Deprecated API

Contents

• Terminally Deprecated
• Classes
• Fields
• Methods
• Constructors

Terminally Deprecated Elements

Element	Description
io.micronaut.security.authentication.DefaultAuthorizationExceptionHandler(ErrorResponseProcessor<?>, RedirectConfiguration, RedirectService, PriorToLoginPersistence)	Use DefaultAuthorizationExceptionHandler(io.micronaut.http.server.exceptions.response.ErrorResponseProcessor<?>,io.micronaut.security.config.RedirectConfiguration,io.micronaut.security.config.RedirectService,java.util.List<io.micronaut.security.authentication.WwwAuthenticateChallengeProvider<io.micronaut.http.HttpRequest<?>>>,io.micronaut.security.errors.@org.jspecify.annotations.Nullable PriorToLoginPersistence) instead.
io.micronaut.security.endpoints.LoginControllerConfigurationProperties.DEFAULT_ENABLED	Not used. ControllerConfigurationProperties.DEFAULT_ENABLED is used instead.
io.micronaut.security.endpoints.LogoutController(LogoutHandler<HttpRequest<?>, MutableHttpResponse<?>>, ApplicationEventPublisher<LogoutEvent>, LogoutControllerConfiguration, HttpHostResolver, HttpLocaleResolver, LogoutControllerConfigurationProperties)	Use LogoutController(LogoutHandler, ApplicationEventPublisher, LogoutControllerConfiguration, HttpHostResolver, HttpLocaleResolver) instead
io.micronaut.security.endpoints.LogoutControllerConfigurationProperties.DEFAULT_ENABLED	Not used. ControllerConfigurationProperties.DEFAULT_ENABLED is used instead.
io.micronaut.security.endpoints.OauthController(RefreshTokenPersistence, RefreshTokenValidator, OauthControllerConfigurationProperties, LoginHandler<HttpRequest<?>, MutableHttpResponse<?>>)	Use OauthController(RefreshTokenPersistence, RefreshTokenValidator, OauthControllerConfiguration, LoginHandler, RefreshTokenCookieConfiguration) instead.
io.micronaut.security.endpoints.OauthController(RefreshTokenPersistence, RefreshTokenValidator, OauthControllerConfiguration, LoginHandler<HttpRequest<?>, MutableHttpResponse<?>>)	Use OauthController(RefreshTokenPersistence, RefreshTokenValidator, OauthControllerConfiguration, LoginHandler, RefreshTokenCookieConfiguration) instead.
io.micronaut.security.endpoints.OauthControllerConfigurationProperties.DEFAULT_ENABLED	Not used. ControllerConfigurationProperties.DEFAULT_ENABLED is used instead.
io.micronaut.security.filters.SecurityFilter(Collection<SecurityRule<HttpRequest<?>>>, Collection<AuthenticationFetcher<HttpRequest<?>>>, SecurityConfiguration)	Use SecurityFilter(Collection, Collection, SecurityConfiguration, SecurityFilterConfiguration, StaticResourceAuthenticationBypass).
io.micronaut.security.oauth2.client.DefaultOpenIdProviderMetadata()	Use DefaultOpenIdProviderMetadata(java.lang.@org.jspecify.annotations.NonNull String) instead.
io.micronaut.security.oauth2.endpoint.authorization.response.DefaultOauthAuthorizationResponseHandler(TokenEndpointClient, StateValidator, PkcePersistence)	Use DefaultOauthAuthorizationResponseHandler(TokenEndpointClient, OauthRouteUrlBuilder, StateValidator, PkcePersistence). A handler created with this constructor does not send the redirect_uri parameter to the token endpoint.
io.micronaut.security.oauth2.endpoint.token.request.context.OauthCodeTokenRequestContext(AuthorizationResponse, SecureEndpoint, OauthClientConfiguration, String)	Use OauthCodeTokenRequestContext(AuthorizationResponse, OauthRouteUrlBuilder, SecureEndpoint, OauthClientConfiguration, String). A context created with this constructor does not send the redirect_uri parameter to the token endpoint.
io.micronaut.security.oauth2.endpoint.token.response.DefaultOpenIdAuthenticationMapper(OpenIdAdditionalClaimsConfiguration, AuthenticationModeConfiguration)	Use DefaultOpenIdAuthenticationMapper(OpenIdAdditionalClaimsConfiguration, AuthenticationModeConfiguration, OpenIdConfiguration, Collection) instead. This constructor never qualifies the username with the provider name.
