All Classes and Interfaces
Class
Description
Abstract class that handles the logic for importing and updating brokered users for all mappers that map a SAML
attribute into a
Keycloak
group.Abstract class that handles the logic for importing and updating brokered users for all mappers that map a SAML
attribute into a
Keycloak
role.Abstract class that handles the logic for importing and updating brokered users for all mappers that map an OIDC
claim into a
Keycloak
role.AbstractClientPolicyConditionProvider<CONFIG extends ClientPolicyConditionConfigurationRepresentation>
Helper base class for ClientModel implementations for ClientStorageProvider implementations.
Abstract base class for updating a single reference (specified via a single config property).
Abstract helper class that Authenticator implementations can leverage
Abstract class for Social Provider mappers which allow mapping of JSON user profile field into Keycloak user
attribute.
Handles some common transaction logic related to start, rollback-only etc.
Abstract "store" for bulk sending of the updates related to lastSessionRefresh
Stateful per-request object
Abstract class for number validator.
Set the 'sub' claim to pairwise .
Base class for parsers
Base PartialImport for most resource types.
Helper class for securing local services.
Base class for arbitrary value type validators.
Simple support for STaX type of parsing.
AbstractStorageManager<ProviderType extends Provider,StorageProviderModelType extends CacheableStorageProviderModel>
Base class for String value format validators.
This abstract class provides implementations for everything but getUsername().
The
AbstractUserAdapter.Streams
interface makes all collection-based methods in AbstractUserAdapter
default by providing
implementations that delegate to the Stream
-based variants instead of the other way around.Assumes everything is managed by federated storage except for username.
Deprecated.
This interface is no longer necessary; collection-based methods were removed from the parent interface
and therefore the parent interface can be used directly
Abstract base for Freemarker context bean providing informations about user profile to render dynamic or crafted forms.
A base class for
UserProfileProvider
implementations providing the main hooks for customizations.Abstract class that is meant to be extended by implementations of
VaultProvider
that want to have support for
key resolvers.Abstract class that is meant to be extended by implementations of
VaultProviderFactory
that want to offer support
for the configuration of key resolvers.Enum containing the available
VaultKeyResolver
s.OAuth 2.0 Access Token Response json
Created by st on 29/03/17.
A
AccountResourceProvider
creates JAX-RS resource instances for the Account endpoints, allowing
an implementor to override the behavior of the entire Account console.A factory that creates
AccountResourceProvider
instances.A
Spi
to replace Account resources.CRUD data in the authentication session, which are related to step-up authentication
Enum for actions taken by PartialImport.
Handler of the action token.
Java class for ActionType complex type.
Java class for ActivationLimitDurationType complex type.
Java class for ActivationLimitDurationType complex type.
Java class for ActivationLimitSessionType complex type.
Java class for ActivationLimitSessionType complex type.
Java class for ActivationLimitType complex type.
Java class for ActivationLimitType complex type.
Java class for ActivationLimitUsagesType complex type.
Java class for ActivationLimitUsagesType complex type.
Java class for ActivationPinType complex type.
Java class for ActivationPinType complex type.
Configuration for Java based adapters
Configuration options relevant for configuring http client that can be used by adapter.
Java class for AdditionalMetadataLocationType complex type.
Posted to managed client from admin server.
Created by st on 21/03/17.
Useful as a function pointer, i.e.
Useful as a function pointer, i.e.
A sub-resource instances for paths relative
to Realm's RESTful Admin API that could not be resolved by the server.
AdminRealmResourceProvider
creates JAX-RS A factory that creates
AdminRealmResourceProvider
instances.A
Spi
to plug additional sub-resources to Realms' RESTful Admin API.Root resource for admin console and admin REST API
Java class for AdviceType complex type.
Java class for AffiliationDescriptorType complex type.
Java class for AgreementMethodType complex type.
Deprecated.
Authenticator will always successfully authenticate.
Populates token with requested scope.
Protocol mapper to add allowed web origins to the access token to the 'allowed-origins' claim
Java class for AlphabetType complex type.
Java class for AlphabetType complex type.
Ancestor for a provider factory for both a standalone
ProviderFactory
and a ComponentFactory
.A criteria that matches a property based on its annotations
Parses any DOM tree to a list of DOM representations.
The provider allows to extract X.509 client certificate forwarded
to keycloak configured behind the Apache reverse proxy.
Deprecated.
Provides a way to create and resolve artifacts for SAML Artifact binding
Exception to indicate a configuration error in
ArtifactResolver
.A factory that creates
ArtifactResolver
instances.Exception to indicate a processing error in
ArtifactResolver
.
Java class for ArtifactResolveType complex type.
Java class for ArtifactResponseType complex type.
Security Exception indicating expiration of SAML2 assertion
Java class for AssertionIDRequestType complex type.
Utility to deal with assertions
When using
AsyncResponse.resume(Object)
directly in the code, the response is returned before all changes
done withing this execution are committed.Base resource class for the admin REST api of one realm
Pass-thru atheneticator that just sets the context to attempted.
Java class for AttributeAuthorityDescriptorType complex type.
Interface of the user profile attribute change listener.
Constants for attributes
Java class for AttributeConsumingServiceType complex type.
Configuration of the attribute group.
Java class for AttributeQueryType complex type.
Validator to check that User Profile attribute value is not blank (nor null) if the attribute is required based on
AttributeMetadata predicate.
