Package org.keycloak.broker.oidc

Class OIDCIdentityProvider

java.lang.Object

org.keycloak.broker.provider.AbstractIdentityProvider<C>

org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

org.keycloak.broker.oidc.OIDCIdentityProvider

All Implemented Interfaces:

ClientAssertionIdentityProvider<OIDCIdentityProviderConfig>, ExchangeExternalToken, ExchangeTokenToIdentityProviderToken, IdentityProvider<OIDCIdentityProviderConfig>, JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>, UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>, Provider

Direct Known Subclasses:

GitLabIdentityProvider, GoogleIdentityProvider, KeycloakOIDCIdentityProvider, LinkedInOIDCIdentityProvider

public class OIDCIdentityProvider
extends AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>
implements ExchangeExternalToken, ClientAssertionIdentityProvider<OIDCIdentityProviderConfig>, JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

Author:

Pedro Igor

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
protected static class	OIDCIdentityProvider.OIDCEndpoint

Nested classes/interfaces inherited from class org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider

AbstractOAuth2IdentityProvider.Endpoint, AbstractOAuth2IdentityProvider.OAuthResponse

Nested classes/interfaces inherited from interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider

UserAuthenticationIdentityProvider.AuthenticationCallback

Field Summary

Fields

Modifier and Type	Field	Description
static final String	EXCHANGE_PROVIDER
static final String	FEDERATED_ACCESS_TOKEN_RESPONSE
static final String	FEDERATED_ID_TOKEN
protected static final org.jboss.logging.Logger	logger
static final String	SCOPE_OPENID
static final String	USER_INFO
static final String	VALIDATED_ACCESS_TOKEN
static final String	VALIDATED_ID_TOKEN

Fields inherited from class org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider

ACCESS_DENIED, ACCESS_TOKEN_EXPIRATION, FEDERATED_REFRESH_TOKEN, FEDERATED_TOKEN_EXPIRATION, mapper, OAUTH2_GRANT_TYPE_AUTHORIZATION_CODE, OAUTH2_GRANT_TYPE_REFRESH_TOKEN, OAUTH2_PARAMETER_ACCESS_TOKEN, OAUTH2_PARAMETER_CLIENT_ID, OAUTH2_PARAMETER_CLIENT_SECRET, OAUTH2_PARAMETER_CODE, OAUTH2_PARAMETER_GRANT_TYPE, OAUTH2_PARAMETER_REDIRECT_URI, OAUTH2_PARAMETER_RESPONSE_TYPE, OAUTH2_PARAMETER_SCOPE, OAUTH2_PARAMETER_STATE

Fields inherited from class org.keycloak.broker.provider.AbstractIdentityProvider

ACCOUNT_LINK_URL, BROKER_REGISTERED_NEW_USER, session, UPDATE_PROFILE_EMAIL_CHANGED, UPDATE_PROFILE_USERNAME_CHANGED

Fields inherited from interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider

EXTERNAL_IDENTITY_PROVIDER, FEDERATED_ACCESS_TOKEN

Constructor Summary

Constructors

Constructor	Description
OIDCIdentityProvider(KeycloakSession session, OIDCIdentityProviderConfig config)

