org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint クラス

org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint の継承関係図

org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint 連携図

クラス
enum	Action

公開メンバ関数
	AuthorizationEndpoint (RealmModel realm, EventBuilder event)
Response	buildPost ()
Response	buildGet ()
AuthorizationEndpoint	register ()
AuthorizationEndpoint	forgotCredentials ()

静的公開変数類
static final String	CODE_AUTH_TYPE = "code"
static final String	LOGIN_SESSION_NOTE_ADDITIONAL_REQ_PARAMS_PREFIX = "client_request_param_"
static final String	APP_INITIATED_FLOW = "APP_INITIATED_FLOW"

限定公開メンバ関数
AuthenticationProcessor	createProcessor (AuthenticationSessionModel authSession, String flowId, String flowPath)
Response	handleBrowserAuthenticationRequest (AuthenticationSessionModel authSession, LoginProtocol protocol, boolean isPassive, boolean redirectToAuthentication)
AuthenticationFlowModel	getAuthenticationFlow (AuthenticationSessionModel authSession)
void	checkSsl ()
void	checkRealm ()
AuthenticationSessionModel	createAuthenticationSession (ClientModel client, String requestState)

限定公開変数類
RealmModel	realm
EventBuilder	event
AuthenticationManager	authManager
HttpHeaders	headers
HttpRequest	httpRequest
KeycloakSession	session
ClientConnection	clientConnection

非公開メンバ関数
Response	process (MultivaluedMap< String, String > params)
void	checkClient (String clientId)
Response	checkResponseType ()
Response	checkOIDCParams ()
Response	checkPKCEParams ()
boolean	isValidPkceCodeChallenge (String codeChallenge)
Response	redirectErrorToClient (OIDCResponseMode responseMode, String error, String errorDescription)
void	checkRedirectUri ()
void	updateAuthenticationSession ()
Response	buildAuthorizationCodeAuthorizationResponse ()
Response	buildRegister ()
Response	buildForgotCredential ()

非公開変数類
ClientModel	client
AuthenticationSessionModel	authenticationSession
Action	action
OIDCResponseType	parsedResponseType
OIDCResponseMode	parsedResponseMode
AuthorizationEndpointRequest	request
String	redirectUri

静的非公開変数類
static final Logger	logger = Logger.getLogger(AuthorizationEndpoint.class)
static final Pattern	VALID_CODE_CHALLENGE_PATTERN = Pattern.compile("^[0-9a-zA-Z\\-\\.~_]+$")

詳解

著者

Stian Thorgersen

---

クラス詳解

org::keycloak::protocol::oidc::endpoints::AuthorizationEndpoint::Action

enum org::keycloak::protocol::oidc::endpoints::AuthorizationEndpoint::Action

org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.Action 連携図

列挙値
CODE
FORGOT_CREDENTIALS
REGISTER

構築子と解体子

AuthorizationEndpoint()

org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.AuthorizationEndpoint ( RealmModel  realm, EventBuilder  event  )

inline

                                                                       {
        super(realm, event);
        event.event(EventType.LOGIN);
    }

関数詳解

buildAuthorizationCodeAuthorizationResponse()

Response org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse ( )

inlineprivate

                                                                   {
        this.event.event(EventType.LOGIN);
        authenticationSession.setAuthNote(Details.AUTH_TYPE, CODE_AUTH_TYPE);

        return handleBrowserAuthenticationRequest(authenticationSession, new OIDCLoginProtocol(session, realm, session.getContext().getUri(), headers, event), TokenUtil.hasPrompt(request.getPrompt(), OIDCLoginProtocol.PROMPT_VALUE_NONE), false);
    }

buildForgotCredential()

Response org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildForgotCredential ( )

inlineprivate

                                             {
        authManager.expireIdentityCookie(realm, session.getContext().getUri(), clientConnection);

        AuthenticationFlowModel flow = realm.getResetCredentialsFlow();
        String flowId = flow.getId();

        AuthenticationProcessor processor = createProcessor(authenticationSession, flowId, LoginActionsService.RESET_CREDENTIALS_PATH);
        authenticationSession.setClientNote(APP_INITIATED_FLOW, LoginActionsService.RESET_CREDENTIALS_PATH);

        return processor.authenticate();
    }

buildGet()