Holds attributes, their values and provides utlity methods to manage them.
This interface wraps the attributes associated with a user profile.
Holds an attribute and its values, providing useful methods for obtaining and formatting values.
Java class for AttributeStatementType complex type.
Java class for AttributeType complex type.
Protocol mapper, which adds all client_ids of "allowed" clients to the audience field of the token.
Java class for AudienceRestrictionType complex type.
Provides the interface for requesting the authentication(AuthN) and authorization(AuthZ) by an authentication device (AD) to the external entity via Authentication Channel.
Defines constants for authentication flow bindings.
Callback to be triggered during various lifecycle events of authentication flow.
Factory to create
AuthenticationFlowCallback
instances.This interface encapsulates information about an execution in an AuthenticationFlow.
Set of error codes that can be thrown by an Authenticator, FormAuthenticator, or FormAction
Throw this exception from an Authenticator, FormAuthenticator, or FormAction if you want to completely abort the flow.
Stateless object that manages authentication
NOTE: Calling setter doesn't automatically enlist for update
Allow to encode compound string to fully lookup authenticationSessionModel
Represents the state of the authentication.
Non http-only cookie with tracking remaining authSessions in current root authentication session
This interface is for users that want to add custom authenticators to an authentication flow.
Java class for AuthenticatorBaseType complex type.
Java class for AuthenticatorBaseType complex type.
Factory for creating Authenticator instances.
Java class for AuthenticatorTransportProtocolType complex type.
Java class for AuthenticatorTransportProtocolType complex type.
Java class for AuthnAuthorityDescriptorType complex type.
Type that represents an AuthnContextClassRef
Java class for AuthnContextComparisonType.
Java class for AuthnContextDeclarationBaseType complex type.
Java class for AuthnContextDeclarationBaseType complex type.
Type that represents an AuthnContextDeclRef
Type that represents an AuthnContextDecl
Java class for AuthnContextType complex type.
Java class for AuthnMethodBaseType complex type.
Java class for AuthnMethodBaseType complex type.
Java class for AuthnQueryType complex type.
Java class for AuthnRequestType complex type.
Java class for AuthnStatementType complex type.
The internal Keycloak representation of a Rich Authorization Request authorization_details object, together with
some extra metadata to make it easier to work with this data in other parts of the codebase.
The JSON representation of a Rich Authorization Request's "authorization_details" object.
Common base class for Authorization REST endpoints implementation, which have to be implemented by each protocol.
Implements some checks typical for OIDC Authorization Endpoint.
The main contract here is the creation of
PermissionEvaluator
instances.This context object will contain all parsed Rich Authorization Request objects, together with the internal representation
that Keycloak is going to use for Scopes.
An entry point for obtaining permissions from the server.
This is class serves as an entry point for clients looking for access to Keycloak Authorization Services.
Java class for AuthzDecisionQueryType complex type.
Java class for AuthzDecisionStatementType complex type.
Parse the parameters from PAR
Parse the parameters from request queryString
Parse the parameters from OIDC "request" object
Class to detect if SSSD is available in the system.
Base32 - encodes and decodes RFC3548 Base32 (see http://www.faqs.org/rfcs/rfc3548.html )
Encodes and decodes to and from Base64 notation.
A
Base64.InputStream
will read data from another
java.io.InputStream, given in the constructor,
and encode/decode to/from Base64 notation on the fly.A
Base64.OutputStream
will write data to another
java.io.OutputStream, given in the constructor,
and encode/decode to/from Base64 notation on the fly.Common Adapter configuration
Abstract Type that represents an ID
Common Realm Configuration
Base Class for the Stax writers for SAML
The default implementation is compliant with RFC 2617
compliant with RFC 6749
Checks a password against a configured password blacklist.
Creates
BlacklistPasswordPolicyProvider
instances.A
BlacklistPasswordPolicyProviderFactory.FileBasedPasswordBlacklist
uses password-blacklist files as
to construct a BlacklistPasswordPolicyProviderFactory.PasswordBlacklist
.A
BlacklistPasswordPolicyProviderFactory.PasswordBlacklist
describes a list of too easy to guess
or potentially leaked passwords that users should not be able to use.Validator to check that User Profile attribute value is not blank (null value is OK!).
Java class for booleanType.
Represents all identity information obtained from an
IdentityProvider
after a
successful authentication.Validator to check that User Profile username is provided during Brokerin/Federation.
The point of this is to improve experience of browser history (back/forward/refresh buttons), but ensure there is no more redirects then necessary.
The cache entry, which contains list of all identityProvider links for particular user.
Cached authorization model classes will implement this interface.
Cached realms will implement this interface
Cached users will implement this interface
Some notes on how this works:
This implementation manages optimistic locking and version checks itself.
Java class for CanonicalizationMethodType complex type.
PEM values of key and certificate
The Class CertificateUtils provides utility functions for generation of V1 and V3
X509Certificate
The Class CertificateUtils provides utility functions for generation of V1 and V3
X509Certificate
Configure Certificate validation
Represents an authentication request sent by a consumption device (CD).
Provides the resolver that converts several types of receives login hint to its corresponding UserModel.
Java class for CipherDataType complex type.
Java class for CipherReferenceType complex type.
Claims parameter as described in the OIDC specification https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter
Clear user cache.
Clear user cache.
Encapsulates information about the execution in ClientAuthenticationFlow
This interface is for users that want to add custom client authenticators to an authentication flow.