io.micronaut.security.oauth2.endpoint.token.response.IdTokenLoginHandler(AccessTokenCookieConfiguration, RedirectConfiguration, RedirectService, PriorToLoginPersistence<HttpRequest<?>, MutableHttpResponse<?>>)	Use IdTokenLoginHandler(AccessTokenCookieConfiguration, RedirectConfiguration, RedirectService, PriorToLoginPersistence, List) instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_ADDRESS	Use ProfileClaims.CLAIM_ADDRESS instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_BIRTHDATE	Use ProfileClaims.CLAIM_BIRTHDATE instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_EMAIL	Use ProfileClaims.CLAIM_EMAIL instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_EMAIL_VERIFIED	Use ProfileClaims.CLAIM_EMAIL_VERIFIED instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_FAMILY_NAME	Use ProfileClaims.CLAIM_FAMILY_NAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_GENDER	Use ProfileClaims.CLAIM_GENDER instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_GIVEN_NAME	Use ProfileClaims.CLAIM_GIVEN_NAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_LOCALE	Use ProfileClaims.CLAIM_LOCALE instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_MIDDLE_NAME	Use ProfileClaims.CLAIM_MIDDLE_NAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_NAME	Use ProfileClaims.CLAIM_NAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_NICKNAME	Use ProfileClaims.CLAIM_NICKNAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_PHONE_NUMBER	Use ProfileClaims.CLAIM_PHONE_NUMBER instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_PHONE_NUMBER_VERIFIED	Use ProfileClaims.CLAIM_PHONE_NUMBER_VERIFIED instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_PICTURE	Use ProfileClaims.CLAIM_PICTURE instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_PREFERRED_USERNAME	Use ProfileClaims.CLAIM_PREFERRED_USERNAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_PROFILE	Use ProfileClaims.CLAIM_PROFILE instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_UPDATED_AT	Use ProfileClaims.CLAIM_UPDATED_AT instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_WEBSITE	Use ProfileClaims.CLAIM_WEBSITE instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_ZONEINFO	Use ProfileClaims.CLAIM_ZONEINFO instead.
io.micronaut.security.rules.ConfigurationInterceptUrlMapRule(RolesFinder, SecurityConfiguration, InterceptUrlPatternModifier)	Use ConfigurationInterceptUrlMapRule(RolesFinder, SecurityConfiguration, InterceptUrlPatternModifier, ServerContextPathProvider) instead.
io.micronaut.security.session.SessionLoginHandler(RedirectConfiguration, SessionStore<Session>, PriorToLoginPersistence<HttpRequest<?>, MutableHttpResponse<?>>, RedirectService)	Use SessionLoginHandler(RedirectConfiguration, SessionStore, PriorToLoginPersistence, RedirectService, List) instead.
io.micronaut.security.session.SessionLogoutHandler(RedirectConfiguration, RedirectService)	Use SessionLogoutHandler(RedirectConfiguration, RedirectService, SessionStore, List) instead. Without a SessionStore, the session is not deleted on logout; only the authentication is removed from it.
io.micronaut.security.token.ClaimsUtils.endsWithIgnoringProtocolAndTrailingSlash(String, String)	Use ClaimsUtils.equalsIgnoringProtocolAndTrailingSlash(String, String) instead. This method no longer performs a suffix match.
io.micronaut.security.token.cookie.TokenCookieLoginHandler(RedirectService, RedirectConfiguration, AccessTokenCookieConfiguration, RefreshTokenCookieConfiguration, AccessTokenConfiguration, AccessRefreshTokenGenerator, PriorToLoginPersistence<HttpRequest<?>, MutableHttpResponse<?>>)	Use TokenCookieLoginHandler(RedirectService, RedirectConfiguration, AccessTokenCookieConfiguration, RefreshTokenCookieConfiguration, AccessTokenConfiguration, AccessRefreshTokenGenerator, PriorToLoginPersistence, List) instead.
io.micronaut.security.token.cookie.TokenCookieTokenReader	Use CookieTokenReader instead.
io.micronaut.security.token.jwt.signature.jwks.DefaultJwkSetFetcher(JwksClient)	Use DefaultJwkSetFetcher(JwksClient, JwksClientConfiguration) instead.
io.micronaut.security.token.jwt.signature.jwks.JwksSignatureConfiguration.getCacheExpiration()	Not used. JWKS is cached via Micronaut Cache. You need an implementation of Micronaut Cache and the cache configuration micronaut.caches.jwks.expire-after-write
io.micronaut.security.token.jwt.signature.jwks.JwksSignatureConfigurationProperties.DEFAULT_KEYTYPE	No longer used. Since 5.5.2 no key type is applied unless JwksSignatureConfigurationProperties.setKeyType(KeyType) is configured, so that keys of any type of the JWKS are matched.
io.micronaut.security.token.jwt.signature.jwks.JwksSignatureConfigurationProperties.getCacheExpiration()	Not used. JWKS is cached via Micronaut Cache. You need an implementation of Micronaut Cache and the cache configuration micronaut.caches.jwks.expire-after-write
io.micronaut.security.token.jwt.signature.jwks.JwksSignatureConfigurationProperties.setCacheExpiration(Integer)	Not used. JWKS is cached via Micronaut Cache. You need an implementation of Micronaut Cache and the cache configuration micronaut.caches.jwks.expire-after-write

