Package org.keycloak.protocol.oid4vc.refresh

Class OID4VCIRefreshTokenProvider

java.lang.Object

org.keycloak.protocol.oidc.refresh.AbstractRefreshTokenProvider

org.keycloak.protocol.oid4vc.refresh.OID4VCIRefreshTokenProvider

All Implemented Interfaces:

RefreshTokenProvider, Provider

public class OID4VCIRefreshTokenProvider
extends AbstractRefreshTokenProvider
implements RefreshTokenProvider

Field Summary

Fields inherited from class org.keycloak.protocol.oidc.refresh.AbstractRefreshTokenProvider

session

Constructor Summary

Constructors

Constructor	Description
OID4VCIRefreshTokenProvider(KeycloakSession session)

Method Summary

Modifier and Type	Method	Description
protected void	afterRefreshTokenGenerated(RefreshTokenContext ctx, TokenManager.AccessTokenResponseBuilder responseBuilder)	Callback method invoked after refresh token is generated
protected IssuedVerifiableCredentialModel	checkIssuedVerifiableCredential(KeycloakSession session, UserModel user, String issuedCredentialId, CredentialScopeModel expectedCredentialScope, ClientModel expectedClient)
RefreshToken	generateRefreshToken(InitialRefreshTokenContext initialRefreshTokenCtx)	Method is triggered during initial issuance of refresh token - usually after successful user authentication.
String	getProviderId()	Returns the provider ID that this instance uses to identify issued refresh tokens.
protected UserModel	getUser(RealmModel realm, RefreshToken oldToken)
void	revokeToken(AccessToken token, UserModel user, ClientModel client, EventBuilder event)	Invoked when the revocation endpoint receives a request to revoke a refresh token issued by this provider.
boolean	supports(InitialRefreshTokenContext initialRefreshTokenCtx)	Method is triggered during initial issuance of refresh token - usually after successful user authentication.
boolean	supports(RefreshTokenContext ctx)	Invoked during refresh-token request.
protected TokenManager.TokenValidation	validateToken(KeycloakSession session, jakarta.ws.rs.core.UriInfo uriInfo, ClientConnection connection, RealmModel realm, RefreshToken oldToken, jakarta.ws.rs.core.HttpHeaders headers, String scope, ClientModel client, TokenManager tokenManager, EventBuilder event)	Validation specific to the particular refreshToken provider type.

Methods inherited from class org.keycloak.protocol.oidc.refresh.AbstractRefreshTokenProvider

createRefreshToken, refreshAccessToken

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.protocol.oidc.refresh.RefreshTokenProvider

close, refreshAccessToken

Constructor Details

OID4VCIRefreshTokenProvider

public OID4VCIRefreshTokenProvider(KeycloakSession session)

Method Details

supports

public boolean supports(InitialRefreshTokenContext initialRefreshTokenCtx)

Description copied from interface: RefreshTokenProvider

Method is triggered during initial issuance of refresh token - usually after successful user authentication.

Specified by:

supports in interface RefreshTokenProvider

Parameters:

initialRefreshTokenCtx - context information with the data useful to determine if this provider can be used to generate refresh token

Returns:

true if this provider can be used to generate refresh token. In this case method RefreshTokenProvider.generateRefreshToken(InitialRefreshTokenContext) would be used for this provider to generate new refresh token. Keycloak iterates over available providers to determine which one can be used. Providers are sorted by their priority (based on the "order" of particular ProviderFactory)

generateRefreshToken

public RefreshToken generateRefreshToken(InitialRefreshTokenContext initialRefreshTokenCtx)
                                  throws RefreshTokenException

Description copied from interface: RefreshTokenProvider

Method is triggered during initial issuance of refresh token - usually after successful user authentication. Refresh token is generated by single provider, which was first available provider returned by method RefreshTokenProvider.supports(InitialRefreshTokenContext)

Specified by:

generateRefreshToken in interface RefreshTokenProvider

Parameters:

initialRefreshTokenCtx - context information with the data useful to determine

Returns:

newly generated refresh token

Throws:

RefreshTokenException - in case of some issues during refresh token generation

supports

public boolean supports(RefreshTokenContext ctx)

Description copied from interface: RefreshTokenProvider

Invoked during refresh-token request.

Specified by:

supports in interface RefreshTokenProvider

Parameters:

ctx - Context, which contains old refresh token and some other data

Returns:

True if this provider supports verification of the refresh token from the context

validateToken

protected TokenManager.TokenValidation validateToken(KeycloakSession session,
 jakarta.ws.rs.core.UriInfo uriInfo,
 ClientConnection connection,
 RealmModel realm,
 RefreshToken oldToken,
 jakarta.ws.rs.core.HttpHeaders headers,
 String scope,
 ClientModel client,
 TokenManager tokenManager,
 EventBuilder event)
                                              throws OAuthErrorException

Description copied from class: AbstractRefreshTokenProvider

Validation specific to the particular refreshToken provider type. For example this could be validation if related user session still exists and is not expired etc.

Specified by:

validateToken in class AbstractRefreshTokenProvider

Returns:

token validation with successful context information

Throws:

OAuthErrorException - In case that some validation failed

afterRefreshTokenGenerated

protected void afterRefreshTokenGenerated(RefreshTokenContext ctx,
 TokenManager.AccessTokenResponseBuilder responseBuilder)

Description copied from class: AbstractRefreshTokenProvider

Callback method invoked after refresh token is generated

Specified by:

afterRefreshTokenGenerated in class AbstractRefreshTokenProvider

Parameters:

ctx - context

responseBuilder - response builder with already filled refresh token and client session context

revokeToken

public void revokeToken(AccessToken token,
 UserModel user,
 ClientModel client,
 EventBuilder event)

Description copied from interface: RefreshTokenProvider

Invoked when the revocation endpoint receives a request to revoke a refresh token issued by this provider. The default implementation is a no-op; override to perform provider-specific cleanup (e.g., revoking associated credentials).

Specified by:

revokeToken in interface RefreshTokenProvider

Parameters:

token - the decoded token (refresh/offline) represented as an AccessToken

user - the token subject

client - the client for which the token was issued

event - the event builder for recording revocation events

getProviderId

public String getProviderId()

Description copied from interface: RefreshTokenProvider

Returns the provider ID that this instance uses to identify issued refresh tokens. Used for event detail emission during initial issuance and refresh-token processing when the token does not carry a provider claim

Specified by:

getProviderId in interface RefreshTokenProvider

getUser

protected UserModel getUser(RealmModel realm,
 RefreshToken oldToken)

checkIssuedVerifiableCredential

protected IssuedVerifiableCredentialModel checkIssuedVerifiableCredential(KeycloakSession session,
 UserModel user,
 String issuedCredentialId,
 CredentialScopeModel expectedCredentialScope,
 ClientModel expectedClient)