Package org.keycloak.broker.oidc

Class OIDCIdentityProvider

java.lang.Object
org.keycloak.broker.provider.AbstractIdentityProvider<C>
org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>
org.keycloak.broker.oidc.OIDCIdentityProvider
All Implemented Interfaces:
org.keycloak.broker.provider.ClientAssertionIdentityProvider<OIDCIdentityProviderConfig>, org.keycloak.broker.provider.ExchangeExternalToken, org.keycloak.broker.provider.ExchangeTokenToIdentityProviderToken, org.keycloak.broker.provider.IdentityProvider<OIDCIdentityProviderConfig>, org.keycloak.broker.provider.JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>, org.keycloak.broker.provider.TrustMaterialIdentityProvider<OIDCIdentityProviderConfig>, org.keycloak.broker.provider.UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>, org.keycloak.provider.Provider
Direct Known Subclasses:
GitLabIdentityProvider, GoogleIdentityProvider, KeycloakOIDCIdentityProvider, LinkedInOIDCIdentityProvider
public class OIDCIdentityProvider extends AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig> implements org.keycloak.broker.provider.ExchangeExternalToken, org.keycloak.broker.provider.ClientAssertionIdentityProvider<OIDCIdentityProviderConfig>, org.keycloak.broker.provider.JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>, org.keycloak.broker.provider.TrustMaterialIdentityProvider<OIDCIdentityProviderConfig>
Author:
Pedro Igor

  • Field Details

  • Constructor Details

    • OIDCIdentityProvider

      public OIDCIdentityProvider(org.keycloak.models.KeycloakSession session, OIDCIdentityProviderConfig config)

  • Method Details

    • callback

      public Object callback(org.keycloak.models.RealmModel realm, org.keycloak.broker.provider.UserAuthenticationIdentityProvider.AuthenticationCallback callback, org.keycloak.events.EventBuilder event)
      Specified by:
      callback in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>
      Overrides:
      callback in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • isType

      public boolean isType(org.keycloak.models.KeycloakSession session, org.keycloak.models.IdentityProviderType type)
      Specified by:
      isType in interface org.keycloak.broker.provider.IdentityProvider<OIDCIdentityProviderConfig>

    • refreshTokenForLogout

      public String refreshTokenForLogout(org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession)
      Returns access token response as a string from a refresh token invocation on the remote OIDC broker
      Parameters:
      session -
      userSession -
      Returns:

    • backchannelLogout

      public void backchannelLogout(org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.models.RealmModel realm)
      Specified by:
      backchannelLogout in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>
      Overrides:
      backchannelLogout in class org.keycloak.broker.provider.AbstractIdentityProvider<OIDCIdentityProviderConfig>

    • backchannelLogout

      protected void backchannelLogout(org.keycloak.models.UserSessionModel userSession, String idToken)

    • keycloakInitiatedBrowserLogout

      public jakarta.ws.rs.core.Response keycloakInitiatedBrowserLogout(org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.models.RealmModel realm)
      Specified by:
      keycloakInitiatedBrowserLogout in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>
      Overrides:
      keycloakInitiatedBrowserLogout in class org.keycloak.broker.provider.AbstractIdentityProvider<OIDCIdentityProviderConfig>

    • exchangeStoredToken

      protected jakarta.ws.rs.core.Response exchangeStoredToken(jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.events.EventBuilder event, org.keycloak.models.ClientModel authorizedClient, org.keycloak.models.UserSessionModel tokenUserSession, org.keycloak.models.UserModel tokenSubject)
      Overrides:
      exchangeStoredToken in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • exchangeSessionToken

      protected jakarta.ws.rs.core.Response exchangeSessionToken(jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.events.EventBuilder event, org.keycloak.models.ClientModel authorizedClient, org.keycloak.models.UserSessionModel tokenUserSession, org.keycloak.models.UserModel tokenSubject)
      Overrides:
      exchangeSessionToken in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • validateExternalTokenThroughUserInfo

      protected org.keycloak.broker.provider.BrokeredIdentityContext validateExternalTokenThroughUserInfo(org.keycloak.events.EventBuilder event, String subjectToken, String subjectTokenType)
      Overrides:
      validateExternalTokenThroughUserInfo in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • processAccessTokenResponse

      protected void processAccessTokenResponse(org.keycloak.broker.provider.BrokeredIdentityContext context, org.keycloak.representations.AccessTokenResponse response)

