Package org.keycloak.social.microsoft

Class MicrosoftIdentityProviderConfig

java.lang.Object

org.keycloak.models.IdentityProviderModel

org.keycloak.broker.oidc.OAuth2IdentityProviderConfig

org.keycloak.broker.oidc.OIDCIdentityProviderConfig

org.keycloak.social.microsoft.MicrosoftIdentityProviderConfig

All Implemented Interfaces:

Serializable, JWTAuthorizationGrantConfig, IssuerValidation

public class MicrosoftIdentityProviderConfig
extends OIDCIdentityProviderConfig

See Also:

• Serialized Form

Field Summary

Fields inherited from class org.keycloak.broker.oidc.OIDCIdentityProviderConfig

ALLOW_CLIENT_ID_AS_AUDIENCE, IS_ACCESS_TOKEN_JWT, JWKS_URL, SUPPORTS_CLIENT_ASSERTION_REUSE, SUPPORTS_CLIENT_ASSERTIONS, USE_JWKS_URL, VALIDATE_SIGNATURE

Fields inherited from class org.keycloak.broker.oidc.OAuth2IdentityProviderConfig

JWT_X509_HEADERS_ENABLED, PKCE_ENABLED, PKCE_METHOD, REQUIRES_SHORT_STATE_PARAMETER, TOKEN_ENDPOINT_URL, TOKEN_INTROSPECTION_URL

Fields inherited from class org.keycloak.models.IdentityProviderModel

addReadTokenRoleOnCreate, ALIAS, ALIAS_NOT_IN, ALLOW_ADMIN_ROLE_MAPPING, ALLOWED_CLOCK_SKEW, AUTHENTICATE_BY_DEFAULT, CASE_SENSITIVE_ORIGINAL_USERNAME, CLAIM_FILTER_NAME, CLAIM_FILTER_VALUE, DEFAULT_MIN_VALIDITY_TOKEN, DISPLAY_NAME, DO_NOT_STORE_USERS, ENABLED, FEDERATED_CLIENT_ASSERTION_MAX_EXPIRATION, FILTERED_BY_CLAIMS, FIRST_BROKER_LOGIN_FLOW_ID, HIDE_ON_LOGIN, ISSUER, LEGACY_HIDE_ON_LOGIN_ATTR, LINK_ONLY, linkOnly, LOGIN_HINT, METADATA_DESCRIPTOR_URL, MIN_VALIDITY_TOKEN, ORGANIZATION_ID, ORGANIZATION_ID_NOT_NULL, PASS_MAX_AGE, POST_BROKER_LOGIN_FLOW_ID, SEARCH, SHOW_IN_ACCOUNT_CONSOLE, STORE_TOKEN_IN_SESSION, SYNC_MODE

Fields inherited from interface org.keycloak.broker.jwtauthorizationgrant.JWTAuthorizationGrantConfig

JWT_AUTHORIZATION_GRANT_ALLOWED_CLOCK_SKEW, JWT_AUTHORIZATION_GRANT_ASSERTION_REUSE_ALLOWED, JWT_AUTHORIZATION_GRANT_ASSERTION_SIGNATURE_ALG, JWT_AUTHORIZATION_GRANT_ENABLED, JWT_AUTHORIZATION_GRANT_LIMIT_ACCESS_TOKEN_EXP, JWT_AUTHORIZATION_GRANT_MAX_ALLOWED_ASSERTION_EXPIRATION, PUBLIC_KEY_SIGNATURE_VERIFIER, PUBLIC_KEY_SIGNATURE_VERIFIER_KEY_ID

Constructor Summary

Constructors

Constructor	Description
MicrosoftIdentityProviderConfig()
MicrosoftIdentityProviderConfig(IdentityProviderModel model)

Method Summary

Modifier and Type	Method	Description
protected String[]	getClientSecretDestinationConfigKeys()	Config keys that determine where/how a client secret is sent.
String	getTenantId()
protected boolean	isClientSecretDestinationChanged(String key, String stored, String updated)	An absent tenantId resolves to the multi-tenant common endpoint at runtime, so treat the two as equivalent when deciding whether the token destination changed.
void	setTenantId(String tenantId)

Methods inherited from class org.keycloak.broker.oidc.OIDCIdentityProviderConfig

getAllowedClockSkew, getLogoutUrl, isAccessTokenJwt, isAllowClientIdAsAudience, isBackchannelSupported, isDisableNonce, isDisableTypeClaimCheck, isDisableUserInfoService, isSendClientIdOnLogout, isSendIdTokenOnLogout, isSupportsClientAssertionReuse, isSupportsClientAssertions, isValidateSignature, setAccessTokenJwt, setAllowClientIdAsAudience, setBackchannelSupported, setDisableNonce, setDisableTypeClaimCheck, setDisableUserInfoService, setLogoutUrl, setPrompt, setSendClientOnLogout, setSendIdTokenOnLogout, setSupportsClientAssertions, setValidateSignature, validate