Response org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet ( )

inline

                               {
        logger.trace("Processing @GET request");
        return process(session.getContext().getUri().getQueryParameters());
    }

buildPost()

Response org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildPost ( )

inline

                                {
        logger.trace("Processing @POST request");
        return process(httpRequest.getDecodedFormParameters());
    }

buildRegister()

Response org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildRegister ( )

inlineprivate

                                     {
        authManager.expireIdentityCookie(realm, session.getContext().getUri(), clientConnection);

        AuthenticationFlowModel flow = realm.getRegistrationFlow();
        String flowId = flow.getId();

        AuthenticationProcessor processor = createProcessor(authenticationSession, flowId, LoginActionsService.REGISTRATION_PATH);
        authenticationSession.setClientNote(APP_INITIATED_FLOW, LoginActionsService.REGISTRATION_PATH);

        return processor.authenticate();
    }

checkClient()

void org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.checkClient ( String  clientId )

inlineprivate

                                              {
        if (clientId == null) {
            event.error(Errors.INVALID_REQUEST);
            throw new ErrorPageException(session, authenticationSession, Response.Status.BAD_REQUEST, Messages.MISSING_PARAMETER, OIDCLoginProtocol.CLIENT_ID_PARAM);
        }

        event.client(clientId);

        client = realm.getClientByClientId(clientId);
        if (client == null) {
            event.error(Errors.CLIENT_NOT_FOUND);
            throw new ErrorPageException(session, authenticationSession, Response.Status.BAD_REQUEST, Messages.CLIENT_NOT_FOUND);
        }

        if (!client.isEnabled()) {
            event.error(Errors.CLIENT_DISABLED);
            throw new ErrorPageException(session, authenticationSession, Response.Status.BAD_REQUEST, Messages.CLIENT_DISABLED);
        }

        if (client.isBearerOnly()) {
            event.error(Errors.NOT_ALLOWED);
            throw new ErrorPageException(session, authenticationSession, Response.Status.FORBIDDEN, Messages.BEARER_ONLY);
        }

        session.getContext().setClient(client);
    }

checkOIDCParams()

Response org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.checkOIDCParams ( )

inlineprivate

                                       {
        // If request is not OIDC request, but pure OAuth2 request and response_type is just 'token', then 'nonce' is not mandatory
        boolean isOIDCRequest = TokenUtil.isOIDCRequest(request.getScope());
        if (!isOIDCRequest && parsedResponseType.toString().equals(OIDCResponseType.TOKEN)) {
            return null;
        }

        if (parsedResponseType.isImplicitOrHybridFlow() && request.getNonce() == null) {
            ServicesLogger.LOGGER.missingParameter(OIDCLoginProtocol.NONCE_PARAM);
            event.error(Errors.INVALID_REQUEST);
            return redirectErrorToClient(parsedResponseMode, OAuthErrorException.INVALID_REQUEST, "Missing parameter: nonce");
        }

        return null;
    }

checkPKCEParams()

Response org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.checkPKCEParams ( )

inlineprivate

                                       {
        String codeChallenge = request.getCodeChallenge();
        String codeChallengeMethod = request.getCodeChallengeMethod();

        // PKCE not adopted to OAuth2 Implicit Grant and OIDC Implicit Flow,
        // adopted to OAuth2 Authorization Code Grant and OIDC Authorization Code Flow, Hybrid Flow
        // Namely, flows using authorization code.
        if (parsedResponseType.isImplicitFlow()) return null;

        if (codeChallenge == null && codeChallengeMethod != null) {
            logger.info("PKCE supporting Client without code challenge");
            event.error(Errors.INVALID_REQUEST);
            return redirectErrorToClient(parsedResponseMode, OAuthErrorException.INVALID_REQUEST, "Missing parameter: code_challenge");
        }