    • getFederatedIdentity

      public org.keycloak.broker.provider.BrokeredIdentityContext getFederatedIdentity(String response)
      Overrides:
      getFederatedIdentity in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • isAuthTimeExpired

      protected boolean isAuthTimeExpired(org.keycloak.representations.JsonWebToken idToken, org.keycloak.sessions.AuthenticationSessionModel authSession)

    • extractIdentity

      protected org.keycloak.broker.provider.BrokeredIdentityContext extractIdentity(org.keycloak.representations.AccessTokenResponse tokenResponse, String accessToken, org.keycloak.representations.JsonWebToken idToken) throws IOException
      Throws:
      IOException

    • getusernameClaimNameForIdToken

      protected String getusernameClaimNameForIdToken()

    • getUserInfoUrl

      protected String getUserInfoUrl()

    • getIdentityProviderKeyWrapper

      protected org.keycloak.crypto.KeyWrapper getIdentityProviderKeyWrapper(org.keycloak.jose.jws.JWSInput jws)

    • verify

      protected boolean verify(org.keycloak.jose.jws.JWSInput jws)

    • verifySignature

      protected boolean verifySignature(org.keycloak.jose.jws.JWSInput jws)
      Verify signature on given JWS
      Returns:
      true if signature was successfully verified with the keys available to identity provider

    • parseTokenInput

      protected String parseTokenInput(String encodedToken, boolean shouldBeSigned)
      Parses a JWT token that can be a JWE, JWS or JWE/JWS. It returns the content as a string. If JWS is involved the signature is also validated. A IdentityBrokerException is thrown on any error.
      Parameters:
      encodedToken - The token in the encoded string format.
      shouldBeSigned - true if the token should be signed (id token), false if the token can be only encrypted and not signed (user info).
      Returns:
      The content in string format.

    • validateToken

      public org.keycloak.representations.JsonWebToken validateToken(String encodedToken)

    • validateToken

      protected org.keycloak.representations.JsonWebToken validateToken(String encodedToken, boolean ignoreAudience)

    • authenticationFinished

      public void authenticationFinished(org.keycloak.sessions.AuthenticationSessionModel authSession, org.keycloak.broker.provider.BrokeredIdentityContext context)
      Specified by:
      authenticationFinished in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>
      Overrides:
      authenticationFinished in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • getDefaultScopes

      protected String getDefaultScopes()
      Specified by:
      getDefaultScopes in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • isIssuer

      public boolean isIssuer(String issuer, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
      Specified by:
      isIssuer in interface org.keycloak.broker.provider.ExchangeExternalToken
      Overrides:
      isIssuer in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • supportsExternalExchange

      protected boolean supportsExternalExchange()
      Overrides:
      supportsExternalExchange in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • getProfileEndpointForValidation

      protected String getProfileEndpointForValidation(org.keycloak.events.EventBuilder event)
      Overrides:
      getProfileEndpointForValidation in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • extractIdentityFromProfile

      protected org.keycloak.broker.provider.BrokeredIdentityContext extractIdentityFromProfile(org.keycloak.events.EventBuilder event, com.fasterxml.jackson.databind.JsonNode userInfo)
      Overrides:
      extractIdentityFromProfile in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • getUsernameFromUserInfo

      protected String getUsernameFromUserInfo(com.fasterxml.jackson.databind.JsonNode userInfo)

    • validateJwt

      protected final org.keycloak.broker.provider.BrokeredIdentityContext validateJwt(org.keycloak.events.EventBuilder event, String subjectToken, String subjectTokenType)

    • isTokenTypeSupported

      protected boolean isTokenTypeSupported(org.keycloak.representations.JsonWebToken parsedToken)

