Package org.keycloak.broker.oidc

Class AbstractOAuth2IdentityProvider<C extends OAuth2IdentityProviderConfig>

java.lang.Object
org.keycloak.broker.provider.AbstractIdentityProvider<C>
org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider<C>
All Implemented Interfaces:
org.keycloak.broker.provider.ExchangeExternalToken, org.keycloak.broker.provider.ExchangeTokenToIdentityProviderToken, org.keycloak.broker.provider.IdentityProvider<C>, org.keycloak.broker.provider.UserAuthenticationIdentityProvider<C>, org.keycloak.provider.Provider
Direct Known Subclasses:
BitbucketIdentityProvider, FacebookIdentityProvider, GitHubIdentityProvider, InstagramIdentityProvider, MicrosoftIdentityProvider, OAuth2IdentityProvider, OIDCIdentityProvider, OpenshiftV4IdentityProvider, PayPalIdentityProvider, StackoverflowIdentityProvider
public abstract class AbstractOAuth2IdentityProvider<C extends OAuth2IdentityProviderConfig> extends org.keycloak.broker.provider.AbstractIdentityProvider<C> implements org.keycloak.broker.provider.ExchangeTokenToIdentityProviderToken, org.keycloak.broker.provider.ExchangeExternalToken
Author:
Pedro Igor

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Class
    Description
    protected static class 
    AbstractOAuth2IdentityProvider.Endpoint
     
    static class 
    AbstractOAuth2IdentityProvider.OAuthResponse
    This is a custom variant of AccessTokenResponse which avoid primitives that would auto-add zero values to the original responses.

    Nested classes/interfaces inherited from interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider

    org.keycloak.broker.provider.UserAuthenticationIdentityProvider.AuthenticationCallback

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    ACCESS_DENIED
     
    static final String
    ACCESS_TOKEN_EXPIRATION
     
    static final String
    FEDERATED_REFRESH_TOKEN
     
    static final String
    FEDERATED_TOKEN_EXPIRATION
     
    protected static final org.jboss.logging.Logger
    logger
     
    protected static com.fasterxml.jackson.databind.ObjectMapper
    mapper
     
    static final String
    OAUTH2_GRANT_TYPE_AUTHORIZATION_CODE
     
    static final String
    OAUTH2_GRANT_TYPE_REFRESH_TOKEN
     
    static final String
    OAUTH2_PARAMETER_ACCESS_TOKEN
     
    static final String
    OAUTH2_PARAMETER_CLIENT_ID
     
    static final String
    OAUTH2_PARAMETER_CLIENT_SECRET
     
    static final String
    OAUTH2_PARAMETER_CODE
     
    static final String
    OAUTH2_PARAMETER_GRANT_TYPE
     
    static final String
    OAUTH2_PARAMETER_REDIRECT_URI
     
    static final String
    OAUTH2_PARAMETER_RESPONSE_TYPE
     
    static final String
    OAUTH2_PARAMETER_SCOPE
     
    static final String
    OAUTH2_PARAMETER_STATE
     

    Fields inherited from class org.keycloak.broker.provider.AbstractIdentityProvider

    ACCOUNT_LINK_URL, BROKER_REGISTERED_NEW_USER, session, UPDATE_PROFILE_EMAIL_CHANGED, UPDATE_PROFILE_USERNAME_CHANGED

    Fields inherited from interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider

    EXTERNAL_IDENTITY_PROVIDER, FEDERATED_ACCESS_TOKEN

  • Constructor Summary

    Constructors
    Constructor
    Description
    AbstractOAuth2IdentityProvider(org.keycloak.models.KeycloakSession session, C config)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    com.fasterxml.jackson.databind.JsonNode
    asJsonNode(String json)
     
    org.keycloak.http.simple.SimpleHttpRequest
    authenticateTokenRequest(org.keycloak.http.simple.SimpleHttpRequest tokenRequest)
     
    void
    authenticationFinished(org.keycloak.sessions.AuthenticationSessionModel authSession, org.keycloak.broker.provider.BrokeredIdentityContext context)
     
    protected org.keycloak.http.simple.SimpleHttpRequest
    buildUserInfoRequest(String subjectToken, String userInfoUrl)
     