Deprecated Classes

Class	Description
io.micronaut.security.token.cookie.TokenCookieTokenReader	Use CookieTokenReader instead.

Deprecated Fields

Field	Description
io.micronaut.security.endpoints.LoginControllerConfigurationProperties.DEFAULT_ENABLED	Not used. ControllerConfigurationProperties.DEFAULT_ENABLED is used instead.
io.micronaut.security.endpoints.LogoutControllerConfigurationProperties.DEFAULT_ENABLED	Not used. ControllerConfigurationProperties.DEFAULT_ENABLED is used instead.
io.micronaut.security.endpoints.OauthControllerConfigurationProperties.DEFAULT_ENABLED	Not used. ControllerConfigurationProperties.DEFAULT_ENABLED is used instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_ADDRESS	Use ProfileClaims.CLAIM_ADDRESS instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_BIRTHDATE	Use ProfileClaims.CLAIM_BIRTHDATE instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_EMAIL	Use ProfileClaims.CLAIM_EMAIL instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_EMAIL_VERIFIED	Use ProfileClaims.CLAIM_EMAIL_VERIFIED instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_FAMILY_NAME	Use ProfileClaims.CLAIM_FAMILY_NAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_GENDER	Use ProfileClaims.CLAIM_GENDER instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_GIVEN_NAME	Use ProfileClaims.CLAIM_GIVEN_NAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_LOCALE	Use ProfileClaims.CLAIM_LOCALE instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_MIDDLE_NAME	Use ProfileClaims.CLAIM_MIDDLE_NAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_NAME	Use ProfileClaims.CLAIM_NAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_NICKNAME	Use ProfileClaims.CLAIM_NICKNAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_PHONE_NUMBER	Use ProfileClaims.CLAIM_PHONE_NUMBER instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_PHONE_NUMBER_VERIFIED	Use ProfileClaims.CLAIM_PHONE_NUMBER_VERIFIED instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_PICTURE	Use ProfileClaims.CLAIM_PICTURE instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_PREFERRED_USERNAME	Use ProfileClaims.CLAIM_PREFERRED_USERNAME instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_PROFILE	Use ProfileClaims.CLAIM_PROFILE instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_UPDATED_AT	Use ProfileClaims.CLAIM_UPDATED_AT instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_WEBSITE	Use ProfileClaims.CLAIM_WEBSITE instead.
io.micronaut.security.oauth2.endpoint.token.response.OpenIdClaims.CLAIMS_ZONEINFO	Use ProfileClaims.CLAIM_ZONEINFO instead.
io.micronaut.security.token.jwt.signature.jwks.JwksSignatureConfigurationProperties.DEFAULT_KEYTYPE	No longer used. Since 5.5.2 no key type is applied unless JwksSignatureConfigurationProperties.setKeyType(KeyType) is configured, so that keys of any type of the JWKS are matched.

