Package org.keycloak.protocol.oidc

Class OIDCLoginProtocol

java.lang.Object

org.keycloak.protocol.oidc.OIDCLoginProtocol

All Implemented Interfaces:

LoginProtocol, Provider

public class OIDCLoginProtocol
extends Object
implements LoginProtocol

Author:

Bill Burke, Stian Thorgersen

Nested Class Summary

Nested classes/interfaces inherited from interface org.keycloak.protocol.LoginProtocol

LoginProtocol.Error

Field Summary

Fields

Modifier and Type	Field	Description
static final String	ACR_PARAM
static final String	CLAIMS_PARAM
static final String	CLIENT_ID_PARAM
static final String	CLIENT_SECRET_BASIC
static final String	CLIENT_SECRET_BASIC_UNENCODED	Deprecated, for removal: This API element is subject to removal in a future version.
static final String	CLIENT_SECRET_JWT
static final String	CLIENT_SECRET_POST
static final String	CODE_CHALLENGE_METHOD_PARAM
static final String	CODE_CHALLENGE_PARAM
static final String	CODE_PARAM
static final String	DPOP_JKT
protected EventBuilder	event
static final String	GRANT_TYPE_PARAM
protected jakarta.ws.rs.core.HttpHeaders	headers
static final String	ID_TOKEN_HINT
static final String	ISSUER
static final String	LOGIN_HINT_PARAM
static final String	LOGIN_PROTOCOL
static final String	LOGOUT_REDIRECT_URI
static final String	LOGOUT_STATE_PARAM
static final String	LOGOUT_VALIDATED_ID_TOKEN_ISSUED_AT
static final String	LOGOUT_VALIDATED_ID_TOKEN_SESSION_STATE
static final String	MAX_AGE_PARAM
static final String	NONCE_PARAM
static final int	PKCE_CODE_CHALLENGE_MAX_LENGTH
static final int	PKCE_CODE_CHALLENGE_MIN_LENGTH
static final int	PKCE_CODE_VERIFIER_MAX_LENGTH
static final int	PKCE_CODE_VERIFIER_MIN_LENGTH
static final String	PKCE_METHOD_PLAIN
static final String	PKCE_METHOD_S256
static final String	POST_LOGOUT_REDIRECT_URI_PARAM
static final String	PRIVATE_KEY_JWT
static final String	PROMPT_PARAM
static final String	PROMPT_VALUE_CONSENT
static final String	PROMPT_VALUE_CREATE
static final String	PROMPT_VALUE_LOGIN
static final String	PROMPT_VALUE_NONE
static final String	PROMPT_VALUE_SELECT_ACCOUNT
protected OIDCProviderConfig	providerConfig
protected RealmModel	realm
static final String	REDIRECT_URI_PARAM
static final String	REQUEST_PARAM
static final String	REQUEST_URI_PARAM
static final String	RESPONSE_MODE_PARAM
static final String	RESPONSE_TYPE_PARAM
protected OIDCResponseMode	responseMode
protected OIDCResponseType	responseType
static final String	SCOPE_PARAM
protected KeycloakSession	session
static final String	STATE_PARAM
static final String	TLS_CLIENT_AUTH
static final String	UI_LOCALES_PARAM
protected jakarta.ws.rs.core.UriInfo	uriInfo

Constructor Summary

Constructors

Constructor	Description
OIDCLoginProtocol(KeycloakSession session, RealmModel realm, jakarta.ws.rs.core.UriInfo uriInfo, jakarta.ws.rs.core.HttpHeaders headers, EventBuilder event)
OIDCLoginProtocol(OIDCProviderConfig providerConfig)

