Package org.keycloak.protocol.oidc

Class OIDCClientSecretConfigWrapper

java.lang.Object

org.keycloak.protocol.oidc.AbstractClientConfigWrapper

org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper

public class OIDCClientSecretConfigWrapper
extends AbstractClientConfigWrapper

Author:

Marcelo Sales

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
class	OIDCClientSecretConfigWrapper.ReadOnlyRotatedSecretClientModel	Representation of a client model that passes information from a rotated secret.

Field Summary

Fields inherited from class org.keycloak.protocol.oidc.AbstractClientConfigWrapper

clientModel, clientRep

Method Summary

Modifier and Type	Method	Description
static OIDCClientSecretConfigWrapper	fromClientModel(ClientModel client)
static OIDCClientSecretConfigWrapper	fromClientRepresentation(ClientRepresentation clientRep)
String	getClientRotatedSecret(KeycloakSession session)	Returns the rotated client secret value without vault resolution.
String	getClientRotatedSecret(KeycloakSession session, boolean resolveVault)	Returns the rotated client secret value, optionally resolving vault expressions.
long	getClientRotatedSecretCreationTime()
long	getClientRotatedSecretExpirationTime()
String	getClientSecretAuthenticationAllowedMethod()
long	getClientSecretCreationTime()
long	getClientSecretExpirationTime()
String	getId()
String	getName()
String	getSecret()
boolean	hasClientRotatedSecretExpirationTime()
boolean	hasClientSecretExpirationTime()
boolean	hasRotatedSecret()
boolean	isClientRotatedSecretExpired()
boolean	isClientSecretExpired()
void	removeClientSecretRotated()
void	removeClientSecretRotationInfo()
void	setClientRotatedSecret(String secret)
void	setClientRotatedSecretCreationTime()
void	setClientRotatedSecretCreationTime(Long rotatedTime)
void	setClientRotatedSecretExpirationTime(Long expiration)
void	setClientSecretAuthenticationAllowedMethod(String clientSecretAuthenticationAllowedMethod)
void	setClientSecretCreationTime()
void	setClientSecretCreationTime(long creationTime)
void	setClientSecretExpirationTime(Long expiration)
String	toJson()
OIDCClientSecretConfigWrapper.ReadOnlyRotatedSecretClientModel	toRotatedClientModel(KeycloakSession session)
void	updateClientRepresentationAttributes(ClientRepresentation rep)
boolean	validateRotatedSecret(KeycloakSession session, String secret)
boolean	validateSecret(KeycloakSession session, String secret)

Methods inherited from class org.keycloak.protocol.oidc.AbstractClientConfigWrapper

getAttribute, getAttribute, getAttributeMultivalued, getAttributes, setAttribute, setAttributeMultivalued

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

fromClientModel

public static OIDCClientSecretConfigWrapper fromClientModel(ClientModel client)

fromClientRepresentation

public static OIDCClientSecretConfigWrapper fromClientRepresentation(ClientRepresentation clientRep)

getSecret

public String getSecret()

getId

public String getId()

getName

public String getName()

getClientSecretAuthenticationAllowedMethod

public String getClientSecretAuthenticationAllowedMethod()

setClientSecretAuthenticationAllowedMethod

public void setClientSecretAuthenticationAllowedMethod(String clientSecretAuthenticationAllowedMethod)

removeClientSecretRotationInfo

public void removeClientSecretRotationInfo()

removeClientSecretRotated

public void removeClientSecretRotated()

getClientSecretCreationTime

public long getClientSecretCreationTime()

setClientSecretCreationTime

public void setClientSecretCreationTime(long creationTime)

hasRotatedSecret

public boolean hasRotatedSecret()

getClientRotatedSecret

public String getClientRotatedSecret(KeycloakSession session)

Returns the rotated client secret value without vault resolution. Vault expressions should not be resolved when returning secrets through the Admin API to avoid leaking sensitive vault-backed values. Use hasRotatedSecret() to check whether a rotated secret is effectively present before calling this method.

getClientRotatedSecret

public String getClientRotatedSecret(KeycloakSession session,
 boolean resolveVault)

Returns the rotated client secret value, optionally resolving vault expressions. Vault resolution should only be enabled for authentication validation, never for returning values through the Admin API to avoid leaking sensitive vault-backed values. Use hasRotatedSecret() to check whether a rotated secret is effectively present before calling this method.

Parameters:

session - the keycloak session

resolveVault - if true, vault expressions like ${vault.key} are resolved to their actual values; if false, the raw stored value (potentially a vault placeholder) is returned

setClientRotatedSecret

public void setClientRotatedSecret(String secret)

getClientRotatedSecretCreationTime

public long getClientRotatedSecretCreationTime()

setClientRotatedSecretCreationTime

public void setClientRotatedSecretCreationTime(Long rotatedTime)

setClientSecretCreationTime

public void setClientSecretCreationTime()

setClientRotatedSecretCreationTime

public void setClientRotatedSecretCreationTime()

updateClientRepresentationAttributes

public void updateClientRepresentationAttributes(ClientRepresentation rep)

hasClientSecretExpirationTime

public boolean hasClientSecretExpirationTime()

getClientSecretExpirationTime

public long getClientSecretExpirationTime()

setClientSecretExpirationTime

public void setClientSecretExpirationTime(Long expiration)

isClientSecretExpired

public boolean isClientSecretExpired()

getClientRotatedSecretExpirationTime

public long getClientRotatedSecretExpirationTime()

setClientRotatedSecretExpirationTime

public void setClientRotatedSecretExpirationTime(Long expiration)

hasClientRotatedSecretExpirationTime

public boolean hasClientRotatedSecretExpirationTime()

isClientRotatedSecretExpired

public boolean isClientRotatedSecretExpired()

validateSecret

public boolean validateSecret(KeycloakSession session,
 String secret)

validateRotatedSecret

public boolean validateRotatedSecret(KeycloakSession session,
 String secret)

toJson

public String toJson()

toRotatedClientModel

public OIDCClientSecretConfigWrapper.ReadOnlyRotatedSecretClientModel toRotatedClientModel(KeycloakSession session)
                                                                                    throws InvalidObjectException

Throws:

InvalidObjectException