Factory for creating ClientAuthenticator instances.
TODO: remove this class entirely?
Information about the client connection
The simple SPI for authenticating clients/applications .
Represents the context in the request to register/read/update/unregister client by Dynamic Client Registration or Admin REST API.
Provider plugin interface for importing clients from an arbitrary configuration format
Provider plugin interface for importing clients from an arbitrary configuration format
Validates client based on "client_id" and "client_secret" sent either in request parameters or in "Authorization: Basic" header .
Traditional OAuth2 authentication of clients based on client_id and client_secret
Provides a template/sample client config adapter file.
Abstraction interface for lookoup of clients by id and clientId.
Client Policies' (the set of all Client Policy) external representation class
Utilities for treating client policies/profiles
Just adds some type-safety to the ClientPolicyConditionConfiguration
This condition determines to which client a client policy is adopted.
Provides Client Policy Context.
Events on which client policies mechanism detects and do its operation
Just adds some type-safety to the ClientPolicyExecutorConfiguration
This executor specifies what action is executed on the client to which a client policy is adopted.
Provides a method for handling an event defined in
ClientPolicyEvent
.Client Policy's external representation class
Client Profile's external representation class
Client Profiles' (the set of all Client Profile) external representation class
Provider of the client records.
Created by st on 29/03/17.
Base resource class for managing one particular client of a realm.
Partial Import handler for Client Roles.
Binding between client and clientScope
Provider of the client scopes records.
Base resource class for managing one particular client of a realm.
Base resource class for managing a realm's client scopes.
Stored configuration of a Client scope Storage provider instance.
Request-scoped context object
PartialImport handler for Clients.
Base resource class for managing a realm's clients.
Base interface for components that want to provide an alternative storage mechanism for clients
This is currently a private incomplete SPI.
Stored configuration of a Client Storage provider instance.
TODO Leave the name ClientTemplateEvent just due the backwards compatibility of infinispan migration.
Deprecated.
Ensures that there are not concurrent executions of same task (either on this host or any other cluster host)
Task to be executed on all cluster nodes once it's notified.
Deprecated.
This is only available when the legacy store is enabled.
SAML Action Type
SAML Advice Type
SAML AssertionType
Predecesor of AuthenticationSessionModel, ClientLoginSessionModel and ClientSessionModel (then action tickets).
Common configuration useful for all providers
Mapper related to mapping of LDAP groups to keycloak model objects (either keycloak roles or keycloak groups)
SAML Request Abstract Type
Java class for StatusDetailType complex type.
Java class for ComplexAuthenticatorType complex type.
Java class for ComplexAuthenticatorType complex type.
Stored configuration of a User Storage provider instance.
KeyLocator
that represents a list of multiple KeyLocator
s.A
Condition
is used to specify how a specific query parameter
is defined in order to filter query results.
Java class for ConditionAbstractType complex type.
An
OTPFormAuthenticator
that can conditionally require OTP authentication.
Java class for ConditionsType complex type.
Conditions validation as per Section 2.5 of https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
Event listener which synchronizes mapper configs, when references change.
Interface for updating references in mapper configs, when references (like group path) change.
Exception indicating an issue with the configuration
Java class for ContactType complex type.
Java class for ContactTypeType.
Created by st on 21/03/17.
A Utility class that parses the Response object into the underlying ID attribute
Single purpose method that knows how to authenticate a user based on a credential type.
used to set an execution a state based on type.
Implentations of this interface can validate CredentialInput, i.e.
Used just in cases when we want to "directly" update or retrieve the hash or salt of user credential (For example during export/import)
Output of credential validation
Cross-DC based CrossDCLastSessionRefreshStore
Tracks the queue of lastSessionRefreshes, which were updated on this host.
Abstraction to handle differences between the APIs for non-fips and fips mode
This class overrides original ForeignKeySnapshotGenerator from liquibase 3.5.5.
We need to remove DELETE SQL command, which liquibase adds by default when inserting record to table lock.
We use "SELECT FOR UPDATE" pessimistic locking (Same algorithm like Hibernate LockMode.PESSIMISTIC_WRITE )
Liquibase lock service, which has some bugfixes and assumes timeouts to be configured in milliseconds
Util class for localized date and time representation
Encapsulates preloading of sessions within the DB Lock.
Global database lock to ensure that some actions in DB can be done just be
one cluster node at a time.
Lock namespace to have different lock types or contexts.
Java class for DCEValueType complex type.
The decision strategy dictates how the policies associated with a given policy are evaluated and how a final decision
is obtained.
Java class for DecisionType.
UserProfileProvider
loading configuration from the changeable JSON file stored in component config.Part of action token that is intended to be used e.g.
The default implementation for
Attributes
.A single thread will log failures.
The provider retrieves a client certificate and the certificate chain
(if any) from the incoming TLS connection.
The factory and the corresponding providers extract a client certificate
and the certificate chain (if any) from the incoming TLS connection.
Binding between realm and default clientScope
Not thread safe.
The default
HttpClientFactory
for HttpClientProvider's
used by Keycloak for outbound HTTP calls.Default implementation of
DefaultLazyLoader
that only fetches data once.Various common utils needed for migration from older version to newer
The default implementation for generating/formatting user code of OAuth 2.0 Device Authorization Grant.
ArtifactResolver for artifact-04 format.
