revokeTokenAdditionalContentTypes

revokeTokenAdditionalContentTypes?: string[]

Will check the content type header of the response of the revocation endpoint to match these passed values (default: [])

Optional revokeTokenTypes

revokeTokenTypes?: ("access_token" | "refresh_token")[]

The token_type_hints to pass to the authority server by default (default: ["access_token", "refresh_token"])

Token types will be revoked in the same order as they are given here.

Optional revokeTokensOnSignout

revokeTokensOnSignout?: boolean

Will invoke the revocation endpoint on signout if there is an access token for the user (default: false)

Optional scope

scope?: string

The scope being requested from the OIDC/OAuth2 provider (default: "openid")

Optional signingKeys

signingKeys?: SigningKey[]

Provide signingKeys when authority server does not allow CORS on the jwks uri

Optional silentRequestTimeoutInSeconds

silentRequestTimeoutInSeconds?: number

Number of seconds to wait for the silent renew to return before assuming it has failed or timed out (default: 10)

Optional silent_redirect_uri

silent_redirect_uri?: string

The URL for the page containing the code handling the silent renew

Optional staleStateAgeInSeconds

staleStateAgeInSeconds?: number

Number (in seconds) indicating the age of state entries in storage for authorize requests that are considered abandoned and thus can be cleaned up (default: 900)

Optional stateStore

stateStore?: StateStore

Storage object used to persist interaction state (default: window.localStorage, InMemoryWebStorage iff no window). E.g. stateStore: new WebStorageStateStore({ store: window.localStorage })

Optional stopCheckSessionOnError

stopCheckSessionOnError?: boolean

Optional ui_locales

ui_locales?: string

optional protocol param

Optional userInfoJwtIssuer

userInfoJwtIssuer?: string

Deprecated

Unused

Optional userStore

userStore?: WebStorageStateStore

Storage object used to persist User for currently authenticated user (default: window.sessionStorage, InMemoryWebStorage iff no window). E.g. userStore: new WebStorageStateStore({ store: window.localStorage })

Optional validateSubOnSilentRenew

validateSubOnSilentRenew?: boolean

Flag to validate user.profile.sub in silent renew calls (default: true)

On This Page

Generated using TypeDoc v0.25.2