Package org.keycloak.protocol.oidc.tokenexchange

Class AbstractTokenExchangeProvider

java.lang.Object
org.keycloak.protocol.oidc.tokenexchange.AbstractTokenExchangeProvider
All Implemented Interfaces:
org.keycloak.protocol.oidc.TokenExchangeProvider, org.keycloak.provider.Provider
Direct Known Subclasses:
StandardTokenExchangeProvider, V1TokenExchangeProvider
public abstract class AbstractTokenExchangeProvider extends Object implements org.keycloak.protocol.oidc.TokenExchangeProvider
Base token exchange implementation. For now for both V1 and V2 token exchange (may change in the follow-up commits)
Author:
Dmitry Telegin

  • Field Details

    • params

      protected org.keycloak.protocol.oidc.TokenExchangeContext.Params params

    • formParams

      protected jakarta.ws.rs.core.MultivaluedMap<String,String> formParams

    • session

      protected org.keycloak.models.KeycloakSession session

    • cors

      protected org.keycloak.services.cors.Cors cors

    • realm

      protected org.keycloak.models.RealmModel realm

    • client

      protected org.keycloak.models.ClientModel client

    • event

      protected org.keycloak.events.EventBuilder event

    • clientConnection

      protected org.keycloak.common.ClientConnection clientConnection

    • headers

      protected jakarta.ws.rs.core.HttpHeaders headers

    • tokenManager

      protected TokenManager tokenManager

    • clientAuthAttributes

      protected Map<String,String> clientAuthAttributes

    • context

      protected org.keycloak.protocol.oidc.TokenExchangeContext context

  • Constructor Details

    • AbstractTokenExchangeProvider

      public AbstractTokenExchangeProvider()

  • Method Details

    • exchange

      public jakarta.ws.rs.core.Response exchange(org.keycloak.protocol.oidc.TokenExchangeContext context)
      Specified by:
      exchange in interface org.keycloak.protocol.oidc.TokenExchangeProvider

    • close

      public void close()
      Specified by:
      close in interface org.keycloak.provider.Provider

    • tokenExchange

      protected abstract jakarta.ws.rs.core.Response tokenExchange()

    • isExternalInternalTokenExchangeRequest

      protected boolean isExternalInternalTokenExchangeRequest(org.keycloak.protocol.oidc.TokenExchangeContext context)
      Is it the request for external-internal token exchange?

    • getSubjectIssuer

      protected String getSubjectIssuer(org.keycloak.protocol.oidc.TokenExchangeContext context, String subjectToken, String subjectTokenType)

    • exchangeToIdentityProvider

      protected jakarta.ws.rs.core.Response exchangeToIdentityProvider(org.keycloak.models.UserModel targetUser, org.keycloak.models.UserSessionModel targetUserSession, String requestedIssuer)

    • getRequestedTokenType

      protected abstract String getRequestedTokenType()

    • getTargetAudienceClients

      protected List<org.keycloak.models.ClientModel> getTargetAudienceClients()

    • validateAudience

      protected abstract void validateAudience(org.keycloak.representations.AccessToken token, boolean disallowOnHolderOfTokenMismatch, List<org.keycloak.models.ClientModel> targetAudienceClients)

    • exchangeClientToClient

      protected jakarta.ws.rs.core.Response exchangeClientToClient(org.keycloak.models.UserModel targetUser, org.keycloak.models.UserSessionModel targetUserSession, org.keycloak.representations.AccessToken token, boolean disallowOnHolderOfTokenMismatch)

    • forbiddenIfClientIsNotWithinTokenAudience

      protected void forbiddenIfClientIsNotWithinTokenAudience(org.keycloak.representations.AccessToken token)

    • forbiddenIfClientIsNotTokenHolder

      protected void forbiddenIfClientIsNotTokenHolder(boolean disallowOnHolderOfTokenMismatch, org.keycloak.models.ClientModel tokenHolder)

    • getSupportedOAuthResponseTokenTypes

      protected abstract List<String> getSupportedOAuthResponseTokenTypes()

    • createSessionModel

      protected org.keycloak.sessions.AuthenticationSessionModel createSessionModel(org.keycloak.models.UserSessionModel targetUserSession, org.keycloak.sessions.RootAuthenticationSessionModel rootAuthSession, org.keycloak.models.UserModel targetUser, org.keycloak.models.ClientModel client, String scope)

    • getRequestedScope

      protected abstract String getRequestedScope(org.keycloak.representations.AccessToken token, List<org.keycloak.models.ClientModel> targetAudienceClients)

    • setClientToContext

      protected void setClientToContext(List<org.keycloak.models.ClientModel> targetAudienceClients)

    • exchangeClientToOIDCClient

      protected abstract jakarta.ws.rs.core.Response exchangeClientToOIDCClient(org.keycloak.models.UserModel targetUser, org.keycloak.models.UserSessionModel targetUserSession, String requestedTokenType, List<org.keycloak.models.ClientModel> targetAudienceClients, String scope, org.keycloak.representations.AccessToken subjectToken)

    • exchangeClientToSAML2Client

      protected abstract jakarta.ws.rs.core.Response exchangeClientToSAML2Client(org.keycloak.models.UserModel targetUser, org.keycloak.models.UserSessionModel targetUserSession, String requestedTokenType, List<org.keycloak.models.ClientModel> targetAudienceClients)

    • exchangeExternalToken

      protected jakarta.ws.rs.core.Response exchangeExternalToken(String subjectIssuer, String subjectToken)

    • importUserFromExternalIdentity

      protected org.keycloak.models.UserModel importUserFromExternalIdentity(org.keycloak.broker.provider.BrokeredIdentityContext context)

    • updateUserSessionFromClientAuth

      protected void updateUserSessionFromClientAuth(org.keycloak.models.UserSessionModel userSession)

    • locateExchangeExternalTokenByAlias

      protected AbstractTokenExchangeProvider.ExternalExchangeContext locateExchangeExternalTokenByAlias(String alias)