Default token exchange implementation
Default token exchange provider factory
The default implementation for
UserProfile
.Default
VaultCharSecret
implementation based on CharBuffer
.Default raw secret implementation for
byte[]
.Default
VaultCharSecret
implementation based on String
.Default
VaultTranscriber
implementation that uses the configured VaultProvider
to obtain raw secrets
and convert them into other types.Encoder of saml messages based on DEFLATE compression
Explicitly deny access to the resources.
Allows to CRUD for configurations (like Authenticator configs).
Allows to register "deployed configurations", which are retrieved in runtime from deployed providers and hence are not saved in the DB
Extract PrivateKey, PublicKey, and X509Certificate from a DER encoded byte array or file.
Holder containing the information about a destination
Check that Destination field in SAML request/response is either unset or matches the expected one.
Cookie encapsulating data to be displayed on the info/error page.
Java class for DeviceTypeType.
Java class for DeviceTypeType.
Java class for DigestMethodType complex type.
Construct a
DirExportProviderFactory
to be used to export one or more realms.Persistence of userSessions is disabled .
Per the docker auth v2 spec, access is defined like this:
{
"type": "repository",
"name": "samalba/my-app",
"actions": [
"push",
"pull"
]
}
Representation of the docker-compose.yaml file
Implements a docker-client understandable format.
JSON Representation of a Docker Error in the following format:
{
"code": "UNAUTHORIZED",
"message": "access to the requested resource is not authorized",
"detail": [
{
"Type": "repository",
"Name": "samalba/my-app",
"Action": "pull"
},
{
"Type": "repository",
"Name": "samalba/my-app",
"Action": "push"
}
]
}
The “kid” field has to be in a libtrust fingerprint compatible format.
Creates a response understandable by the docker client in the form:
{
"token" : "eyJh...nSQ",
"expires_in" : 300,
"issued_at" : "2016-09-02T10:56:33Z"
}
* {
"iss": "auth.docker.com",
"sub": "jlhawn",
"aud": "registry.docker.com",
"exp": 1415387315,
"nbf": 1415387015,
"iat": 1415387015,
"jti": "tYJCO1c6cnyy7kAn0c7rKPgbV1H1bFws",
"access": [
{
"type": "repository",
"name": "samalba/my-app",
"actions": [
"push"
]
}
]
}
Utility dealing with DOM
PLINK-158: Maintain backward compatibility
Validate input being any kind of
Number
.
Java class for DSAKeyValueType complex type.
Dummy lock service injected to Liquibase.
Validator to check User Profile email duplication conditions based on realm settings like isDuplicateEmailsAllowed.
Validator to check that User Profile username already exists in database for another user in case of it's change, and
fail in this case.
Validator to check User Profile email duplication conditions if isDuplicateEmailsAllowed is false but
isRegistrationEmailAsUsername is true.
Email Validator Utility to check email inputs based on
hibernate-validator implementation.
Email format validation - accepts plain string and collection of strings, for basic behavior like null/blank values
handling and collections support see
AbstractStringValidator
.Assertion that is encrypted
Java class for EncryptedDataType complex type.
Represents an element that is encrypted
Java class for EncryptedKeyType complex type.
Java class for EncryptedType complex type.
Java class for EncryptionMethodType complex type.
Java class for EncryptionPropertiesType complex type.
Java class for EncryptionPropertyType complex type.
Java class for EndpointType complex type.
Java class for EntitiesDescriptorType complex type.
*
Java class for EntityDescriptorType complex type.
Classes implementing this interface guarantee that for each instance of this class,
there exists an mutually unique integer which is stable in time, and identifies
always the same instance of this class.
Providers that are only supported in some environments can implement this interface to be able to determine if they
should be available or not.
Replaces any ${} strings with their corresponding system property.
Error Codes for PicketLink https://docs.jboss.org/author/display/PLINK/PicketLink+Error+Codes
An exception that can hold a Response object.
Wraps a
ScriptModel
so it can be evaluated with custom bindings.An
Evaluation
is mainly used by PolicyProvider
in order to evaluate a single
and specific ResourcePermission
against the configured policies.This interface serves as a bridge between the policy evaluation runtime and the environment in which it is running.
A factory for the different
PermissionEvaluator
implementations.AttributeChangeListener
to audit user profile attribute changes into Event
.
Java class for EvidenceType complex type.
Use to unwrap exceptions specifically if there is an exception at JTA commit
Exchange a token crafted by this provider for a local realm token.
Token verification exception that bears an error to be logged via event system
and a message to show to the user e.g.
This adapter allows the exporter to act independent of APIs used to serve the exported data to the caller.
Custom consumer that is allowed to throw an
IOException
as writing to an output stream might do this.Manage importing and updating of realms for the legacy store.
Just to wrap
IOException
A type that contains a list of ExtensionType
Java class for ExtensionOnlyType complex type.
Java class for ExtensionOnlyType complex type.
Java class for ExtensionsType complex type.
Java class for ExtensionsType complex type.
Java class for ExtensionType complex type.
Java class for ExtensionType complex type.
User attribute mapper.
A text-based vault provider, which stores each secret in a separate file.
Creates and configures
FilesPlainTextVaultProvider
.Deprecated.
Deprecated.
Constants copied from XMLConstants to work around issues with IntelliJ
See https://issues.redhat.com/browse/KEYCLOAK-19403
Status of an execution/authenticator in a Authentication Flow
To provide a typed exception for Forbidden (This doesn't exist in Resteasy 2.3.7)
Thrown internally when authenticator wants to fork the current flow.