    Object
    callback(org.keycloak.models.RealmModel realm, org.keycloak.broker.provider.UserAuthenticationIdentityProvider.AuthenticationCallback callback, org.keycloak.events.EventBuilder event)
     
    protected jakarta.ws.rs.core.UriBuilder
    createAuthorizationUrl(org.keycloak.broker.provider.AuthenticationRequest request)
     
    protected org.keycloak.broker.provider.BrokeredIdentityContext
    doGetFederatedIdentity(String accessToken)
     
    final org.keycloak.broker.provider.BrokeredIdentityContext
    exchangeExternal(org.keycloak.protocol.oidc.TokenExchangeProvider tokenExchangeProvider, org.keycloak.protocol.oidc.TokenExchangeContext tokenExchangeContext)
     
    void
    exchangeExternalComplete(org.keycloak.models.UserSessionModel userSession, org.keycloak.broker.provider.BrokeredIdentityContext context, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
     
    protected org.keycloak.broker.provider.BrokeredIdentityContext
    exchangeExternalImpl(org.keycloak.events.EventBuilder event, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
    Usage with external-internal token-exchange
    protected org.keycloak.broker.provider.BrokeredIdentityContext
    exchangeExternalUserInfoValidationOnly(org.keycloak.events.EventBuilder event, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
     
    jakarta.ws.rs.core.Response
    exchangeFromToken(jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.events.EventBuilder event, org.keycloak.models.ClientModel authorizedClient, org.keycloak.models.UserSessionModel tokenUserSession, org.keycloak.models.UserModel tokenSubject, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
     
    protected jakarta.ws.rs.core.Response
    exchangeSessionToken(jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.events.EventBuilder event, org.keycloak.models.ClientModel authorizedClient, org.keycloak.models.UserSessionModel tokenUserSession, org.keycloak.models.UserModel tokenSubject)
     
    protected jakarta.ws.rs.core.Response
    exchangeStoredToken(jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.events.EventBuilder event, org.keycloak.models.ClientModel authorizedClient, org.keycloak.models.UserSessionModel tokenUserSession, org.keycloak.models.UserModel tokenSubject)
     
    protected org.keycloak.broker.provider.BrokeredIdentityContext
    extractIdentityFromProfile(org.keycloak.events.EventBuilder event, com.fasterxml.jackson.databind.JsonNode node)
     
    protected String
    extractTokenFromResponse(String response, String tokenName)
     
    protected org.keycloak.representations.JsonWebToken
    generateToken()
     
    protected String
    getAccessTokenResponseParameter()
     
    C
    getConfig()
     
    protected abstract String
    getDefaultScopes()
     
    org.keycloak.broker.provider.BrokeredIdentityContext
    getFederatedIdentity(String response)
     
    String
    getJsonProperty(com.fasterxml.jackson.databind.JsonNode jsonNode, String name)
    Get JSON property as text.
    protected String
    getProfileEndpointForValidation(org.keycloak.events.EventBuilder event)
     
    protected org.keycloak.http.simple.SimpleHttpRequest
    getRefreshTokenRequest(org.keycloak.models.KeycloakSession session, String refreshToken, String clientId, String clientSecret)
     
    protected org.keycloak.crypto.SignatureSignerContext
    getSignatureContext()
     
    protected jakarta.ws.rs.core.Response
    hasExternalExchangeToken(org.keycloak.events.EventBuilder event, org.keycloak.models.UserSessionModel tokenUserSession, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
    check to see if we have a token exchange in session in other words check to see if this session was created by an external exchange
    boolean
    isIssuer(String issuer, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
     
