Package org.keycloak.authentication.authenticators.client

Class AbstractJWTClientValidator

java.lang.Object

org.keycloak.authentication.authenticators.client.AbstractBaseJWTValidator

org.keycloak.authentication.authenticators.client.AbstractJWTClientValidator

Direct Known Subclasses:

FederatedJWTClientValidator, JWTClientValidator

public abstract class AbstractJWTClientValidator
extends AbstractBaseJWTValidator

Common validation for JWT client authentication with private_key_jwt or with client_secret

Author:

Marek Posolda

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static interface	AbstractJWTClientValidator.SignatureValidator

Field Summary

Fields

Modifier and Type	Field	Description
protected final String	clientAuthenticatorProviderId
protected final org.keycloak.authentication.ClientAuthenticationFlowContext	context
protected String	expectedClientAssertionType
protected final org.keycloak.models.RealmModel	realm
protected final AbstractJWTClientValidator.SignatureValidator	signatureValidator

Fields inherited from class org.keycloak.authentication.authenticators.client.AbstractBaseJWTValidator

clientAssertionState, currentTime, session

Constructor Summary

Constructors

Constructor	Description
AbstractJWTClientValidator(org.keycloak.authentication.ClientAuthenticationFlowContext context, AbstractJWTClientValidator.SignatureValidator signatureValidator, String clientAuthenticatorProviderId)

Method Summary

Modifier and Type	Method	Description
boolean	failure(String errorDescription)
boolean	failure(String errorDescription, int statusCode)
boolean	failure(String error, String errorDescription, int statusCode)
protected boolean	failure(org.keycloak.authentication.AuthenticationFlowError error)
protected boolean	failure(org.keycloak.authentication.AuthenticationFlowError error, jakarta.ws.rs.core.Response response)
protected void	failureCallback(String errorDescription)
protected abstract int	getAllowedClockSkew()
org.keycloak.models.ClientModel	getClient()
org.keycloak.authentication.ClientAuthenticationFlowContext	getContext()
protected abstract List<String>	getExpectedAudiences()
protected abstract String	getExpectedSignatureAlgorithm()
protected abstract String	getExpectedTokenIssuer()
protected abstract int	getMaximumExpirationTime()
protected abstract boolean	isMultipleAudienceAllowed()
protected abstract boolean	isReusePermitted()
boolean	validate()
protected boolean	validateClient()
protected boolean	validateClientAssertionParameters()
protected boolean	validateSignature()

Methods inherited from class org.keycloak.authentication.authenticators.client.AbstractBaseJWTValidator

getClientAssertion, getJtiCacheKeyPrefix, getJws, getState, isSymmetricAlgorithmAllowed, validateSignatureAlgorithm, validateTokenActive, validateTokenAudience, validateTokenReuse

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

context

protected final org.keycloak.authentication.ClientAuthenticationFlowContext context

realm

protected final org.keycloak.models.RealmModel realm

signatureValidator

protected final AbstractJWTClientValidator.SignatureValidator signatureValidator

clientAuthenticatorProviderId

protected final String clientAuthenticatorProviderId

expectedClientAssertionType

protected String expectedClientAssertionType

Constructor Details

AbstractJWTClientValidator

public AbstractJWTClientValidator(org.keycloak.authentication.ClientAuthenticationFlowContext context,
 AbstractJWTClientValidator.SignatureValidator signatureValidator,
 String clientAuthenticatorProviderId)
                           throws Exception

Throws:

Exception

Method Details

getContext

public org.keycloak.authentication.ClientAuthenticationFlowContext getContext()

getClient

public org.keycloak.models.ClientModel getClient()

validate

public boolean validate()

validateClientAssertionParameters

protected boolean validateClientAssertionParameters()

validateClient

protected boolean validateClient()

validateSignature

protected boolean validateSignature()

failure

public boolean failure(String errorDescription)

failure

public boolean failure(String errorDescription,
 int statusCode)

failure

public boolean failure(String error,
 String errorDescription,
 int statusCode)

failure

protected boolean failure(org.keycloak.authentication.AuthenticationFlowError error)

failure

protected boolean failure(org.keycloak.authentication.AuthenticationFlowError error,
 jakarta.ws.rs.core.Response response)

failureCallback

protected void failureCallback(String errorDescription)

Specified by:

failureCallback in class AbstractBaseJWTValidator

getExpectedTokenIssuer

protected abstract String getExpectedTokenIssuer()

getExpectedAudiences

protected abstract List<String> getExpectedAudiences()

isMultipleAudienceAllowed

protected abstract boolean isMultipleAudienceAllowed()

getAllowedClockSkew

protected abstract int getAllowedClockSkew()

getMaximumExpirationTime

protected abstract int getMaximumExpirationTime()

isReusePermitted

protected abstract boolean isReusePermitted()

getExpectedSignatureAlgorithm

protected abstract String getExpectedSignatureAlgorithm()