org.keycloak.adapters.wildfly.WildflyRequestAuthenticator クラス

org.keycloak.adapters.wildfly.WildflyRequestAuthenticator の継承関係図

org.keycloak.adapters.wildfly.WildflyRequestAuthenticator 連携図

公開メンバ関数
	WildflyRequestAuthenticator (HttpFacade facade, KeycloakDeployment deployment, int sslRedirectPort, SecurityContext securityContext, HttpServerExchange exchange, AdapterTokenStore tokenStore)
AuthChallenge	getChallenge ()
AuthOutcome	authenticate ()

限定公開メンバ関数
void	propagateKeycloakContext (KeycloakUndertowAccount account)
Principal	getPrincipal (Subject subject)
Group	createGroup (String name, Set< Principal > principals)
Group []	getRoleSets (Collection< String > roleSet)
OAuthRequestAuthenticator	createOAuthAuthenticator ()
KeycloakUndertowAccount	createAccount (KeycloakPrincipal< RefreshableKeycloakSecurityContext > principal)
String	changeHttpSessionId (boolean create)
String	getHttpSessionId (boolean create)
HttpSession	getSession (boolean create)
void	completeOAuthAuthentication (KeycloakPrincipal< RefreshableKeycloakSecurityContext > principal)
void	completeBearerAuthentication (KeycloakPrincipal< RefreshableKeycloakSecurityContext > principal, String method)
boolean	verifySSL ()
boolean	isAutodetectedBearerOnly (HttpFacade.Request request)
BearerTokenRequestAuthenticator	createBearerTokenAuthenticator ()
BasicAuthRequestAuthenticator	createBasicAuthAuthenticator ()
QueryParamterTokenRequestAuthenticator	createQueryParamterTokenRequestAuthenticator ()
void	completeAuthentication (OAuthRequestAuthenticator oauth)
void	completeAuthentication (BearerTokenRequestAuthenticator bearer, String method)

限定公開変数類
SecurityContext	securityContext
HttpServerExchange	exchange
HttpFacade	facade
AuthChallenge	challenge
KeycloakDeployment	deployment
AdapterTokenStore	tokenStore
int	sslRedirectPort

静的限定公開変数類
static Logger	log = Logger.getLogger(WildflyRequestAuthenticator.class)

静的非公開メンバ関数
static void	mapGroupMembersOfAuthenticatedSubjectIntoSecurityContext (org.jboss.security.SecurityContext sc)

詳解

著者

Bill Burke

バージョン

Revision

1

構築子と解体子

WildflyRequestAuthenticator()

org.keycloak.adapters.wildfly.WildflyRequestAuthenticator.WildflyRequestAuthenticator ( HttpFacade  facade, KeycloakDeployment  deployment, int  sslRedirectPort, SecurityContext  securityContext, HttpServerExchange  exchange, AdapterTokenStore  tokenStore  )

inline

                                                                     {
        super(facade, deployment, sslRedirectPort, securityContext, exchange, tokenStore);
    }

関数詳解

authenticate()

AuthOutcome org.keycloak.adapters.RequestAuthenticator.authenticate ( )

inlineinherited

                                      {
        if (log.isTraceEnabled()) {
            log.trace("--> authenticate()");
        }

        BearerTokenRequestAuthenticator bearer = createBearerTokenAuthenticator();
        if (log.isTraceEnabled()) {
            log.trace("try bearer");
        }

        AuthOutcome outcome = bearer.authenticate(facade);
        if (outcome == AuthOutcome.FAILED) {
            challenge = bearer.getChallenge();
            log.debug("Bearer FAILED");
            return AuthOutcome.FAILED;
        } else if (outcome == AuthOutcome.AUTHENTICATED) {
            if (verifySSL()) return AuthOutcome.FAILED;
            completeAuthentication(bearer, "KEYCLOAK");
            log.debug("Bearer AUTHENTICATED");
            return AuthOutcome.AUTHENTICATED;
        }