Deprecated Methods

Method	Description
io.micronaut.security.oauth2.endpoint.endsession.request.AuthorizationServer.infer(String)	Use AuthorizationServerResolver instead
io.micronaut.security.token.ClaimsUtils.endsWithIgnoringProtocolAndTrailingSlash(String, String)	Use ClaimsUtils.equalsIgnoringProtocolAndTrailingSlash(String, String) instead. This method no longer performs a suffix match.
io.micronaut.security.token.jwt.signature.jwks.JwksSignatureConfiguration.getCacheExpiration()	Not used. JWKS is cached via Micronaut Cache. You need an implementation of Micronaut Cache and the cache configuration micronaut.caches.jwks.expire-after-write
io.micronaut.security.token.jwt.signature.jwks.JwksSignatureConfigurationProperties.getCacheExpiration()	Not used. JWKS is cached via Micronaut Cache. You need an implementation of Micronaut Cache and the cache configuration micronaut.caches.jwks.expire-after-write
io.micronaut.security.token.jwt.signature.jwks.JwksSignatureConfigurationProperties.setCacheExpiration(Integer)	Not used. JWKS is cached via Micronaut Cache. You need an implementation of Micronaut Cache and the cache configuration micronaut.caches.jwks.expire-after-write

Deprecated Constructors

Constructor	Description
io.micronaut.security.authentication.DefaultAuthorizationExceptionHandler(ErrorResponseProcessor<?>, RedirectConfiguration, RedirectService, PriorToLoginPersistence)	Use DefaultAuthorizationExceptionHandler(io.micronaut.http.server.exceptions.response.ErrorResponseProcessor<?>,io.micronaut.security.config.RedirectConfiguration,io.micronaut.security.config.RedirectService,java.util.List<io.micronaut.security.authentication.WwwAuthenticateChallengeProvider<io.micronaut.http.HttpRequest<?>>>,io.micronaut.security.errors.@org.jspecify.annotations.Nullable PriorToLoginPersistence) instead.
io.micronaut.security.endpoints.LogoutController(LogoutHandler<HttpRequest<?>, MutableHttpResponse<?>>, ApplicationEventPublisher<LogoutEvent>, LogoutControllerConfiguration, HttpHostResolver, HttpLocaleResolver, LogoutControllerConfigurationProperties)	Use LogoutController(LogoutHandler, ApplicationEventPublisher, LogoutControllerConfiguration, HttpHostResolver, HttpLocaleResolver) instead
io.micronaut.security.endpoints.OauthController(RefreshTokenPersistence, RefreshTokenValidator, OauthControllerConfigurationProperties, LoginHandler<HttpRequest<?>, MutableHttpResponse<?>>)	Use OauthController(RefreshTokenPersistence, RefreshTokenValidator, OauthControllerConfiguration, LoginHandler, RefreshTokenCookieConfiguration) instead.
io.micronaut.security.endpoints.OauthController(RefreshTokenPersistence, RefreshTokenValidator, OauthControllerConfiguration, LoginHandler<HttpRequest<?>, MutableHttpResponse<?>>)	Use OauthController(RefreshTokenPersistence, RefreshTokenValidator, OauthControllerConfiguration, LoginHandler, RefreshTokenCookieConfiguration) instead.
io.micronaut.security.filters.SecurityFilter(Collection<SecurityRule<HttpRequest<?>>>, Collection<AuthenticationFetcher<HttpRequest<?>>>, SecurityConfiguration)	Use SecurityFilter(Collection, Collection, SecurityConfiguration, SecurityFilterConfiguration, StaticResourceAuthenticationBypass).
io.micronaut.security.oauth2.client.DefaultOpenIdProviderMetadata()	Use DefaultOpenIdProviderMetadata(java.lang.@org.jspecify.annotations.NonNull String) instead.
io.micronaut.security.oauth2.DefaultProviderResolver(List<OpenIdClientConfiguration>)	Use DefaultProviderResolver(List, Collection) instead, which ignores disabled OAuth 2.0 clients.