Fine grain processing of a form.
Factory for instantiating FormAction objects.
This class is responsible for rendering a form.
Factory for instantiating FormAuthenticators.
Interface that encapsulates the current state of the current form being executed
Message (eg.
Mapper useful for the LDAP deployments when some attribute (usually CN) is mapped to full name of user
Set the 'name' claim to be first + last name.
Check that switch "fullScopeAllowed" is not enabled for the clients
Check that switch "fullScopeAllowed" is not enabled for the clients
Not thread-safe.
Constants
Java class for anonymous complex type.
Java class for anonymous complex type.
User attribute mapper.
Result of the "global" request (like push notBefore or logoutAll), which is send to all cluster nodes
User attribute mapper.
Java class for GoverningAgreementRefType complex type.
Java class for GoverningAgreementRefType complex type.
Java class for GoverningAgreementsType complex type.
Java class for GoverningAgreementsType complex type.
Updates a group reference in a mapper config, when the path of a group changes.
Maps user group membership
Provider of group records
Partial import handler for Groups.
Stored configuration of a Group Storage provider instance.
The provider allows to extract X.509 client certificate forwarded
to the keycloak middleware configured behind the haproxy reverse proxy.
Mappings UserModel property (the property name of a getter method) to an AttributeStatement.
Key locator for a bunch of keys.
Add a role to a token
Mappings UserModel property (the property name of a getter method) to an AttributeStatement.
The Hostname provider is used by Keycloak to decide URLs for frontend and backend requests.
Abstraction for creating HttpClients.
An extension of
javax.ws.rs.core.Cookie
in order to support additional
fields and behavior.Deprecated.
Class is deprecated and may be removed in the future.
Represents an incoming HTTP request.
Represents an out coming HTTP response.
Java class for IdentificationType complex type.
Java class for IdentificationType complex type.
Represents a security identity, which can be a person or non-person entity that was previously authenticated.
Encapsulates parsing logic related to state passed to identity provider in "state" (or RelayState) parameter
Specifies a mapping from broker login to user data.
PartialImport handler for Identitiy Provider Mappers.
A model type representing the configuration for identity providers.
PartialImport handler for Identitiy Providers.
IdentityStore representation providing minimal SPI
TODO: Rather remove this abstraction
An LSResource Resolver for schema validation
Utility class that generates unique IDs
Java class for IDPEntryType complex type.
Holds essential information about an IDP for creating saml messages.
Java class for IDPListType complex type.
Java class for IDPSSODescriptorType complex type.
Same like classic username+password form, but for use in IdP linking.
Representation of a token that represents a time-limited verify e-mail action.
Action token handler for verification of e-mail address.
A validator that fails when the attribute is marked as read only and its value has changed.
Session note metadata for impersonation details stored in user session notes.
This is an optional capability interface that is intended to be implemented by any
UserStorageProvider
that supports validating users.Deprecated.
This is an optional capability interface that is intended to be implemented by any
UserStorageProvider
that supports syncing users to keycloak local
storage.
Java class for IndexedEndpointType complex type.
Startup initialization for reading persistent userSessions to be filled into infinispan/memory .
This impl is aware of Cross-Data-Center scenario too
Abstract subclass for Wildfly externalizers.
Impl for sending infinispan messages across cluster and listening to them
TODO: Check if Boolean can be used as single-use cache argument instead of SingleUseObjectValueEntity.
Note that this state is NOT thread safe.
User attribute mapper.
Handles invalidation requests.
Tagging interface for the kinds of invalidatable object
Wraps a
ScriptModel
and makes it Invocable
.Exception indicating that the IssueInstant is missing
Holds info about the issuer for saml messages creation
Exception indicating that the issuer is not trusted
Utility to obtain JAXB2 marshaller/unmarshaller etc
Utility class associated with JAXP Validation
Factory for the SAML v2 Authn Response
SAML Constants
Define the constants based on URI
An interface to represent signed (JWS) and encrypted (JWE) JWTs.
This interface represents a JOSE header.
Migration class to remove old rh-sso themes.
Migration class to update themes for those who had upgraded to 22.0.0 already.
Update CREATED_ON and LAST_SESSION_REFRESH columns to current startup time
Status of database up-to-dateness
Component model backed by JSON configuration.
Utility class to handle simple JSON serializable for Keycloak.
Utility methods for manipulating JSON objects.
Get keycloak.js file for javascript clients
JTA TransactionManager lookup
Client authentication based on JWT signed by client private key .
Client authentication based on JWT signed by client private key .
Client authentication based on JWT signed by client secret instead of private key .
Client authentication based on JWT signed by client secret instead of private key .
Common validation for JWT client authentication with private_key_jwt or with client_secret
Override explicitly added ExceptionMapper for handling
UnrecognizedPropertyException
in RestEasy Jackson
org.jboss.resteasy.plugins.providers.jackson.UnrecognizedPropertyExceptionHandler
Configuration specific to
KerberosFederationProvider
Factory for standalone Kerberos federation provider.
Provides abstraction to handle differences between various JDK vendors (Sun, IBM)
Provides serialization/deserialization of kerberos
GSSCredential
, so it can be transmitted from auth-server to the application
and used for further calls to kerberos-secured services
Java class for KeyActivationType complex type.