Method Summary

Modifier and Type	Method	Description
void	authenticationFinished(AuthenticationSessionModel authSession, BrokeredIdentityContext context)
void	backchannelLogout(KeycloakSession session, UserSessionModel userSession, jakarta.ws.rs.core.UriInfo uriInfo, RealmModel realm)
protected void	backchannelLogout(UserSessionModel userSession, String idToken)
Object	callback(RealmModel realm, UserAuthenticationIdentityProvider.AuthenticationCallback callback, EventBuilder event)	JAXRS callback endpoint for when the remote IDP wants to callback to keycloak.
protected jakarta.ws.rs.core.UriBuilder	createAuthorizationUrl(AuthenticationRequest request)
protected BrokeredIdentityContext	exchangeExternalTokenV1Impl(EventBuilder event, jakarta.ws.rs.core.MultivaluedMap<String,String> params)	Usage with token-exchange V1
protected BrokeredIdentityContext	exchangeExternalTokenV2Impl(TokenExchangeContext tokenExchangeContext)	Usage with external-internal token-exchange v2.
protected jakarta.ws.rs.core.Response	exchangeSessionToken(jakarta.ws.rs.core.UriInfo uriInfo, EventBuilder event, ClientModel authorizedClient, UserSessionModel tokenUserSession, UserModel tokenSubject)
protected jakarta.ws.rs.core.Response	exchangeStoredToken(jakarta.ws.rs.core.UriInfo uriInfo, EventBuilder event, ClientModel authorizedClient, UserSessionModel tokenUserSession, UserModel tokenSubject)
protected BrokeredIdentityContext	extractIdentity(AccessTokenResponse tokenResponse, String accessToken, JsonWebToken idToken)
protected BrokeredIdentityContext	extractIdentityFromProfile(EventBuilder event, com.fasterxml.jackson.databind.JsonNode userInfo)
List<String>	getAllowedAudienceForJWTGrant()
int	getAllowedClockSkew()
String	getAssertionSignatureAlg()
protected String	getDefaultScopes()
BrokeredIdentityContext	getFederatedIdentity(String response)
protected KeyWrapper	getIdentityProviderKeyWrapper(JWSInput jws)
int	getMaxAllowedExpiration()
protected String	getProfileEndpointForValidation(EventBuilder event)
protected String	getUserInfoUrl()
protected String	getusernameClaimNameForIdToken()
protected String	getUsernameFromUserInfo(com.fasterxml.jackson.databind.JsonNode userInfo)
boolean	isAssertionReuseAllowed()
protected boolean	isAuthTimeExpired(JsonWebToken idToken, AuthenticationSessionModel authSession)
boolean	isIssuer(String issuer, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
protected boolean	isTokenTypeSupported(JsonWebToken parsedToken)
jakarta.ws.rs.core.Response	keycloakInitiatedBrowserLogout(KeycloakSession session, UserSessionModel userSession, jakarta.ws.rs.core.UriInfo uriInfo, RealmModel realm)	Called when a Keycloak application initiates a logout through the browser.
protected String	parseTokenInput(String encodedToken, boolean shouldBeSigned)	Parses a JWT token that can be a JWE, JWS or JWE/JWS.
void	preprocessFederatedIdentity(KeycloakSession session, RealmModel realm, BrokeredIdentityContext context)
protected void	processAccessTokenResponse(BrokeredIdentityContext context, AccessTokenResponse response)
String	refreshTokenForLogout(KeycloakSession session, UserSessionModel userSession)	Returns access token response as a string from a refresh token invocation on the remote OIDC broker
boolean	reloadKeys()	Reload keys for the identity provider if permitted in it.For example OIDC or SAML providers will reload the keys from the jwks or metadata endpoint.
protected void	setEmailVerified(UserModel user, BrokeredIdentityContext context)
protected boolean	supportsExternalExchange()
BrokeredIdentityContext	validateAuthorizationGrantAssertion(JWTAuthorizationGrantValidationContext context)
protected BrokeredIdentityContext	validateExternalTokenThroughUserInfo(EventBuilder event, String subjectToken, String subjectTokenType)
protected final BrokeredIdentityContext	validateJwt(EventBuilder event, String subjectToken, String subjectTokenType)
JsonWebToken	validateToken(String encodedToken)
protected JsonWebToken	validateToken(String encodedToken, boolean ignoreAudience)
protected boolean	verify(JWSInput jws)
boolean	verifyClientAssertion(ClientAuthenticationFlowContext context)
protected boolean	verifySignature(JWSInput jws)	Verify signature on given JWS

Methods inherited from class org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider

asJsonNode, authenticateTokenRequest, buildUserInfoRequest, doGetFederatedIdentity, exchangeExternal, exchangeExternalComplete, exchangeExternalUserInfoValidationOnly, exchangeFromToken, extractTokenFromResponse, generateToken, getAccessTokenResponseParameter, getConfig, getJsonProperty, getRefreshTokenRequest, getSignatureContext, hasExternalExchangeToken, performLogin, retrieveToken, sendTokenIntrospectionRequest, supportsLongStateParameter, validateExternalTokenWithIntrospectionEndpoint

Methods inherited from class org.keycloak.broker.provider.AbstractIdentityProvider

close, exchangeErrorResponse, exchangeNotLinked, exchangeNotLinkedNoStore, exchangeNotSupported, exchangeTokenExpired, exchangeUnsupportedRequiredType, getLinkingUrl, getMarshaller, importNewUser, updateBrokeredUser, updateEmail

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.broker.provider.ExchangeExternalToken

exchangeExternal, exchangeExternalComplete

Methods inherited from interface org.keycloak.broker.provider.IdentityProvider

export, getConfig, isMapperSupported

Methods inherited from interface org.keycloak.provider.Provider

close

Field Details

logger

protected static final org.jboss.logging.Logger logger

SCOPE_OPENID

public static final String SCOPE_OPENID

See Also:

• Constant Field Values

FEDERATED_ID_TOKEN

public static final String FEDERATED_ID_TOKEN

See Also:

• Constant Field Values

USER_INFO

public static final String USER_INFO

See Also:

• Constant Field Values

FEDERATED_ACCESS_TOKEN_RESPONSE

public static final String FEDERATED_ACCESS_TOKEN_RESPONSE

See Also:

• Constant Field Values

VALIDATED_ID_TOKEN

public static final String VALIDATED_ID_TOKEN

See Also:

• Constant Field Values

EXCHANGE_PROVIDER

public static final String EXCHANGE_PROVIDER

See Also:

• Constant Field Values

VALIDATED_ACCESS_TOKEN

public static final String VALIDATED_ACCESS_TOKEN

See Also:

• Constant Field Values

Constructor Details

OIDCIdentityProvider

public OIDCIdentityProvider(KeycloakSession session,
 OIDCIdentityProviderConfig config)

Method Details

callback

public Object callback(RealmModel realm,
 UserAuthenticationIdentityProvider.AuthenticationCallback callback,
 EventBuilder event)

Description copied from interface: UserAuthenticationIdentityProvider

JAXRS callback endpoint for when the remote IDP wants to callback to keycloak.

