Package org.keycloak.broker.oidc

Class AbstractOAuth2IdentityProvider<C extends OAuth2IdentityProviderConfig>

java.lang.Object

org.keycloak.broker.provider.AbstractIdentityProvider<C>

org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider<C>

All Implemented Interfaces:

ExchangeExternalToken, ExchangeTokenToIdentityProviderToken, IdentityProvider<C>, Provider

Direct Known Subclasses:

BitbucketIdentityProvider, FacebookIdentityProvider, GitHubIdentityProvider, InstagramIdentityProvider, MicrosoftIdentityProvider, OAuth2IdentityProvider, OIDCIdentityProvider, OpenshiftV4IdentityProvider, PayPalIdentityProvider, StackoverflowIdentityProvider

public abstract class AbstractOAuth2IdentityProvider<C extends OAuth2IdentityProviderConfig>
extends AbstractIdentityProvider<C>
implements ExchangeTokenToIdentityProviderToken, ExchangeExternalToken

Author:

Pedro Igor

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
protected static class	AbstractOAuth2IdentityProvider.Endpoint
static class	AbstractOAuth2IdentityProvider.OAuthResponse	This is a custom variant of AccessTokenResponse which avoid primitives that would auto-add zero values to the original responses.

Nested classes/interfaces inherited from interface org.keycloak.broker.provider.IdentityProvider

IdentityProvider.AuthenticationCallback

Field Summary

Fields

Modifier and Type	Field	Description
static final String	ACCESS_DENIED
static final String	ACCESS_TOKEN_EXPIRATION
static final String	FEDERATED_REFRESH_TOKEN
static final String	FEDERATED_TOKEN_EXPIRATION
protected static final org.jboss.logging.Logger	logger
protected static com.fasterxml.jackson.databind.ObjectMapper	mapper
static final String	OAUTH2_GRANT_TYPE_AUTHORIZATION_CODE
static final String	OAUTH2_GRANT_TYPE_REFRESH_TOKEN
static final String	OAUTH2_PARAMETER_ACCESS_TOKEN
static final String	OAUTH2_PARAMETER_CLIENT_ID
static final String	OAUTH2_PARAMETER_CLIENT_SECRET
static final String	OAUTH2_PARAMETER_CODE
static final String	OAUTH2_PARAMETER_GRANT_TYPE
static final String	OAUTH2_PARAMETER_REDIRECT_URI
static final String	OAUTH2_PARAMETER_RESPONSE_TYPE
static final String	OAUTH2_PARAMETER_SCOPE
static final String	OAUTH2_PARAMETER_STATE

Fields inherited from class org.keycloak.broker.provider.AbstractIdentityProvider

ACCOUNT_LINK_URL, BROKER_REGISTERED_NEW_USER, session, UPDATE_PROFILE_EMAIL_CHANGED, UPDATE_PROFILE_USERNAME_CHANGED

Fields inherited from interface org.keycloak.broker.provider.IdentityProvider

EXTERNAL_IDENTITY_PROVIDER, FEDERATED_ACCESS_TOKEN

Constructor Summary

Constructors

Constructor	Description
AbstractOAuth2IdentityProvider(KeycloakSession session, C config)