        QueryParamterTokenRequestAuthenticator queryParamAuth = createQueryParamterTokenRequestAuthenticator();
        if (log.isTraceEnabled()) {
            log.trace("try query paramter auth");
        }

        outcome = queryParamAuth.authenticate(facade);
        if (outcome == AuthOutcome.FAILED) {
            challenge = queryParamAuth.getChallenge();
            log.debug("QueryParamAuth auth FAILED");
            return AuthOutcome.FAILED;
        } else if (outcome == AuthOutcome.AUTHENTICATED) {
            if (verifySSL()) return AuthOutcome.FAILED;
            log.debug("QueryParamAuth AUTHENTICATED");
            completeAuthentication(queryParamAuth, "KEYCLOAK");
            return AuthOutcome.AUTHENTICATED;
        }

        if (deployment.isEnableBasicAuth()) {
            BasicAuthRequestAuthenticator basicAuth = createBasicAuthAuthenticator();
            if (log.isTraceEnabled()) {
                log.trace("try basic auth");
            }

            outcome = basicAuth.authenticate(facade);
            if (outcome == AuthOutcome.FAILED) {
                challenge = basicAuth.getChallenge();
                log.debug("BasicAuth FAILED");
                return AuthOutcome.FAILED;
            } else if (outcome == AuthOutcome.AUTHENTICATED) {
                if (verifySSL()) return AuthOutcome.FAILED;
                log.debug("BasicAuth AUTHENTICATED");
                completeAuthentication(basicAuth, "BASIC");
                return AuthOutcome.AUTHENTICATED;
            }
        }

        if (deployment.isBearerOnly()) {
            challenge = bearer.getChallenge();
            log.debug("NOT_ATTEMPTED: bearer only");
            return AuthOutcome.NOT_ATTEMPTED;
        }

        if (isAutodetectedBearerOnly(facade.getRequest())) {
            challenge = bearer.getChallenge();
            log.debug("NOT_ATTEMPTED: Treating as bearer only");
            return AuthOutcome.NOT_ATTEMPTED;
        }

        if (log.isTraceEnabled()) {
            log.trace("try oauth");
        }

        if (tokenStore.isCached(this)) {
            if (verifySSL()) return AuthOutcome.FAILED;
            log.debug("AUTHENTICATED: was cached");
            return AuthOutcome.AUTHENTICATED;
        }

        OAuthRequestAuthenticator oauth = createOAuthAuthenticator();
        outcome = oauth.authenticate();
        if (outcome == AuthOutcome.FAILED) {
            challenge = oauth.getChallenge();
            return AuthOutcome.FAILED;
        } else if (outcome == AuthOutcome.NOT_ATTEMPTED) {
            challenge = oauth.getChallenge();
            return AuthOutcome.NOT_ATTEMPTED;

        }

        if (verifySSL()) return AuthOutcome.FAILED;

        completeAuthentication(oauth);

        // redirect to strip out access code and state query parameters
        facade.getResponse().setHeader("Location", oauth.getStrippedOauthParametersRequestUri());
        facade.getResponse().setStatus(302);
        facade.getResponse().end();

        log.debug("AUTHENTICATED");
        return AuthOutcome.AUTHENTICATED;
    }

changeHttpSessionId()

String org.keycloak.adapters.undertow.ServletRequestAuthenticator.changeHttpSessionId ( boolean  create )

inlineprotectedinherited

                                                         {
        if (!deployment.isTurnOffChangeSessionIdOnLogin()) return ChangeSessionId.changeSessionId(exchange, create);
        else return getHttpSessionId(create);
    }

completeAuthentication() [1/2]

void org.keycloak.adapters.RequestAuthenticator.completeAuthentication ( OAuthRequestAuthenticator  oauth )

inlineprotectedinherited

                                                                           {
        RefreshableKeycloakSecurityContext session = new RefreshableKeycloakSecurityContext(deployment, tokenStore, oauth.getTokenString(), oauth.getToken(), oauth.getIdTokenString(), oauth.getIdToken(), oauth.getRefreshToken());
        final KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal = new KeycloakPrincipal<RefreshableKeycloakSecurityContext>(AdapterUtils.getPrincipalName(deployment, oauth.getToken()), session);
        completeOAuthAuthentication(principal);
        log.debugv("User ''{0}'' invoking ''{1}'' on client ''{2}''", principal.getName(), facade.getRequest().getURI(), deployment.getResourceName());
    }

completeAuthentication() [2/2]

void org.keycloak.adapters.RequestAuthenticator.completeAuthentication ( BearerTokenRequestAuthenticator  bearer, String  method  )