    • exchangeExternalImpl

      protected org.keycloak.broker.provider.BrokeredIdentityContext exchangeExternalImpl(org.keycloak.events.EventBuilder event, jakarta.ws.rs.core.MultivaluedMap<String,String> params)
      Description copied from class: AbstractOAuth2IdentityProvider
      Usage with external-internal token-exchange
      Overrides:
      exchangeExternalImpl in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>
      Parameters:
      event - event builder
      params - parameters of the token-exchange request
      Returns:
      brokered identity context with the details about user from the IDP

    • createAuthorizationUrl

      protected jakarta.ws.rs.core.UriBuilder createAuthorizationUrl(org.keycloak.broker.provider.AuthenticationRequest request)
      Overrides:
      createAuthorizationUrl in class AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig>

    • preprocessFederatedIdentity

      public void preprocessFederatedIdentity(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, org.keycloak.broker.provider.BrokeredIdentityContext context)
      Specified by:
      preprocessFederatedIdentity in interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider<OIDCIdentityProviderConfig>
      Overrides:
      preprocessFederatedIdentity in class org.keycloak.broker.provider.AbstractIdentityProvider<OIDCIdentityProviderConfig>

    • reloadKeys

      public boolean reloadKeys()
      Specified by:
      reloadKeys in interface org.keycloak.broker.provider.IdentityProvider<OIDCIdentityProviderConfig>

    • resolveKeys

      public Stream<org.keycloak.jose.jwk.JWK> resolveKeys(org.keycloak.broker.provider.TrustMaterialRequest request)
      Specified by:
      resolveKeys in interface org.keycloak.broker.provider.TrustMaterialIdentityProvider<OIDCIdentityProviderConfig>

    • setEmailVerified

      protected void setEmailVerified(org.keycloak.models.UserModel user, org.keycloak.broker.provider.BrokeredIdentityContext context)
      Overrides:
      setEmailVerified in class org.keycloak.broker.provider.AbstractIdentityProvider<OIDCIdentityProviderConfig>

    • verifyClientAssertion

      public boolean verifyClientAssertion(org.keycloak.authentication.ClientAuthenticationFlowContext context) throws Exception
      Specified by:
      verifyClientAssertion in interface org.keycloak.broker.provider.ClientAssertionIdentityProvider<OIDCIdentityProviderConfig>
      Throws:
      Exception

    • validateAuthorizationGrantAssertion

      public org.keycloak.broker.provider.BrokeredIdentityContext validateAuthorizationGrantAssertion(org.keycloak.protocol.oidc.JWTAuthorizationGrantValidationContext context) throws org.keycloak.broker.provider.IdentityBrokerException
      Specified by:
      validateAuthorizationGrantAssertion in interface org.keycloak.broker.provider.JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>
      Throws:
      org.keycloak.broker.provider.IdentityBrokerException

    • getAllowedClockSkew

      public int getAllowedClockSkew()
      Specified by:
      getAllowedClockSkew in interface org.keycloak.broker.provider.JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

    • isAssertionReuseAllowed

      public boolean isAssertionReuseAllowed()
      Specified by:
      isAssertionReuseAllowed in interface org.keycloak.broker.provider.JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

    • getAllowedAudienceForJWTGrant

      public List<String> getAllowedAudienceForJWTGrant()
      Specified by:
      getAllowedAudienceForJWTGrant in interface org.keycloak.broker.provider.JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

    • getMaxAllowedExpiration

      public int getMaxAllowedExpiration()
      Specified by:
      getMaxAllowedExpiration in interface org.keycloak.broker.provider.JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

    • getAssertionSignatureAlg

      public String getAssertionSignatureAlg()
      Specified by:
      getAssertionSignatureAlg in interface org.keycloak.broker.provider.JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>

    • isLimitAccessTokenExpiration

      public boolean isLimitAccessTokenExpiration()
      Specified by:
      isLimitAccessTokenExpiration in interface org.keycloak.broker.provider.JWTAuthorizationGrantProvider<OIDCIdentityProviderConfig>