Package org.keycloak.protocol.oauth2.cimd.provider

Class AbstractPersistentClientIdMetadataDocumentProvider<CONFIG extends AbstractClientIdMetadataDocumentExecutor.Configuration>

java.lang.Object
org.keycloak.protocol.oauth2.cimd.provider.AbstractPersistentClientIdMetadataDocumentProvider<CONFIG>
All Implemented Interfaces:
ClientIdMetadataDocumentProvider<CONFIG>, Provider
Direct Known Subclasses:
PersistentClientIdMetadataDocumentProvider
public abstract class AbstractPersistentClientIdMetadataDocumentProvider<CONFIG extends AbstractClientIdMetadataDocumentExecutor.Configuration> extends Object implements ClientIdMetadataDocumentProvider<CONFIG>
The abstract class persists client metadata.

Creating and updating a client metadata: The class does almost the same process in Dynamic Client Registration (DCR)in OIDCClientRegistrationProvider.

The reason is that a client sends its metadata to an authorization server in DCR by RFC 7591 while an authorization server fetches a client metadata in CIMD, which means that only the method of getting a client metadata is different.

The reason why not directly calling methods of OIDCClientRegistrationProvider is as follows:

  • client_id property is not allowed in DCR while it is mandatory in CIMD. OIDCClientRegistrationProvider does not allow client metadata including client_id.
  • A registration access token is issued in DCR (to say more precisely, RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol) while it is not needed in CIMD. OIDCClientRegistrationProvider issues the registration access token.

Cache expiry time: The provider stores the cache expiry time in an attribute of ClientRepresentation/ClientModel.

Process when a cache expires

Do nothing. After keycloak supports workflow for clients, it would be used to delete a client metadata.

Roles of the abstract class and its concrete class: The abstract class itself covers all about persisting a client metadata while the concrete class can see a configuration of the concrete class of (AbstractClientIdMetadataDocumentExecutor) and augment a client metadata based on it. Moreover, the concrete class can add or modify the abstract class, which makes it easy to implement custom persistent CIMD provider.

Author:
Takashi Norimatsu