Package org.keycloak.protocol.oidc

Class TokenManager

java.lang.Object

org.keycloak.protocol.oidc.TokenManager

public class TokenManager
extends Object

Stateless object that creates tokens and manages oauth access codes

Version:

$Revision: 1 $

Author:

Bill Burke

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	TokenManager.AccessTokenResponseBuilder
static class	TokenManager.NotBeforeCheck
static class	TokenManager.TokenRevocationCheck	Check if access token was revoked with OAuth revocation endpoint
static class	TokenManager.TokenValidation

Constructor Summary

Constructors

Constructor	Description
TokenManager()

Method Summary

Modifier and Type	Method	Description
static org.keycloak.models.ClientSessionContext	attachAuthenticationSession(org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, org.keycloak.sessions.AuthenticationSessionModel authSession)
static org.keycloak.models.ClientSessionContext	attachAuthenticationSession(org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, org.keycloak.sessions.AuthenticationSessionModel authSession, boolean createTransientIfMissing)
static org.keycloak.models.ClientSessionContext	attachAuthenticationSession(org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, org.keycloak.sessions.AuthenticationSessionModel authSession, Set<String> restrictedScopes, boolean createTransientIfMissing)
org.keycloak.representations.AccessToken	createClientAccessToken(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, org.keycloak.models.ClientModel client, org.keycloak.models.UserModel user, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, boolean isOffline)
static void	detachClientSession(org.keycloak.models.AuthenticatedClientSessionModel clientSession)
Map<String,Object>	generateUserInfoClaims(org.keycloak.representations.AccessToken userInfo, org.keycloak.models.UserModel userModel)
static Set<org.keycloak.models.RoleModel>	getAccess(org.keycloak.models.UserModel user, org.keycloak.models.ClientModel client, Stream<org.keycloak.models.ClientScopeModel> clientScopes)
static Stream<org.keycloak.models.ClientScopeModel>	getRequestedClientScopes(org.keycloak.models.KeycloakSession session, String scopeParam, org.keycloak.models.ClientModel client, org.keycloak.models.UserModel user)	Return client itself + all default client scopes of client + optional client scopes requested by scope parameter
String	getReuseIdKey(org.keycloak.representations.AccessToken refreshToken)
protected org.keycloak.representations.AccessToken	initToken(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, org.keycloak.models.ClientModel client, org.keycloak.models.UserModel user, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, boolean isOffline)
static boolean	isRepeatableScope(org.keycloak.models.KeycloakSession session, org.keycloak.models.ClientScopeModel clientScope)
static boolean	isUserValid(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, org.keycloak.representations.AccessToken token, org.keycloak.models.UserModel user)
static boolean	isValidScope(org.keycloak.models.KeycloakSession session, String scopes, org.keycloak.models.ClientModel client)
static boolean	isValidScope(org.keycloak.models.KeycloakSession session, String scopes, org.keycloak.models.ClientModel client, org.keycloak.models.UserModel user)
static boolean	isValidScope(org.keycloak.models.KeycloakSession session, String scopes, org.keycloak.rar.AuthorizationRequestContext authorizationRequestContext, org.keycloak.models.ClientModel client)	Check that all the ClientScopes that have been parsed into authorization_resources are actually in the requested scopes otherwise, the scope wasn't parsed correctly
static boolean	isValidScope(org.keycloak.models.KeycloakSession session, String scopes, org.keycloak.rar.AuthorizationRequestContext authorizationRequestContext, org.keycloak.models.ClientModel client, org.keycloak.models.UserModel user)