        // based on code_challenge value decide whether this client(RP) supports PKCE
        if (codeChallenge == null) {
            logger.debug("PKCE non-supporting Client");
            return null;
        }

        if (codeChallengeMethod != null) {
                // https://tools.ietf.org/html/rfc7636#section-4.2
                // plain or S256
            if (!codeChallengeMethod.equals(OIDCLoginProtocol.PKCE_METHOD_S256) && !codeChallengeMethod.equals(OIDCLoginProtocol.PKCE_METHOD_PLAIN)) {
                logger.infof("PKCE supporting Client with invalid code challenge method not specified in PKCE, codeChallengeMethod = %s", codeChallengeMethod);
                event.error(Errors.INVALID_REQUEST);
                return redirectErrorToClient(parsedResponseMode, OAuthErrorException.INVALID_REQUEST, "Invalid parameter: code_challenge_method");
            }
        } else {
                // https://tools.ietf.org/html/rfc7636#section-4.3
                // default code_challenge_method is plane
                codeChallengeMethod = OIDCLoginProtocol.PKCE_METHOD_PLAIN;
        }

        if (!isValidPkceCodeChallenge(codeChallenge)) {
            logger.infof("PKCE supporting Client with invalid code challenge specified in PKCE, codeChallenge = %s", codeChallenge);
            event.error(Errors.INVALID_REQUEST);
            return redirectErrorToClient(parsedResponseMode, OAuthErrorException.INVALID_REQUEST, "Invalid parameter: code_challenge");
        }

        return null;
    }

checkRealm()

void org.keycloak.protocol.AuthorizationEndpointBase.checkRealm ( )

inlineprotectedinherited

                                {
        if (!realm.isEnabled()) {
            event.error(Errors.REALM_DISABLED);
            throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.REALM_NOT_ENABLED);
        }
    }

checkRedirectUri()

void org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.checkRedirectUri ( )

inlineprivate

                                    {
        String redirectUriParam = request.getRedirectUriParam();
        boolean isOIDCRequest = TokenUtil.isOIDCRequest(request.getScope());

        event.detail(Details.REDIRECT_URI, redirectUriParam);

        // redirect_uri parameter is required per OpenID Connect, but optional per OAuth2
        redirectUri = RedirectUtils.verifyRedirectUri(session.getContext().getUri(), redirectUriParam, realm, client, isOIDCRequest);
        if (redirectUri == null) {
            event.error(Errors.INVALID_REDIRECT_URI);
            throw new ErrorPageException(session, authenticationSession, Response.Status.BAD_REQUEST, Messages.INVALID_PARAMETER, OIDCLoginProtocol.REDIRECT_URI_PARAM);
        }
    }

checkResponseType()

Response org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.checkResponseType ( )

inlineprivate

                                         {
        String responseType = request.getResponseType();

        if (responseType == null) {
            ServicesLogger.LOGGER.missingParameter(OAuth2Constants.RESPONSE_TYPE);
            event.error(Errors.INVALID_REQUEST);
            return redirectErrorToClient(OIDCResponseMode.QUERY, OAuthErrorException.INVALID_REQUEST, "Missing parameter: response_type");
        }

        event.detail(Details.RESPONSE_TYPE, responseType);

        try {
            parsedResponseType = OIDCResponseType.parse(responseType);
            if (action == null) {
                action = Action.CODE;
            }
        } catch (IllegalArgumentException iae) {
            logger.error(iae.getMessage());
            event.error(Errors.INVALID_REQUEST);
            return redirectErrorToClient(OIDCResponseMode.QUERY, OAuthErrorException.UNSUPPORTED_RESPONSE_TYPE, null);
        }

        OIDCResponseMode parsedResponseMode = null;
        try {
            parsedResponseMode = OIDCResponseMode.parse(request.getResponseMode(), parsedResponseType);
        } catch (IllegalArgumentException iae) {
            ServicesLogger.LOGGER.invalidParameter(OIDCLoginProtocol.RESPONSE_MODE_PARAM);
            event.error(Errors.INVALID_REQUEST);
            return redirectErrorToClient(OIDCResponseMode.QUERY, OAuthErrorException.INVALID_REQUEST, "Invalid parameter: response_mode");
        }

        event.detail(Details.RESPONSE_MODE, parsedResponseMode.toString().toLowerCase());