inlineprotectedinherited

                                                                                                 {
        RefreshableKeycloakSecurityContext session = new RefreshableKeycloakSecurityContext(deployment, null, bearer.getTokenString(), bearer.getToken(), null, null, null);
        final KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal = new KeycloakPrincipal<RefreshableKeycloakSecurityContext>(AdapterUtils.getPrincipalName(deployment, bearer.getToken()), session);
        completeBearerAuthentication(principal, method);
        log.debugv("User ''{0}'' invoking ''{1}'' on client ''{2}''", principal.getName(), facade.getRequest().getURI(), deployment.getResourceName());
    }

completeBearerAuthentication()

void org.keycloak.adapters.undertow.AbstractUndertowRequestAuthenticator.completeBearerAuthentication ( KeycloakPrincipal< RefreshableKeycloakSecurityContext >  principal, String  method  )

inlineprotectedinherited

                                                                                                                                {
        KeycloakUndertowAccount account = createAccount(principal);
        securityContext.authenticationComplete(account, method, false);
        propagateKeycloakContext(account);
    }

completeOAuthAuthentication()

void org.keycloak.adapters.undertow.AbstractUndertowRequestAuthenticator.completeOAuthAuthentication ( KeycloakPrincipal< RefreshableKeycloakSecurityContext >  principal )

inlineprotectedinherited

                                                                                                                {
        KeycloakUndertowAccount account = createAccount(principal);
        securityContext.authenticationComplete(account, "KEYCLOAK", false);
        propagateKeycloakContext(account);
        tokenStore.saveAccountInfo(account);
    }

createAccount()

KeycloakUndertowAccount org.keycloak.adapters.undertow.ServletRequestAuthenticator.createAccount ( KeycloakPrincipal< RefreshableKeycloakSecurityContext >  principal )

inlineprotectedinherited

                                                                                                                     {
        return new KeycloakUndertowAccount(principal);
    }

createBasicAuthAuthenticator()

BasicAuthRequestAuthenticator org.keycloak.adapters.RequestAuthenticator.createBasicAuthAuthenticator ( )

inlineprotectedinherited

                                                                           {
        return new BasicAuthRequestAuthenticator(deployment);
    }

createBearerTokenAuthenticator()

BearerTokenRequestAuthenticator org.keycloak.adapters.RequestAuthenticator.createBearerTokenAuthenticator ( )

inlineprotectedinherited

                                                                               {
        return new BearerTokenRequestAuthenticator(deployment);
    }

createGroup()

Group org.keycloak.adapters.wildfly.WildflyRequestAuthenticator.createGroup ( String  name, Set< Principal >  principals  )

inlineprotected

                                                                        {
        Group roles = null;
        Iterator<Principal> iter = principals.iterator();
        while (iter.hasNext()) {
            Object next = iter.next();
            if (!(next instanceof Group))
                continue;
            Group grp = (Group) next;
            if (grp.getName().equals(name)) {
                roles = grp;
                break;
            }
        }
        // If we did not find a group create one
        if (roles == null) {
            roles = new SimpleGroup(name);
            principals.add(roles);
        }
        return roles;
    }

createOAuthAuthenticator()

OAuthRequestAuthenticator org.keycloak.adapters.undertow.ServletRequestAuthenticator.createOAuthAuthenticator ( )

inlineprotectedinherited

                                                                   {
        return new OAuthRequestAuthenticator(this, facade, deployment, sslRedirectPort, tokenStore);
    }

createQueryParamterTokenRequestAuthenticator()

QueryParamterTokenRequestAuthenticator org.keycloak.adapters.RequestAuthenticator.createQueryParamterTokenRequestAuthenticator ( )

inlineprotectedinherited

                                                                                                    {
        return new QueryParamterTokenRequestAuthenticator(deployment);
    }

getChallenge()

AuthChallenge org.keycloak.adapters.RequestAuthenticator.getChallenge ( )

inlineinherited

                                        {
        return challenge;
    }

getHttpSessionId()

String org.keycloak.adapters.undertow.ServletRequestAuthenticator.getHttpSessionId ( boolean  create )

inlineprotectedinherited

                                                      {
        HttpSession session = getSession(create);
        return session != null ? session.getId() : null;
    }

getPrincipal()

Principal org.keycloak.adapters.wildfly.WildflyRequestAuthenticator.getPrincipal ( Subject  subject )

inlineprotected

Get the Principal given the authenticated Subject. Currently the first subject that is not of type

Group 

is considered or the single subject inside the CallerPrincipal group.

