org.keycloak.protocol.oidc

Class TokenManager

java.lang.Object

org.keycloak.protocol.oidc.TokenManager

public class TokenManager
extends Object

Stateless object that creates tokens and manages oauth access codes

Version:

$Revision: 1 $

Author:

Bill Burke

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
class	TokenManager.AccessTokenResponseBuilder
class	TokenManager.RefreshResult
static class	TokenManager.TokenValidation

Constructor Summary

Constructors

Constructor and Description
TokenManager()

Method Summary

Modifier and Type	Method and Description
protected void	addComposites(AccessToken token, RoleModel role)
static void	applyScope(RoleModel role, RoleModel scope, Set<RoleModel> visited, Set<RoleModel> requested)
static ClientSessionContext	attachAuthenticationSession(KeycloakSession session, UserSessionModel userSession, AuthenticationSessionModel authSession)
AccessToken	createClientAccessToken(KeycloakSession session, RealmModel realm, ClientModel client, UserModel user, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
static void	dettachClientSession(UserSessionProvider sessions, RealmModel realm, AuthenticatedClientSessionModel clientSession)
String	encodeToken(KeycloakSession session, RealmModel realm, Object token)
static Set<RoleModel>	getAccess(UserModel user, ClientModel client, Set<ClientScopeModel> clientScopes)
static Set<ClientScopeModel>	getRequestedClientScopes(String scopeParam, ClientModel client) Return client itself + all default client scopes of client + optional client scopes requested by scope parameter
protected AccessToken	initToken(RealmModel realm, ClientModel client, UserModel user, UserSessionModel session, ClientSessionContext clientSessionCtx, javax.ws.rs.core.UriInfo uriInfo)
boolean	isTokenValid(KeycloakSession session, RealmModel realm, AccessToken token)
TokenManager.RefreshResult	refreshAccessToken(KeycloakSession session, javax.ws.rs.core.UriInfo uriInfo, org.keycloak.common.ClientConnection connection, RealmModel realm, ClientModel authorizedClient, String encodedRefreshToken, EventBuilder event, javax.ws.rs.core.HttpHeaders headers, org.jboss.resteasy.spi.HttpRequest request)
TokenManager.AccessTokenResponseBuilder	responseBuilder(RealmModel realm, ClientModel client, EventBuilder event, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
RefreshToken	toRefreshToken(KeycloakSession session, RealmModel realm, String encodedRefreshToken)
AccessToken	transformAccessToken(KeycloakSession session, AccessToken token, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
void	transformIDToken(KeycloakSession session, IDToken token, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
AccessToken	transformUserInfoAccessToken(KeycloakSession session, AccessToken token, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
TokenManager.TokenValidation	validateToken(KeycloakSession session, javax.ws.rs.core.UriInfo uriInfo, org.keycloak.common.ClientConnection connection, RealmModel realm, RefreshToken oldToken, javax.ws.rs.core.HttpHeaders headers)
static boolean	verifyConsentStillAvailable(KeycloakSession session, UserModel user, ClientModel client, Set<ClientScopeModel> requestedClientScopes)
IDToken	verifyIDToken(KeycloakSession session, RealmModel realm, String encodedIDToken)
IDToken	verifyIDTokenSignature(KeycloakSession session, RealmModel realm, String encodedIDToken)
RefreshToken	verifyRefreshToken(KeycloakSession session, RealmModel realm, ClientModel client, org.jboss.resteasy.spi.HttpRequest request, String encodedRefreshToken, boolean checkExpiration)
RefreshToken	verifyRefreshToken(KeycloakSession session, RealmModel realm, String encodedRefreshToken)
RefreshToken	verifyRefreshToken(KeycloakSession session, RealmModel realm, String encodedRefreshToken, boolean checkExpiration)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

TokenManager

public TokenManager()

Method Detail

applyScope

public static void applyScope(RoleModel role,
                              RoleModel scope,
                              Set<RoleModel> visited,
                              Set<RoleModel> requested)

validateToken

public TokenManager.TokenValidation validateToken(KeycloakSession session,
                                                  javax.ws.rs.core.UriInfo uriInfo,
                                                  org.keycloak.common.ClientConnection connection,
                                                  RealmModel realm,
                                                  RefreshToken oldToken,
                                                  javax.ws.rs.core.HttpHeaders headers)
                                           throws OAuthErrorException

Throws:

OAuthErrorException

isTokenValid

public boolean isTokenValid(KeycloakSession session,
                            RealmModel realm,
                            AccessToken token)
                     throws OAuthErrorException

Throws:

OAuthErrorException

refreshAccessToken

public TokenManager.RefreshResult refreshAccessToken(KeycloakSession session,
                                                     javax.ws.rs.core.UriInfo uriInfo,
                                                     org.keycloak.common.ClientConnection connection,
                                                     RealmModel realm,
                                                     ClientModel authorizedClient,
                                                     String encodedRefreshToken,
                                                     EventBuilder event,
                                                     javax.ws.rs.core.HttpHeaders headers,
                                                     org.jboss.resteasy.spi.HttpRequest request)
                                              throws OAuthErrorException

Throws:

OAuthErrorException

verifyRefreshToken

public RefreshToken verifyRefreshToken(KeycloakSession session,
                                       RealmModel realm,
                                       String encodedRefreshToken)
                                throws OAuthErrorException

Throws:

OAuthErrorException

verifyRefreshToken

public RefreshToken verifyRefreshToken(KeycloakSession session,
                                       RealmModel realm,
                                       String encodedRefreshToken,
                                       boolean checkExpiration)
                                throws OAuthErrorException

Throws:

OAuthErrorException

verifyRefreshToken

public RefreshToken verifyRefreshToken(KeycloakSession session,
                                       RealmModel realm,
                                       ClientModel client,
                                       org.jboss.resteasy.spi.HttpRequest request,
                                       String encodedRefreshToken,
                                       boolean checkExpiration)
                                throws OAuthErrorException

Throws:

OAuthErrorException

toRefreshToken

public RefreshToken toRefreshToken(KeycloakSession session,
                                   RealmModel realm,
                                   String encodedRefreshToken)
                            throws JWSInputException,
                                   OAuthErrorException

Throws:

JWSInputException

OAuthErrorException

verifyIDToken

public IDToken verifyIDToken(KeycloakSession session,
                             RealmModel realm,
                             String encodedIDToken)
                      throws OAuthErrorException

Throws:

OAuthErrorException

verifyIDTokenSignature

public IDToken verifyIDTokenSignature(KeycloakSession session,
                                      RealmModel realm,
                                      String encodedIDToken)
                               throws OAuthErrorException

Throws:

OAuthErrorException

createClientAccessToken

public AccessToken createClientAccessToken(KeycloakSession session,
                                           RealmModel realm,
                                           ClientModel client,
                                           UserModel user,
                                           UserSessionModel userSession,
                                           ClientSessionContext clientSessionCtx)

attachAuthenticationSession

public static ClientSessionContext attachAuthenticationSession(KeycloakSession session,
                                                               UserSessionModel userSession,
                                                               AuthenticationSessionModel authSession)

dettachClientSession

public static void dettachClientSession(UserSessionProvider sessions,
                                        RealmModel realm,
                                        AuthenticatedClientSessionModel clientSession)

getAccess

public static Set<RoleModel> getAccess(UserModel user,
                                       ClientModel client,
                                       Set<ClientScopeModel> clientScopes)

getRequestedClientScopes

public static Set<ClientScopeModel> getRequestedClientScopes(String scopeParam,
                                                             ClientModel client)

Return client itself + all default client scopes of client + optional client scopes requested by scope parameter

verifyConsentStillAvailable

public static boolean verifyConsentStillAvailable(KeycloakSession session,
                                                  UserModel user,
                                                  ClientModel client,
                                                  Set<ClientScopeModel> requestedClientScopes)

transformAccessToken

public AccessToken transformAccessToken(KeycloakSession session,
                                        AccessToken token,
                                        UserSessionModel userSession,
                                        ClientSessionContext clientSessionCtx)

transformUserInfoAccessToken

public AccessToken transformUserInfoAccessToken(KeycloakSession session,
                                                AccessToken token,
                                                UserSessionModel userSession,
                                                ClientSessionContext clientSessionCtx)

transformIDToken

public void transformIDToken(KeycloakSession session,
                             IDToken token,
                             UserSessionModel userSession,
                             ClientSessionContext clientSessionCtx)

initToken

protected AccessToken initToken(RealmModel realm,
                                ClientModel client,
                                UserModel user,
                                UserSessionModel session,
                                ClientSessionContext clientSessionCtx,
                                javax.ws.rs.core.UriInfo uriInfo)

addComposites

protected void addComposites(AccessToken token,
                             RoleModel role)

encodeToken

public String encodeToken(KeycloakSession session,
                          RealmModel realm,
                          Object token)

responseBuilder

public TokenManager.AccessTokenResponseBuilder responseBuilder(RealmModel realm,
                                                               ClientModel client,
                                                               EventBuilder event,
                                                               KeycloakSession session,
                                                               UserSessionModel userSession,
                                                               ClientSessionContext clientSessionCtx)