Package org.keycloak.broker.oidc

Class OAuth2IdentityProviderConfig

java.lang.Object
org.keycloak.models.IdentityProviderModel
org.keycloak.broker.oidc.OAuth2IdentityProviderConfig
All Implemented Interfaces:
Serializable
Direct Known Subclasses:
OIDCIdentityProviderConfig, OpenshiftV4IdentityProviderConfig, PayPalIdentityProviderConfig, StackOverflowIdentityProviderConfig
public class OAuth2IdentityProviderConfig extends IdentityProviderModel
Author:
Pedro Igor
See Also:

  • Field Details

  • Constructor Details

    • OAuth2IdentityProviderConfig

      public OAuth2IdentityProviderConfig(IdentityProviderModel model)

    • OAuth2IdentityProviderConfig

      public OAuth2IdentityProviderConfig()

  • Method Details

    • getAuthorizationUrl

      public String getAuthorizationUrl()

    • setAuthorizationUrl

      public void setAuthorizationUrl(String authorizationUrl)

    • getTokenUrl

      public String getTokenUrl()

    • setTokenUrl

      public void setTokenUrl(String tokenUrl)

    • getUserInfoUrl

      public String getUserInfoUrl()

    • setUserInfoUrl

      public void setUserInfoUrl(String userInfoUrl)

    • getTokenIntrospectionUrl

      public String getTokenIntrospectionUrl()

    • setTokenIntrospectionUrl

      public void setTokenIntrospectionUrl(String introspectionEndpointUrl)

    • getClientId

      public String getClientId()

    • setClientId

      public void setClientId(String clientId)

    • getClientAuthMethod

      public String getClientAuthMethod()

    • setClientAuthMethod

      public void setClientAuthMethod(String clientAuth)

    • getClientSecret

      public String getClientSecret()

    • setClientSecret

      public void setClientSecret(String clientSecret)

    • getDefaultScope

      public String getDefaultScope()

    • setDefaultScope

      public void setDefaultScope(String defaultScope)

    • isJWTAuthentication

      public boolean isJWTAuthentication()

    • isBasicAuthentication

      public boolean isBasicAuthentication()

    • isBasicAuthenticationUnencoded

      public boolean isBasicAuthenticationUnencoded()

    • isUiLocales

      public boolean isUiLocales()

    • setUiLocales

      public void setUiLocales(boolean uiLocales)

    • getPrompt

      public String getPrompt()

    • isRequiresShortStateParameter

      public boolean isRequiresShortStateParameter()

    • setRequiresShortStateParameter

      public void setRequiresShortStateParameter(boolean requiresShortStateParameter)

    • getForwardParameters

      public String getForwardParameters()

    • setForwardParameters

      public void setForwardParameters(String forwardParameters)

    • isPkceEnabled

      public boolean isPkceEnabled()

    • setPkceEnabled

      public void setPkceEnabled(boolean enabled)

    • getPkceMethod

      public String getPkceMethod()

    • setPkceMethod

      public String setPkceMethod(String method)

    • getClientAssertionSigningAlg

      public String getClientAssertionSigningAlg()

    • setClientAssertionSigningAlg

      public void setClientAssertionSigningAlg(String signingAlg)

    • getClientAssertionAudience

      public String getClientAssertionAudience()

    • setClientAssertionAudience

      public void setClientAssertionAudience(String audience)

    • isJwtX509HeadersEnabled

      public boolean isJwtX509HeadersEnabled()

    • setJwtX509HeadersEnabled

      public void setJwtX509HeadersEnabled(boolean enabled)

    • getUserIDClaim

      public String getUserIDClaim()

    • getUserNameClaim

      public String getUserNameClaim()

    • getFullNameClaim

      public String getFullNameClaim()

    • getGivenNameClaim

      public String getGivenNameClaim()

    • getFamilyNameClaim

      public String getFamilyNameClaim()

    • getEmailClaim

      public String getEmailClaim()

    • validate

      public void validate(RealmModel realm)
      Description copied from class: IdentityProviderModel

      Validates this configuration.

      Sub-classes can override this method in order to enforce provider specific validations.

      Overrides:
      validate in class IdentityProviderModel
      Parameters:
      realm - the realm

    • getClientSecretDestinationConfigKeys

      protected String[] getClientSecretDestinationConfigKeys()
      Config keys that determine where/how a client secret is sent. Includes baseUrl, which some social providers (for example GitHub/OpenShift) use to derive the token endpoint at runtime. Provider-specific configs may override to add keys such as tenantId or sandbox.

    • canReuseMaskedClientSecret

      public boolean canReuseMaskedClientSecret(IdentityProviderModel other)
      Reuse a masked clientSecret only when fields that determine where/how the secret is sent are unchanged. Otherwise a delegated IdP manager could rebind the stored secret to an attacker-controlled token endpoint.
      Overrides:
      canReuseMaskedClientSecret in class IdentityProviderModel
      Parameters:
      other - the other model to compare destination/auth fields against (usually the stored IdP)
      Returns:
      true if the stored secret may be reused; default allows reuse

    • isClientSecretDestinationChanged

      protected boolean isClientSecretDestinationChanged(String key, String stored, String updated)
      Decides whether a destination config value changed in a way that affects where/how the client secret is sent. By default null and "" are treated as equivalent, as UI/API clients may send "" for omitted optional fields; any other difference is a change, matching the raw values used at runtime. Sub-classes may override to apply key-specific semantics such as boolean or default-value equivalence.
      Parameters:
      key - the config key being compared
      stored - the currently stored value, possibly null
      updated - the submitted value, possibly null
      Returns:
      true if the values represent different destinations