Package org.keycloak.protocol.saml

Class SamlProtocol

java.lang.Object
org.keycloak.protocol.saml.SamlProtocol
All Implemented Interfaces:
org.keycloak.protocol.LoginProtocol, org.keycloak.provider.Provider
Direct Known Subclasses:
TokenEndpoint.TokenExchangeSamlProtocol
public class SamlProtocol extends Object implements org.keycloak.protocol.LoginProtocol
Version:
$Revision: 1 $
Author:
Bill Burke

  • Field Details

    • ATTRIBUTE_TRUE_VALUE

      public static final String ATTRIBUTE_TRUE_VALUE
      See Also:

    • ATTRIBUTE_FALSE_VALUE

      public static final String ATTRIBUTE_FALSE_VALUE
      See Also:

    • SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE

      public static final String SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE
      See Also:

    • SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE

      public static final String SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE
      See Also:

    • SAML_ASSERTION_CONSUMER_URL_ARTIFACT_ATTRIBUTE

      public static final String SAML_ASSERTION_CONSUMER_URL_ARTIFACT_ATTRIBUTE
      See Also:

    • SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE

      public static final String SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE
      See Also:

    • SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE

      public static final String SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE
      See Also:

    • SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE

      public static final String SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE
      See Also:

    • SAML_SINGLE_LOGOUT_SERVICE_URL_SOAP_ATTRIBUTE

      public static final String SAML_SINGLE_LOGOUT_SERVICE_URL_SOAP_ATTRIBUTE
      See Also:

    • SAML_ARTIFACT_RESOLUTION_SERVICE_URL_ATTRIBUTE

      public static final String SAML_ARTIFACT_RESOLUTION_SERVICE_URL_ATTRIBUTE
      See Also:

    • LOGIN_PROTOCOL

      public static final String LOGIN_PROTOCOL
      See Also:

    • SAML_BINDING

      public static final String SAML_BINDING
      See Also:

    • SAML_IDP_INITIATED_LOGIN

      public static final String SAML_IDP_INITIATED_LOGIN
      See Also:

    • SAML_POST_BINDING

      public static final String SAML_POST_BINDING
      See Also:

    • SAML_ARTIFACT_BINDING

      public static final String SAML_ARTIFACT_BINDING
      See Also:

    • SAML_SOAP_BINDING

      public static final String SAML_SOAP_BINDING
      See Also:

    • SAML_REDIRECT_BINDING

      public static final String SAML_REDIRECT_BINDING
      See Also:

    • SAML_REQUEST_ID

      public static final String SAML_REQUEST_ID
      See Also:

    • SAML_REQUEST_ID_BROKER

      public static final String SAML_REQUEST_ID_BROKER
      See Also:

    • SAML_LOGOUT_BINDING

      public static final String SAML_LOGOUT_BINDING
      See Also:

    • SAML_LOGOUT_ADD_EXTENSIONS_ELEMENT_WITH_KEY_INFO

      public static final String SAML_LOGOUT_ADD_EXTENSIONS_ELEMENT_WITH_KEY_INFO
      See Also:

    • SAML_SERVER_SIGNATURE_KEYINFO_KEY_NAME_TRANSFORMER

      public static final String SAML_SERVER_SIGNATURE_KEYINFO_KEY_NAME_TRANSFORMER
      See Also:

    • SAML_LOGOUT_REQUEST_ID

      public static final String SAML_LOGOUT_REQUEST_ID
      See Also:

    • SAML_LOGOUT_RELAY_STATE

      public static final String SAML_LOGOUT_RELAY_STATE
      See Also:

    • SAML_LOGOUT_CANONICALIZATION

      public static final String SAML_LOGOUT_CANONICALIZATION
      See Also:

    • SAML_LOGOUT_BINDING_URI

      public static final String SAML_LOGOUT_BINDING_URI
      See Also:

    • SAML_LOGOUT_SIGNATURE_ALGORITHM

      public static final String SAML_LOGOUT_SIGNATURE_ALGORITHM
      See Also:

    • SAML_NAME_ID

      public static final String SAML_NAME_ID
      See Also:

    • SAML_NAME_ID_FORMAT

      public static final String SAML_NAME_ID_FORMAT
      See Also:

    • SAML_DEFAULT_NAMEID_FORMAT

      public static final String SAML_DEFAULT_NAMEID_FORMAT

    • SAML_PERSISTENT_NAME_ID_FOR

      public static final String SAML_PERSISTENT_NAME_ID_FOR
      See Also:

    • SAML_IDP_INITIATED_SSO_RELAY_STATE

      public static final String SAML_IDP_INITIATED_SSO_RELAY_STATE
      See Also:

    • SAML_IDP_INITIATED_SSO_URL_NAME

      public static final String SAML_IDP_INITIATED_SSO_URL_NAME
      See Also:

    • SAML_LOGIN_REQUEST_FORCEAUTHN

      public static final String SAML_LOGIN_REQUEST_FORCEAUTHN
      See Also:

    • SAML_FORCEAUTHN_REQUIREMENT

      public static final String SAML_FORCEAUTHN_REQUIREMENT
      See Also:

    • SAML_LOGOUT_INITIATOR_CLIENT_ID

      public static final String SAML_LOGOUT_INITIATOR_CLIENT_ID
      See Also:

    • USER_SESSION_ID

      public static final String USER_SESSION_ID
      See Also:

    • CLIENT_SESSION_ID

      public static final String CLIENT_SESSION_ID
      See Also:

    • SAML_AUTHN_CONTEXT_CLASS_REF

      public static final String SAML_AUTHN_CONTEXT_CLASS_REF
      See Also:

    • logger

      protected static final org.jboss.logging.Logger logger

    • session

      protected org.keycloak.models.KeycloakSession session

    • realm

      protected org.keycloak.models.RealmModel realm

    • uriInfo

      protected jakarta.ws.rs.core.UriInfo uriInfo

    • headers

      protected jakarta.ws.rs.core.HttpHeaders headers

    • event

      protected org.keycloak.events.EventBuilder event

    • artifactResolver

      protected org.keycloak.protocol.saml.ArtifactResolver artifactResolver

    • singleUseStore

      protected org.keycloak.models.SingleUseObjectProvider singleUseStore

  • Constructor Details

    • SamlProtocol

      public SamlProtocol()

  • Method Details

    • setSession

      public SamlProtocol setSession(org.keycloak.models.KeycloakSession session)
      Specified by:
      setSession in interface org.keycloak.protocol.LoginProtocol

    • setRealm

      public SamlProtocol setRealm(org.keycloak.models.RealmModel realm)
      Specified by:
      setRealm in interface org.keycloak.protocol.LoginProtocol

    • setUriInfo

      public SamlProtocol setUriInfo(jakarta.ws.rs.core.UriInfo uriInfo)
      Specified by:
      setUriInfo in interface org.keycloak.protocol.LoginProtocol

    • setHttpHeaders

      public SamlProtocol setHttpHeaders(jakarta.ws.rs.core.HttpHeaders headers)
      Specified by:
      setHttpHeaders in interface org.keycloak.protocol.LoginProtocol

    • setEventBuilder

      public SamlProtocol setEventBuilder(org.keycloak.events.EventBuilder event)
      Specified by:
      setEventBuilder in interface org.keycloak.protocol.LoginProtocol

    • sendError

      public jakarta.ws.rs.core.Response sendError(org.keycloak.sessions.AuthenticationSessionModel authSession, org.keycloak.protocol.LoginProtocol.Error error, String errorMessage)
      Specified by:
      sendError in interface org.keycloak.protocol.LoginProtocol

    • getClientData

      public org.keycloak.protocol.ClientData getClientData(org.keycloak.sessions.AuthenticationSessionModel authSession)
      Specified by:
      getClientData in interface org.keycloak.protocol.LoginProtocol

    • sendError

      public jakarta.ws.rs.core.Response sendError(org.keycloak.models.ClientModel client, org.keycloak.protocol.ClientData clientData, org.keycloak.protocol.LoginProtocol.Error error)
      Specified by:
      sendError in interface org.keycloak.protocol.LoginProtocol

    • buildErrorResponse

      protected jakarta.ws.rs.core.Response buildErrorResponse(boolean isPostBinding, String destination, JaxrsSAML2BindingBuilder binding, Document document) throws org.keycloak.saml.common.exceptions.ConfigurationException, org.keycloak.saml.common.exceptions.ProcessingException, IOException
      Throws:
      org.keycloak.saml.common.exceptions.ConfigurationException
      org.keycloak.saml.common.exceptions.ProcessingException
      IOException

    • getResponseIssuer

      protected String getResponseIssuer(org.keycloak.models.RealmModel realm)

    • isPostBinding

      protected boolean isPostBinding(org.keycloak.sessions.AuthenticationSessionModel authSession)

    • isPostBinding

      protected boolean isPostBinding(org.keycloak.models.AuthenticatedClientSessionModel clientSession)