Java class for KeyActivationType complex type.
Provides a Keycloak client.
Provides a
Keycloak
client builder with the ability to customize the underlying
RESTEasy client
used to communicate with the Keycloak server.Needed on Wildfly, so that remoteStore (hotRod client) can find our classes
A
Logger
implementation that delegates to a JBoss Logger
.A
LogService
implementation that creates instances of KeycloakLogger
.Helper to optimize marshalling/unmarhsalling of some types
Override explicitly added ExceptionMapper for handling
MismatchedInputException
in RestEasy JacksonSet of helper methods, which are useful in various model implementations.
Class of constants relating to the OpenAPI annotations in Keycloak and the Keycloak Admin REST API
Allows sanitizing of html that uses Freemarker ?no_esc.
Based on the EbayPolicyExample in owasp java-html-sanitizer.
Available in secured requests under HttpServletRequest.getAttribute()
Also available in HttpSession.getAttribute under the classname of this class
Task to be executed inside transaction
Interface for tasks that compute a result and need access to the
KeycloakSession
.
Java class for KeyDescriptorType complex type.
Java class for KeyInfoConfirmationDataType complex type.
Tools for
KeyInfo
object manipulation.
Java class for KeyInfoType complex type.
This interface defines a method for obtaining a security key by ID.
Helper class that facilitates the hash of a Key to be located easier.
Java class for KeySharingType complex type.
Java class for KeySharingType complex type.
Java class for KeyStorageType complex type.
Java class for KeyStorageType complex type.
Configuration of KeyStore.
Java class for KeyTypes.
Java class for KeyValueType complex type.
Java class for localizedURIType complex type.
A functional interface that can be used to return data
D
from a source S
where implementations are free to define how and when
data is fetched from source as well how it is internally cached.Value object to represent an OID (object identifier) as used to describe LDAP schema, extension and features.
Single RDN inside the DN.
An IdentityStore implementation backed by an LDAP directory
TODO: Possibly add "priority" instead of hardcoding behaviour
This class provides a set of operations to manage LDAP trees.
Configuration specific to
LDAPStorageProvider
Default IdentityQuery implementation.
TODO: LDAPStorageMapper should be divided into more interfaces and let the LDAPStorageMapperManager to check which operation (feature) is supported by which mapper implementation
Track which LDAP users were already enlisted during this transaction
Utility class for working with LDAP.
Allow to directly call some operations against LDAPIdentityStore.
User model delegate, which tracks what attributes were written to LDAP in this transaction.
Enables legacy support when managing attributes without the declarative provider.
This wraps the functionality about export/import for legacy storage.
This wraps the functionality for migrations of the legacy storage.
Event for notifying legacy store, so it can do migrations on the representation as needed.
Event for notifying legacy store about the need to reconfigure user providers
sychronization.
Handling credentials for a given user for the legacy store.
Java class for LengthType complex type.
Java class for LengthType complex type.
String value length validation - accepts plain string and collection of strings, for basic behavior like null/blank
values handling and collections support see
AbstractStringValidator
.API for linking/unlinking social login accounts
Deprecated.
Deprecated.
Specific OIDC LinkedIn provider for Sign In with LinkedIn using OpenID Connect
product app.
Specific OIDC LinkedIn provider for Sign In with LinkedIn using OpenID Connect
product app.
Specific public key loader that assumes that use for the keys is the requested one.
User attribute mapper.
Method used to format the link expiration time period in emails.
This interface is used for controlling load balancer.
Prepare information for the load balancer (possibly in a multi-site setup) whether this Keycloak cluster should receive traffic.
A date validator that only takes into account the format associated with the current locale.
Java class for localizedNameType complex type.
Java class for localizedURIType complex type.
This exception is thrown when acquiring a lock times out.
This flags the session that all information loaded from the stores should be locked as the service layer
plans to modify it.
Indicates that retrieve lock wasn't successful, but it worth to retry it in different transaction (For example if we were trying to create LOCK table, but other transaction
created the table in the meantime etc)
The decision strategy dictates how the policies associated with a given policy are evaluated and how a final decision
is obtained.
This check verifies that user ID (subject) from the token matches
the one from the authentication session.
Verifies that if authentication session exists and any action is required according to it, then it is
the expected one.
Verifies whether the given redirect URL, when set, is valid for the given client.
Various util methods, so the logic is not hardcoded in freemarker beans
Java class for localizedURIType complex type.
Java class for LogoutRequestType complex type.
Utilities for OIDC logout
A Service Provider Interface (SPI) that allows to plug-in a cache manager instance.
Java class for ManageNameIDRequestType complex type.
Java class for ManifestType complex type.
Specifies the maximum age of an authentication with which a password may be changed without re-authentication.
Java class for mediumType.
Java class for mediumType.
Bean used to hold form messages per field.
Enum with types of messages.
Identity provider for Microsoft account.
User attribute mapper.
Implements the migration necessary for version 6.0.0.
Handle the migration of the datastore and an imported realm representation.
Various common utils needed for migration from older version to newer
Thrown when data can't be retrieved for the model.
Mapper specific to MSAD LDS.
Mapper specific to MSAD.
Changes VARCHAR type with size greater than 255 to text type for MySQL 8 and newer.
A criteria that matches a property based on name
Java class for NameIDMappingRequestType complex type.
Java class for NameIDMappingResponseType complex type.
Java class for NameIDPolicyType complex type.