static org.keycloak.models.UserModel	lookupUserFromStatelessToken(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, org.keycloak.representations.AccessToken token)	Lookup user from the "stateless" token.
static Stream<String>	parseScopeParameter(String scopeParam)
TokenManager.AccessTokenResponseBuilder	responseBuilder(org.keycloak.models.RealmModel realm, org.keycloak.models.ClientModel client, org.keycloak.events.EventBuilder event, org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
Optional<org.keycloak.representations.LogoutToken>	toLogoutToken(String encodedLogoutToken)
org.keycloak.representations.RefreshToken	toRefreshToken(org.keycloak.models.KeycloakSession session, String encodedRefreshToken)
org.keycloak.representations.AccessToken	transformAccessToken(org.keycloak.models.KeycloakSession session, org.keycloak.representations.AccessToken token, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
org.keycloak.representations.AccessTokenResponse	transformAccessTokenResponse(org.keycloak.models.KeycloakSession session, org.keycloak.representations.AccessTokenResponse accessTokenResponse, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
org.keycloak.representations.IDToken	transformIDToken(org.keycloak.models.KeycloakSession session, org.keycloak.representations.IDToken token, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
org.keycloak.representations.AccessToken	transformIntrospectionAccessToken(org.keycloak.models.KeycloakSession session, org.keycloak.representations.AccessToken bearer, org.keycloak.representations.AccessToken token, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
org.keycloak.representations.AccessToken	transformUserInfoAccessToken(org.keycloak.models.KeycloakSession session, org.keycloak.representations.AccessToken userInfo, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
org.keycloak.representations.AccessToken	transformUserInfoAccessToken(org.keycloak.models.KeycloakSession session, org.keycloak.representations.AccessToken bearerToken, org.keycloak.representations.AccessToken userInfo, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
Stream<OIDCIdentityProvider>	validateLogoutTokenAgainstIdpProvider(Stream<OIDCIdentityProvider> oidcIdps, String encodedLogoutToken)
void	validateSelectedOrganization(org.keycloak.models.KeycloakSession session, org.keycloak.representations.JsonWebToken token, org.keycloak.models.UserModel user)
TokenManager.TokenValidation	validateToken(org.keycloak.models.KeycloakSession session, jakarta.ws.rs.core.UriInfo uriInfo, org.keycloak.common.ClientConnection connection, org.keycloak.models.RealmModel realm, org.keycloak.representations.RefreshToken oldToken, jakarta.ws.rs.core.HttpHeaders headers, String oldTokenScope)
void	validateTokenReuse(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, org.keycloak.representations.AccessToken refreshToken, org.keycloak.models.AuthenticatedClientSessionModel clientSession, boolean refreshFlag)
static boolean	validateUserNotBefore(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, org.keycloak.representations.AccessToken token, org.keycloak.models.UserModel user)
static boolean	verifyConsentStillAvailable(org.keycloak.models.KeycloakSession session, org.keycloak.models.UserModel user, org.keycloak.models.ClientModel client, org.keycloak.models.AuthenticatedClientSessionModel clientSession, String scopeParam)
org.keycloak.representations.IDToken	verifyIDToken(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, String encodedIDToken)
org.keycloak.representations.IDToken	verifyIDTokenSignature(org.keycloak.models.KeycloakSession session, String encodedIDToken)
LogoutTokenValidationContext	verifyLogoutToken(org.keycloak.models.KeycloakSession session, String encodedLogoutToken)
org.keycloak.representations.RefreshToken	verifyRefreshToken(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, org.keycloak.models.ClientModel client, org.keycloak.http.HttpRequest request, String encodedRefreshToken, boolean checkExpiration)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

