Package org.keycloak.services.managers

Class AuthenticationManager

java.lang.Object

org.keycloak.services.managers.AuthenticationManager

Direct Known Subclasses:

AppAuthManager

public class AuthenticationManager
extends Object

Stateless object that manages authentication

Version:

$Revision: 1 $

Author:

Bill Burke

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	AuthenticationManager.AuthenticationStatus
static class	AuthenticationManager.AuthResult

Field Summary

Fields

Modifier and Type	Field	Description
static final String	AUTH_TIME
static final String	AUTH_TIME_BROKER
static final String	CLIENT_LOGOUT_STATE	Auth session note on client logout state (when logging out)
static final String	END_AFTER_REQUIRED_ACTIONS
static final String	FORCED_REAUTHENTICATION
static final String	FORM_USERNAME
static final String	INITIATING_IDP_PARAM
static final String	INVALIDATE_ACTION_TOKEN
static final String	KEYCLOAK_LOGOUT_PROTOCOL
static final String	KEYCLOAK_SESSION_COOKIE
protected static final org.jboss.logging.Logger	logger
static final String	LOGOUT_INITIATING_IDP
static final String	LOGOUT_WITH_SYSTEM_CLIENT
static final String	PASSWORD_VALIDATED
static final String	SET_REDIRECT_URI_AFTER_REQUIRED_ACTIONS
static final String	SSO_AUTH
static final String	USER_SESSION_PERSISTENT_STATE	Auth session note, which indicates if user session will be persistent (Saved to real persistent store) or transient (transient session will be scoped to single request and hence there is no need to save it in the underlying store)

Constructor Summary

Constructors

Constructor	Description
AuthenticationManager()