Methods inherited from class org.keycloak.broker.oidc.OAuth2IdentityProviderConfig

canReuseMaskedClientSecret, getAuthorizationUrl, getClientAssertionAudience, getClientAssertionSigningAlg, getClientAuthMethod, getClientId, getClientSecret, getDefaultScope, getEmailClaim, getFamilyNameClaim, getForwardParameters, getFullNameClaim, getGivenNameClaim, getPkceMethod, getPrompt, getTokenIntrospectionUrl, getTokenUrl, getUserIDClaim, getUserInfoUrl, getUserNameClaim, isBasicAuthentication, isBasicAuthenticationUnencoded, isJWTAuthentication, isJwtX509HeadersEnabled, isPkceEnabled, isRequiresShortStateParameter, isUiLocales, setAuthorizationUrl, setClientAssertionAudience, setClientAssertionSigningAlg, setClientAuthMethod, setClientId, setClientSecret, setDefaultScope, setForwardParameters, setJwtX509HeadersEnabled, setPkceEnabled, setPkceMethod, setRequiresShortStateParameter, setTokenIntrospectionUrl, setTokenUrl, setUiLocales, setUserInfoUrl

Methods inherited from class org.keycloak.models.IdentityProviderModel

equals, getAlias, getClaimFilterName, getClaimFilterValue, getConfig, getDisplayIconClasses, getDisplayName, getFederatedClientAssertionMaxExpiration, getFirstBrokerLoginFlowId, getInternalId, getMetadataDescriptorUrl, getMinValidityToken, getOrganizationId, getOrganizationIds, getPostBrokerLoginFlowId, getProviderId, getShowInAccountConsole, getSyncMode, hashCode, hasOrganization, isAddReadTokenRoleOnCreate, isAllowAdminRoleMapping, isAuthenticateByDefault, isCaseSensitiveOriginalUsername, isEnabled, isFilteredByClaims, isHideOnLogin, isLinkedToOrganization, isLinkOnly, isLoginHint, isPassMaxAge, isStoreToken, isStoreTokenInSession, isTransientUsers, isTrustEmail, setAddReadTokenRoleOnCreate, setAlias, setAllowAdminRoleMapping, setAuthenticateByDefault, setCaseSensitiveOriginalUsername, setClaimFilterName, setClaimFilterValue, setConfig, setDisplayName, setEnabled, setFederatedClientAssertionMaxExpiration, setFilteredByClaims, setFirstBrokerLoginFlowId, setHideOnLogin, setInternalId, setLinkOnly, setLoginHint, setMetadataDescriptorUrl, setMinValidityToken, setOrganizationId, setOrganizationIds, setPassMaxAge, setPostBrokerLoginFlowId, setProviderId, setStoreToken, setStoreTokenInSession, setSyncMode, setTransientUsers, setTrustEmail

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.broker.oidc.IssuerValidation

getConfig, getInternalId, isEnabled, validateIssuer

Methods inherited from interface org.keycloak.broker.jwtauthorizationgrant.JWTAuthorizationGrantConfig

getAlias, getConfig, getInternalId, getIssuer, getJwksUrl, getJWTAuthorizationGrantAllowedClockSkew, getJWTAuthorizationGrantAssertionSignatureAlg, getJWTAuthorizationGrantMaxAllowedAssertionExpiration, getPublicKeySignatureVerifier, getPublicKeySignatureVerifierKeyId, isJWTAuthorizationGrantAssertionReuseAllowed, isJWTAuthorizationGrantEnabled, isJwtAuthorizationGrantLimitAccessTokenExp, isUseJwksUrl, setIssuer, setJwksUrl, setJWTAuthorizationGrantEnabled, setPublicKeySignatureVerifier, setPublicKeySignatureVerifierKeyId, setUseJwksUrl

Constructor Details

MicrosoftIdentityProviderConfig

public MicrosoftIdentityProviderConfig(IdentityProviderModel model)

MicrosoftIdentityProviderConfig

public MicrosoftIdentityProviderConfig()

Method Details

getTenantId

public String getTenantId()

setTenantId

public void setTenantId(String tenantId)

getClientSecretDestinationConfigKeys

protected String[] getClientSecretDestinationConfigKeys()

Description copied from class: OAuth2IdentityProviderConfig

Config keys that determine where/how a client secret is sent. Includes baseUrl, which some social providers (for example GitHub/OpenShift) use to derive the token endpoint at runtime. Provider-specific configs may override to add keys such as tenantId or sandbox.

Overrides:

getClientSecretDestinationConfigKeys in class OAuth2IdentityProviderConfig

isClientSecretDestinationChanged

protected boolean isClientSecretDestinationChanged(String key,
 String stored,
 String updated)

An absent tenantId resolves to the multi-tenant common endpoint at runtime, so treat the two as equivalent when deciding whether the token destination changed. The derivation mirrors MicrosoftIdentityProvider: only null/empty fall back to common; any other value is trimmed.

Overrides:

isClientSecretDestinationChanged in class OAuth2IdentityProviderConfig

Parameters:

key - the config key being compared

stored - the currently stored value, possibly null

updated - the submitted value, possibly null

Returns:

true if the values represent different destinations