Package org.keycloak.broker.spiffe

Class SpiffeIdentityProvider

java.lang.Object

org.keycloak.broker.spiffe.SpiffeIdentityProvider

All Implemented Interfaces:

ClientAssertionIdentityProvider, IdentityProvider<SpiffeIdentityProviderConfig>, Provider

public class SpiffeIdentityProvider
extends Object
implements IdentityProvider<SpiffeIdentityProviderConfig>, ClientAssertionIdentityProvider

Implementation for https://datatracker.ietf.org/doc/draft-schwenkschuster-oauth-spiffe-client-auth/ Main differences for SPIFFE JWT SVIDs and regular client assertions:

• jwt-spiffe client assertion type
• iss claim is optional, uses SPIFFE IDs, which includes trust domain instead
• jti claim is optional, and SPIFFE vendors re-use/cache tokens
• sub is a SPIFFE ID with the syntax spiffe://trust-domain/workload-identity
• Keys are fetched from a SPIFFE bundle endpoint, where the JWKS has additional SPIFFE specific fields (spiffe_sequence and spiffe_refresh_hint, the JWK does not set the alg>

Nested Class Summary

Nested classes/interfaces inherited from interface org.keycloak.broker.provider.IdentityProvider

IdentityProvider.AuthenticationCallback

Field Summary

Fields inherited from interface org.keycloak.broker.provider.IdentityProvider

EXTERNAL_IDENTITY_PROVIDER, FEDERATED_ACCESS_TOKEN

Constructor Summary

Constructors

Constructor	Description
SpiffeIdentityProvider(KeycloakSession session, SpiffeIdentityProviderConfig config)

Method Summary

Modifier and Type	Method	Description
void	authenticationFinished(AuthenticationSessionModel authSession, BrokeredIdentityContext context)
void	backchannelLogout(KeycloakSession session, UserSessionModel userSession, jakarta.ws.rs.core.UriInfo uriInfo, RealmModel realm)
Object	callback(RealmModel realm, IdentityProvider.AuthenticationCallback callback, EventBuilder event)
void	close()
jakarta.ws.rs.core.Response	export(jakarta.ws.rs.core.UriInfo uriInfo, RealmModel realm, String format)
SpiffeIdentityProviderConfig	getConfig()
IdentityProviderDataMarshaller	getMarshaller()
void	importNewUser(KeycloakSession session, RealmModel realm, UserModel user, BrokeredIdentityContext context)
jakarta.ws.rs.core.Response	keycloakInitiatedBrowserLogout(KeycloakSession session, UserSessionModel userSession, jakarta.ws.rs.core.UriInfo uriInfo, RealmModel realm)
jakarta.ws.rs.core.Response	performLogin(AuthenticationRequest request)
void	preprocessFederatedIdentity(KeycloakSession session, RealmModel realm, BrokeredIdentityContext context)
jakarta.ws.rs.core.Response	retrieveToken(KeycloakSession session, FederatedIdentityModel identity)
void	updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, BrokeredIdentityContext context)
boolean	verifyClientAssertion(ClientAuthenticationFlowContext context)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.broker.provider.IdentityProvider

isMapperSupported, reloadKeys, supportsLongStateParameter

Constructor Details

SpiffeIdentityProvider

public SpiffeIdentityProvider(KeycloakSession session,
 SpiffeIdentityProviderConfig config)

Method Details

getConfig

public SpiffeIdentityProviderConfig getConfig()

Specified by:

getConfig in interface IdentityProvider<SpiffeIdentityProviderConfig>

verifyClientAssertion

public boolean verifyClientAssertion(ClientAuthenticationFlowContext context)
                              throws Exception

Specified by:

verifyClientAssertion in interface ClientAssertionIdentityProvider

Throws:

Exception

close

public void close()

Specified by:

close in interface Provider

preprocessFederatedIdentity

public void preprocessFederatedIdentity(KeycloakSession session,
 RealmModel realm,
 BrokeredIdentityContext context)

Specified by:

preprocessFederatedIdentity in interface IdentityProvider<SpiffeIdentityProviderConfig>

authenticationFinished

public void authenticationFinished(AuthenticationSessionModel authSession,
 BrokeredIdentityContext context)

Specified by:

authenticationFinished in interface IdentityProvider<SpiffeIdentityProviderConfig>

importNewUser

public void importNewUser(KeycloakSession session,
 RealmModel realm,
 UserModel user,
 BrokeredIdentityContext context)

Specified by:

importNewUser in interface IdentityProvider<SpiffeIdentityProviderConfig>

updateBrokeredUser

public void updateBrokeredUser(KeycloakSession session,
 RealmModel realm,
 UserModel user,
 BrokeredIdentityContext context)

Specified by:

updateBrokeredUser in interface IdentityProvider<SpiffeIdentityProviderConfig>

callback

public Object callback(RealmModel realm,
 IdentityProvider.AuthenticationCallback callback,
 EventBuilder event)

Specified by:

callback in interface IdentityProvider<SpiffeIdentityProviderConfig>

performLogin

public jakarta.ws.rs.core.Response performLogin(AuthenticationRequest request)

Specified by:

performLogin in interface IdentityProvider<SpiffeIdentityProviderConfig>

retrieveToken

public jakarta.ws.rs.core.Response retrieveToken(KeycloakSession session,
 FederatedIdentityModel identity)

Specified by:

retrieveToken in interface IdentityProvider<SpiffeIdentityProviderConfig>

backchannelLogout

public void backchannelLogout(KeycloakSession session,
 UserSessionModel userSession,
 jakarta.ws.rs.core.UriInfo uriInfo,
 RealmModel realm)

Specified by:

backchannelLogout in interface IdentityProvider<SpiffeIdentityProviderConfig>

keycloakInitiatedBrowserLogout

public jakarta.ws.rs.core.Response keycloakInitiatedBrowserLogout(KeycloakSession session,
 UserSessionModel userSession,
 jakarta.ws.rs.core.UriInfo uriInfo,
 RealmModel realm)

Specified by:

keycloakInitiatedBrowserLogout in interface IdentityProvider<SpiffeIdentityProviderConfig>

export

public jakarta.ws.rs.core.Response export(jakarta.ws.rs.core.UriInfo uriInfo,
 RealmModel realm,
 String format)

Specified by:

export in interface IdentityProvider<SpiffeIdentityProviderConfig>

getMarshaller

public IdentityProviderDataMarshaller getMarshaller()

Specified by:

getMarshaller in interface IdentityProvider<SpiffeIdentityProviderConfig>