Represents a NameIDType
Helper class in process of parsing signature out of SAML token.
Utility methods related to networking.
The NGINX Provider extract end user X.509 certificate send during TLS mutual authentication,
and forwarded in an http header.
The factory and the corresponding providers extract a client certificate
from a NGINX reverse proxy (TLS termination).
The NGINX Trusted Provider verify extract end user X.509 certificate sent during TLS mutual authentication,
verifies it against provided CA the and forwarded in an HTTP header along with a new header ssl-client-verify: SUCCESS.
Validate that value exists and is not empty nor blank.
A
PasswordPolicyProvider
which does not allow to use the current email as password.Check that input value is not empty.
An exception that indicates that something is not ready for use.
Java class for nymType.
Java class for nymType.
Data associated with the oauth2 code.
Representation for Device Authorization Response.
Deprecated.
A type that contains a list of objects
Any class with package org.jboss.resteasy.skeleton.key will use NON_DEFAULT inclusion
Java class for ObjectType complex type.
Hacked extension to UserSessionModel so that user id can be obtain directly so
Resource class for the oauth/openid connect token service
Callback for component creation.
Java class for OneTimeUseType complex type.
Callback for component update.
Identity provider for Openshift V3.
Identity provider for Openshift V4.
OpenShift 4 Identity Provider configuration class.
OpenShift 4 Identity Provider factory class.
Java class for OperationalProtectionType complex type.
Java class for OperationalProtectionType complex type.
Validation against list of allowed values - accepts plain string and collection of strings (every value is validated against allowed values), for basic behavior like null/blank
values handling and collections support see
AbstractStringValidator
.
Java class for OrganizationType complex type.
Java class for AuthenticatorBaseType complex type.
Java class for AuthenticatorTransportProtocolType complex type.
Java class for AuthnContextDeclarationBaseType complex type.
Java class for AuthnMethodBaseType complex type.
The supported encodings when reading the raw secret from the storage
PAMAuthenticator for Unix users
Pushed Authorization Request endpoint
Parse the parameters from a request object sent to PAR Endpoint
General Exception indicating parsing exception
Main interface for PartialImport handlers.
This class manages the PartialImport handlers.
Deprecated.
Used for partial import of users, groups, clients, roles, and identity providers.
This class represents a single result for a resource imported.
Aggregates all the PartialImportResult objects.
An implementation of the
LDAP Password Modify Extended Operation
client request.
Created by st on 23/05/17.
Java class for PasswordType complex type.
Java class for PasswordType complex type.
Deprecated.
Recommended to use
UserCredentialModel
as it contains all the functionality required by this classA utility class for handling URI template parameters.
Validate String against configured RegEx pattern - accepts plain string and collection of strings, for basic behavior
like null/blank values handling and collections support see
AbstractStringValidator
.User attribute mapper.
PBKDF2 Password Hash provider with HMAC using SHA256
Provider factory for SHA512 variant of the PBKDF2 password hash algorithm.
Java class for PDPDescriptorType complex type.
Utility classes to extract PublicKey, PrivateKey, and X509Certificate from openssl generated PEM files
Utility classes to extract PublicKey, PrivateKey, and X509Certificate from openssl generated PEM files
An
PermissionEvaluator
represents a source of ResourcePermission
, responsible for emitting these permissions
to a consumer in order to evaluate the authorization policies based on a EvaluationContext
.An entry point for managing permission tickets using the Protection API.
A
PermissionTicketStore
is responsible to manage the persistence of PermissionTicket
instances.The store is supposed to do periodic bulk update of lastSessionRefresh times of all userSessions, which were refreshed during some period
of time.
This validator disallowing bunch of characters we really not to expect in names of persons (fist, middle, last names).
Java class for PGPDataType complex type.
Java class for anonymous complex type.
Java class for anonymous complex type.
Any exception that is raised by the security module extends from this runtime exception class, making it easy for
other modules and extensions to catch all security-related exceptions in a single catch block, if need be.
Constants useful to the JBoss Identity Federation project
This interface acts as a Log Facade for PicketLink, from which exceptions and messages should be created or
logged.
Factory class to create
PicketLinkLogger
instances.Represents an authorization policy and all the configuration associated with it.
The policy enforcement mode dictates how authorization requests are handled by the server.
A
PolicyEvaluator
evaluates authorization policies based on a given ResourcePermission
, sending
the results to a Decision
point through the methods defined in that interface.An entry point for managing user-managed permissions for a particular resource
A
PolicyStore
is responsible to manage the persistence of Policy
instances.Utility for the HTTP/Post binding
Executed at startup after model migration is finished
Java class for PrincipalAuthenticationMechanismType complex type.
Java class for PrincipalAuthenticationMechanismType complex type.
Java class for PrivateKeyProtectionType complex type.
Java class for PrivateKeyProtectionType complex type.
Exception to indicate a server processing error
Utility class for working with JavaBean style properties
A representation of a JavaBean style property
A property criteria can be used to filter the properties found by a
PropertyQuery
Utilities for working with property queries
Queries a target class for properties that match certain criteria.
An entry point for managing resources using the Protection API.
An entry point to access the Protection API endpoints.
Specifies a mapping from user data to a protocol claim assertion.
Base resource for managing users
Configuration property metadata.
Builds a list of ProviderConfigProperty instances.
At boot time, keycloak discovers all factories.