    jakarta.ws.rs.core.Response
    performLogin(org.keycloak.broker.provider.AuthenticationRequest request)
     
    jakarta.ws.rs.core.Response
    retrieveToken(org.keycloak.models.KeycloakSession session, org.keycloak.models.FederatedIdentityModel identity)
     
    jakarta.ws.rs.core.Response
    retrieveToken(org.keycloak.models.KeycloakSession session, org.keycloak.models.FederatedIdentityModel identity, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.UserModel user)
     
    protected org.keycloak.representations.oidc.TokenMetadataRepresentation
    sendTokenIntrospectionRequest(String idpAccessToken, org.keycloak.events.EventBuilder event)
    Send introspection request as specified in the OAuth2 token introspection specification.
    protected boolean
    supportsExternalExchange()
     
    boolean
    supportsLongStateParameter()
     
    protected org.keycloak.broker.provider.BrokeredIdentityContext
    validateExternalTokenThroughUserInfo(org.keycloak.events.EventBuilder event, String subjectToken, String subjectTokenType)
     
    protected void
    validateExternalTokenWithIntrospectionEndpoint(org.keycloak.protocol.oidc.TokenExchangeContext tokenExchangeContext)
    Called usually during external-internal token exchange for validation of external token, which is the token issued by the IDP.

    Methods inherited from class org.keycloak.broker.provider.AbstractIdentityProvider

    backchannelLogout, buildTokenResponse, close, exchangeErrorResponse, exchangeNotLinked, exchangeNotLinkedNoStore, exchangeNotSupported, exchangeTokenExpired, exchangeUnsupportedRequiredType, getFederatedAccessToken, getLinkingUrl, getMarshaller, importNewUser, keycloakInitiatedBrowserLogout, preprocessFederatedIdentity, setEmailVerified, updateBrokeredUser, updateEmail

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface org.keycloak.broker.provider.IdentityProvider

    export, isMapperSupported, isType, reloadKeys

  • Field Details

  • Constructor Details

    • AbstractOAuth2IdentityProvider

      public AbstractOAuth2IdentityProvider(org.keycloak.models.KeycloakSession session, C config)

  • Method Details

    • callback

      public Object callback(org.keycloak.models.RealmModel realm, org.keycloak.broker.provider.UserAuthenticationIdentityProvider.AuthenticationCallback callback, org.keycloak.events.EventBuilder event)
      Specified by:
      callback in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<C extends OAuth2IdentityProviderConfig>
      Overrides:
      callback in class org.keycloak.broker.provider.AbstractIdentityProvider<C extends OAuth2IdentityProviderConfig>

    • performLogin

      public jakarta.ws.rs.core.Response performLogin(org.keycloak.broker.provider.AuthenticationRequest request)
      Specified by:
      performLogin in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<C extends OAuth2IdentityProviderConfig>
      Overrides:
      performLogin in class org.keycloak.broker.provider.AbstractIdentityProvider<C extends OAuth2IdentityProviderConfig>

    • retrieveToken

      public jakarta.ws.rs.core.Response retrieveToken(org.keycloak.models.KeycloakSession session, org.keycloak.models.FederatedIdentityModel identity)
      Specified by:
      retrieveToken in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<C extends OAuth2IdentityProviderConfig>

    • retrieveToken

      public jakarta.ws.rs.core.Response retrieveToken(org.keycloak.models.KeycloakSession session, org.keycloak.models.FederatedIdentityModel identity, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.UserModel user)
      Specified by:
      retrieveToken in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<C extends OAuth2IdentityProviderConfig>

    • getRefreshTokenRequest

      protected org.keycloak.http.simple.SimpleHttpRequest getRefreshTokenRequest(org.keycloak.models.KeycloakSession session, String refreshToken, String clientId, String clientSecret)