Method Summary

Modifier and Type	Method	Description
jakarta.ws.rs.core.Response	authenticated(AuthenticationSessionModel authSession, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
jakarta.ws.rs.core.Response	backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession)
jakarta.ws.rs.core.Response	buildRedirectUri(OIDCRedirectUriBuilder redirectUriBuilder, AuthenticationSessionModel authSession, UserSessionModel userSession, ClientSessionContext clientSessionCtx)	this method can be used in extension-implementations to the OIDCLoginProtocol to add additional parameters to the redirectUri after successful authentication and to store these e.g.
jakarta.ws.rs.core.Response	buildRedirectUri(OIDCRedirectUriBuilder redirectUriBuilder, AuthenticationSessionModel authSession, UserSessionModel userSession, ClientSessionContext clientSessionCtx, Exception ex, LoginProtocol.Error oidcError)	this method can be used in extension-implementations to the OIDCLoginProtocol to add additional parameters to the redirectUri after failed authentication
void	close()
jakarta.ws.rs.core.Response	finishBrowserLogout(UserSessionModel userSession, AuthenticationSessionModel logoutSession)	This method is called when browser logout is going to be finished.
jakarta.ws.rs.core.Response	frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession)
ClientData	getClientData(AuthenticationSessionModel authSession)	Returns client data, which will be wrapped in the "clientData" parameter sent within "authentication flow" requests.
OIDCProviderConfig	getConfig()
protected boolean	isAuthTimeExpired(UserSessionModel userSession, AuthenticationSessionModel authSession)
protected boolean	isPromptLogin(AuthenticationSessionModel authSession)
protected boolean	isReAuthRequiredForKcAction(UserSessionModel userSession, AuthenticationSessionModel authSession)
boolean	requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession)
jakarta.ws.rs.core.Response	sendError(ClientModel client, ClientData clientData, LoginProtocol.Error error)	Send the specified error to the specified client with the use of this protocol.
jakarta.ws.rs.core.Response	sendError(AuthenticationSessionModel authSession, LoginProtocol.Error error, String errorMessage)
boolean	sendPushRevocationPolicyRequest(RealmModel realm, ClientModel resource, int notBefore, String managementUrl)	Send not-before revocation policy to the given client.
OIDCLoginProtocol	setEventBuilder(EventBuilder event)
OIDCLoginProtocol	setHttpHeaders(jakarta.ws.rs.core.HttpHeaders headers)
OIDCLoginProtocol	setRealm(RealmModel realm)
OIDCLoginProtocol	setSession(KeycloakSession session)
OIDCLoginProtocol	setUriInfo(jakarta.ws.rs.core.UriInfo uriInfo)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOGIN_PROTOCOL

public static final String LOGIN_PROTOCOL

See Also:

• Constant Field Values

STATE_PARAM

public static final String STATE_PARAM

See Also:

• Constant Field Values

SCOPE_PARAM

public static final String SCOPE_PARAM

See Also:

• Constant Field Values

CODE_PARAM

public static final String CODE_PARAM

See Also:

• Constant Field Values

RESPONSE_TYPE_PARAM

public static final String RESPONSE_TYPE_PARAM

See Also:

• Constant Field Values

GRANT_TYPE_PARAM

public static final String GRANT_TYPE_PARAM

See Also:

• Constant Field Values

REDIRECT_URI_PARAM

public static final String REDIRECT_URI_PARAM

See Also:

• Constant Field Values

POST_LOGOUT_REDIRECT_URI_PARAM

public static final String POST_LOGOUT_REDIRECT_URI_PARAM

See Also:

• Constant Field Values

CLIENT_ID_PARAM

public static final String CLIENT_ID_PARAM

See Also:

• Constant Field Values

NONCE_PARAM

public static final String NONCE_PARAM

See Also:

• Constant Field Values

MAX_AGE_PARAM

public static final String MAX_AGE_PARAM

See Also:

• Constant Field Values

PROMPT_PARAM

public static final String PROMPT_PARAM

See Also:

• Constant Field Values

LOGIN_HINT_PARAM

public static final String LOGIN_HINT_PARAM

See Also:

• Constant Field Values

REQUEST_PARAM

public static final String REQUEST_PARAM

See Also:

• Constant Field Values

REQUEST_URI_PARAM

public static final String REQUEST_URI_PARAM

See Also:

• Constant Field Values

UI_LOCALES_PARAM

public static final String UI_LOCALES_PARAM

See Also:

• Constant Field Values

CLAIMS_PARAM

public static final String CLAIMS_PARAM

See Also:

• Constant Field Values

ACR_PARAM

public static final String ACR_PARAM

See Also:

• Constant Field Values

ID_TOKEN_HINT

public static final String ID_TOKEN_HINT

See Also:

• Constant Field Values

LOGOUT_STATE_PARAM

public static final String LOGOUT_STATE_PARAM

See Also:

• Constant Field Values

LOGOUT_REDIRECT_URI

public static final String LOGOUT_REDIRECT_URI

See Also:

• Constant Field Values

LOGOUT_VALIDATED_ID_TOKEN_SESSION_STATE

public static final String LOGOUT_VALIDATED_ID_TOKEN_SESSION_STATE

See Also:

• Constant Field Values

LOGOUT_VALIDATED_ID_TOKEN_ISSUED_AT

public static final String LOGOUT_VALIDATED_ID_TOKEN_ISSUED_AT

See Also:

• Constant Field Values

ISSUER

public static final String ISSUER

See Also:

• Constant Field Values

RESPONSE_MODE_PARAM

public static final String RESPONSE_MODE_PARAM

See Also:

• Constant Field Values

PROMPT_VALUE_NONE

public static final String PROMPT_VALUE_NONE

See Also:

• Constant Field Values

PROMPT_VALUE_LOGIN

public static final String PROMPT_VALUE_LOGIN

See Also:

• Constant Field Values

PROMPT_VALUE_CONSENT

public static final String PROMPT_VALUE_CONSENT

See Also:

• Constant Field Values

PROMPT_VALUE_CREATE

public static final String PROMPT_VALUE_CREATE

See Also:

• Constant Field Values

PROMPT_VALUE_SELECT_ACCOUNT

public static final String PROMPT_VALUE_SELECT_ACCOUNT

See Also:

• Constant Field Values

CLIENT_SECRET_BASIC

public static final String CLIENT_SECRET_BASIC

See Also:

• Constant Field Values

CLIENT_SECRET_POST

public static final String CLIENT_SECRET_POST

See Also:

• Constant Field Values

CLIENT_SECRET_JWT

public static final String CLIENT_SECRET_JWT

See Also:

• Constant Field Values

PRIVATE_KEY_JWT

public static final String PRIVATE_KEY_JWT

See Also:

• Constant Field Values

TLS_CLIENT_AUTH

public static final String TLS_CLIENT_AUTH

See Also:

• Constant Field Values

CLIENT_SECRET_BASIC_UNENCODED

@Deprecated(since="26.5",
            forRemoval=true)
public static final String CLIENT_SECRET_BASIC_UNENCODED

Deprecated, for removal: This API element is subject to removal in a future version.

This is just for legacy setups which expect an unencoded, non-RFC6749 compliant client secret send from Keycloak to an IdP.

See Also:

• Constant Field Values

CODE_CHALLENGE_PARAM

public static final String CODE_CHALLENGE_PARAM

See Also:

• Constant Field Values

CODE_CHALLENGE_METHOD_PARAM

public static final String CODE_CHALLENGE_METHOD_PARAM

See Also:

• Constant Field Values

PKCE_CODE_CHALLENGE_MIN_LENGTH

public static final int PKCE_CODE_CHALLENGE_MIN_LENGTH

See Also:

• Constant Field Values

PKCE_CODE_CHALLENGE_MAX_LENGTH

public static final int PKCE_CODE_CHALLENGE_MAX_LENGTH

See Also:

• Constant Field Values

PKCE_CODE_VERIFIER_MIN_LENGTH

public static final int PKCE_CODE_VERIFIER_MIN_LENGTH

See Also:

• Constant Field Values

PKCE_CODE_VERIFIER_MAX_LENGTH

public static final int PKCE_CODE_VERIFIER_MAX_LENGTH

See Also:

• Constant Field Values

PKCE_METHOD_PLAIN

public static final String PKCE_METHOD_PLAIN

See Also:

• Constant Field Values

PKCE_METHOD_S256

public static final String PKCE_METHOD_S256

See Also:

• Constant Field Values

DPOP_JKT

public static final String DPOP_JKT

See Also:

• Constant Field Values

session

protected KeycloakSession session

realm

protected RealmModel realm

uriInfo

protected jakarta.ws.rs.core.UriInfo uriInfo

headers

protected jakarta.ws.rs.core.HttpHeaders headers

event

protected EventBuilder event

responseType

protected OIDCResponseType responseType

responseMode

protected OIDCResponseMode responseMode

providerConfig

protected OIDCProviderConfig providerConfig

Constructor Details

OIDCLoginProtocol

public OIDCLoginProtocol(KeycloakSession session,
 RealmModel realm,
 jakarta.ws.rs.core.UriInfo uriInfo,
 jakarta.ws.rs.core.HttpHeaders headers,
 EventBuilder event)

OIDCLoginProtocol

public OIDCLoginProtocol(OIDCProviderConfig providerConfig)

Method Details

setSession

public OIDCLoginProtocol setSession(KeycloakSession session)

Specified by:

setSession in interface LoginProtocol

setRealm

public OIDCLoginProtocol setRealm(RealmModel realm)

Specified by:

setRealm in interface LoginProtocol

setUriInfo

public OIDCLoginProtocol setUriInfo(jakarta.ws.rs.core.UriInfo uriInfo)

Specified by:

setUriInfo in interface LoginProtocol

setHttpHeaders

public OIDCLoginProtocol setHttpHeaders(jakarta.ws.rs.core.HttpHeaders headers)

Specified by:

setHttpHeaders in interface LoginProtocol

setEventBuilder

public OIDCLoginProtocol setEventBuilder(EventBuilder event)

Specified by:

setEventBuilder in interface LoginProtocol

getConfig

public OIDCProviderConfig getConfig()

authenticated

public jakarta.ws.rs.core.Response authenticated(AuthenticationSessionModel authSession,
 UserSessionModel userSession,
 ClientSessionContext clientSessionCtx)