    • isLogoutPostBindingForInitiator

      public static boolean isLogoutPostBindingForInitiator(org.keycloak.models.UserSessionModel session)

    • getLogoutBindingTypeForClientSession

      public static String getLogoutBindingTypeForClientSession(org.keycloak.models.AuthenticatedClientSessionModel clientSession)

    • getNameIdFormat

      protected String getNameIdFormat(SamlClient samlClient, org.keycloak.sessions.AuthenticationSessionModel authSession)

    • getNameId

      protected String getNameId(String nameIdFormat, org.keycloak.sessions.CommonClientSessionModel clientSession, org.keycloak.models.UserSessionModel userSession)

    • getPersistentNameId

      protected String getPersistentNameId(org.keycloak.sessions.CommonClientSessionModel clientSession, org.keycloak.models.UserSessionModel userSession)
      Attempts to retrieve the persistent type NameId as follows:
      1. saml.persistent.name.id.for.$clientId user attribute
      2. saml.persistent.name.id.for.* user attribute
      3. G-$randomUuid

      If a randomUuid is generated, an attribute for the given saml.persistent.name.id.for.$clientId will be generated, otherwise no state change will occur with respect to the user's attributes.

      Returns:
      the user's persistent NameId

    • authenticated

      public jakarta.ws.rs.core.Response authenticated(org.keycloak.sessions.AuthenticationSessionModel authSession, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
      Specified by:
      authenticated in interface org.keycloak.protocol.LoginProtocol

    • buildAuthenticatedResponse

      protected jakarta.ws.rs.core.Response buildAuthenticatedResponse(org.keycloak.models.AuthenticatedClientSessionModel clientSession, String redirectUri, Document samlDocument, JaxrsSAML2BindingBuilder bindingBuilder) throws org.keycloak.saml.common.exceptions.ConfigurationException, org.keycloak.saml.common.exceptions.ProcessingException, IOException
      Throws:
      org.keycloak.saml.common.exceptions.ConfigurationException
      org.keycloak.saml.common.exceptions.ProcessingException
      IOException

    • populateAttributeStatements

      public org.keycloak.dom.saml.v2.assertion.AttributeStatementType populateAttributeStatements(List<SamlProtocol.ProtocolMapperProcessor<SAMLAttributeStatementMapper>> attributeStatementMappers, org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.AuthenticatedClientSessionModel clientSession)

    • transformLoginResponse

      public org.keycloak.dom.saml.v2.protocol.ResponseType transformLoginResponse(List<SamlProtocol.ProtocolMapperProcessor<SAMLLoginResponseMapper>> mappers, org.keycloak.dom.saml.v2.protocol.ResponseType response, org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)

    • populateRoles

      public void populateRoles(SamlProtocol.ProtocolMapperProcessor<SAMLRoleListMapper> roleListMapper, org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, org.keycloak.dom.saml.v2.assertion.AttributeStatementType existingAttributeStatement)

    • getSAMLNameId

      protected String getSAMLNameId(List<SamlProtocol.ProtocolMapperProcessor<SAMLNameIdMapper>> samlNameIdMappers, String nameIdFormat, org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.AuthenticatedClientSessionModel clientSession)

    • getLogoutServiceUrl

      public static String getLogoutServiceUrl(org.keycloak.models.KeycloakSession session, org.keycloak.models.ClientModel client, String bindingType, boolean backChannelLogout)

    • useArtifactForLogout

      public static boolean useArtifactForLogout(org.keycloak.models.ClientModel client)

    • frontchannelLogout

      public jakarta.ws.rs.core.Response frontchannelLogout(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.AuthenticatedClientSessionModel clientSession)
      Specified by:
      frontchannelLogout in interface org.keycloak.protocol.LoginProtocol

    • finishBrowserLogout

      public jakarta.ws.rs.core.Response finishBrowserLogout(org.keycloak.models.UserSessionModel userSession, org.keycloak.sessions.AuthenticationSessionModel logoutSession)
      Specified by:
      finishBrowserLogout in interface org.keycloak.protocol.LoginProtocol

    • buildLogoutResponse

      protected jakarta.ws.rs.core.Response buildLogoutResponse(org.keycloak.models.UserSessionModel userSession, String logoutBindingUri, org.keycloak.saml.SAML2LogoutResponseBuilder builder, JaxrsSAML2BindingBuilder binding) throws org.keycloak.saml.common.exceptions.ConfigurationException, org.keycloak.saml.common.exceptions.ProcessingException, IOException
      Throws:
      org.keycloak.saml.common.exceptions.ConfigurationException
      org.keycloak.saml.common.exceptions.ProcessingException
      IOException

