org.keycloak.protocol.oidc.mappers

Class AbstractPairwiseSubMapper

java.lang.Object

org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper

org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper

All Implemented Interfaces:

OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper, ProtocolMapper, ConfiguredProvider, Provider, ProviderFactory<ProtocolMapper>

Direct Known Subclasses:

SHA256PairwiseSubMapper

public abstract class AbstractPairwiseSubMapper
extends AbstractOIDCProtocolMapper
implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper

Set the 'sub' claim to pairwise .

Author:

Martin Hardselius

Field Summary

Fields

Modifier and Type	Field and Description
static String	PROVIDER_ID_SUFFIX

Fields inherited from class org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper

TOKEN_MAPPER_CATEGORY

Constructor Summary

Constructors

Constructor and Description
AbstractPairwiseSubMapper()

Method Summary

Modifier and Type	Method and Description
abstract String	generateSub(ProtocolMapperModel mappingModel, String sectorIdentifier, String localSub) Generates a pairwise subject identifier.
List<ProviderConfigProperty>	getAdditionalConfigProperties() Override to add additional provider configuration properties.
List<ProviderConfigProperty>	getConfigProperties()
String	getDisplayCategory()
String	getId()
abstract String	getIdPrefix()
protected void	setAccessTokenSubject(IDToken token, String pairwiseSub)
protected void	setIDTokenSubject(IDToken token, String pairwiseSub)
protected void	setUserInfoTokenSubject(IDToken token, String pairwiseSub)
AccessToken	transformAccessToken(AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
IDToken	transformIDToken(IDToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
AccessToken	transformUserInfoToken(AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
void	validateAdditionalConfig(KeycloakSession session, RealmModel realm, ProtocolMapperContainerModel mapperContainer, ProtocolMapperModel mapperModel) Override to add additional configuration validation.
void	validateConfig(KeycloakSession session, RealmModel realm, ProtocolMapperContainerModel mapperContainer, ProtocolMapperModel mapperModel) Called when instance of mapperModel is created/updated for this protocolMapper through admin endpoint

Methods inherited from class org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper

close, create, getProtocol, init, postInit, setClaim, setClaim

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.protocol.ProtocolMapper

getDisplayType, getPriority

Methods inherited from interface org.keycloak.provider.ProviderFactory

order

Methods inherited from interface org.keycloak.provider.ConfiguredProvider

getHelpText

Field Detail

PROVIDER_ID_SUFFIX

public static final String PROVIDER_ID_SUFFIX

See Also:

Constant Field Values

Constructor Detail

AbstractPairwiseSubMapper

public AbstractPairwiseSubMapper()

Method Detail

getIdPrefix

public abstract String getIdPrefix()

generateSub

public abstract String generateSub(ProtocolMapperModel mappingModel,
                                   String sectorIdentifier,
                                   String localSub)

Generates a pairwise subject identifier.

Parameters:

mappingModel -

sectorIdentifier - client sector identifier

localSub - local subject identifier (user id)

Returns:

A pairwise subject identifier

getAdditionalConfigProperties

public List<ProviderConfigProperty> getAdditionalConfigProperties()

Override to add additional provider configuration properties. By default, a pairwise sub mapper will only contain configuration for a sector identifier URI.

Returns:

A list of provider configuration properties.

validateAdditionalConfig

public void validateAdditionalConfig(KeycloakSession session,
                                     RealmModel realm,
                                     ProtocolMapperContainerModel mapperContainer,
                                     ProtocolMapperModel mapperModel)
                              throws ProtocolMapperConfigException

Override to add additional configuration validation. Called when instance of mapperModel is created/updated for this protocolMapper through admin endpoint.

Parameters:

session -

realm -

mapperContainer - client or clientScope

mapperModel -

Throws:

ProtocolMapperConfigException - if configuration provided in mapperModel is not valid

getDisplayCategory

public final String getDisplayCategory()

Specified by:

getDisplayCategory in interface ProtocolMapper

transformIDToken

public IDToken transformIDToken(IDToken token,
                                ProtocolMapperModel mappingModel,
                                KeycloakSession session,
                                UserSessionModel userSession,
                                ClientSessionContext clientSessionCtx)

Specified by:

transformIDToken in interface OIDCIDTokenMapper

Overrides:

transformIDToken in class AbstractOIDCProtocolMapper

transformAccessToken

public AccessToken transformAccessToken(AccessToken token,
                                        ProtocolMapperModel mappingModel,
                                        KeycloakSession session,
                                        UserSessionModel userSession,
                                        ClientSessionContext clientSessionCtx)

Specified by:

transformAccessToken in interface OIDCAccessTokenMapper

Overrides:

transformAccessToken in class AbstractOIDCProtocolMapper

transformUserInfoToken

public AccessToken transformUserInfoToken(AccessToken token,
                                          ProtocolMapperModel mappingModel,
                                          KeycloakSession session,
                                          UserSessionModel userSession,
                                          ClientSessionContext clientSessionCtx)

Specified by:

transformUserInfoToken in interface UserInfoTokenMapper

Overrides:

transformUserInfoToken in class AbstractOIDCProtocolMapper

setIDTokenSubject

protected void setIDTokenSubject(IDToken token,
                                 String pairwiseSub)

setAccessTokenSubject

protected void setAccessTokenSubject(IDToken token,
                                     String pairwiseSub)

setUserInfoTokenSubject

protected void setUserInfoTokenSubject(IDToken token,
                                       String pairwiseSub)

getConfigProperties

public final List<ProviderConfigProperty> getConfigProperties()

Specified by:

getConfigProperties in interface ConfiguredProvider

validateConfig

public final void validateConfig(KeycloakSession session,
                                 RealmModel realm,
                                 ProtocolMapperContainerModel mapperContainer,
                                 ProtocolMapperModel mapperModel)
                          throws ProtocolMapperConfigException

Description copied from interface: ProtocolMapper

Called when instance of mapperModel is created/updated for this protocolMapper through admin endpoint

Specified by:

validateConfig in interface ProtocolMapper

mapperContainer - client or clientTemplate

Throws:

ProtocolMapperConfigException - if configuration provided in mapperModel is not valid

getId

public final String getId()

Specified by:

getId in interface ProviderFactory<ProtocolMapper>