        // Disallowed by OIDC specs
        if (parsedResponseType.isImplicitOrHybridFlow() && parsedResponseMode == OIDCResponseMode.QUERY) {
            ServicesLogger.LOGGER.responseModeQueryNotAllowed();
            event.error(Errors.INVALID_REQUEST);
            return redirectErrorToClient(OIDCResponseMode.QUERY, OAuthErrorException.INVALID_REQUEST, "Response_mode 'query' not allowed for implicit or hybrid flow");
        }

        if ((parsedResponseType.hasResponseType(OIDCResponseType.CODE) || parsedResponseType.hasResponseType(OIDCResponseType.NONE)) && !client.isStandardFlowEnabled()) {
            ServicesLogger.LOGGER.flowNotAllowed("Standard");
            event.error(Errors.NOT_ALLOWED);
            return redirectErrorToClient(parsedResponseMode, OAuthErrorException.UNSUPPORTED_RESPONSE_TYPE, "Client is not allowed to initiate browser login with given response_type. Standard flow is disabled for the client.");
        }

        if (parsedResponseType.isImplicitOrHybridFlow() && !client.isImplicitFlowEnabled()) {
            ServicesLogger.LOGGER.flowNotAllowed("Implicit");
            event.error(Errors.NOT_ALLOWED);
            return redirectErrorToClient(parsedResponseMode, OAuthErrorException.UNSUPPORTED_RESPONSE_TYPE, "Client is not allowed to initiate browser login with given response_type. Implicit flow is disabled for the client.");
        }

        this.parsedResponseMode = parsedResponseMode;

        return null;
    }

checkSsl()

void org.keycloak.protocol.AuthorizationEndpointBase.checkSsl ( )

inlineprotectedinherited

                              {
        if (!session.getContext().getUri().getBaseUri().getScheme().equals("https") && realm.getSslRequired().isRequired(clientConnection)) {
            event.error(Errors.SSL_REQUIRED);
            throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.HTTPS_REQUIRED);
        }
    }

createAuthenticationSession()

AuthenticationSessionModel org.keycloak.protocol.AuthorizationEndpointBase.createAuthenticationSession ( ClientModel  client, String  requestState  )

inlineprotectedinherited

                                                                                                              {
        AuthenticationSessionManager manager = new AuthenticationSessionManager(session);
        RootAuthenticationSessionModel rootAuthSession = manager.getCurrentRootAuthenticationSession(realm);

        AuthenticationSessionModel authSession;

        if (rootAuthSession != null) {
            authSession = rootAuthSession.createAuthenticationSession(client);

            logger.debugf("Sent request to authz endpoint. Root authentication session with ID '%s' exists. Client is '%s' . Created new authentication session with tab ID: %s",
                    rootAuthSession.getId(), client.getClientId(), authSession.getTabId());
        } else {
            UserSessionCrossDCManager userSessionCrossDCManager = new UserSessionCrossDCManager(session);
            UserSessionModel userSession = userSessionCrossDCManager.getUserSessionIfExistsRemotely(manager, realm);

            if (userSession != null) {
                String userSessionId = userSession.getId();
                rootAuthSession = session.authenticationSessions().createRootAuthenticationSession(userSessionId, realm);
                authSession = rootAuthSession.createAuthenticationSession(client);
                logger.debugf("Sent request to authz endpoint. We don't have root authentication session with ID '%s' but we have userSession." +
                        "Re-created root authentication session with same ID. Client is: %s . New authentication session tab ID: %s", userSessionId, client.getClientId(), authSession.getTabId());
            } else {
                rootAuthSession = manager.createAuthenticationSession(realm, true);
                authSession = rootAuthSession.createAuthenticationSession(client);
                logger.debugf("Sent request to authz endpoint. Created new root authentication session with ID '%s' . Client: %s . New authentication session tab ID: %s",
                        rootAuthSession.getId(), client.getClientId(), authSession.getTabId());
            }
        }

        session.getProvider(LoginFormsProvider.class).setAuthenticationSession(authSession);

        return authSession;

    }

createProcessor()