Method Summary

Modifier and Type	Method	Description
com.fasterxml.jackson.databind.JsonNode	asJsonNode(String json)
SimpleHttpRequest	authenticateTokenRequest(SimpleHttpRequest tokenRequest)
void	authenticationFinished(AuthenticationSessionModel authSession, BrokeredIdentityContext context)
protected SimpleHttpRequest	buildUserInfoRequest(String subjectToken, String userInfoUrl)
Object	callback(RealmModel realm, IdentityProvider.AuthenticationCallback callback, EventBuilder event)	JAXRS callback endpoint for when the remote IDP wants to callback to keycloak.
protected jakarta.ws.rs.core.UriBuilder	createAuthorizationUrl(AuthenticationRequest request)
protected BrokeredIdentityContext	doGetFederatedIdentity(String accessToken)
final BrokeredIdentityContext	exchangeExternal(TokenExchangeProvider tokenExchangeProvider, TokenExchangeContext tokenExchangeContext)
void	exchangeExternalComplete(UserSessionModel userSession, BrokeredIdentityContext context, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
protected BrokeredIdentityContext	exchangeExternalTokenV1Impl(EventBuilder event, jakarta.ws.rs.core.MultivaluedMap<String,String> params)	Usage with token-exchange V1
protected BrokeredIdentityContext	exchangeExternalTokenV2Impl(TokenExchangeContext tokenExchangeContext)	Usage with external-internal token-exchange v2.
protected BrokeredIdentityContext	exchangeExternalUserInfoValidationOnly(EventBuilder event, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
jakarta.ws.rs.core.Response	exchangeFromToken(jakarta.ws.rs.core.UriInfo uriInfo, EventBuilder event, ClientModel authorizedClient, UserSessionModel tokenUserSession, UserModel tokenSubject, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
protected jakarta.ws.rs.core.Response	exchangeSessionToken(jakarta.ws.rs.core.UriInfo uriInfo, EventBuilder event, ClientModel authorizedClient, UserSessionModel tokenUserSession, UserModel tokenSubject)
protected jakarta.ws.rs.core.Response	exchangeStoredToken(jakarta.ws.rs.core.UriInfo uriInfo, EventBuilder event, ClientModel authorizedClient, UserSessionModel tokenUserSession, UserModel tokenSubject)
protected BrokeredIdentityContext	extractIdentityFromProfile(EventBuilder event, com.fasterxml.jackson.databind.JsonNode node)
protected String	extractTokenFromResponse(String response, String tokenName)
protected JsonWebToken	generateToken()
protected String	getAccessTokenResponseParameter()
C	getConfig()
protected abstract String	getDefaultScopes()
BrokeredIdentityContext	getFederatedIdentity(String response)
String	getJsonProperty(com.fasterxml.jackson.databind.JsonNode jsonNode, String name)	Get JSON property as text.
protected String	getProfileEndpointForValidation(EventBuilder event)
protected SimpleHttpRequest	getRefreshTokenRequest(KeycloakSession session, String refreshToken, String clientId, String clientSecret)
protected SignatureSignerContext	getSignatureContext()
protected jakarta.ws.rs.core.Response	hasExternalExchangeToken(EventBuilder event, UserSessionModel tokenUserSession, jakarta.ws.rs.core.MultivaluedMap<String,String> params)	check to see if we have a token exchange in session in other words check to see if this session was created by an external exchange
boolean	isIssuer(String issuer, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
jakarta.ws.rs.core.Response	performLogin(AuthenticationRequest request)	Initiates the authentication process by sending an authentication request to an identity provider.
jakarta.ws.rs.core.Response	retrieveToken(KeycloakSession session, FederatedIdentityModel identity)	Returns a Response containing the token previously stored during the authentication process for a specific user.
protected TokenMetadataRepresentation	sendTokenIntrospectionRequest(String idpAccessToken, EventBuilder event)	Send introspection request as specified in the OAuth2 token introspection specification.
protected boolean	supportsExternalExchange()
boolean	supportsLongStateParameter()
protected BrokeredIdentityContext	validateExternalTokenThroughUserInfo(EventBuilder event, String subjectToken, String subjectTokenType)
protected void	validateExternalTokenWithIntrospectionEndpoint(TokenExchangeContext tokenExchangeContext)	Called usually during external-internal token exchange for validation of external token, which is the token issued by the IDP.

