Package org.keycloak.protocol.oidc.grants.ciba.endpoints

Class CibaOtherClaimsValidator

java.lang.Object

org.keycloak.protocol.oidc.grants.ciba.endpoints.CibaOtherClaimsValidator

public final class CibaOtherClaimsValidator
extends Object

Detects forged claims smuggled into the otherClaims of a parsed CIBA authentication request.

Method Summary

Modifier and Type	Method	Description
static boolean	hasForgedOtherClaims(CIBAAuthenticationRequest request)	Checks whether a serialize/deserialize round trip drops any otherClaims entry because its name collides with an internal/reserved request property.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

hasForgedOtherClaims

public static boolean hasForgedOtherClaims(CIBAAuthenticationRequest request)

Checks whether a serialize/deserialize round trip drops any otherClaims entry because its name collides with an internal/reserved request property.

A claim whose name collides with a reserved property is consumed into that property during deserialization and disappears from otherClaims. Claim values may legitimately change their Java type during the round trip (for example a Long becoming an Integer), so values are never compared. A claim with a null value is also dropped, but only because serialization omits null values, which is not a collision, so such entries are ignored.

Parameters:

request - the parsed authentication request

Returns:

true if a non-null otherClaims entry disappears after the round trip, i.e. a forged claim collided with a reserved property; false otherwise