AuthenticationProcessor org.keycloak.protocol.AuthorizationEndpointBase.createProcessor ( AuthenticationSessionModel  authSession, String  flowId, String  flowPath  )

inlineprotectedinherited

                                                                                                                              {
        AuthenticationProcessor processor = new AuthenticationProcessor();
        processor.setAuthenticationSession(authSession)
                .setFlowPath(flowPath)
                .setFlowId(flowId)
                .setBrowserFlow(true)
                .setConnection(clientConnection)
                .setEventBuilder(event)
                .setRealm(realm)
                .setSession(session)
                .setUriInfo(session.getContext().getUri())
                .setRequest(httpRequest);

        authSession.setAuthNote(AuthenticationProcessor.CURRENT_FLOW_PATH, flowPath);

        return processor;
    }

forgotCredentials()

AuthorizationEndpoint org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.forgotCredentials ( )

inline

                                                     {
        event.event(EventType.RESET_PASSWORD);
        action = Action.FORGOT_CREDENTIALS;

        if (!realm.isResetPasswordAllowed()) {
            throw new ErrorPageException(session, authenticationSession, Response.Status.BAD_REQUEST, Messages.RESET_CREDENTIAL_NOT_ALLOWED);
        }

        return this;
    }

getAuthenticationFlow()

AuthenticationFlowModel org.keycloak.protocol.AuthorizationEndpointBase.getAuthenticationFlow ( AuthenticationSessionModel  authSession )

inlineprotectedinherited

                                                                                                    {
        return AuthenticationFlowResolver.resolveBrowserFlow(authSession);
    }

handleBrowserAuthenticationRequest()

Response org.keycloak.protocol.AuthorizationEndpointBase.handleBrowserAuthenticationRequest ( AuthenticationSessionModel  authSession, LoginProtocol  protocol, boolean  isPassive, boolean  redirectToAuthentication  )

inlineprotectedinherited

Common method to handle browser authentication request in protocols unified way.

引数

authSession	for current request
protocol	handler for protocol used to initiate login
isPassive	set to true if login should be passive (without login screen shown)
redirectToAuthentication	if true redirect to flow url. If initial call to protocol is a POST, you probably want to do this. This is so we can disable the back button on browser

戻り値

response to be returned to the browser

                                                                                                                                                                               {
        AuthenticationFlowModel flow = getAuthenticationFlow(authSession);
        String flowId = flow.getId();
        AuthenticationProcessor processor = createProcessor(authSession, flowId, LoginActionsService.AUTHENTICATE_PATH);
        event.detail(Details.CODE_ID, authSession.getParentSession().getId());
        if (isPassive) {
            // OIDC prompt == NONE or SAML 2 IsPassive flag
            // This means that client is just checking if the user is already completely logged in.
            // We cancel login if any authentication action or required action is required
            try {
                if (processor.authenticateOnly() == null) {
                    // processor.attachSession();
                } else {
                    Response response = protocol.sendError(authSession, Error.PASSIVE_LOGIN_REQUIRED);
                    return response;
                }

                AuthenticationManager.setClientScopesInSession(authSession);

                if (processor.nextRequiredAction() != null) {
                    Response response = protocol.sendError(authSession, Error.PASSIVE_INTERACTION_REQUIRED);
                    return response;
                }

                // Attach session once no requiredActions or other things are required
                processor.attachSession();
            } catch (Exception e) {
                return processor.handleBrowserException(e);
            }
            return processor.finishAuthentication(protocol);
        } else {
            try {
                RestartLoginCookie.setRestartCookie(session, realm, clientConnection, session.getContext().getUri(), authSession);
                if (redirectToAuthentication) {
                    return processor.redirectToFlow();
                }
                return processor.authenticate();
            } catch (Exception e) {
                return processor.handleBrowserException(e);
            }
        }
    }

isValidPkceCodeChallenge()

boolean org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.isValidPkceCodeChallenge ( String  codeChallenge )

inlineprivate

                                                                   {
        if (codeChallenge.length() < OIDCLoginProtocol.PKCE_CODE_CHALLENGE_MIN_LENGTH) {
           logger.debugf("PKCE codeChallenge length under lower limit , codeChallenge = %s", codeChallenge);
           return false;
       }
       if (codeChallenge.length() > OIDCLoginProtocol.PKCE_CODE_CHALLENGE_MAX_LENGTH) {
           logger.debugf("PKCE codeChallenge length over upper limit , codeChallenge = %s", codeChallenge);
           return false;
       }
       Matcher m = VALID_CODE_CHALLENGE_PATTERN.matcher(codeChallenge);
       return m.matches() ? true : false;
    }

process()

