org.keycloak.authentication.authenticators.client.X509ClientAuthenticator クラス

org.keycloak.authentication.authenticators.client.X509ClientAuthenticator の継承関係図

org.keycloak.authentication.authenticators.client.X509ClientAuthenticator 連携図

公開メンバ関数
void	authenticateClient (ClientAuthenticationFlowContext context)
String	getDisplayType ()
boolean	isConfigurable ()
AuthenticationExecutionModel.Requirement []	getRequirementChoices ()
List< ProviderConfigProperty >	getConfigPropertiesPerClient ()
Map< String, Object >	getAdapterConfiguration (ClientModel client)
Set< String >	getProtocolAuthenticatorMethods (String loginProtocol)
String	getHelpText ()
List< ProviderConfigProperty >	getConfigProperties ()
String	getId ()
ClientAuthenticator	create ()
ClientAuthenticator	create (KeycloakSession session)
void	close ()
void	init (Config.Scope config)
void	postInit (KeycloakSessionFactory factory)
boolean	isUserSetupAllowed ()
String	getReferenceCategory ()
default int	order ()

静的公開変数類
static final String	PROVIDER_ID = "client-x509"
static final String	ATTR_PREFIX = "x509"
static final String	ATTR_SUBJECT_DN = ATTR_PREFIX + ".subjectdn"
static final AuthenticationExecutionModel.Requirement []	REQUIREMENT_CHOICES

静的限定公開変数類
static ServicesLogger	logger = ServicesLogger.LOGGER

詳解

関数詳解

authenticateClient()

void org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.authenticateClient ( ClientAuthenticationFlowContext  context )

inline

org.keycloak.authentication.ClientAuthenticatorを実装しています。

                                                                            {

        X509ClientCertificateLookup provider = context.getSession().getProvider(X509ClientCertificateLookup.class);
        if (provider == null) {
            logger.errorv("\"{0}\" Spi is not available, did you forget to update the configuration?",
                    X509ClientCertificateLookup.class);
            return;
        }

        X509Certificate[] certs = null;
        ClientModel client = null;
        try {
            certs = provider.getCertificateChain(context.getHttpRequest());
            String client_id = null;
            MediaType mediaType = context.getHttpRequest().getHttpHeaders().getMediaType();
            boolean hasFormData = mediaType != null && mediaType.isCompatible(MediaType.APPLICATION_FORM_URLENCODED_TYPE);

            MultivaluedMap<String, String> formData = hasFormData ? context.getHttpRequest().getDecodedFormParameters() : null;
            MultivaluedMap<String, String> queryParams = context.getHttpRequest().getUri().getQueryParameters();

            if (formData != null) {
                client_id = formData.getFirst(OAuth2Constants.CLIENT_ID);
            }

            if (client_id == null && queryParams != null) {
                client_id = queryParams.getFirst(OAuth2Constants.CLIENT_ID);
            }

            if (client_id == null) {
                client_id = context.getSession().getAttribute("client_id", String.class);
            }

            if (client_id == null) {
                Response challengeResponse = ClientAuthUtil.errorResponse(Response.Status.BAD_REQUEST.getStatusCode(), "invalid_client", "Missing client_id parameter");
                context.challenge(challengeResponse);
                return;
            }

            client = context.getRealm().getClientByClientId(client_id);
            if (client == null) {
                context.failure(AuthenticationFlowError.CLIENT_NOT_FOUND, null);
                return;
            }
            context.getEvent().client(client_id);
            context.setClient(client);

            if (!client.isEnabled()) {
                context.failure(AuthenticationFlowError.CLIENT_DISABLED, null);
                return;
            }
        } catch (GeneralSecurityException e) {
            logger.errorf("[X509ClientCertificateAuthenticator:authenticate] Exception: %s", e.getMessage());
            context.attempted();
            return;
        }

        if (certs == null || certs.length == 0) {
            // No x509 client cert, fall through and
            // continue processing the rest of the authentication flow
            logger.debug("[X509ClientCertificateAuthenticator:authenticate] x509 client certificate is not available for mutual SSL.");
            context.attempted();
            return;
        }

        String subjectDNRegexp = client.getAttribute(ATTR_SUBJECT_DN);
        if (subjectDNRegexp == null || subjectDNRegexp.length() == 0) {
            logger.errorf("[X509ClientCertificateAuthenticator:authenticate] " + ATTR_SUBJECT_DN + " is null or empty");
            context.attempted();
            return;
        }
        Pattern subjectDNPattern = Pattern.compile(subjectDNRegexp);