Method Summary

Modifier and Type	Method	Description
AuthenticationManager.AuthResult	authenticateIdentityCookie(KeycloakSession session, RealmModel realm)
static AuthenticationManager.AuthResult	authenticateIdentityCookie(KeycloakSession session, RealmModel realm, boolean checkActive)
static BackchannelLogoutResponse	backchannelLogout(KeycloakSession session, RealmModel realm, UserSessionModel userSession, jakarta.ws.rs.core.UriInfo uriInfo, ClientConnection connection, jakarta.ws.rs.core.HttpHeaders headers, boolean logoutBroker)
static BackchannelLogoutResponse	backchannelLogout(KeycloakSession session, RealmModel realm, UserSessionModel userSession, jakarta.ws.rs.core.UriInfo uriInfo, ClientConnection connection, jakarta.ws.rs.core.HttpHeaders headers, boolean logoutBroker, boolean offlineSession)
static void	backchannelLogout(KeycloakSession session, UserSessionModel userSession, boolean logoutBroker)
static void	backchannelLogoutUserFromClient(KeycloakSession session, RealmModel realm, UserModel user, ClientModel client, jakarta.ws.rs.core.UriInfo uriInfo, jakarta.ws.rs.core.HttpHeaders headers)	Logout all clientSessions of this user and client
static jakarta.ws.rs.core.Response	browserLogout(KeycloakSession session, RealmModel realm, UserSessionModel userSession, jakarta.ws.rs.core.UriInfo uriInfo, ClientConnection connection, jakarta.ws.rs.core.HttpHeaders headers)
static boolean	compareSessionIdWithSessionCookie(KeycloakSession session, String sessionId)
static IdentityCookieToken	createIdentityToken(KeycloakSession keycloakSession, RealmModel realm, UserModel user, UserSessionModel session, String issuer)
static void	createLoginCookie(KeycloakSession keycloakSession, RealmModel realm, UserModel user, UserSessionModel session, jakarta.ws.rs.core.UriInfo uriInfo, ClientConnection connection)
static AuthenticationSessionModel	createOrJoinLogoutSession(KeycloakSession session, RealmModel realm, AuthenticationSessionManager asm, UserSessionModel userSession, boolean browserCookie, boolean initiateLogout)
static void	createRememberMeCookie(String username, jakarta.ws.rs.core.UriInfo uriInfo, KeycloakSession session)
static RequiredActionProvider	createRequiredAction(RequiredActionContextResult context)
static void	evaluateRequiredActionTriggers(KeycloakSession session, AuthenticationSessionModel authSession, HttpRequest request, EventBuilder event, RealmModel realm, UserModel user)
protected static jakarta.ws.rs.core.Response	executionActions(KeycloakSession session, AuthenticationSessionModel authSession, HttpRequest request, EventBuilder event, RealmModel realm, UserModel user, Set<String> ignoredActions)
static void	expireAuthSessionCookie(KeycloakSession session)
static void	expireIdentityCookie(KeycloakSession session)
static void	expireRememberMeCookie(KeycloakSession session)
static boolean	expireUserSessionCookie(KeycloakSession session, UserSessionModel userSession, RealmModel realm, jakarta.ws.rs.core.UriInfo uriInfo, jakarta.ws.rs.core.HttpHeaders headers, ClientConnection connection)
static jakarta.ws.rs.core.Response	finishBrowserLogout(KeycloakSession session, RealmModel realm, UserSessionModel userSession, jakarta.ws.rs.core.UriInfo uriInfo, ClientConnection connection, jakarta.ws.rs.core.HttpHeaders headers)
static jakarta.ws.rs.core.Response	finishedRequiredActions(KeycloakSession session, AuthenticationSessionModel authSession, UserSessionModel userSession, ClientConnection clientConnection, HttpRequest request, jakarta.ws.rs.core.UriInfo uriInfo, EventBuilder event)
static void	finishUnconfirmedUserSession(KeycloakSession session, RealmModel realm, UserSessionModel userSessionModel)
static CommonClientSessionModel.Action	getClientLogoutAction(AuthenticationSessionModel logoutAuthSession, String clientUuid)	Returns the logout state of the particular client as per the logoutAuthSession
static String	getRealmCookiePath(RealmModel realm, jakarta.ws.rs.core.UriInfo uriInfo)
static String	getRememberMeUsername(KeycloakSession session)
static String	getRequestedScopes(KeycloakSession session)
static String	getRequestedScopes(KeycloakSession session, ClientModel client)
static boolean	isClientSessionValid(RealmModel realm, ClientModel client, UserSessionModel userSession, AuthenticatedClientSessionModel clientSession)
static boolean	isSessionValid(RealmModel realm, UserSessionModel userSession)
static boolean	isSSOAuthentication(AuthenticatedClientSessionModel clientSession)
static void	logSuccess(KeycloakSession session, AuthenticationSessionModel authSession)
static UserModel	lookupUserForBruteForceLog(KeycloakSession session, RealmModel realm, AuthenticationSessionModel authenticationSession)
static jakarta.ws.rs.core.Response	nextActionAfterAuthentication(KeycloakSession session, AuthenticationSessionModel authSession, ClientConnection clientConnection, HttpRequest request, jakarta.ws.rs.core.UriInfo uriInfo, EventBuilder event)
static String	nextRequiredAction(KeycloakSession session, AuthenticationSessionModel authSession, HttpRequest request, EventBuilder event)
static jakarta.ws.rs.core.Response	redirectAfterSuccessfulFlow(KeycloakSession session, RealmModel realm, UserSessionModel userSession, ClientSessionContext clientSessionCtx, HttpRequest request, jakarta.ws.rs.core.UriInfo uriInfo, ClientConnection clientConnection, EventBuilder event, AuthenticationSessionModel authSession)
static jakarta.ws.rs.core.Response	redirectAfterSuccessfulFlow(KeycloakSession session, RealmModel realm, UserSessionModel userSession, ClientSessionContext clientSessionCtx, HttpRequest request, jakarta.ws.rs.core.UriInfo uriInfo, ClientConnection clientConnection, EventBuilder event, AuthenticationSessionModel authSession, LoginProtocol protocol)
static jakarta.ws.rs.core.Response	redirectToRequiredActions(KeycloakSession session, RealmModel realm, AuthenticationSessionModel authSession, jakarta.ws.rs.core.UriInfo uriInfo, String requiredAction)
static void	resolveLightweightAccessTokenRoles(KeycloakSession session, AccessToken accessToken, RealmModel realm)
static void	setClientLogoutAction(AuthenticationSessionModel logoutAuthSession, String clientUuid, CommonClientSessionModel.Action action)	Sets logout state of the particular client into the logoutAuthSession
static void	setClientScopesInSession(KeycloakSession session, AuthenticationSessionModel authSession)
static void	setKcActionStatus(String executedProviderId, RequiredActionContext.KcActionStatus status, AuthenticationSessionModel authSession)
static void	setKcActionToEnforced(String executedProviderId, AuthenticationSessionModel authSession)
static String	sha256UrlEncodedHash(String input)
static AuthenticationManager.AuthResult	verifyIdentityToken(KeycloakSession session, RealmModel realm, jakarta.ws.rs.core.UriInfo uriInfo, ClientConnection connection, boolean checkActive, boolean checkTokenType, String checkAudience, boolean isCookie, String tokenString, jakarta.ws.rs.core.HttpHeaders headers, Consumer<TokenVerifier<AccessToken>> verifierConsumer)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