Specified by:

callback in interface UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>

Overrides:

callback in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

Returns:

refreshTokenForLogout

public String refreshTokenForLogout(KeycloakSession session,
 UserSessionModel userSession)

Returns access token response as a string from a refresh token invocation on the remote OIDC broker

Parameters:

session -

userSession -

Returns:

backchannelLogout

public void backchannelLogout(KeycloakSession session,
 UserSessionModel userSession,
 jakarta.ws.rs.core.UriInfo uriInfo,
 RealmModel realm)

Specified by:

backchannelLogout in interface UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>

Overrides:

backchannelLogout in class AbstractIdentityProvider<OIDCIdentityProviderConfig>

backchannelLogout

protected void backchannelLogout(UserSessionModel userSession,
 String idToken)

keycloakInitiatedBrowserLogout

public jakarta.ws.rs.core.Response keycloakInitiatedBrowserLogout(KeycloakSession session,
 UserSessionModel userSession,
 jakarta.ws.rs.core.UriInfo uriInfo,
 RealmModel realm)

Description copied from interface: UserAuthenticationIdentityProvider

Called when a Keycloak application initiates a logout through the browser. This is expected to do a logout with the IDP

Specified by:

keycloakInitiatedBrowserLogout in interface UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>

Overrides:

keycloakInitiatedBrowserLogout in class AbstractIdentityProvider<OIDCIdentityProviderConfig>

Returns:

null if this is not supported by this provider

exchangeStoredToken

protected jakarta.ws.rs.core.Response exchangeStoredToken(jakarta.ws.rs.core.UriInfo uriInfo,
 EventBuilder event,
 ClientModel authorizedClient,
 UserSessionModel tokenUserSession,
 UserModel tokenSubject)

Overrides:

exchangeStoredToken in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

validateExternalTokenThroughUserInfo

protected BrokeredIdentityContext validateExternalTokenThroughUserInfo(EventBuilder event,
 String subjectToken,
 String subjectTokenType)

Overrides:

validateExternalTokenThroughUserInfo in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

processAccessTokenResponse

protected void processAccessTokenResponse(BrokeredIdentityContext context,
 AccessTokenResponse response)

exchangeSessionToken

protected jakarta.ws.rs.core.Response exchangeSessionToken(jakarta.ws.rs.core.UriInfo uriInfo,
 EventBuilder event,
 ClientModel authorizedClient,
 UserSessionModel tokenUserSession,
 UserModel tokenSubject)

Overrides:

exchangeSessionToken in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

getFederatedIdentity

public BrokeredIdentityContext getFederatedIdentity(String response)

Overrides:

getFederatedIdentity in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

isAuthTimeExpired

protected boolean isAuthTimeExpired(JsonWebToken idToken,
 AuthenticationSessionModel authSession)

extractIdentity

protected BrokeredIdentityContext extractIdentity(AccessTokenResponse tokenResponse,
 String accessToken,
 JsonWebToken idToken)
                                           throws IOException

Throws:

IOException

getusernameClaimNameForIdToken

protected String getusernameClaimNameForIdToken()

getUserInfoUrl

protected String getUserInfoUrl()

getIdentityProviderKeyWrapper

protected KeyWrapper getIdentityProviderKeyWrapper(JWSInput jws)

verify

protected boolean verify(JWSInput jws)

verifySignature

protected boolean verifySignature(JWSInput jws)

Verify signature on given JWS

Returns:

true if signature was successfully verified with the keys available to identity provider

parseTokenInput

protected String parseTokenInput(String encodedToken,
 boolean shouldBeSigned)

Parses a JWT token that can be a JWE, JWS or JWE/JWS. It returns the content as a string. If JWS is involved the signature is also validated. A IdentityBrokerException is thrown on any error.

Parameters:

encodedToken - The token in the encoded string format.

shouldBeSigned - true if the token should be signed (id token), false if the token can be only encrypted and not signed (user info).

