Package org.keycloak.protocol.oidc

Class OIDCLoginProtocol

java.lang.Object

org.keycloak.protocol.oidc.OIDCLoginProtocol

All Implemented Interfaces:

org.keycloak.protocol.LoginProtocol, org.keycloak.provider.Provider

public class OIDCLoginProtocol
extends Object
implements org.keycloak.protocol.LoginProtocol

Author:

Bill Burke, Stian Thorgersen

Nested Class Summary

Nested classes/interfaces inherited from interface org.keycloak.protocol.LoginProtocol

org.keycloak.protocol.LoginProtocol.Error

Field Summary

Fields

Modifier and Type	Field	Description
static final String	ACR_PARAM
static final String	ATTEST_JWT_CLIENT_AUTH
static final String	CLAIMS_PARAM
static final String	CLIENT_ID_PARAM
static final String	CLIENT_SECRET_BASIC
static final String	CLIENT_SECRET_BASIC_UNENCODED	Deprecated, for removal: This API element is subject to removal in a future version.
static final String	CLIENT_SECRET_JWT
static final String	CLIENT_SECRET_POST
static final String	CODE_CHALLENGE_METHOD_PARAM
static final String	CODE_CHALLENGE_PARAM
static final String	CODE_PARAM
static final String	CONSENT_NOTE
static final String	DPOP_JKT
protected org.keycloak.events.EventBuilder	event
static final String	GRANT_TYPE_PARAM
protected jakarta.ws.rs.core.HttpHeaders	headers
static final String	ID_TOKEN_HINT
static final String	ISSUER
static final String	LOGIN_HINT_PARAM
static final String	LOGIN_PROTOCOL
static final String	LOGOUT_REDIRECT_URI
static final String	LOGOUT_STATE_PARAM
static final String	LOGOUT_VALIDATED_ID_TOKEN_ISSUED_AT
static final String	LOGOUT_VALIDATED_ID_TOKEN_SESSION_STATE
static final String	MAX_AGE_PARAM
static final String	NONCE_PARAM
static final int	PKCE_CODE_CHALLENGE_MAX_LENGTH
static final int	PKCE_CODE_CHALLENGE_MIN_LENGTH
static final int	PKCE_CODE_VERIFIER_MAX_LENGTH
static final int	PKCE_CODE_VERIFIER_MIN_LENGTH
static final String	PKCE_METHOD_PLAIN
static final String	PKCE_METHOD_S256
static final String	POST_LOGOUT_REDIRECT_URI_PARAM
static final String	PRIVATE_KEY_JWT
static final String	PROMPT_PARAM
static final String	PROMPT_VALUE_CONSENT
static final String	PROMPT_VALUE_CREATE
static final String	PROMPT_VALUE_LOGIN
static final String	PROMPT_VALUE_NONE
static final String	PROMPT_VALUE_SELECT_ACCOUNT
protected OIDCProviderConfig	providerConfig
protected org.keycloak.models.RealmModel	realm
static final String	REDIRECT_URI_PARAM
static final String	REQUEST_PARAM
static final String	REQUEST_URI_PARAM
static final String	RESOURCE_PARAM
static final String	RESPONSE_MODE_PARAM
static final String	RESPONSE_TYPE_PARAM
protected OIDCResponseMode	responseMode
protected OIDCResponseType	responseType
static final String	SCOPE_PARAM
protected org.keycloak.models.KeycloakSession	session
static final String	STATE_PARAM
static final String	TLS_CLIENT_AUTH
static final String	UI_LOCALES_PARAM
protected jakarta.ws.rs.core.UriInfo	uriInfo

Constructor Summary

Constructors

Constructor	Description
OIDCLoginProtocol(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, jakarta.ws.rs.core.UriInfo uriInfo, jakarta.ws.rs.core.HttpHeaders headers, org.keycloak.events.EventBuilder event)
OIDCLoginProtocol(OIDCProviderConfig providerConfig)