Methods inherited from class org.keycloak.broker.provider.AbstractIdentityProvider

backchannelLogout, close, exchangeErrorResponse, exchangeNotLinked, exchangeNotLinkedNoStore, exchangeNotSupported, exchangeTokenExpired, exchangeUnsupportedRequiredType, export, getLinkingUrl, getMarshaller, importNewUser, keycloakInitiatedBrowserLogout, preprocessFederatedIdentity, setEmailVerified, updateBrokeredUser, updateEmail

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.broker.provider.IdentityProvider

isMapperSupported, reloadKeys

Field Details

logger

protected static final org.jboss.logging.Logger logger

OAUTH2_GRANT_TYPE_REFRESH_TOKEN

public static final String OAUTH2_GRANT_TYPE_REFRESH_TOKEN

See Also:

• Constant Field Values

OAUTH2_GRANT_TYPE_AUTHORIZATION_CODE

public static final String OAUTH2_GRANT_TYPE_AUTHORIZATION_CODE

See Also:

• Constant Field Values

FEDERATED_REFRESH_TOKEN

public static final String FEDERATED_REFRESH_TOKEN

See Also:

• Constant Field Values

FEDERATED_TOKEN_EXPIRATION

public static final String FEDERATED_TOKEN_EXPIRATION

See Also:

• Constant Field Values

ACCESS_DENIED

public static final String ACCESS_DENIED

See Also:

• Constant Field Values

mapper

protected static com.fasterxml.jackson.databind.ObjectMapper mapper

OAUTH2_PARAMETER_ACCESS_TOKEN

public static final String OAUTH2_PARAMETER_ACCESS_TOKEN

See Also:

• Constant Field Values

OAUTH2_PARAMETER_SCOPE

public static final String OAUTH2_PARAMETER_SCOPE

See Also:

• Constant Field Values

OAUTH2_PARAMETER_STATE

public static final String OAUTH2_PARAMETER_STATE

See Also:

• Constant Field Values

OAUTH2_PARAMETER_RESPONSE_TYPE

public static final String OAUTH2_PARAMETER_RESPONSE_TYPE

See Also:

• Constant Field Values

OAUTH2_PARAMETER_REDIRECT_URI

public static final String OAUTH2_PARAMETER_REDIRECT_URI

See Also:

• Constant Field Values

OAUTH2_PARAMETER_CODE

public static final String OAUTH2_PARAMETER_CODE

See Also:

• Constant Field Values

OAUTH2_PARAMETER_CLIENT_ID

public static final String OAUTH2_PARAMETER_CLIENT_ID

See Also:

• Constant Field Values

OAUTH2_PARAMETER_CLIENT_SECRET

public static final String OAUTH2_PARAMETER_CLIENT_SECRET

See Also:

• Constant Field Values

OAUTH2_PARAMETER_GRANT_TYPE

public static final String OAUTH2_PARAMETER_GRANT_TYPE

See Also:

• Constant Field Values

ACCESS_TOKEN_EXPIRATION

public static final String ACCESS_TOKEN_EXPIRATION

See Also:

• Constant Field Values

Constructor Details

AbstractOAuth2IdentityProvider

public AbstractOAuth2IdentityProvider(KeycloakSession session,
 C config)

Method Details

callback

public Object callback(RealmModel realm,
 IdentityProvider.AuthenticationCallback callback,
 EventBuilder event)

Description copied from interface: IdentityProvider

JAXRS callback endpoint for when the remote IDP wants to callback to keycloak.

Specified by:

callback in interface IdentityProvider<C extends OAuth2IdentityProviderConfig>

Overrides:

callback in class AbstractIdentityProvider<C extends OAuth2IdentityProviderConfig>

Returns:

performLogin

public jakarta.ws.rs.core.Response performLogin(AuthenticationRequest request)

Description copied from interface: IdentityProvider

Initiates the authentication process by sending an authentication request to an identity provider. This method is called only once during the authentication.

Specified by:

performLogin in interface IdentityProvider<C extends OAuth2IdentityProviderConfig>

Overrides:

performLogin in class AbstractIdentityProvider<C extends OAuth2IdentityProviderConfig>

Parameters:

request - The initial authentication request. Contains all the contextual information in order to build an authentication request to the identity provider.