    • getConfig

      public C getConfig()
      Specified by:
      getConfig in interface org.keycloak.broker.provider.IdentityProvider<C extends OAuth2IdentityProviderConfig>
      Overrides:
      getConfig in class org.keycloak.broker.provider.AbstractIdentityProvider<C extends OAuth2IdentityProviderConfig>

    • extractTokenFromResponse

      protected String extractTokenFromResponse(String response, String tokenName)

    • exchangeFromToken

      public jakarta.ws.rs.core.Response exchangeFromToken(jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.events.EventBuilder event, org.keycloak.models.ClientModel authorizedClient, org.keycloak.models.UserSessionModel tokenUserSession, org.keycloak.models.UserModel tokenSubject, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
      Specified by:
      exchangeFromToken in interface org.keycloak.broker.provider.ExchangeTokenToIdentityProviderToken

    • hasExternalExchangeToken

      protected jakarta.ws.rs.core.Response hasExternalExchangeToken(org.keycloak.events.EventBuilder event, org.keycloak.models.UserSessionModel tokenUserSession, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
      check to see if we have a token exchange in session in other words check to see if this session was created by an external exchange
      Parameters:
      tokenUserSession -
      params -
      Returns:

    • exchangeStoredToken

      protected jakarta.ws.rs.core.Response exchangeStoredToken(jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.events.EventBuilder event, org.keycloak.models.ClientModel authorizedClient, org.keycloak.models.UserSessionModel tokenUserSession, org.keycloak.models.UserModel tokenSubject)

    • exchangeSessionToken

      protected jakarta.ws.rs.core.Response exchangeSessionToken(jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.events.EventBuilder event, org.keycloak.models.ClientModel authorizedClient, org.keycloak.models.UserSessionModel tokenUserSession, org.keycloak.models.UserModel tokenSubject)

    • getFederatedIdentity

      public org.keycloak.broker.provider.BrokeredIdentityContext getFederatedIdentity(String response)

    • getAccessTokenResponseParameter

      protected String getAccessTokenResponseParameter()

    • doGetFederatedIdentity

      protected org.keycloak.broker.provider.BrokeredIdentityContext doGetFederatedIdentity(String accessToken)

    • createAuthorizationUrl

      protected jakarta.ws.rs.core.UriBuilder createAuthorizationUrl(org.keycloak.broker.provider.AuthenticationRequest request)

    • getJsonProperty

      public String getJsonProperty(com.fasterxml.jackson.databind.JsonNode jsonNode, String name)
      Get JSON property as text.

      Supports literal keys containing dots and nested lookup via dot-notation (e.g. "data.id" resolves json.data.id). Use backslash escaping for literal dots in nested paths (e.g. "data\.id" matches key "data.id"). See JsonUtils.splitClaimPath(String).

      Resolution order: 1) Exact key match (literal) 2) Nested path lookup

      JSON numbers and booleans are converted to text. Empty string is converted to null.

      Parameters:
      jsonNode - to get property from
      name - of property to get (supports dot-notation for nested paths, backslash-escaped dots for literal keys)
      Returns:
      string value of the property or null.

    • asJsonNode

      public com.fasterxml.jackson.databind.JsonNode asJsonNode(String json) throws IOException
      Throws:
      IOException

    • getDefaultScopes

      protected abstract String getDefaultScopes()

    • authenticationFinished

      public void authenticationFinished(org.keycloak.sessions.AuthenticationSessionModel authSession, org.keycloak.broker.provider.BrokeredIdentityContext context)
      Specified by:
      authenticationFinished in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<C extends OAuth2IdentityProviderConfig>
      Overrides:
      authenticationFinished in class org.keycloak.broker.provider.AbstractIdentityProvider<C extends OAuth2IdentityProviderConfig>

    • authenticateTokenRequest

      public org.keycloak.http.simple.SimpleHttpRequest authenticateTokenRequest(org.keycloak.http.simple.SimpleHttpRequest tokenRequest)

    • generateToken

      protected org.keycloak.representations.JsonWebToken generateToken()

