Package org.keycloak.protocol.oidc.refresh

Class DefaultRefreshTokenProvider

java.lang.Object

org.keycloak.protocol.oidc.refresh.AbstractRefreshTokenProvider

org.keycloak.protocol.oidc.refresh.DefaultRefreshTokenProvider

All Implemented Interfaces:

RefreshTokenProvider, Provider

public class DefaultRefreshTokenProvider
extends AbstractRefreshTokenProvider
implements RefreshTokenProvider

Default refresh token provider. Requires valid user session, which is referenced in the refresh token, to be present in Keycloak storage

Field Summary

Fields inherited from class org.keycloak.protocol.oidc.refresh.AbstractRefreshTokenProvider

session

Constructor Summary

Constructors

Constructor	Description
DefaultRefreshTokenProvider(KeycloakSession session)

Method Summary

Modifier and Type	Method	Description
protected void	afterRefreshTokenGenerated(RefreshTokenContext ctx, TokenManager.AccessTokenResponseBuilder responseBuilder)	Callback method invoked after refresh token is generated
RefreshToken	generateRefreshToken(InitialRefreshTokenContext initialRefreshTokenCtx)	Method is triggered during initial issuance of refresh token - usually after successful user authentication.
String	getProviderId()	Returns the provider ID that this instance uses to identify issued refresh tokens.
void	revokeToken(AccessToken token, UserModel user, ClientModel client, EventBuilder event)	Invoked when the revocation endpoint receives a request to revoke a refresh token issued by this provider.
static void	revokeTokenExchangeSession(UserSessionModel userSession, AccessToken token, EventBuilder event)
boolean	supports(InitialRefreshTokenContext initialRefreshTokenCtx)	Method is triggered during initial issuance of refresh token - usually after successful user authentication.
boolean	supports(RefreshTokenContext ctx)	Invoked during refresh-token request.
protected TokenManager.TokenValidation	validateToken(KeycloakSession session, jakarta.ws.rs.core.UriInfo uriInfo, ClientConnection connection, RealmModel realm, RefreshToken oldToken, jakarta.ws.rs.core.HttpHeaders headers, String scope, ClientModel client, TokenManager tokenManager, EventBuilder event)	Validation specific to the particular refreshToken provider type.

Methods inherited from class org.keycloak.protocol.oidc.refresh.AbstractRefreshTokenProvider

createRefreshToken, refreshAccessToken

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.protocol.oidc.refresh.RefreshTokenProvider

close, refreshAccessToken

Constructor Details

DefaultRefreshTokenProvider

public DefaultRefreshTokenProvider(KeycloakSession session)

Method Details

supports

public boolean supports(InitialRefreshTokenContext initialRefreshTokenCtx)

Description copied from interface: RefreshTokenProvider

Method is triggered during initial issuance of refresh token - usually after successful user authentication.

Specified by:

supports in interface RefreshTokenProvider

Parameters:

initialRefreshTokenCtx - context information with the data useful to determine if this provider can be used to generate refresh token

Returns:

true if this provider can be used to generate refresh token. In this case method RefreshTokenProvider.generateRefreshToken(InitialRefreshTokenContext) would be used for this provider to generate new refresh token. Keycloak iterates over available providers to determine which one can be used. Providers are sorted by their priority (based on the "order" of particular ProviderFactory)

generateRefreshToken

public RefreshToken generateRefreshToken(InitialRefreshTokenContext initialRefreshTokenCtx)

Description copied from interface: RefreshTokenProvider

Method is triggered during initial issuance of refresh token - usually after successful user authentication. Refresh token is generated by single provider, which was first available provider returned by method RefreshTokenProvider.supports(InitialRefreshTokenContext)

Specified by:

generateRefreshToken in interface RefreshTokenProvider

Parameters:

initialRefreshTokenCtx - context information with the data useful to determine

Returns:

newly generated refresh token

supports

public boolean supports(RefreshTokenContext ctx)

Description copied from interface: RefreshTokenProvider

Invoked during refresh-token request.

Specified by:

supports in interface RefreshTokenProvider

Parameters:

ctx - Context, which contains old refresh token and some other data

Returns:

True if this provider supports verification of the refresh token from the context

validateToken

protected TokenManager.TokenValidation validateToken(KeycloakSession session,
 jakarta.ws.rs.core.UriInfo uriInfo,
 ClientConnection connection,
 RealmModel realm,
 RefreshToken oldToken,
 jakarta.ws.rs.core.HttpHeaders headers,
 String scope,
 ClientModel client,
 TokenManager tokenManager,
 EventBuilder event)
                                              throws OAuthErrorException

Description copied from class: AbstractRefreshTokenProvider

Validation specific to the particular refreshToken provider type. For example this could be validation if related user session still exists and is not expired etc.

Specified by:

validateToken in class AbstractRefreshTokenProvider

Returns:

token validation with successful context information

Throws:

OAuthErrorException - In case that some validation failed

afterRefreshTokenGenerated

protected void afterRefreshTokenGenerated(RefreshTokenContext ctx,
 TokenManager.AccessTokenResponseBuilder responseBuilder)

Description copied from class: AbstractRefreshTokenProvider

Callback method invoked after refresh token is generated

Specified by:

afterRefreshTokenGenerated in class AbstractRefreshTokenProvider

Parameters:

ctx - context

responseBuilder - response builder with already filled refresh token and client session context

revokeToken

public void revokeToken(AccessToken token,
 UserModel user,
 ClientModel client,
 EventBuilder event)

Description copied from interface: RefreshTokenProvider

Invoked when the revocation endpoint receives a request to revoke a refresh token issued by this provider. The default implementation is a no-op; override to perform provider-specific cleanup (e.g., revoking associated credentials).

Specified by:

revokeToken in interface RefreshTokenProvider

Parameters:

token - the decoded token (refresh/offline) represented as an AccessToken

user - the token subject

client - the client for which the token was issued

event - the event builder for recording revocation events

getProviderId

public String getProviderId()

Description copied from interface: RefreshTokenProvider

Returns the provider ID that this instance uses to identify issued refresh tokens. Used for event detail emission during initial issuance and refresh-token processing when the token does not carry a provider claim

Specified by:

getProviderId in interface RefreshTokenProvider

revokeTokenExchangeSession

public static void revokeTokenExchangeSession(UserSessionModel userSession,
 AccessToken token,
 EventBuilder event)