Package org.keycloak.services.util

Class MtlsHoKTokenUtil.MtlsHoKProtocolMapper

java.lang.Object

org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper

org.keycloak.services.util.MtlsHoKTokenUtil.MtlsHoKProtocolMapper

All Implemented Interfaces:

OIDCAccessTokenMapper, OIDCAccessTokenResponseMapper, OIDCIDTokenMapper, TokenIntrospectionTokenMapper, UserInfoTokenMapper, org.keycloak.protocol.ProtocolMapper, org.keycloak.provider.ConfiguredProvider, org.keycloak.provider.Provider, org.keycloak.provider.ProviderFactory<org.keycloak.protocol.ProtocolMapper>

Enclosing class:

MtlsHoKTokenUtil

public static class MtlsHoKTokenUtil.MtlsHoKProtocolMapper
extends AbstractOIDCProtocolMapper
implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper, TokenIntrospectionTokenMapper, OIDCAccessTokenResponseMapper

Protocol mapper that binds access tokens to the client's mTLS certificate by adding the "cnf" (confirmation) claim with a "x5t#S256" certificate thumbprint. This ensures sender-constrained tokens for all grant types, including token exchange.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	PROVIDER_ID

Fields inherited from class org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper

TOKEN_MAPPER_CATEGORY

Constructor Summary

Constructors

Constructor	Description
MtlsHoKProtocolMapper()

Method Summary

Modifier and Type	Method	Description
List<org.keycloak.provider.ProviderConfigProperty>	getConfigProperties()
String	getDisplayCategory()
String	getDisplayType()
String	getHelpText()
String	getId()
org.keycloak.representations.AccessToken	transformAccessToken(org.keycloak.representations.AccessToken token, org.keycloak.models.ProtocolMapperModel mappingModel, org.keycloak.models.KeycloakSession session, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)

Methods inherited from class org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper

close, create, getEffectiveModel, getProtocol, getShouldUseLightweightToken, init, postInit, setClaim, setClaim, setClaim, transformAccessTokenResponse, transformIDToken, transformIntrospectionToken, transformUserInfoToken

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.provider.ConfiguredProvider

getConfig

Methods inherited from interface org.keycloak.protocol.oidc.mappers.OIDCAccessTokenResponseMapper

transformAccessTokenResponse

Methods inherited from interface org.keycloak.protocol.oidc.mappers.OIDCIDTokenMapper

transformIDToken

Methods inherited from interface org.keycloak.protocol.ProtocolMapper

getPriority, validateConfig

Methods inherited from interface org.keycloak.provider.ProviderFactory

dependsOn, getConfigMetadata, order

Methods inherited from interface org.keycloak.protocol.oidc.mappers.TokenIntrospectionTokenMapper

transformIntrospectionToken

Methods inherited from interface org.keycloak.protocol.oidc.mappers.UserInfoTokenMapper

transformUserInfoToken

Field Details

PROVIDER_ID

public static final String PROVIDER_ID

See Also:

• Constant Field Values

Constructor Details

MtlsHoKProtocolMapper

public MtlsHoKProtocolMapper()

Method Details

getId

public String getId()

Specified by:

getId in interface org.keycloak.provider.ProviderFactory<org.keycloak.protocol.ProtocolMapper>

getDisplayCategory

public String getDisplayCategory()

Specified by:

getDisplayCategory in interface org.keycloak.protocol.ProtocolMapper

getDisplayType

public String getDisplayType()

Specified by:

getDisplayType in interface org.keycloak.protocol.ProtocolMapper

getHelpText

public String getHelpText()

Specified by:

getHelpText in interface org.keycloak.provider.ConfiguredProvider

getConfigProperties

public List<org.keycloak.provider.ProviderConfigProperty> getConfigProperties()

Specified by:

getConfigProperties in interface org.keycloak.provider.ConfiguredProvider

transformAccessToken

public org.keycloak.representations.AccessToken transformAccessToken(org.keycloak.representations.AccessToken token,
 org.keycloak.models.ProtocolMapperModel mappingModel,
 org.keycloak.models.KeycloakSession session,
 org.keycloak.models.UserSessionModel userSession,
 org.keycloak.models.ClientSessionContext clientSessionCtx)

Specified by:

transformAccessToken in interface OIDCAccessTokenMapper

Overrides:

transformAccessToken in class AbstractOIDCProtocolMapper