Package org.keycloak.protocol.oidc.tokenexchange

Class V1TokenExchangeProvider

java.lang.Object

org.keycloak.protocol.oidc.tokenexchange.AbstractTokenExchangeProvider

org.keycloak.protocol.oidc.tokenexchange.V1TokenExchangeProvider

All Implemented Interfaces:

org.keycloak.protocol.oidc.TokenExchangeProvider, org.keycloak.provider.Provider

public class V1TokenExchangeProvider
extends AbstractTokenExchangeProvider

V1 token exchange provider. Supports all token exchange types (standard, federated, subject impersonation)

Author:

Dmitry Telegin

Nested Class Summary

Nested classes/interfaces inherited from class org.keycloak.protocol.oidc.tokenexchange.AbstractTokenExchangeProvider

AbstractTokenExchangeProvider.ExternalExchangeContext

Field Summary

Fields inherited from class org.keycloak.protocol.oidc.tokenexchange.AbstractTokenExchangeProvider

client, clientAuthAttributes, clientConnection, context, cors, event, formParams, headers, params, realm, session, tokenManager

Constructor Summary

Constructors

Constructor	Description
V1TokenExchangeProvider()

Method Summary

Modifier and Type	Method	Description
protected jakarta.ws.rs.core.Response	exchangeClientToOIDCClient(org.keycloak.models.UserModel targetUser, org.keycloak.models.UserSessionModel targetUserSession, String requestedTokenType, List<org.keycloak.models.ClientModel> targetAudienceClients, String scope, org.keycloak.representations.AccessToken subjectToken)
protected jakarta.ws.rs.core.Response	exchangeClientToSAML2Client(org.keycloak.models.UserModel targetUser, org.keycloak.models.UserSessionModel targetUserSession, String requestedTokenType, List<org.keycloak.models.ClientModel> targetAudienceClients)
protected String	getRequestedScope(org.keycloak.representations.AccessToken token, List<org.keycloak.models.ClientModel> targetAudienceClients)
protected String	getRequestedTokenType()
protected List<String>	getSupportedOAuthResponseTokenTypes()
protected org.keycloak.models.ClientModel	getTargetClient(List<org.keycloak.models.ClientModel> targetAudienceClients)
protected void	setClientToContext(List<org.keycloak.models.ClientModel> targetAudienceClients)
boolean	supports(org.keycloak.protocol.oidc.TokenExchangeContext context)
protected jakarta.ws.rs.core.Response	tokenExchange()
protected void	validateAudience(org.keycloak.representations.AccessToken token, boolean disallowOnHolderOfTokenMismatch, List<org.keycloak.models.ClientModel> targetAudienceClients)

Methods inherited from class org.keycloak.protocol.oidc.tokenexchange.AbstractTokenExchangeProvider

close, createSessionModel, exchange, exchangeClientToClient, exchangeExternalToken, exchangeToIdentityProvider, forbiddenIfClientIsNotTokenHolder, forbiddenIfClientIsNotWithinTokenAudience, getSubjectIssuer, getTargetAudienceClients, importUserFromExternalIdentity, isExternalInternalTokenExchangeRequest, locateExchangeExternalTokenByAlias, updateUserSessionFromClientAuth

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

V1TokenExchangeProvider

public V1TokenExchangeProvider()

Method Details

supports

public boolean supports(org.keycloak.protocol.oidc.TokenExchangeContext context)

tokenExchange

protected jakarta.ws.rs.core.Response tokenExchange()

Specified by:

tokenExchange in class AbstractTokenExchangeProvider

getRequestedTokenType

protected String getRequestedTokenType()

Specified by:

getRequestedTokenType in class AbstractTokenExchangeProvider

validateAudience

protected void validateAudience(org.keycloak.representations.AccessToken token,
 boolean disallowOnHolderOfTokenMismatch,
 List<org.keycloak.models.ClientModel> targetAudienceClients)

Specified by:

validateAudience in class AbstractTokenExchangeProvider

getSupportedOAuthResponseTokenTypes

protected List<String> getSupportedOAuthResponseTokenTypes()

Specified by:

getSupportedOAuthResponseTokenTypes in class AbstractTokenExchangeProvider

getRequestedScope

protected String getRequestedScope(org.keycloak.representations.AccessToken token,
 List<org.keycloak.models.ClientModel> targetAudienceClients)

Specified by:

getRequestedScope in class AbstractTokenExchangeProvider

setClientToContext

protected void setClientToContext(List<org.keycloak.models.ClientModel> targetAudienceClients)

Overrides:

setClientToContext in class AbstractTokenExchangeProvider

getTargetClient

protected org.keycloak.models.ClientModel getTargetClient(List<org.keycloak.models.ClientModel> targetAudienceClients)

exchangeClientToOIDCClient

protected jakarta.ws.rs.core.Response exchangeClientToOIDCClient(org.keycloak.models.UserModel targetUser,
 org.keycloak.models.UserSessionModel targetUserSession,
 String requestedTokenType,
 List<org.keycloak.models.ClientModel> targetAudienceClients,
 String scope,
 org.keycloak.representations.AccessToken subjectToken)

Specified by:

exchangeClientToOIDCClient in class AbstractTokenExchangeProvider

exchangeClientToSAML2Client

protected jakarta.ws.rs.core.Response exchangeClientToSAML2Client(org.keycloak.models.UserModel targetUser,
 org.keycloak.models.UserSessionModel targetUserSession,
 String requestedTokenType,
 List<org.keycloak.models.ClientModel> targetAudienceClients)

Specified by:

exchangeClientToSAML2Client in class AbstractTokenExchangeProvider