引数

subject

戻り値

the authenticated subject

                                                      {
        Principal principal = null;
        Principal callerPrincipal = null;
        if (subject != null) {
            Set<Principal> principals = subject.getPrincipals();
            if (principals != null && !principals.isEmpty()) {
                for (Principal p : principals) {
                    if (!(p instanceof Group) && principal == null) {
                        principal = p;
                    }
                    if (p instanceof Group) {
                        Group g = Group.class.cast(p);
                        if (g.getName().equals(SecurityConstants.CALLER_PRINCIPAL_GROUP) && callerPrincipal == null) {
                            Enumeration<? extends Principal> e = g.members();
                            if (e.hasMoreElements())
                                callerPrincipal = e.nextElement();
                        }
                    }
                }
            }
        }
        return callerPrincipal == null ? principal : callerPrincipal;
    }

getRoleSets()

Group [] org.keycloak.adapters.wildfly.WildflyRequestAuthenticator.getRoleSets ( Collection< String >  roleSet )

inlineprotected

                                                              {
        SimpleGroup roles = new SimpleGroup("Roles");
        Group[] roleSets = {roles};
        for (String role : roleSet) {
            roles.addMember(new SimplePrincipal(role));
        }
        return roleSets;
    }

getSession()

HttpSession org.keycloak.adapters.undertow.ServletRequestAuthenticator.getSession ( boolean  create )

inlineprotectedinherited

                                                     {
        final ServletRequestContext servletRequestContext = exchange.getAttachment(ServletRequestContext.ATTACHMENT_KEY);
        HttpServletRequest req = (HttpServletRequest) servletRequestContext.getServletRequest();
        return req.getSession(create);
    }

isAutodetectedBearerOnly()

boolean org.keycloak.adapters.RequestAuthenticator.isAutodetectedBearerOnly ( HttpFacade.Request  request )

inlineprotectedinherited

                                                                           {
        if (!deployment.isAutodetectBearerOnly()) return false;

        String headerValue = facade.getRequest().getHeader("X-Requested-With");
        if (headerValue != null && headerValue.equalsIgnoreCase("XMLHttpRequest")) {
            return true;
        }

        headerValue = facade.getRequest().getHeader("Faces-Request");
        if (headerValue != null && headerValue.startsWith("partial/")) {
            return true;
        }

        headerValue = facade.getRequest().getHeader("SOAPAction");
        if (headerValue != null) {
            return true;
        }

        List<String> accepts = facade.getRequest().getHeaders("Accept");
        if (accepts == null) accepts = Collections.emptyList();

        for (String accept : accepts) {
            if (accept.contains("text/html") || accept.contains("text/*") || accept.contains("*/*")) {
                return false;
            }
        }

        return true;
    }

mapGroupMembersOfAuthenticatedSubjectIntoSecurityContext()

static void org.keycloak.adapters.wildfly.WildflyRequestAuthenticator.mapGroupMembersOfAuthenticatedSubjectIntoSecurityContext ( org.jboss.security.SecurityContext  sc )

inlinestaticprivate

                                                                                                                        {
        SubjectInfo subjectInfo = sc.getSubjectInfo();
        if (subjectInfo == null) {
            return;
        }

        Subject authenticatedSubject = subjectInfo.getAuthenticatedSubject();
        if (authenticatedSubject == null) {
            return;
        }

        // Get role group of security context in order to add roles of authenticatedSubject.
        RoleGroup scRoles = sc.getUtil().getRoles();
        if (scRoles == null) {
            scRoles = new SimpleRoleGroup("Roles");
            sc.getUtil().setRoles(scRoles);
        }