Returns:

retrieveToken

public jakarta.ws.rs.core.Response retrieveToken(KeycloakSession session,
 FederatedIdentityModel identity)

Description copied from interface: IdentityProvider

Returns a Response containing the token previously stored during the authentication process for a specific user.

Specified by:

retrieveToken in interface IdentityProvider<C extends OAuth2IdentityProviderConfig>

Returns:

getRefreshTokenRequest

protected SimpleHttpRequest getRefreshTokenRequest(KeycloakSession session,
 String refreshToken,
 String clientId,
 String clientSecret)

getConfig

public C getConfig()

Specified by:

getConfig in interface IdentityProvider<C extends OAuth2IdentityProviderConfig>

Overrides:

getConfig in class AbstractIdentityProvider<C extends OAuth2IdentityProviderConfig>

extractTokenFromResponse

protected String extractTokenFromResponse(String response,
 String tokenName)

exchangeFromToken

public jakarta.ws.rs.core.Response exchangeFromToken(jakarta.ws.rs.core.UriInfo uriInfo,
 EventBuilder event,
 ClientModel authorizedClient,
 UserSessionModel tokenUserSession,
 UserModel tokenSubject,
 jakarta.ws.rs.core.MultivaluedMap<String,String> params)

Specified by:

exchangeFromToken in interface ExchangeTokenToIdentityProviderToken

authorizedClient - client requesting exchange

tokenUserSession - UserSessionModel of token exchanging from

tokenSubject - UserModel of token exchanging from

params - form parameters received for requested exchange

Returns:

hasExternalExchangeToken

protected jakarta.ws.rs.core.Response hasExternalExchangeToken(EventBuilder event,
 UserSessionModel tokenUserSession,
 jakarta.ws.rs.core.MultivaluedMap<String,String> params)

check to see if we have a token exchange in session in other words check to see if this session was created by an external exchange

Parameters:

tokenUserSession -

params -

Returns:

exchangeStoredToken

protected jakarta.ws.rs.core.Response exchangeStoredToken(jakarta.ws.rs.core.UriInfo uriInfo,
 EventBuilder event,
 ClientModel authorizedClient,
 UserSessionModel tokenUserSession,
 UserModel tokenSubject)

exchangeSessionToken

protected jakarta.ws.rs.core.Response exchangeSessionToken(jakarta.ws.rs.core.UriInfo uriInfo,
 EventBuilder event,
 ClientModel authorizedClient,
 UserSessionModel tokenUserSession,
 UserModel tokenSubject)

getFederatedIdentity

public BrokeredIdentityContext getFederatedIdentity(String response)

getAccessTokenResponseParameter

protected String getAccessTokenResponseParameter()

doGetFederatedIdentity

protected BrokeredIdentityContext doGetFederatedIdentity(String accessToken)

createAuthorizationUrl

protected jakarta.ws.rs.core.UriBuilder createAuthorizationUrl(AuthenticationRequest request)

getJsonProperty

public String getJsonProperty(com.fasterxml.jackson.databind.JsonNode jsonNode,
 String name)

Get JSON property as text. JSON numbers and booleans are converted to text. Empty string is converted to null.

Parameters:

jsonNode - to get property from

name - of property to get

Returns:

string value of the property or null.

asJsonNode

public com.fasterxml.jackson.databind.JsonNode asJsonNode(String json)
                                                   throws IOException

Throws:

IOException

getDefaultScopes

protected abstract String getDefaultScopes()

authenticationFinished

public void authenticationFinished(AuthenticationSessionModel authSession,
 BrokeredIdentityContext context)

Specified by:

authenticationFinished in interface IdentityProvider<C extends OAuth2IdentityProviderConfig>