    • getSignatureContext

      protected org.keycloak.crypto.SignatureSignerContext getSignatureContext()

    • getProfileEndpointForValidation

      protected String getProfileEndpointForValidation(org.keycloak.events.EventBuilder event)

    • extractIdentityFromProfile

      protected org.keycloak.broker.provider.BrokeredIdentityContext extractIdentityFromProfile(org.keycloak.events.EventBuilder event, com.fasterxml.jackson.databind.JsonNode node)

    • validateExternalTokenThroughUserInfo

      protected org.keycloak.broker.provider.BrokeredIdentityContext validateExternalTokenThroughUserInfo(org.keycloak.events.EventBuilder event, String subjectToken, String subjectTokenType)

    • buildUserInfoRequest

      protected org.keycloak.http.simple.SimpleHttpRequest buildUserInfoRequest(String subjectToken, String userInfoUrl)

    • supportsExternalExchange

      protected boolean supportsExternalExchange()

    • isIssuer

      public boolean isIssuer(String issuer, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
      Specified by:
      isIssuer in interface org.keycloak.broker.provider.ExchangeExternalToken

    • exchangeExternal

      public final org.keycloak.broker.provider.BrokeredIdentityContext exchangeExternal(org.keycloak.protocol.oidc.TokenExchangeProvider tokenExchangeProvider, org.keycloak.protocol.oidc.TokenExchangeContext tokenExchangeContext)
      Specified by:
      exchangeExternal in interface org.keycloak.broker.provider.ExchangeExternalToken

    • exchangeExternalImpl

      protected org.keycloak.broker.provider.BrokeredIdentityContext exchangeExternalImpl(org.keycloak.events.EventBuilder event, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
      Usage with external-internal token-exchange
      Parameters:
      event - event builder
      params - parameters of the token-exchange request
      Returns:
      brokered identity context with the details about user from the IDP

    • validateExternalTokenWithIntrospectionEndpoint

      protected void validateExternalTokenWithIntrospectionEndpoint(org.keycloak.protocol.oidc.TokenExchangeContext tokenExchangeContext)
      Called usually during external-internal token exchange for validation of external token, which is the token issued by the IDP. The validation of external token is done by calling OAuth2 introspection endpoint on the IDP side and validate if the response contains all the necessary claims and token is authorized for the token exchange (including validating of claims like aud from introspection response)
      Parameters:
      tokenExchangeContext - token exchange context with the external token (subject token) and other details related to token exchange
      Throws:
      ErrorResponseException - in case that validation failed for any reason

    • sendTokenIntrospectionRequest

      protected org.keycloak.representations.oidc.TokenMetadataRepresentation sendTokenIntrospectionRequest(String idpAccessToken, org.keycloak.events.EventBuilder event)
      Send introspection request as specified in the OAuth2 token introspection specification. It requires
      Parameters:
      idpAccessToken - access token issued by the IDP
      event - event builder
      Returns:
      token metadata in case that token introspection was successful and token is valid and active
      Throws:
      ErrorResponseException - in case that introspection response was not correct for any reason (other status than 200) or the token was not active

    • exchangeExternalUserInfoValidationOnly

      protected org.keycloak.broker.provider.BrokeredIdentityContext exchangeExternalUserInfoValidationOnly(org.keycloak.events.EventBuilder event, jakarta.ws.rs.core.MultivaluedMap<String,String> params)

    • exchangeExternalComplete

      public void exchangeExternalComplete(org.keycloak.models.UserSessionModel userSession, org.keycloak.broker.provider.BrokeredIdentityContext context, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
      Specified by:
      exchangeExternalComplete in interface org.keycloak.broker.provider.ExchangeExternalToken

    • supportsLongStateParameter

      public boolean supportsLongStateParameter()
      Specified by:
      supportsLongStateParameter in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<C extends OAuth2IdentityProviderConfig>