SET_REDIRECT_URI_AFTER_REQUIRED_ACTIONS

public static final String SET_REDIRECT_URI_AFTER_REQUIRED_ACTIONS

See Also:

• Constant Field Values

END_AFTER_REQUIRED_ACTIONS

public static final String END_AFTER_REQUIRED_ACTIONS

See Also:

• Constant Field Values

INVALIDATE_ACTION_TOKEN

public static final String INVALIDATE_ACTION_TOKEN

See Also:

• Constant Field Values

USER_SESSION_PERSISTENT_STATE

public static final String USER_SESSION_PERSISTENT_STATE

Auth session note, which indicates if user session will be persistent (Saved to real persistent store) or transient (transient session will be scoped to single request and hence there is no need to save it in the underlying store)

See Also:

• Constant Field Values

CLIENT_LOGOUT_STATE

public static final String CLIENT_LOGOUT_STATE

Auth session note on client logout state (when logging out)

See Also:

• Constant Field Values

AUTH_TIME

public static final String AUTH_TIME

See Also:

• Constant Field Values

AUTH_TIME_BROKER

public static final String AUTH_TIME_BROKER

See Also:

• Constant Field Values

SSO_AUTH

public static final String SSO_AUTH

See Also:

• Constant Field Values

FORCED_REAUTHENTICATION

public static final String FORCED_REAUTHENTICATION

See Also:

• Constant Field Values

PASSWORD_VALIDATED

public static final String PASSWORD_VALIDATED

See Also:

• Constant Field Values

logger

protected static final org.jboss.logging.Logger logger

FORM_USERNAME

public static final String FORM_USERNAME

See Also:

• Constant Field Values

KEYCLOAK_SESSION_COOKIE

public static final String KEYCLOAK_SESSION_COOKIE

See Also:

• Constant Field Values

LOGOUT_WITH_SYSTEM_CLIENT

public static final String LOGOUT_WITH_SYSTEM_CLIENT

See Also:

• Constant Field Values

KEYCLOAK_LOGOUT_PROTOCOL

public static final String KEYCLOAK_LOGOUT_PROTOCOL

See Also:

• Constant Field Values

LOGOUT_INITIATING_IDP

public static final String LOGOUT_INITIATING_IDP

See Also:

• Constant Field Values

INITIATING_IDP_PARAM

public static final String INITIATING_IDP_PARAM

See Also:

• Constant Field Values

Constructor Details

AuthenticationManager

public AuthenticationManager()

Method Details

isSessionValid

public static boolean isSessionValid(RealmModel realm,
 UserSessionModel userSession)

isClientSessionValid

public static boolean isClientSessionValid(RealmModel realm,
 ClientModel client,
 UserSessionModel userSession,
 AuthenticatedClientSessionModel clientSession)

expireUserSessionCookie

public static boolean expireUserSessionCookie(KeycloakSession session,
 UserSessionModel userSession,
 RealmModel realm,
 jakarta.ws.rs.core.UriInfo uriInfo,
 jakarta.ws.rs.core.HttpHeaders headers,
 ClientConnection connection)

backchannelLogout

public static void backchannelLogout(KeycloakSession session,
 UserSessionModel userSession,
 boolean logoutBroker)

backchannelLogout

public static BackchannelLogoutResponse backchannelLogout(KeycloakSession session,
 RealmModel realm,
 UserSessionModel userSession,
 jakarta.ws.rs.core.UriInfo uriInfo,
 ClientConnection connection,
 jakarta.ws.rs.core.HttpHeaders headers,
 boolean logoutBroker)

backchannelLogout

public static BackchannelLogoutResponse backchannelLogout(KeycloakSession session,
 RealmModel realm,
 UserSessionModel userSession,
 jakarta.ws.rs.core.UriInfo uriInfo,
 ClientConnection connection,
 jakarta.ws.rs.core.HttpHeaders headers,
 boolean logoutBroker,
 boolean offlineSession)