Method Summary

Modifier and Type	Method	Description
jakarta.ws.rs.core.Response	authenticated(org.keycloak.sessions.AuthenticationSessionModel authSession, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
void	authenticationComplete(org.keycloak.sessions.AuthenticationSessionModel authSession)
jakarta.ws.rs.core.Response	backchannelLogout(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.AuthenticatedClientSessionModel clientSession)
jakarta.ws.rs.core.Response	buildRedirectUri(OIDCRedirectUriBuilder redirectUriBuilder, org.keycloak.sessions.AuthenticationSessionModel authSession, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)	this method can be used in extension-implementations to the OIDCLoginProtocol to add additional parameters to the redirectUri after successful authentication and to store these e.g. in the clientSession
jakarta.ws.rs.core.Response	buildRedirectUri(OIDCRedirectUriBuilder redirectUriBuilder, org.keycloak.sessions.AuthenticationSessionModel authSession, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, Exception ex, org.keycloak.protocol.LoginProtocol.Error oidcError)	this method can be used in extension-implementations to the OIDCLoginProtocol to add additional parameters to the redirectUri after failed authentication
void	close()
jakarta.ws.rs.core.Response	finishBrowserLogout(org.keycloak.models.UserSessionModel userSession, org.keycloak.sessions.AuthenticationSessionModel logoutSession)
jakarta.ws.rs.core.Response	frontchannelLogout(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.AuthenticatedClientSessionModel clientSession)
org.keycloak.protocol.ClientData	getClientData(org.keycloak.sessions.AuthenticationSessionModel authSession)
OIDCProviderConfig	getConfig()
protected boolean	isAuthTimeExpired(org.keycloak.models.UserSessionModel userSession, org.keycloak.sessions.AuthenticationSessionModel authSession)
protected boolean	isPromptLogin(org.keycloak.sessions.AuthenticationSessionModel authSession)
protected boolean	isReAuthRequiredForKcAction(org.keycloak.models.UserSessionModel userSession, org.keycloak.sessions.AuthenticationSessionModel authSession)
boolean	requireReauthentication(org.keycloak.models.UserSessionModel userSession, org.keycloak.sessions.AuthenticationSessionModel authSession)
jakarta.ws.rs.core.Response	sendError(org.keycloak.models.ClientModel client, org.keycloak.protocol.ClientData clientData, org.keycloak.protocol.LoginProtocol.Error error)
jakarta.ws.rs.core.Response	sendError(org.keycloak.sessions.AuthenticationSessionModel authSession, org.keycloak.protocol.LoginProtocol.Error error, String errorMessage)
boolean	sendPushRevocationPolicyRequest(org.keycloak.models.RealmModel realm, org.keycloak.models.ClientModel resource, int notBefore, String managementUrl)
OIDCLoginProtocol	setEventBuilder(org.keycloak.events.EventBuilder event)
OIDCLoginProtocol	setHttpHeaders(jakarta.ws.rs.core.HttpHeaders headers)
OIDCLoginProtocol	setRealm(org.keycloak.models.RealmModel realm)
OIDCLoginProtocol	setSession(org.keycloak.models.KeycloakSession session)
OIDCLoginProtocol	setUriInfo(jakarta.ws.rs.core.UriInfo uriInfo)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOGIN_PROTOCOL

public static final String LOGIN_PROTOCOL

See Also:

• Constant Field Values

STATE_PARAM

public static final String STATE_PARAM

See Also:

• Constant Field Values

SCOPE_PARAM

public static final String SCOPE_PARAM

See Also:

• Constant Field Values

RESOURCE_PARAM

public static final String RESOURCE_PARAM

See Also:

• Constant Field Values

CODE_PARAM

public static final String CODE_PARAM

See Also:

• Constant Field Values

RESPONSE_TYPE_PARAM

public static final String RESPONSE_TYPE_PARAM

See Also:

• Constant Field Values

GRANT_TYPE_PARAM

public static final String GRANT_TYPE_PARAM

See Also:

• Constant Field Values

REDIRECT_URI_PARAM

public static final String REDIRECT_URI_PARAM

See Also:

• Constant Field Values

POST_LOGOUT_REDIRECT_URI_PARAM

public static final String POST_LOGOUT_REDIRECT_URI_PARAM

See Also:

• Constant Field Values

CLIENT_ID_PARAM

public static final String CLIENT_ID_PARAM

See Also:

• Constant Field Values

NONCE_PARAM

public static final String NONCE_PARAM

See Also:

• Constant Field Values

MAX_AGE_PARAM

public static final String MAX_AGE_PARAM

See Also:

• Constant Field Values

PROMPT_PARAM

public static final String PROMPT_PARAM

See Also:

• Constant Field Values

LOGIN_HINT_PARAM

public static final String LOGIN_HINT_PARAM

See Also:

• Constant Field Values

REQUEST_PARAM

public static final String REQUEST_PARAM

See Also:

• Constant Field Values

REQUEST_URI_PARAM

public static final String REQUEST_URI_PARAM

See Also:

• Constant Field Values

UI_LOCALES_PARAM

public static final String UI_LOCALES_PARAM

See Also:

• Constant Field Values

CLAIMS_PARAM

public static final String CLAIMS_PARAM

See Also:

• Constant Field Values

ACR_PARAM

public static final String ACR_PARAM

See Also:

• Constant Field Values

ID_TOKEN_HINT

public static final String ID_TOKEN_HINT

See Also:

• Constant Field Values

CONSENT_NOTE

public static final String CONSENT_NOTE

See Also:

• Constant Field Values

LOGOUT_STATE_PARAM

public static final String LOGOUT_STATE_PARAM

See Also:

• Constant Field Values

LOGOUT_REDIRECT_URI

public static final String LOGOUT_REDIRECT_URI

See Also:

• Constant Field Values

LOGOUT_VALIDATED_ID_TOKEN_SESSION_STATE

public static final String LOGOUT_VALIDATED_ID_TOKEN_SESSION_STATE

See Also:

• Constant Field Values

LOGOUT_VALIDATED_ID_TOKEN_ISSUED_AT

public static final String LOGOUT_VALIDATED_ID_TOKEN_ISSUED_AT

See Also:

• Constant Field Values

ISSUER

public static final String ISSUER

See Also:

• Constant Field Values

RESPONSE_MODE_PARAM

public static final String RESPONSE_MODE_PARAM

See Also:

• Constant Field Values

PROMPT_VALUE_NONE

public static final String PROMPT_VALUE_NONE

See Also:

• Constant Field Values

PROMPT_VALUE_LOGIN

public static final String PROMPT_VALUE_LOGIN

See Also:

• Constant Field Values

PROMPT_VALUE_CONSENT

public static final String PROMPT_VALUE_CONSENT

See Also:

• Constant Field Values

PROMPT_VALUE_CREATE

public static final String PROMPT_VALUE_CREATE

See Also:

• Constant Field Values

PROMPT_VALUE_SELECT_ACCOUNT

public static final String PROMPT_VALUE_SELECT_ACCOUNT

See Also:

• Constant Field Values

CLIENT_SECRET_BASIC

public static final String CLIENT_SECRET_BASIC

See Also:

• Constant Field Values

CLIENT_SECRET_POST

public static final String CLIENT_SECRET_POST

See Also:

• Constant Field Values

CLIENT_SECRET_JWT

public static final String CLIENT_SECRET_JWT

See Also:

• Constant Field Values

PRIVATE_KEY_JWT

public static final String PRIVATE_KEY_JWT

See Also:

• Constant Field Values

TLS_CLIENT_AUTH

public static final String TLS_CLIENT_AUTH

See Also:

• Constant Field Values

ATTEST_JWT_CLIENT_AUTH

public static final String ATTEST_JWT_CLIENT_AUTH

See Also:

• Constant Field Values

CLIENT_SECRET_BASIC_UNENCODED

@Deprecated(since="26.5",
            forRemoval=true)
public static final String CLIENT_SECRET_BASIC_UNENCODED

Deprecated, for removal: This API element is subject to removal in a future version.