Response org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process ( MultivaluedMap< String, String >  params )

inlineprivate

                                                                    {
        String clientId = params.getFirst(OIDCLoginProtocol.CLIENT_ID_PARAM);

        checkSsl();
        checkRealm();
        checkClient(clientId);

        request = AuthorizationEndpointRequestParserProcessor.parseRequest(event, session, client, params);

        checkRedirectUri();
        Response errorResponse = checkResponseType();
        if (errorResponse != null) {
            return errorResponse;
        }

        if (!TokenUtil.isOIDCRequest(request.getScope())) {
            ServicesLogger.LOGGER.oidcScopeMissing();
        }

        errorResponse = checkOIDCParams();
        if (errorResponse != null) {
            return errorResponse;
        }

        // https://tools.ietf.org/html/rfc7636#section-4
        errorResponse = checkPKCEParams();
        if (errorResponse != null) {
            return errorResponse;
        }

        authenticationSession = createAuthenticationSession(client, request.getState());
        updateAuthenticationSession();

        // So back button doesn't work
        CacheControlUtil.noBackButtonCacheControlHeader();
        switch (action) {
            case REGISTER:
                return buildRegister();
            case FORGOT_CREDENTIALS:
                return buildForgotCredential();
            case CODE:
                return buildAuthorizationCodeAuthorizationResponse();
        }

        throw new RuntimeException("Unknown action " + action);
    }

redirectErrorToClient()

Response org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.redirectErrorToClient ( OIDCResponseMode  responseMode, String  error, String  errorDescription  )

inlineprivate

                                                                                                                 {
        OIDCRedirectUriBuilder errorResponseBuilder = OIDCRedirectUriBuilder.fromUri(redirectUri, responseMode)
                .addParam(OAuth2Constants.ERROR, error);

        if (errorDescription != null) {
            errorResponseBuilder.addParam(OAuth2Constants.ERROR_DESCRIPTION, errorDescription);
        }

        if (request.getState() != null) {
            errorResponseBuilder.addParam(OAuth2Constants.STATE, request.getState());
        }

        return errorResponseBuilder.build();
    }

register()

AuthorizationEndpoint org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.register ( )

inline

                                            {
        event.event(EventType.REGISTER);
        action = Action.REGISTER;

        if (!realm.isRegistrationAllowed()) {
            throw new ErrorPageException(session, authenticationSession, Response.Status.BAD_REQUEST, Messages.REGISTRATION_NOT_ALLOWED);
        }

        return this;
    }

updateAuthenticationSession()

void org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.updateAuthenticationSession ( )

inlineprivate

                                               {
        authenticationSession.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
        authenticationSession.setRedirectUri(redirectUri);
        authenticationSession.setAction(AuthenticationSessionModel.Action.AUTHENTICATE.name());
        authenticationSession.setClientNote(OIDCLoginProtocol.RESPONSE_TYPE_PARAM, request.getResponseType());
        authenticationSession.setClientNote(OIDCLoginProtocol.REDIRECT_URI_PARAM, request.getRedirectUriParam());
        authenticationSession.setClientNote(OIDCLoginProtocol.ISSUER, Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));

        if (request.getState() != null) authenticationSession.setClientNote(OIDCLoginProtocol.STATE_PARAM, request.getState());
        if (request.getNonce() != null) authenticationSession.setClientNote(OIDCLoginProtocol.NONCE_PARAM, request.getNonce());
        if (request.getMaxAge() != null) authenticationSession.setClientNote(OIDCLoginProtocol.MAX_AGE_PARAM, String.valueOf(request.getMaxAge()));
        if (request.getScope() != null) authenticationSession.setClientNote(OIDCLoginProtocol.SCOPE_PARAM, request.getScope());
        if (request.getLoginHint() != null) authenticationSession.setClientNote(OIDCLoginProtocol.LOGIN_HINT_PARAM, request.getLoginHint());
        if (request.getPrompt() != null) authenticationSession.setClientNote(OIDCLoginProtocol.PROMPT_PARAM, request.getPrompt());
        if (request.getIdpHint() != null) authenticationSession.setClientNote(AdapterConstants.KC_IDP_HINT, request.getIdpHint());
        if (request.getResponseMode() != null) authenticationSession.setClientNote(OIDCLoginProtocol.RESPONSE_MODE_PARAM, request.getResponseMode());
        if (request.getClaims()!= null) authenticationSession.setClientNote(OIDCLoginProtocol.CLAIMS_PARAM, request.getClaims());
        if (request.getAcr() != null) authenticationSession.setClientNote(OIDCLoginProtocol.ACR_PARAM, request.getAcr());
        if (request.getDisplay() != null) authenticationSession.setAuthNote(OAuth2Constants.DISPLAY, request.getDisplay());

