Package org.keycloak.protocol.oidc.utils

Class PairwiseSubMapperUtils

java.lang.Object

org.keycloak.protocol.oidc.utils.PairwiseSubMapperUtils

public class PairwiseSubMapperUtils
extends Object

Constructor Summary

Constructors

Constructor	Description
PairwiseSubMapperUtils()

Method Summary

Modifier and Type	Method	Description
static List<ProtocolMapperRepresentation>	getPairwiseSubMappers(ClientRepresentation client)
static boolean	isPairwiseSubjectMatching(KeycloakSession session, RealmModel realm, UserModel user, JsonWebToken token)	Tries to re-create "sub" claim from the ID of given user assuming that client, which the token was issued for, uses the pairwise subject mapper.
static boolean	matchesRedirects(String clientRootUrl, Set<String> clientRedirectUris, Set<String> sectorRedirects)	Checks if the the registered client redirect URIs matches the set of redirect URIs from the sector identifier URI.
static Set<String>	resolveValidRedirectUris(String clientRootUrl, Collection<String> clientRedirectUris)	Returns a set of valid redirect URIs from the root url and redirect URIs registered on a client.
static String	resolveValidSectorIdentifier(String sectorIdentifierUri)	Tries to resolve a valid sector identifier from a sector identifier URI.
static String	resolveValidSectorIdentifier(String clientRootUrl, Set<String> clientRedirectUris)	Tries to resolve a valid sector identifier from the redirect URIs registered on a client.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

PairwiseSubMapperUtils

public PairwiseSubMapperUtils()

Method Details

resolveValidRedirectUris

public static Set<String> resolveValidRedirectUris(String clientRootUrl,
 Collection<String> clientRedirectUris)

Returns a set of valid redirect URIs from the root url and redirect URIs registered on a client.

Parameters:

clientRootUrl -

clientRedirectUris -

Returns:

resolveValidSectorIdentifier

public static String resolveValidSectorIdentifier(String sectorIdentifierUri)

Tries to resolve a valid sector identifier from a sector identifier URI.

Parameters:

sectorIdentifierUri -

Returns:

a sector identifier iff. the sector identifier URI is a valid URI, contains a valid scheme and contains a valid host component.

resolveValidSectorIdentifier

public static String resolveValidSectorIdentifier(String clientRootUrl,
 Set<String> clientRedirectUris)

Tries to resolve a valid sector identifier from the redirect URIs registered on a client.

Parameters:

clientRootUrl - Root url registered on the client.

clientRedirectUris - Redirect URIs registered on the client.

Returns:

a sector identifier iff. all the registered redirect URIs are located at the same host, otherwise null.

matchesRedirects

public static boolean matchesRedirects(String clientRootUrl,
 Set<String> clientRedirectUris,
 Set<String> sectorRedirects)

Checks if the the registered client redirect URIs matches the set of redirect URIs from the sector identifier URI.

Parameters:

clientRootUrl - root url registered on the client.

clientRedirectUris - redirect URIs registered on the client.

sectorRedirects - value of the sector identifier URI.

Returns:

true iff. the all the redirect URIs can be described by the sectorRedirects, i.e if the registered redirect URIs is a subset of the sectorRedirects, otherwise false.

getPairwiseSubMappers

public static List<ProtocolMapperRepresentation> getPairwiseSubMappers(ClientRepresentation client)

isPairwiseSubjectMatching

public static boolean isPairwiseSubjectMatching(KeycloakSession session,
 RealmModel realm,
 UserModel user,
 JsonWebToken token)

Tries to re-create "sub" claim from the ID of given user assuming that client, which the token was issued for, uses the pairwise subject mapper. Method returns true if "sub" computed from the userId by the pairwise mapper of referenced client matches with the "sub" claim from the token