ProxyMappings
describes an ordered mapping for hostname regex patterns to a HttpHost
proxy.ProxyMappings.ProxyMapping
describes a Proxy Mapping with a Hostname Pattern
that is mapped to a proxy HttpHost
.A
DefaultRoutePlanner
that determines the proxy to use for a given target hostname by consulting
the given ProxyMappings
.
Java class for ProxyRestrictionType complex type.
Java class for PublicKeyType complex type.
Java class for PublicKeyType complex type.
Resource class for public realm information
Validator to check that User Profile attribute value is not changed if attribute is read-only.
Thrown when UserStorageProvider UserModel adapter is read-only
Will be good to get rid of this class and use ReadOnlyUserModelDelegate, but it can't be done now due the backwards compatibility.
Readonly proxy for a SSSD UserModel that prevents attributes from being updated.
This interface provides methods to query information from a realm.
Base resource class for the admin REST api of one realm
- the high level architecture of this cache is an invalidation cache.
Per request object
Deprecated.
Deprecated.
A sub-resource instances for paths relative
to Realm's RESTful API that could not be resolved by the server.
RealmResourceProvider
creates JAX-RS A factory that creates
RealmResourceProvider
instances.A
Spi
to plug additional sub-resources to Realms' RESTful API.PartialImport handler for Realm Roles.
Top level resource for Admin REST API
Utility class for SAML HTTP/Redirect binding
A Destination holder that holds the destination host url and the destination query string
Java class for anonymous complex type.
Java class for ReferenceType complex type.
Java class for ReferenceType complex type.
Utility class for working with JDK Reflection and also CDI's {link Annotated} metadata.
Validator to check User Profile email attribute value during Registration when "RegistrationEmailAsUsername()" is
enabled.
Validator to check User Profile username attribute value during Registration when "RegistrationEmailAsUsername()" is
enabled.
Validator to check User Profile username attribute uniqueness during registration (when
"RegistrationEmailAsUsername()" is NOT enabled).
Java class for RelayStateType complex type.
Get either just remoteCache associated with remoteStore associated with infinispan cache of given name.
Java class for RequestAbstractType complex type.
Java class for RequestedAttributeType complex type.
Java class for RequestedAuthnContextType complex type.
Deprecated.
Deprecated.
Java class for RequestType complex type.
Interface that encapsulates current information about the current requred action
You must specify a file
META-INF/services/org.keycloak.authentication.RequiredActionFactory in the jar that this class is contained in
This file must have the fully qualified class name of all your RequiredActionFactory classes
RequiredAction provider.
Some endpoints (like register new required action) doesn't support all the fields (like setEnabled etc).
Representation of a token that represents a time-limited reset credentials action.
Useful when there is a need for callback when time offset is restarted.
Represents a resource, which is usually protected by a set of policies within a resource server.
Represents a permission for a given resource.
One or more resources that the resource server manages as a set of protected resources.
Represents a resource server, whose resources are managed and protected.
A
ResourceServerStore
is responsible to manage the persistence of ResourceServer
instances.A
ResourceStore
is responsible to manage the persistence of Resource
instances.Represents Keycloak resource types for which
AdminEvent's
can be triggered.Enum for each resource type that can be partially imported.
A
KeycloakSessionTaskWithResult
that is aimed to be used by endpoints that want to produce a Response
in
a retriable transaction.
Java class for ResponseType complex type.
Java class for ResponseType complex type.
This is an an encoded token that is stored as a cookie so that if there is a client timeout, then the authentication session
can be restarted.
Provides a layer of indirection to abstract invocations to Resteasy internal APIs.
An implementation of
ResteasyClientProvider
based on RESTEasy classic.An SPI for using the JAX-RS Client API regardless of the underlying stack.
Java class for RestrictedLengthType complex type.
Java class for RestrictedLengthType complex type.
Java class for RestrictedPasswordType complex type.
Java class for RestrictedPasswordType complex type.
Java class for RetrievalMethodType complex type.
Runnable, which provides some additional info (iteration for now)
Needed here because:
- java.util.function.Supplier defined from Java 8
- Adds some additional info (current iteration)
Needed here because:
- java.util.function.BiConsumer defined from Java 8
- Adds some additional info (current iteration and called throwable
Sometimes its easier to just interact with roles by their ID instead of container/role-name
Sometimes its easier to just interact with roles by their ID instead of container/role-name
Updates a role reference in a mapper config, when a client ID changes.
Updates a role reference a in mapper config, when a role name changes.
Java class for RoleDescriptorType complex type.
Map realm roles or roles of particular client to LDAP groups
Abstraction interface for lookup of both realm roles and client roles by id, name and description.
Base resource for managing users
Map an assigned role to a different position and name in the token
Map an assigned role to a different position and name in the token
Provider of the role records.
Helper class to ensure that all the user's permitted roles (including composite roles) are loaded just once per request.
This class handles both realm roles and client roles.
Base interface for components that want to provide an alternative storage mechanism for roles
Stored configuration of a Role Storage provider instance.
Represents usually one browser session with potentially many browser tabs.
Introspects token accordingly with UMA Bearer Token Profile.
Java class for RSAKeyValueType complex type.
Deprecated.
SAML11 Action Type
Parse the saml assertion
Write the SAML 11 Assertion to stream
Constants for the SAML v1.1 Specifications
Utility for parsing SAML 1.1 payload
Parse the SAML2 AuthnRequest