        // https://tools.ietf.org/html/rfc7636#section-4
        if (request.getCodeChallenge() != null) authenticationSession.setClientNote(OIDCLoginProtocol.CODE_CHALLENGE_PARAM, request.getCodeChallenge());
        if (request.getCodeChallengeMethod() != null) {
            authenticationSession.setClientNote(OIDCLoginProtocol.CODE_CHALLENGE_METHOD_PARAM, request.getCodeChallengeMethod());
        } else {
            authenticationSession.setClientNote(OIDCLoginProtocol.CODE_CHALLENGE_METHOD_PARAM, OIDCLoginProtocol.PKCE_METHOD_PLAIN);
        }

        if (request.getAdditionalReqParams() != null) {
            for (String paramName : request.getAdditionalReqParams().keySet()) {
                authenticationSession.setClientNote(LOGIN_SESSION_NOTE_ADDITIONAL_REQ_PARAMS_PREFIX + paramName, request.getAdditionalReqParams().get(paramName));
            }
        }
    }

メンバ詳解

action

Action org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.action

private

APP_INITIATED_FLOW

final String org.keycloak.protocol.AuthorizationEndpointBase.APP_INITIATED_FLOW = "APP_INITIATED_FLOW"

staticinherited

authenticationSession

AuthenticationSessionModel org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.authenticationSession

private

authManager

AuthenticationManager org.keycloak.protocol.AuthorizationEndpointBase.authManager

protectedinherited

client

ClientModel org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.client

private

clientConnection

ClientConnection org.keycloak.protocol.AuthorizationEndpointBase.clientConnection

protectedinherited

CODE_AUTH_TYPE

final String org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.CODE_AUTH_TYPE = "code"

static

event

EventBuilder org.keycloak.protocol.AuthorizationEndpointBase.event

protectedinherited

headers

HttpHeaders org.keycloak.protocol.AuthorizationEndpointBase.headers

protectedinherited

httpRequest

HttpRequest org.keycloak.protocol.AuthorizationEndpointBase.httpRequest

protectedinherited

logger

final Logger org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.logger = Logger.getLogger(AuthorizationEndpoint.class)

staticprivate

LOGIN_SESSION_NOTE_ADDITIONAL_REQ_PARAMS_PREFIX

final String org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.LOGIN_SESSION_NOTE_ADDITIONAL_REQ_PARAMS_PREFIX = "client_request_param_"

static

Prefix used to store additional HTTP GET params from original client request into AuthenticationSessionModel note to be available later in Authenticators, RequiredActions etc. Prefix is used to prevent collisions with internally used notes.

参照

AuthenticationSessionModel::getClientNote(String)

parsedResponseMode

OIDCResponseMode org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.parsedResponseMode

private

parsedResponseType

OIDCResponseType org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.parsedResponseType

private

realm

RealmModel org.keycloak.protocol.AuthorizationEndpointBase.realm

protectedinherited

redirectUri

String org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.redirectUri

private

request

AuthorizationEndpointRequest org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.request

private

session

KeycloakSession org.keycloak.protocol.AuthorizationEndpointBase.session

protectedinherited

VALID_CODE_CHALLENGE_PATTERN

final Pattern org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.VALID_CODE_CHALLENGE_PATTERN = Pattern.compile("^[0-9a-zA-Z\\-\\.~_]+$")

staticprivate

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/src/keycloak/src/main/java/org/keycloak/protocol/oidc/endpoints/AuthorizationEndpoint.java