TokenManager

public TokenManager()

Method Details

validateToken

public TokenManager.TokenValidation validateToken(org.keycloak.models.KeycloakSession session,
 jakarta.ws.rs.core.UriInfo uriInfo,
 org.keycloak.common.ClientConnection connection,
 org.keycloak.models.RealmModel realm,
 org.keycloak.representations.RefreshToken oldToken,
 jakarta.ws.rs.core.HttpHeaders headers,
 String oldTokenScope)
                                           throws org.keycloak.OAuthErrorException

Throws:

org.keycloak.OAuthErrorException

isUserValid

public static boolean isUserValid(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.RealmModel realm,
 org.keycloak.representations.AccessToken token,
 org.keycloak.models.UserModel user)

validateUserNotBefore

public static boolean validateUserNotBefore(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.RealmModel realm,
 org.keycloak.representations.AccessToken token,
 org.keycloak.models.UserModel user)

lookupUserFromStatelessToken

public static org.keycloak.models.UserModel lookupUserFromStatelessToken(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.RealmModel realm,
 org.keycloak.representations.AccessToken token)

Lookup user from the "stateless" token. Stateless token is the token without sessionState filled (token doesn't belong to any userSession)

validateTokenReuse

public void validateTokenReuse(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.RealmModel realm,
 org.keycloak.representations.AccessToken refreshToken,
 org.keycloak.models.AuthenticatedClientSessionModel clientSession,
 boolean refreshFlag)
                        throws org.keycloak.OAuthErrorException

Throws:

org.keycloak.OAuthErrorException

verifyRefreshToken

public org.keycloak.representations.RefreshToken verifyRefreshToken(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.RealmModel realm,
 org.keycloak.models.ClientModel client,
 org.keycloak.http.HttpRequest request,
 String encodedRefreshToken,
 boolean checkExpiration)
                                                             throws org.keycloak.OAuthErrorException

Throws:

org.keycloak.OAuthErrorException

toRefreshToken

public org.keycloak.representations.RefreshToken toRefreshToken(org.keycloak.models.KeycloakSession session,
 String encodedRefreshToken)
                                                         throws org.keycloak.jose.jws.JWSInputException,
org.keycloak.OAuthErrorException

Throws:

org.keycloak.jose.jws.JWSInputException

org.keycloak.OAuthErrorException

verifyIDToken

public org.keycloak.representations.IDToken verifyIDToken(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.RealmModel realm,
 String encodedIDToken)
                                                   throws org.keycloak.OAuthErrorException

Throws:

org.keycloak.OAuthErrorException

verifyIDTokenSignature

public org.keycloak.representations.IDToken verifyIDTokenSignature(org.keycloak.models.KeycloakSession session,
 String encodedIDToken)
                                                            throws org.keycloak.OAuthErrorException

Throws:

org.keycloak.OAuthErrorException

createClientAccessToken

public org.keycloak.representations.AccessToken createClientAccessToken(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.RealmModel realm,
 org.keycloak.models.ClientModel client,
 org.keycloak.models.UserModel user,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx,
 boolean isOffline)

attachAuthenticationSession

public static org.keycloak.models.ClientSessionContext attachAuthenticationSession(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.sessions.AuthenticationSessionModel authSession)

attachAuthenticationSession

public static org.keycloak.models.ClientSessionContext attachAuthenticationSession(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.sessions.AuthenticationSessionModel authSession,
 boolean createTransientIfMissing)

attachAuthenticationSession

public static org.keycloak.models.ClientSessionContext attachAuthenticationSession(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.sessions.AuthenticationSessionModel authSession,
 Set<String> restrictedScopes,
 boolean createTransientIfMissing)

detachClientSession

public static void detachClientSession(org.keycloak.models.AuthenticatedClientSessionModel clientSession)

getAccess

public static Set<org.keycloak.models.RoleModel> getAccess(org.keycloak.models.UserModel user,
 org.keycloak.models.ClientModel client,
 Stream<org.keycloak.models.ClientScopeModel> clientScopes)

getRequestedClientScopes

public static Stream<org.keycloak.models.ClientScopeModel> getRequestedClientScopes(org.keycloak.models.KeycloakSession session,
 String scopeParam,
 org.keycloak.models.ClientModel client,
 org.keycloak.models.UserModel user)

Return client itself + all default client scopes of client + optional client scopes requested by scope parameter

isValidScope

public static boolean isValidScope(org.keycloak.models.KeycloakSession session,
 String scopes,
 org.keycloak.rar.AuthorizationRequestContext authorizationRequestContext,
 org.keycloak.models.ClientModel client)

Check that all the ClientScopes that have been parsed into authorization_resources are actually in the requested scopes otherwise, the scope wasn't parsed correctly