Parameters:

session -

realm -

userSession -

uriInfo -

connection -

headers -

logoutBroker -

offlineSession -

Returns:

BackchannelLogoutResponse with logout information

createOrJoinLogoutSession

public static AuthenticationSessionModel createOrJoinLogoutSession(KeycloakSession session,
 RealmModel realm,
 AuthenticationSessionManager asm,
 UserSessionModel userSession,
 boolean browserCookie,
 boolean initiateLogout)

setClientLogoutAction

public static void setClientLogoutAction(AuthenticationSessionModel logoutAuthSession,
 String clientUuid,
 CommonClientSessionModel.Action action)

Sets logout state of the particular client into the logoutAuthSession

Parameters:

logoutAuthSession - logoutAuthSession. May be null in which case this is a no-op.

clientUuid - Client. Must not be null

action -

getClientLogoutAction

public static CommonClientSessionModel.Action getClientLogoutAction(AuthenticationSessionModel logoutAuthSession,
 String clientUuid)

Returns the logout state of the particular client as per the logoutAuthSession

Parameters:

logoutAuthSession - logoutAuthSession. May be null in which case this is a no-op.

clientUuid - Internal ID of the client. Must not be null

Returns:

State if it can be determined, null otherwise.

backchannelLogoutUserFromClient

public static void backchannelLogoutUserFromClient(KeycloakSession session,
 RealmModel realm,
 UserModel user,
 ClientModel client,
 jakarta.ws.rs.core.UriInfo uriInfo,
 jakarta.ws.rs.core.HttpHeaders headers)

Logout all clientSessions of this user and client

Parameters:

session -

realm -

user -

client -

uriInfo -

headers -

browserLogout

public static jakarta.ws.rs.core.Response browserLogout(KeycloakSession session,
 RealmModel realm,
 UserSessionModel userSession,
 jakarta.ws.rs.core.UriInfo uriInfo,
 ClientConnection connection,
 jakarta.ws.rs.core.HttpHeaders headers)

finishBrowserLogout

public static jakarta.ws.rs.core.Response finishBrowserLogout(KeycloakSession session,
 RealmModel realm,
 UserSessionModel userSession,
 jakarta.ws.rs.core.UriInfo uriInfo,
 ClientConnection connection,
 jakarta.ws.rs.core.HttpHeaders headers)

finishUnconfirmedUserSession

public static void finishUnconfirmedUserSession(KeycloakSession session,
 RealmModel realm,
 UserSessionModel userSessionModel)

createIdentityToken

public static IdentityCookieToken createIdentityToken(KeycloakSession keycloakSession,
 RealmModel realm,
 UserModel user,
 UserSessionModel session,
 String issuer)

createLoginCookie

public static void createLoginCookie(KeycloakSession keycloakSession,
 RealmModel realm,
 UserModel user,
 UserSessionModel session,
 jakarta.ws.rs.core.UriInfo uriInfo,
 ClientConnection connection)

createRememberMeCookie

public static void createRememberMeCookie(String username,
 jakarta.ws.rs.core.UriInfo uriInfo,
 KeycloakSession session)

getRememberMeUsername

public static String getRememberMeUsername(KeycloakSession session)

expireIdentityCookie

public static void expireIdentityCookie(KeycloakSession session)

expireRememberMeCookie

public static void expireRememberMeCookie(KeycloakSession session)

expireAuthSessionCookie

public static void expireAuthSessionCookie(KeycloakSession session)

getRealmCookiePath

public static String getRealmCookiePath(RealmModel realm,
 jakarta.ws.rs.core.UriInfo uriInfo)

authenticateIdentityCookie

public AuthenticationManager.AuthResult authenticateIdentityCookie(KeycloakSession session,
 RealmModel realm)

authenticateIdentityCookie

public static AuthenticationManager.AuthResult authenticateIdentityCookie(KeycloakSession session,
 RealmModel realm,
 boolean checkActive)

redirectAfterSuccessfulFlow

public static jakarta.ws.rs.core.Response redirectAfterSuccessfulFlow(KeycloakSession session,
 RealmModel realm,
 UserSessionModel userSession,
 ClientSessionContext clientSessionCtx,
 HttpRequest request,
 jakarta.ws.rs.core.UriInfo uriInfo,
 ClientConnection clientConnection,
 EventBuilder event,
 AuthenticationSessionModel authSession)