This is just for legacy setups which expect an unencoded, non-RFC6749 compliant client secret send from Keycloak to an IdP.

See Also:

• Constant Field Values

CODE_CHALLENGE_PARAM

public static final String CODE_CHALLENGE_PARAM

See Also:

• Constant Field Values

CODE_CHALLENGE_METHOD_PARAM

public static final String CODE_CHALLENGE_METHOD_PARAM

See Also:

• Constant Field Values

PKCE_CODE_CHALLENGE_MIN_LENGTH

public static final int PKCE_CODE_CHALLENGE_MIN_LENGTH

See Also:

• Constant Field Values

PKCE_CODE_CHALLENGE_MAX_LENGTH

public static final int PKCE_CODE_CHALLENGE_MAX_LENGTH

See Also:

• Constant Field Values

PKCE_CODE_VERIFIER_MIN_LENGTH

public static final int PKCE_CODE_VERIFIER_MIN_LENGTH

See Also:

• Constant Field Values

PKCE_CODE_VERIFIER_MAX_LENGTH

public static final int PKCE_CODE_VERIFIER_MAX_LENGTH

See Also:

• Constant Field Values

PKCE_METHOD_PLAIN

public static final String PKCE_METHOD_PLAIN

See Also:

• Constant Field Values

PKCE_METHOD_S256

public static final String PKCE_METHOD_S256

See Also:

• Constant Field Values

DPOP_JKT

public static final String DPOP_JKT

See Also:

• Constant Field Values

session

protected org.keycloak.models.KeycloakSession session

realm

protected org.keycloak.models.RealmModel realm

uriInfo

protected jakarta.ws.rs.core.UriInfo uriInfo

headers

protected jakarta.ws.rs.core.HttpHeaders headers

event

protected org.keycloak.events.EventBuilder event

responseType

protected OIDCResponseType responseType

responseMode

protected OIDCResponseMode responseMode

providerConfig

protected OIDCProviderConfig providerConfig

Constructor Details

OIDCLoginProtocol

public OIDCLoginProtocol(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.RealmModel realm,
 jakarta.ws.rs.core.UriInfo uriInfo,
 jakarta.ws.rs.core.HttpHeaders headers,
 org.keycloak.events.EventBuilder event)

OIDCLoginProtocol

public OIDCLoginProtocol(OIDCProviderConfig providerConfig)

Method Details

setSession

public OIDCLoginProtocol setSession(org.keycloak.models.KeycloakSession session)

Specified by:

setSession in interface org.keycloak.protocol.LoginProtocol

setRealm

public OIDCLoginProtocol setRealm(org.keycloak.models.RealmModel realm)

Specified by:

setRealm in interface org.keycloak.protocol.LoginProtocol

setUriInfo

public OIDCLoginProtocol setUriInfo(jakarta.ws.rs.core.UriInfo uriInfo)

Specified by:

setUriInfo in interface org.keycloak.protocol.LoginProtocol

setHttpHeaders

public OIDCLoginProtocol setHttpHeaders(jakarta.ws.rs.core.HttpHeaders headers)

Specified by:

setHttpHeaders in interface org.keycloak.protocol.LoginProtocol

setEventBuilder

public OIDCLoginProtocol setEventBuilder(org.keycloak.events.EventBuilder event)

Specified by:

setEventBuilder in interface org.keycloak.protocol.LoginProtocol

getConfig

public OIDCProviderConfig getConfig()

authenticated

public jakarta.ws.rs.core.Response authenticated(org.keycloak.sessions.AuthenticationSessionModel authSession,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx)