    • backchannelLogout

      public jakarta.ws.rs.core.Response backchannelLogout(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.AuthenticatedClientSessionModel clientSession)
      Specified by:
      backchannelLogout in interface org.keycloak.protocol.LoginProtocol

    • createLogoutRequest

      protected org.keycloak.dom.saml.v2.protocol.LogoutRequestType createLogoutRequest(String logoutUrl, org.keycloak.models.AuthenticatedClientSessionModel clientSession, org.keycloak.models.ClientModel client, org.keycloak.saml.SamlProtocolExtensionsAwareBuilder.NodeGenerator... extensions) throws org.keycloak.saml.common.exceptions.ConfigurationException
      Throws:
      org.keycloak.saml.common.exceptions.ConfigurationException

    • requireReauthentication

      public boolean requireReauthentication(org.keycloak.models.UserSessionModel userSession, org.keycloak.sessions.AuthenticationSessionModel authSession)
      Specified by:
      requireReauthentication in interface org.keycloak.protocol.LoginProtocol

    • close

      public void close()
      Specified by:
      close in interface org.keycloak.provider.Provider

    • buildArtifactAuthenticatedResponse

      protected jakarta.ws.rs.core.Response buildArtifactAuthenticatedResponse(org.keycloak.models.AuthenticatedClientSessionModel clientSession, String redirectUri, org.keycloak.dom.saml.v2.SAML2Object samlDocument, JaxrsSAML2BindingBuilder bindingBuilder) throws org.keycloak.saml.common.exceptions.ProcessingException, org.keycloak.saml.common.exceptions.ConfigurationException
      This method, instead of sending the actual response with the token sends the artifact message via post or redirect.
      Parameters:
      clientSession - the current authenticated client session
      redirectUri - the redirect uri to the client
      samlDocument - a Document containing the saml Response
      bindingBuilder - the current JaxrsSAML2BindingBuilder configured with information for signing and encryption
      Returns:
      A response (POSTed form or redirect) with a newly generated artifact
      Throws:
      org.keycloak.saml.common.exceptions.ConfigurationException
      org.keycloak.saml.common.exceptions.ProcessingException
      IOException

    • buildLogoutArtifactResponse

      protected jakarta.ws.rs.core.Response buildLogoutArtifactResponse(org.keycloak.models.UserSessionModel userSession, String redirectUri, org.keycloak.dom.saml.v2.protocol.StatusResponseType statusResponseType, JaxrsSAML2BindingBuilder bindingBuilder) throws org.keycloak.saml.common.exceptions.ProcessingException, org.keycloak.saml.common.exceptions.ConfigurationException
      This method, instead of sending the actual response with the token, sends the artifact message via post or redirect. This method is only to be used for the final LogoutResponse.
      Parameters:
      userSession - The current user session being logged out
      redirectUri - the redirect uri to the client
      statusResponseType - a Document containing the saml Response
      bindingBuilder - the current JaxrsSAML2BindingBuilder configured with information for signing and encryption
      Returns:
      A response (POSTed form or redirect) with a newly generated artifact
      Throws:
      org.keycloak.saml.common.exceptions.ProcessingException
      IOException
      org.keycloak.saml.common.exceptions.ConfigurationException

    • buildArtifactAndStoreResponse

      protected String buildArtifactAndStoreResponse(org.keycloak.dom.saml.v2.SAML2Object statusResponseType, org.keycloak.models.UserSessionModel userSession) throws org.keycloak.protocol.saml.ArtifactResolverProcessingException, org.keycloak.saml.common.exceptions.ConfigurationException, org.keycloak.saml.common.exceptions.ProcessingException
      Throws:
      org.keycloak.protocol.saml.ArtifactResolverProcessingException
      org.keycloak.saml.common.exceptions.ConfigurationException
      org.keycloak.saml.common.exceptions.ProcessingException

    • buildArtifactAndStoreResponse

      protected String buildArtifactAndStoreResponse(org.keycloak.dom.saml.v2.SAML2Object saml2Object, org.keycloak.models.AuthenticatedClientSessionModel clientSessionModel) throws org.keycloak.protocol.saml.ArtifactResolverProcessingException, org.keycloak.saml.common.exceptions.ProcessingException, org.keycloak.saml.common.exceptions.ConfigurationException
      Throws:
      org.keycloak.protocol.saml.ArtifactResolverProcessingException
      org.keycloak.saml.common.exceptions.ProcessingException
      org.keycloak.saml.common.exceptions.ConfigurationException