        Optional<String> matchedCertificate = Arrays.stream(certs)
              .map(certificate -> certificate.getSubjectDN().getName())
              .filter(subjectdn -> subjectDNPattern.matcher(subjectdn).matches())
              .findFirst();

        if (!matchedCertificate.isPresent()) {
            // We do quite expensive operation here, so better check the logging level beforehand.
            if (logger.isDebugEnabled()) {
                logger.debug("[X509ClientCertificateAuthenticator:authenticate] Couldn't match any certificate for pattern " + subjectDNRegexp);
                logger.debug("[X509ClientCertificateAuthenticator:authenticate] Available SubjectDNs: " +
                      Arrays.stream(certs)
                            .map(cert -> cert.getSubjectDN().getName())
                            .collect(Collectors.toList()));
            }
            context.attempted();
            return;
        } else {
            logger.debug("[X509ClientCertificateAuthenticator:authenticate] Matched " + matchedCertificate.get() + " certificate.");
        }

        context.success();
    }

close()

void org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.close ( )

inlineinherited

org.keycloak.provider.Providerを実装しています。

                        {

    }

create() [1/2]

ClientAuthenticator org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.create ( )

inlineinherited

org.keycloak.authentication.ClientAuthenticatorFactoryを実装しています。

                                        {
        return this;
    }

create() [2/2]

ClientAuthenticator org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.create ( KeycloakSession  session )

inlineinherited

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                                                               {
        return this;
    }

getAdapterConfiguration()

Map<String, Object> org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.getAdapterConfiguration ( ClientModel  client )

inline

org.keycloak.authentication.ClientAuthenticatorFactoryを実装しています。

                                                                           {
        return Collections.emptyMap();
    }

getConfigProperties()

List<ProviderConfigProperty> org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.getConfigProperties ( )

inline

org.keycloak.provider.ConfiguredProviderを実装しています。

                                                              {
        return Collections.emptyList();
    }

getConfigPropertiesPerClient()

List<ProviderConfigProperty> org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.getConfigPropertiesPerClient ( )

inline

org.keycloak.authentication.ClientAuthenticatorFactoryを実装しています。

                                                                       {
        return Collections.emptyList();
    }

getDisplayType()

String org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.getDisplayType ( )

inline

org.keycloak.authentication.ConfigurableAuthenticatorFactoryを実装しています。

                                   {
        return "X509 Certificate";
    }

getHelpText()

String org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.getHelpText ( )

inline

org.keycloak.provider.ConfiguredProviderを実装しています。

                                {
        return "Validates client based on a X509 Certificate";
    }

getId()

String org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.getId ( )

inline

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                          {
        return PROVIDER_ID;
    }

getProtocolAuthenticatorMethods()

Set<String> org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.getProtocolAuthenticatorMethods ( String  loginProtocol )

inline

org.keycloak.authentication.ClientAuthenticatorFactoryを実装しています。

                                                                             {
        if (loginProtocol.equals(OIDCLoginProtocol.LOGIN_PROTOCOL)) {
            Set<String> results = new HashSet<>();
            return results;
        } else {
            return Collections.emptySet();
        }
    }

getReferenceCategory()

String org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.getReferenceCategory ( )

inlineinherited

org.keycloak.authentication.ConfigurableAuthenticatorFactoryを実装しています。

                                         {
        return null;
    }

getRequirementChoices()

AuthenticationExecutionModel.Requirement [] org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.getRequirementChoices ( )

inline

org.keycloak.authentication.ConfigurableAuthenticatorFactoryを実装しています。

                                                                              {
        return REQUIREMENT_CHOICES;
    }

init()

void org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.init ( Config.Scope  config )

inlineinherited

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                                          {

    }

isConfigurable()

boolean org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.isConfigurable ( )

inline

org.keycloak.authentication.ClientAuthenticatorFactoryを実装しています。

                                    {
        return false;
    }

isUserSetupAllowed()

boolean org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.isUserSetupAllowed ( )

inlineinherited

org.keycloak.authentication.ConfigurableAuthenticatorFactoryを実装しています。

                                        {
        return false;
    }

order()

default int org.keycloak.provider.ProviderFactory< T extends Provider >.order ( )

inlineinherited

org.keycloak.protocol.docker.DockerAuthV2ProtocolFactory, org.keycloak.urls.HostnameProviderFactory, org.keycloak.protocol.oidc.ext.OIDCExtProviderFactoryで実装されています。

                        {
        return 0;
    }

postInit()

void org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.postInit ( KeycloakSessionFactory  factory )

inlineinherited

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                                                         {

    }

メンバ詳解

ATTR_PREFIX

final String org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.ATTR_PREFIX = "x509"

static

ATTR_SUBJECT_DN

final String org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.ATTR_SUBJECT_DN = ATTR_PREFIX + ".subjectdn"

static

logger

ServicesLogger org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.logger = ServicesLogger.LOGGER

staticprotected

PROVIDER_ID

final String org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.PROVIDER_ID = "client-x509"

static

REQUIREMENT_CHOICES

final AuthenticationExecutionModel.Requirement [] org.keycloak.authentication.authenticators.client.X509ClientAuthenticator.REQUIREMENT_CHOICES

static

初期値:

= {
            AuthenticationExecutionModel.Requirement.ALTERNATIVE,
            AuthenticationExecutionModel.Requirement.DISABLED
    }

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/src/keycloak/src/main/java/org/keycloak/authentication/authenticators/client/X509ClientAuthenticator.java