Returns:

The content in string format.

validateToken

public JsonWebToken validateToken(String encodedToken)

validateToken

protected JsonWebToken validateToken(String encodedToken,
 boolean ignoreAudience)

authenticationFinished

public void authenticationFinished(AuthenticationSessionModel authSession,
 BrokeredIdentityContext context)

Specified by:

authenticationFinished in interface UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>

Overrides:

authenticationFinished in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

getDefaultScopes

protected String getDefaultScopes()

Specified by:

getDefaultScopes in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

isIssuer

public boolean isIssuer(String issuer,
 jakarta.ws.rs.core.MultivaluedMap<String,String> params)

Specified by:

isIssuer in interface ExchangeExternalToken

Overrides:

isIssuer in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

supportsExternalExchange

protected boolean supportsExternalExchange()

Overrides:

supportsExternalExchange in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

getProfileEndpointForValidation

protected String getProfileEndpointForValidation(EventBuilder event)

Overrides:

getProfileEndpointForValidation in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

extractIdentityFromProfile

protected BrokeredIdentityContext extractIdentityFromProfile(EventBuilder event,
 com.fasterxml.jackson.databind.JsonNode userInfo)

Overrides:

extractIdentityFromProfile in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

getUsernameFromUserInfo

protected String getUsernameFromUserInfo(com.fasterxml.jackson.databind.JsonNode userInfo)

validateJwt

protected final BrokeredIdentityContext validateJwt(EventBuilder event,
 String subjectToken,
 String subjectTokenType)

isTokenTypeSupported

protected boolean isTokenTypeSupported(JsonWebToken parsedToken)

exchangeExternalTokenV1Impl

protected BrokeredIdentityContext exchangeExternalTokenV1Impl(EventBuilder event,
 jakarta.ws.rs.core.MultivaluedMap<String,String> params)

Description copied from class: AbstractOAuth2IdentityProvider

Usage with token-exchange V1

Overrides:

exchangeExternalTokenV1Impl in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

Parameters:

event - event builder

params - parameters of the token-exchange request

Returns:

brokered identity context with the details about user from the IDP

exchangeExternalTokenV2Impl

protected BrokeredIdentityContext exchangeExternalTokenV2Impl(TokenExchangeContext tokenExchangeContext)

Description copied from class: AbstractOAuth2IdentityProvider

Usage with external-internal token-exchange v2.

Overrides:

exchangeExternalTokenV2Impl in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

Parameters:

tokenExchangeContext - data about token-exchange request

Returns:

brokered identity context with the details about user from the IDP

createAuthorizationUrl

protected jakarta.ws.rs.core.UriBuilder createAuthorizationUrl(AuthenticationRequest request)

Overrides:

createAuthorizationUrl in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

preprocessFederatedIdentity

public void preprocessFederatedIdentity(KeycloakSession session,
 RealmModel realm,
 BrokeredIdentityContext context)

Specified by:

preprocessFederatedIdentity in interface UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>

Overrides:

preprocessFederatedIdentity in class AbstractIdentityProvider<OIDCIdentityProviderConfig>

reloadKeys

public boolean reloadKeys()

Description copied from interface: IdentityProvider

Reload keys for the identity provider if permitted in it.For example OIDC or SAML providers will reload the keys from the jwks or metadata endpoint.

Specified by:

reloadKeys in interface IdentityProvider<OIDCIdentityProviderConfig>

Returns:

true if reloaded, false if not

setEmailVerified

protected void setEmailVerified(UserModel user,
 BrokeredIdentityContext context)

Overrides:

setEmailVerified in class AbstractIdentityProvider<OIDCIdentityProviderConfig>

verifyClientAssertion

public boolean verifyClientAssertion(ClientAuthenticationFlowContext context)
                              throws Exception

Specified by:

verifyClientAssertion in interface ClientAssertionIdentityProvider<OIDCIdentityProviderConfig>

Throws:

Exception

validateAuthorizationGrantAssertion

public BrokeredIdentityContext validateAuthorizationGrantAssertion(JWTAuthorizationGrantValidationContext context)
                                                            throws IdentityBrokerException

Specified by:

validateAuthorizationGrantAssertion in interface JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

Throws:

IdentityBrokerException

getAllowedClockSkew

public int getAllowedClockSkew()

Specified by:

getAllowedClockSkew in interface JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

isAssertionReuseAllowed

public boolean isAssertionReuseAllowed()

Specified by:

isAssertionReuseAllowed in interface JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

getAllowedAudienceForJWTGrant

public List<String> getAllowedAudienceForJWTGrant()

Specified by:

getAllowedAudienceForJWTGrant in interface JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

Returns:

list of allowed audience values. JWT assertion is considered valid if it's audience is one of the audiences returned from this method

getMaxAllowedExpiration

public int getMaxAllowedExpiration()

Specified by:

getMaxAllowedExpiration in interface JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

getAssertionSignatureAlg

public String getAssertionSignatureAlg()

Specified by:

getAssertionSignatureAlg in interface JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>