redirectAfterSuccessfulFlow

public static jakarta.ws.rs.core.Response redirectAfterSuccessfulFlow(KeycloakSession session,
 RealmModel realm,
 UserSessionModel userSession,
 ClientSessionContext clientSessionCtx,
 HttpRequest request,
 jakarta.ws.rs.core.UriInfo uriInfo,
 ClientConnection clientConnection,
 EventBuilder event,
 AuthenticationSessionModel authSession,
 LoginProtocol protocol)

compareSessionIdWithSessionCookie

public static boolean compareSessionIdWithSessionCookie(KeycloakSession session,
 String sessionId)

Parameters:

session - keycloak session

sessionId - in plain-text

Returns:

true if sessionId matches with the session from KEYCLOAK_SESSION_COOKIE

isSSOAuthentication

public static boolean isSSOAuthentication(AuthenticatedClientSessionModel clientSession)

nextActionAfterAuthentication

public static jakarta.ws.rs.core.Response nextActionAfterAuthentication(KeycloakSession session,
 AuthenticationSessionModel authSession,
 ClientConnection clientConnection,
 HttpRequest request,
 jakarta.ws.rs.core.UriInfo uriInfo,
 EventBuilder event)

redirectToRequiredActions

public static jakarta.ws.rs.core.Response redirectToRequiredActions(KeycloakSession session,
 RealmModel realm,
 AuthenticationSessionModel authSession,
 jakarta.ws.rs.core.UriInfo uriInfo,
 String requiredAction)

finishedRequiredActions

public static jakarta.ws.rs.core.Response finishedRequiredActions(KeycloakSession session,
 AuthenticationSessionModel authSession,
 UserSessionModel userSession,
 ClientConnection clientConnection,
 HttpRequest request,
 jakarta.ws.rs.core.UriInfo uriInfo,
 EventBuilder event)

nextRequiredAction

public static String nextRequiredAction(KeycloakSession session,
 AuthenticationSessionModel authSession,
 HttpRequest request,
 EventBuilder event)

setClientScopesInSession

public static void setClientScopesInSession(KeycloakSession session,
 AuthenticationSessionModel authSession)

createRequiredAction

public static RequiredActionProvider createRequiredAction(RequiredActionContextResult context)

executionActions

protected static jakarta.ws.rs.core.Response executionActions(KeycloakSession session,
 AuthenticationSessionModel authSession,
 HttpRequest request,
 EventBuilder event,
 RealmModel realm,
 UserModel user,
 Set<String> ignoredActions)

evaluateRequiredActionTriggers

public static void evaluateRequiredActionTriggers(KeycloakSession session,
 AuthenticationSessionModel authSession,
 HttpRequest request,
 EventBuilder event,
 RealmModel realm,
 UserModel user)

verifyIdentityToken

public static AuthenticationManager.AuthResult verifyIdentityToken(KeycloakSession session,
 RealmModel realm,
 jakarta.ws.rs.core.UriInfo uriInfo,
 ClientConnection connection,
 boolean checkActive,
 boolean checkTokenType,
 String checkAudience,
 boolean isCookie,
 String tokenString,
 jakarta.ws.rs.core.HttpHeaders headers,
 Consumer<TokenVerifier<AccessToken>> verifierConsumer)

resolveLightweightAccessTokenRoles

public static void resolveLightweightAccessTokenRoles(KeycloakSession session,
 AccessToken accessToken,
 RealmModel realm)

setKcActionStatus

public static void setKcActionStatus(String executedProviderId,
 RequiredActionContext.KcActionStatus status,
 AuthenticationSessionModel authSession)

setKcActionToEnforced

public static void setKcActionToEnforced(String executedProviderId,
 AuthenticationSessionModel authSession)

logSuccess

public static void logSuccess(KeycloakSession session,
 AuthenticationSessionModel authSession)

lookupUserForBruteForceLog

public static UserModel lookupUserForBruteForceLog(KeycloakSession session,
 RealmModel realm,
 AuthenticationSessionModel authenticationSession)

sha256UrlEncodedHash

public static String sha256UrlEncodedHash(String input)

getRequestedScopes

public static String getRequestedScopes(KeycloakSession session)

getRequestedScopes

public static String getRequestedScopes(KeycloakSession session,
 ClientModel client)