UserFederatedIdentityCredentialParameters Class

Package:
com.microsoft.aad.msal4j
Maven Artifact:
com.microsoft.azure:msal4j:1.26.0
  • java.lang.Object
    • com.microsoft.aad.msal4j.UserFederatedIdentityCredentialParameters

Implements

com.microsoft.aad.msal4j.IAcquireTokenParameters

public class UserFederatedIdentityCredentialParameters
implements com.microsoft.aad.msal4j.IAcquireTokenParameters

Object containing parameters for the User Federated Identity Credential (user_fic) flow. This is used for Leg 3 of the agent identity protocol, where a federated identity credential (obtained from Leg 2) is exchanged for a user-scoped token.

Can be used as parameter to acquireToken(UserFederatedIdentityCredentialParameters parameters)

Method Summary

Modifier and Type Method and Description
java.lang.String assertion()
static UserFederatedIdentityCredentialParametersBuilder builder(Set<String> scopes, String username, String assertion)

Builder for UserFederatedIdentityCredentialParameters using a UPN (User Principal Name).
static UserFederatedIdentityCredentialParametersBuilder builder(Set<String> scopes, UUID userObjectId, String assertion)

Builder for UserFederatedIdentityCredentialParameters using a user Object ID.
ClaimsRequest claims()

Gets the claims request parameter that will be sent with the authentication request.
java.lang.String clientClaims()

Client-originated claims set via UserFederatedIdentityCredentialParametersBuilder#claimsFromClient(String).
java.lang.String computeExtCacheKeyHash()

Computes the extended cache key hash from all cache key components, or an empty string when there are none.
java.util.Map<java.lang.String,java.lang.String> extraHttpHeaders()

Gets additional HTTP headers to be included in the token request.
java.util.Map<java.lang.String,java.lang.String> extraQueryParameters()

Deprecated

Present only to satisfy the IAcquireTokenParameters interface contract. Not recommended for use — this API is scheduled for removal across all parameter classes and will be replaced by a new mechanism in a future release.

Gets additional query parameters to be included in the token request.
boolean forceRefresh()
java.util.Set<java.lang.String> scopes()

Gets the set of scopes (permissions) requested for the access token.
java.lang.String tenant()

Gets the tenant identifier for the token request.
java.lang.String username()
java.util.UUID userObjectId()

Methods inherited from java.lang.Object

java.lang.Object.clone java.lang.Object.equals java.lang.Object.finalize java.lang.Object.getClass java.lang.Object.hashCode java.lang.Object.notify java.lang.Object.notifyAll java.lang.Object.toString java.lang.Object.wait java.lang.Object.wait java.lang.Object.wait

Method Details

assertion

public String assertion()

Returns:

the federated identity credential assertion (JWT)

builder

public static UserFederatedIdentityCredentialParameters.UserFederatedIdentityCredentialParametersBuilder builder(Set<String> scopes, String username, String assertion)

Builder for UserFederatedIdentityCredentialParameters using a UPN (User Principal Name).

Parameters:

scopes - scopes application is requesting access to
username - the UPN of the target user (e.g., "user@contoso.com")
assertion - the federated identity credential assertion (JWT) obtained from Leg 2

Returns:

builder that can be used to construct UserFederatedIdentityCredentialParameters

builder

public static UserFederatedIdentityCredentialParameters.UserFederatedIdentityCredentialParametersBuilder builder(Set<String> scopes, UUID userObjectId, String assertion)

Builder for UserFederatedIdentityCredentialParameters using a user Object ID.

Parameters:

scopes - scopes application is requesting access to
userObjectId - the Object ID (OID) of the target user
assertion - the federated identity credential assertion (JWT) obtained from Leg 2

Returns:

builder that can be used to construct UserFederatedIdentityCredentialParameters

claims

public ClaimsRequest claims()

Gets the claims request parameter that will be sent with the authentication request.

The claims request parameter can be used to request specific claims to be returned in the token, to request MFA authentication, or to control other aspects of token issuance.

clientClaims

public String clientClaims()

Client-originated claims set via UserFederatedIdentityCredentialParametersBuilder#claimsFromClient(String). Forwarded to the token endpoint as the OAuth claims parameter and used as part of the extended cache key so that distinct claim values are cached separately.

computeExtCacheKeyHash

public String computeExtCacheKeyHash()

Computes the extended cache key hash from all cache key components, or an empty string when there are none. The result is memoized since the parameters are immutable after construction.

extraHttpHeaders

public Map<String,String> extraHttpHeaders()

Gets additional HTTP headers to be included in the token request.

These headers will be added to the HTTP requests sent to the token endpoint. This can be useful for scenarios requiring custom headers for proxies or for diagnostic purposes.

extraQueryParameters


public Map<String,String> extraQueryParameters()

Deprecated

Present only to satisfy the IAcquireTokenParameters interface contract. Not recommended for use — this API is scheduled for removal across all parameter classes and will be replaced by a new mechanism in a future release.

Gets additional query parameters to be included in the token request.

These parameters will be added to the query string in requests to the authorization and token endpoints. This can be useful for scenarios requiring custom parameters that aren't explicitly supported in the library.

forceRefresh

public boolean forceRefresh()

Returns:

whether to bypass the token cache and force a fresh token request

scopes

public Set<String> scopes()

Gets the set of scopes (permissions) requested for the access token.

Scopes represent the permissions that the application is requesting access to.

tenant

public String tenant()

Gets the tenant identifier for the token request.

When specified, this value overrides the tenant specified in the application's authority URL. It can be a tenant ID (GUID), domain name, or one of the special values like "common" or "organizations".

username

public String username()

Returns:

the UPN of the target user, or null if user was identified by Object ID

userObjectId

public UUID userObjectId()

Returns:

the Object ID of the target user, or null if user was identified by UPN

Applies to