        // Get group roles of authenticatedSubject and add each role of the group into security context
        Iterator<Principal> principalItr = authenticatedSubject.getPrincipals().iterator();
        while (principalItr.hasNext()) {
            Principal principal = principalItr.next();
            if (principal instanceof Group) {
                Enumeration<? extends Principal> members = ((Group) principal).members();
                while (members.hasMoreElements()) {
                    Principal role = members.nextElement();
                    scRoles.addRole(new SimpleRole(role.getName()));
                }
            }
        }
    }

propagateKeycloakContext()

void org.keycloak.adapters.wildfly.WildflyRequestAuthenticator.propagateKeycloakContext ( KeycloakUndertowAccount  account )

inlineprotected

                                                                             {
        super.propagateKeycloakContext(account);
        SecurityInfoHelper.propagateSessionInfo(account);
        log.debug("propagate security context to wildfly");
        Subject subject = new Subject();
        Set<Principal> principals = subject.getPrincipals();
        principals.add(account.getPrincipal());
        Group[] roleSets = getRoleSets(account.getRoles());
        for (int g = 0; g < roleSets.length; g++) {
            Group group = roleSets[g];
            String name = group.getName();
            Group subjectGroup = createGroup(name, principals);
            if (subjectGroup instanceof NestableGroup) {
                /* A NestableGroup only allows Groups to be added to it so we
                need to add a SimpleGroup to subjectRoles to contain the roles
                */
                SimpleGroup tmp = new SimpleGroup("Roles");
                subjectGroup.addMember(tmp);
                subjectGroup = tmp;
            }
            // Copy the group members to the Subject group
            Enumeration<? extends Principal> members = group.members();
            while (members.hasMoreElements()) {
                Principal role = (Principal) members.nextElement();
                subjectGroup.addMember(role);
            }
        }
        // add the CallerPrincipal group if none has been added in getRoleSets
        Group callerGroup = new SimpleGroup(SecurityConstants.CALLER_PRINCIPAL_GROUP);
        callerGroup.addMember(account.getPrincipal());
        principals.add(callerGroup);
        org.jboss.security.SecurityContext sc = SecurityContextAssociation.getSecurityContext();
        Principal userPrincipal = getPrincipal(subject);
        sc.getUtil().createSubjectInfo(userPrincipal, account, subject);

        // Roles of subjectInfo are null, because is was constructed by
        // org.jboss.security.identity.extensions.CredentialIdentityFactory
        //   .createIdentity(Principal [=userPrincipal], Object [=account], Role [=null]).
        // Therefore the roles are only contained in the authenticatedSubject (member of subjectInfo)
        // and subsequent logics do only access subjectInfo#roles instead of authenticatedSubject#roles.
        mapGroupMembersOfAuthenticatedSubjectIntoSecurityContext(sc);
    }

verifySSL()

boolean org.keycloak.adapters.RequestAuthenticator.verifySSL ( )

inlineprotectedinherited

                                  {
        if (!facade.getRequest().isSecure() && deployment.getSslRequired().isRequired(facade.getRequest().getRemoteAddr())) {
            log.warnf("SSL is required to authenticate. Remote address %s is secure: %s, SSL required for: %s .",
                    facade.getRequest().getRemoteAddr(), facade.getRequest().isSecure(), deployment.getSslRequired().name());
            return true;
        }
        return false;
    }

メンバ詳解

challenge

AuthChallenge org.keycloak.adapters.RequestAuthenticator.challenge

protectedinherited

deployment

KeycloakDeployment org.keycloak.adapters.RequestAuthenticator.deployment

protectedinherited

exchange

HttpServerExchange org.keycloak.adapters.undertow.AbstractUndertowRequestAuthenticator.exchange

protectedinherited

facade

HttpFacade org.keycloak.adapters.RequestAuthenticator.facade

protectedinherited

log

Logger org.keycloak.adapters.wildfly.WildflyRequestAuthenticator.log = Logger.getLogger(WildflyRequestAuthenticator.class)

staticprotected

securityContext

SecurityContext org.keycloak.adapters.undertow.AbstractUndertowRequestAuthenticator.securityContext

protectedinherited

sslRedirectPort

int org.keycloak.adapters.RequestAuthenticator.sslRedirectPort

protectedinherited

tokenStore

AdapterTokenStore org.keycloak.adapters.RequestAuthenticator.tokenStore

protectedinherited

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/keycloak/doxygen/src/adapters/oidc/wildfly/wildfly-adapter/src/main/java/org/keycloak/adapters/wildfly/WildflyRequestAuthenticator.java