Package org.keycloak.broker.provider

Class TrustMaterialResolver

java.lang.Object

org.keycloak.broker.provider.TrustMaterialResolver

public class TrustMaterialResolver
extends Object

Constructor Summary

Constructors

Constructor	Description
TrustMaterialResolver()

Method Summary

Modifier and Type	Method	Description
Optional<JWK>	resolveKey(KeycloakSession session, String aliases, TrustMaterialRequest request)
Stream<JWK>	resolveKeys(KeycloakSession session, String aliases, TrustMaterialRequest request)
Stream<JWK>	resolveKeys(KeycloakSession session, Collection<String> aliases, TrustMaterialRequest request)
Stream<X509TrustMaterial>	resolveX509Trust(KeycloakSession session, String aliases, TrustMaterialRequest request)
JWK	validateX509Chain(KeycloakSession session, String aliases, TrustMaterialRequest request, List<String> x5c, String algorithm)	Validates the x5c certificate chain against the X.509 trust material of the given providers.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

TrustMaterialResolver

public TrustMaterialResolver()

Method Details

resolveKeys

public Stream<JWK> resolveKeys(KeycloakSession session,
 String aliases,
 TrustMaterialRequest request)

resolveKeys

public Stream<JWK> resolveKeys(KeycloakSession session,
 Collection<String> aliases,
 TrustMaterialRequest request)

resolveKey

public Optional<JWK> resolveKey(KeycloakSession session,
 String aliases,
 TrustMaterialRequest request)

resolveX509Trust

public Stream<X509TrustMaterial> resolveX509Trust(KeycloakSession session,
 String aliases,
 TrustMaterialRequest request)

validateX509Chain

public JWK validateX509Chain(KeycloakSession session,
 String aliases,
 TrustMaterialRequest request,
 List<String> x5c,
 String algorithm)
                      throws VerificationException

Validates the x5c certificate chain against the X.509 trust material of the given providers. The providers are tried in order and the first successful validation wins.

Returns:

the leaf key of the validated chain, or null when none of the providers exposes X.509 trust material

Throws:

VerificationException