Parameters:

session -

scopes -

authorizationRequestContext - authorizationRequestContext. It is not null just if parameterized scopes feature is enabled

client -

Returns:

isValidScope

public static boolean isValidScope(org.keycloak.models.KeycloakSession session,
 String scopes,
 org.keycloak.rar.AuthorizationRequestContext authorizationRequestContext,
 org.keycloak.models.ClientModel client,
 org.keycloak.models.UserModel user)

isRepeatableScope

public static boolean isRepeatableScope(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.ClientScopeModel clientScope)

isValidScope

public static boolean isValidScope(org.keycloak.models.KeycloakSession session,
 String scopes,
 org.keycloak.models.ClientModel client)

isValidScope

public static boolean isValidScope(org.keycloak.models.KeycloakSession session,
 String scopes,
 org.keycloak.models.ClientModel client,
 org.keycloak.models.UserModel user)

parseScopeParameter

public static Stream<String> parseScopeParameter(String scopeParam)

verifyConsentStillAvailable

public static boolean verifyConsentStillAvailable(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.UserModel user,
 org.keycloak.models.ClientModel client,
 org.keycloak.models.AuthenticatedClientSessionModel clientSession,
 String scopeParam)

transformAccessToken

public org.keycloak.representations.AccessToken transformAccessToken(org.keycloak.models.KeycloakSession session,
 org.keycloak.representations.AccessToken token,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx)

transformAccessTokenResponse

public org.keycloak.representations.AccessTokenResponse transformAccessTokenResponse(org.keycloak.models.KeycloakSession session,
 org.keycloak.representations.AccessTokenResponse accessTokenResponse,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx)

transformUserInfoAccessToken

public org.keycloak.representations.AccessToken transformUserInfoAccessToken(org.keycloak.models.KeycloakSession session,
 org.keycloak.representations.AccessToken userInfo,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx)

transformUserInfoAccessToken

public org.keycloak.representations.AccessToken transformUserInfoAccessToken(org.keycloak.models.KeycloakSession session,
 org.keycloak.representations.AccessToken bearerToken,
 org.keycloak.representations.AccessToken userInfo,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx)

transformIntrospectionAccessToken

public org.keycloak.representations.AccessToken transformIntrospectionAccessToken(org.keycloak.models.KeycloakSession session,
 org.keycloak.representations.AccessToken bearer,
 org.keycloak.representations.AccessToken token,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx)

generateUserInfoClaims

public Map<String,Object> generateUserInfoClaims(org.keycloak.representations.AccessToken userInfo,
 org.keycloak.models.UserModel userModel)

transformIDToken

public org.keycloak.representations.IDToken transformIDToken(org.keycloak.models.KeycloakSession session,
 org.keycloak.representations.IDToken token,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx)

initToken

protected org.keycloak.representations.AccessToken initToken(org.keycloak.models.KeycloakSession session,
 org.keycloak.models.RealmModel realm,
 org.keycloak.models.ClientModel client,
 org.keycloak.models.UserModel user,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx,
 boolean isOffline)

responseBuilder

public TokenManager.AccessTokenResponseBuilder responseBuilder(org.keycloak.models.RealmModel realm,
 org.keycloak.models.ClientModel client,
 org.keycloak.events.EventBuilder event,
 org.keycloak.models.KeycloakSession session,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx)

verifyLogoutToken

public LogoutTokenValidationContext verifyLogoutToken(org.keycloak.models.KeycloakSession session,
 String encodedLogoutToken)

toLogoutToken

public Optional<org.keycloak.representations.LogoutToken> toLogoutToken(String encodedLogoutToken)

validateLogoutTokenAgainstIdpProvider

public Stream<OIDCIdentityProvider> validateLogoutTokenAgainstIdpProvider(Stream<OIDCIdentityProvider> oidcIdps,
 String encodedLogoutToken)

getReuseIdKey

public String getReuseIdKey(org.keycloak.representations.AccessToken refreshToken)

validateSelectedOrganization

public void validateSelectedOrganization(org.keycloak.models.KeycloakSession session,
 org.keycloak.representations.JsonWebToken token,
 org.keycloak.models.UserModel user)