Overrides:

authenticationFinished in class AbstractIdentityProvider<C extends OAuth2IdentityProviderConfig>

authenticateTokenRequest

public SimpleHttpRequest authenticateTokenRequest(SimpleHttpRequest tokenRequest)

generateToken

protected JsonWebToken generateToken()

getSignatureContext

protected SignatureSignerContext getSignatureContext()

getProfileEndpointForValidation

protected String getProfileEndpointForValidation(EventBuilder event)

extractIdentityFromProfile

protected BrokeredIdentityContext extractIdentityFromProfile(EventBuilder event,
 com.fasterxml.jackson.databind.JsonNode node)

validateExternalTokenThroughUserInfo

protected BrokeredIdentityContext validateExternalTokenThroughUserInfo(EventBuilder event,
 String subjectToken,
 String subjectTokenType)

buildUserInfoRequest

protected SimpleHttpRequest buildUserInfoRequest(String subjectToken,
 String userInfoUrl)

supportsExternalExchange

protected boolean supportsExternalExchange()

isIssuer

public boolean isIssuer(String issuer,
 jakarta.ws.rs.core.MultivaluedMap<String,String> params)

Specified by:

isIssuer in interface ExchangeExternalToken

exchangeExternal

public final BrokeredIdentityContext exchangeExternal(TokenExchangeProvider tokenExchangeProvider,
 TokenExchangeContext tokenExchangeContext)

Specified by:

exchangeExternal in interface ExchangeExternalToken

exchangeExternalTokenV1Impl

protected BrokeredIdentityContext exchangeExternalTokenV1Impl(EventBuilder event,
 jakarta.ws.rs.core.MultivaluedMap<String,String> params)

Usage with token-exchange V1

Parameters:

event - event builder

params - parameters of the token-exchange request

Returns:

brokered identity context with the details about user from the IDP

exchangeExternalTokenV2Impl

protected BrokeredIdentityContext exchangeExternalTokenV2Impl(TokenExchangeContext tokenExchangeContext)

Usage with external-internal token-exchange v2.

Parameters:

tokenExchangeContext - data about token-exchange request

Returns:

brokered identity context with the details about user from the IDP

validateExternalTokenWithIntrospectionEndpoint

protected void validateExternalTokenWithIntrospectionEndpoint(TokenExchangeContext tokenExchangeContext)

Called usually during external-internal token exchange for validation of external token, which is the token issued by the IDP. The validation of external token is done by calling OAuth2 introspection endpoint on the IDP side and validate if the response contains all the necessary claims and token is authorized for the token exchange (including validating of claims like aud from introspection response)

Parameters:

tokenExchangeContext - token exchange context with the external token (subject token) and other details related to token exchange

Throws:

ErrorResponseException - in case that validation failed for any reason

sendTokenIntrospectionRequest

protected TokenMetadataRepresentation sendTokenIntrospectionRequest(String idpAccessToken,
 EventBuilder event)

Send introspection request as specified in the OAuth2 token introspection specification. It requires

Parameters:

idpAccessToken - access token issued by the IDP

event - event builder

Returns:

token metadata in case that token introspection was successful and token is valid and active

Throws:

ErrorResponseException - in case that introspection response was not correct for any reason (other status than 200) or the token was not active

exchangeExternalUserInfoValidationOnly

protected BrokeredIdentityContext exchangeExternalUserInfoValidationOnly(EventBuilder event,
 jakarta.ws.rs.core.MultivaluedMap<String,String> params)

exchangeExternalComplete

public void exchangeExternalComplete(UserSessionModel userSession,
 BrokeredIdentityContext context,
 jakarta.ws.rs.core.MultivaluedMap<String,String> params)

Specified by:

exchangeExternalComplete in interface ExchangeExternalToken

supportsLongStateParameter

public boolean supportsLongStateParameter()

Specified by:

supportsLongStateParameter in interface IdentityProvider<C extends OAuth2IdentityProviderConfig>

Returns:

true if identity provider supports long value of "state" parameter (or "RelayState" parameter), which can hold relatively big amount of context data