Specified by:

authenticated in interface org.keycloak.protocol.LoginProtocol

buildRedirectUri

public jakarta.ws.rs.core.Response buildRedirectUri(OIDCRedirectUriBuilder redirectUriBuilder,
 org.keycloak.sessions.AuthenticationSessionModel authSession,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx)

this method can be used in extension-implementations to the OIDCLoginProtocol to add additional parameters to the redirectUri after successful authentication and to store these e.g. in the clientSession

buildRedirectUri

public jakarta.ws.rs.core.Response buildRedirectUri(OIDCRedirectUriBuilder redirectUriBuilder,
 org.keycloak.sessions.AuthenticationSessionModel authSession,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx,
 Exception ex,
 org.keycloak.protocol.LoginProtocol.Error oidcError)

this method can be used in extension-implementations to the OIDCLoginProtocol to add additional parameters to the redirectUri after failed authentication

sendError

public jakarta.ws.rs.core.Response sendError(org.keycloak.sessions.AuthenticationSessionModel authSession,
 org.keycloak.protocol.LoginProtocol.Error error,
 String errorMessage)

Specified by:

sendError in interface org.keycloak.protocol.LoginProtocol

getClientData

public org.keycloak.protocol.ClientData getClientData(org.keycloak.sessions.AuthenticationSessionModel authSession)

Specified by:

getClientData in interface org.keycloak.protocol.LoginProtocol

sendError

public jakarta.ws.rs.core.Response sendError(org.keycloak.models.ClientModel client,
 org.keycloak.protocol.ClientData clientData,
 org.keycloak.protocol.LoginProtocol.Error error)

Specified by:

sendError in interface org.keycloak.protocol.LoginProtocol

backchannelLogout

public jakarta.ws.rs.core.Response backchannelLogout(org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.AuthenticatedClientSessionModel clientSession)

Specified by:

backchannelLogout in interface org.keycloak.protocol.LoginProtocol

frontchannelLogout

public jakarta.ws.rs.core.Response frontchannelLogout(org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.AuthenticatedClientSessionModel clientSession)

Specified by:

frontchannelLogout in interface org.keycloak.protocol.LoginProtocol

finishBrowserLogout

public jakarta.ws.rs.core.Response finishBrowserLogout(org.keycloak.models.UserSessionModel userSession,
 org.keycloak.sessions.AuthenticationSessionModel logoutSession)

Specified by:

finishBrowserLogout in interface org.keycloak.protocol.LoginProtocol

requireReauthentication

public boolean requireReauthentication(org.keycloak.models.UserSessionModel userSession,
 org.keycloak.sessions.AuthenticationSessionModel authSession)

Specified by:

requireReauthentication in interface org.keycloak.protocol.LoginProtocol

isPromptLogin

protected boolean isPromptLogin(org.keycloak.sessions.AuthenticationSessionModel authSession)

isAuthTimeExpired

protected boolean isAuthTimeExpired(org.keycloak.models.UserSessionModel userSession,
 org.keycloak.sessions.AuthenticationSessionModel authSession)

isReAuthRequiredForKcAction

protected boolean isReAuthRequiredForKcAction(org.keycloak.models.UserSessionModel userSession,
 org.keycloak.sessions.AuthenticationSessionModel authSession)

sendPushRevocationPolicyRequest

public boolean sendPushRevocationPolicyRequest(org.keycloak.models.RealmModel realm,
 org.keycloak.models.ClientModel resource,
 int notBefore,
 String managementUrl)

Specified by:

sendPushRevocationPolicyRequest in interface org.keycloak.protocol.LoginProtocol

authenticationComplete

public void authenticationComplete(org.keycloak.sessions.AuthenticationSessionModel authSession)

Specified by:

authenticationComplete in interface org.keycloak.protocol.LoginProtocol

close

public void close()

Specified by:

close in interface org.keycloak.provider.Provider