io.micronaut.security.oauth2.endpoint.authorization.response.DefaultOauthAuthorizationResponseHandler(TokenEndpointClient, StateValidator, PkcePersistence)	Use DefaultOauthAuthorizationResponseHandler(TokenEndpointClient, OauthRouteUrlBuilder, StateValidator, PkcePersistence). A handler created with this constructor does not send the redirect_uri parameter to the token endpoint.
io.micronaut.security.oauth2.endpoint.endsession.request.EndSessionEndpointResolver(BeanContext)
io.micronaut.security.oauth2.endpoint.endsession.request.OktaEndSessionEndpoint(EndSessionCallbackUrlBuilder, OauthClientConfiguration, Supplier<OpenIdProviderMetadata>, SecurityConfiguration, TokenResolver<HttpRequest<?>>)	Use OktaEndSessionEndpoint(EndSessionCallbackUrlBuilder, OauthClientConfiguration, Supplier, SecurityConfiguration) instead.
io.micronaut.security.oauth2.endpoint.token.request.context.OauthCodeTokenRequestContext(AuthorizationResponse, SecureEndpoint, OauthClientConfiguration, String)	Use OauthCodeTokenRequestContext(AuthorizationResponse, OauthRouteUrlBuilder, SecureEndpoint, OauthClientConfiguration, String). A context created with this constructor does not send the redirect_uri parameter to the token endpoint.
io.micronaut.security.oauth2.endpoint.token.response.DefaultOpenIdAuthenticationMapper(OpenIdAdditionalClaimsConfiguration, AuthenticationModeConfiguration)	Use DefaultOpenIdAuthenticationMapper(OpenIdAdditionalClaimsConfiguration, AuthenticationModeConfiguration, OpenIdConfiguration, Collection) instead. This constructor never qualifies the username with the provider name.
io.micronaut.security.oauth2.endpoint.token.response.IdTokenLoginHandler(AccessTokenCookieConfiguration, RedirectConfiguration, RedirectService, PriorToLoginPersistence<HttpRequest<?>, MutableHttpResponse<?>>)	Use IdTokenLoginHandler(AccessTokenCookieConfiguration, RedirectConfiguration, RedirectService, PriorToLoginPersistence, List) instead.
io.micronaut.security.rules.ConfigurationInterceptUrlMapRule(RolesFinder, SecurityConfiguration, InterceptUrlPatternModifier)	Use ConfigurationInterceptUrlMapRule(RolesFinder, SecurityConfiguration, InterceptUrlPatternModifier, ServerContextPathProvider) instead.
io.micronaut.security.session.SessionLoginHandler(RedirectConfiguration, SessionStore<Session>, PriorToLoginPersistence<HttpRequest<?>, MutableHttpResponse<?>>, RedirectService)	Use SessionLoginHandler(RedirectConfiguration, SessionStore, PriorToLoginPersistence, RedirectService, List) instead.
io.micronaut.security.session.SessionLogoutHandler(RedirectConfiguration, RedirectService)	Use SessionLogoutHandler(RedirectConfiguration, RedirectService, SessionStore, List) instead. Without a SessionStore, the session is not deleted on logout; only the authentication is removed from it.
io.micronaut.security.token.cookie.TokenCookieLoginHandler(RedirectService, RedirectConfiguration, AccessTokenCookieConfiguration, RefreshTokenCookieConfiguration, AccessTokenConfiguration, AccessRefreshTokenGenerator, PriorToLoginPersistence<HttpRequest<?>, MutableHttpResponse<?>>)	Use TokenCookieLoginHandler(RedirectService, RedirectConfiguration, AccessTokenCookieConfiguration, RefreshTokenCookieConfiguration, AccessTokenConfiguration, AccessRefreshTokenGenerator, PriorToLoginPersistence, List) instead.
io.micronaut.security.token.jwt.signature.jwks.DefaultJwkSetFetcher(JwksClient)	Use DefaultJwkSetFetcher(JwksClient, JwksClientConfiguration) instead.