Specified by:

authenticated in interface LoginProtocol

buildRedirectUri

public jakarta.ws.rs.core.Response buildRedirectUri(OIDCRedirectUriBuilder redirectUriBuilder,
 AuthenticationSessionModel authSession,
 UserSessionModel userSession,
 ClientSessionContext clientSessionCtx)

this method can be used in extension-implementations to the OIDCLoginProtocol to add additional parameters to the redirectUri after successful authentication and to store these e.g. in the clientSession

buildRedirectUri

public jakarta.ws.rs.core.Response buildRedirectUri(OIDCRedirectUriBuilder redirectUriBuilder,
 AuthenticationSessionModel authSession,
 UserSessionModel userSession,
 ClientSessionContext clientSessionCtx,
 Exception ex,
 LoginProtocol.Error oidcError)

this method can be used in extension-implementations to the OIDCLoginProtocol to add additional parameters to the redirectUri after failed authentication

sendError

public jakarta.ws.rs.core.Response sendError(AuthenticationSessionModel authSession,
 LoginProtocol.Error error,
 String errorMessage)

Specified by:

sendError in interface LoginProtocol

getClientData

public ClientData getClientData(AuthenticationSessionModel authSession)

Description copied from interface: LoginProtocol

Returns client data, which will be wrapped in the "clientData" parameter sent within "authentication flow" requests. The purpose of clientData is to be able to send HTTP error response back to the client if authentication fails due some error and authenticationSession is not available anymore (was either expired or removed). So clientData need to contain all the data to be able to send such response. For instance redirect-uri, state in case of OIDC or RelayState in case of SAML etc.

Specified by:

getClientData in interface LoginProtocol

Parameters:

authSession - session from which particular clientData can be retrieved

Returns:

client data, which will be wrapped in the "clientData" parameter sent within "authentication flow" requests

sendError

public jakarta.ws.rs.core.Response sendError(ClientModel client,
 ClientData clientData,
 LoginProtocol.Error error)

Description copied from interface: LoginProtocol

Send the specified error to the specified client with the use of this protocol. ClientData can contain additional metadata about how to send error response to the client in a correct way for particular protocol. For instance redirect-uri where to send error, state to be used in OIDC authorization endpoint response etc. This method is usually used when we don't have authenticationSession anymore (it was removed or expired) as otherwise it is recommended to use #sendError(AuthenticationSessionModel, Error) NOTE: This method should also validate if provided clientData are valid according to given client (for instance if redirect-uri is valid) as clientData is request parameter, which can be injected to HTTP URLs by anyone.

Specified by:

sendError in interface LoginProtocol

Parameters:

client - client where to send error

clientData - clientData with additional protocol specific metadata needed for being able to properly send error with the use of this protocol

error - error to be used

Returns:

response if error was sent. Null if error was not sent.

backchannelLogout

public jakarta.ws.rs.core.Response backchannelLogout(UserSessionModel userSession,
 AuthenticatedClientSessionModel clientSession)

Specified by:

backchannelLogout in interface LoginProtocol

frontchannelLogout

public jakarta.ws.rs.core.Response frontchannelLogout(UserSessionModel userSession,
 AuthenticatedClientSessionModel clientSession)

Specified by:

frontchannelLogout in interface LoginProtocol

finishBrowserLogout

public jakarta.ws.rs.core.Response finishBrowserLogout(UserSessionModel userSession,
 AuthenticationSessionModel logoutSession)

Description copied from interface: LoginProtocol

This method is called when browser logout is going to be finished. It is not triggered during backchannel logout

Specified by:

finishBrowserLogout in interface LoginProtocol

Parameters:

userSession - user session, which was logged out

logoutSession - authentication session, which was used during logout to track the logout state

Returns:

response to be sent to the client

requireReauthentication

public boolean requireReauthentication(UserSessionModel userSession,
 AuthenticationSessionModel authSession)

Specified by:

requireReauthentication in interface LoginProtocol

Returns:

true if SSO cookie authentication can't be used. User will need to "actively" reauthenticate

isPromptLogin

protected boolean isPromptLogin(AuthenticationSessionModel authSession)

isAuthTimeExpired

protected boolean isAuthTimeExpired(UserSessionModel userSession,
 AuthenticationSessionModel authSession)

isReAuthRequiredForKcAction

protected boolean isReAuthRequiredForKcAction(UserSessionModel userSession,
 AuthenticationSessionModel authSession)

sendPushRevocationPolicyRequest

public boolean sendPushRevocationPolicyRequest(RealmModel realm,
 ClientModel resource,
 int notBefore,
 String managementUrl)

Description copied from interface: LoginProtocol

Send not-before revocation policy to the given client.

Specified by:

sendPushRevocationPolicyRequest in interface LoginProtocol

Returns:

true if revocation policy was successfully updated at the client, false otherwise.

close

public void close()

Specified by:

close in interface Provider