org.keycloak.protocol.docker.DockerEndpoint クラス

org.keycloak.protocol.docker.DockerEndpoint の継承関係図

org.keycloak.protocol.docker.DockerEndpoint 連携図

公開メンバ関数
	DockerEndpoint (final RealmModel realm, final EventBuilder event, final EventType login)
Response	build ()

静的公開変数類
static final String	APP_INITIATED_FLOW = "APP_INITIATED_FLOW"

限定公開メンバ関数
AuthenticationFlowModel	getAuthenticationFlow (AuthenticationSessionModel authSession)
AuthenticationProcessor	createProcessor (AuthenticationSessionModel authSession, String flowId, String flowPath)
Response	handleBrowserAuthenticationRequest (AuthenticationSessionModel authSession, LoginProtocol protocol, boolean isPassive, boolean redirectToAuthentication)
void	checkSsl ()
void	checkRealm ()
AuthenticationSessionModel	createAuthenticationSession (ClientModel client, String requestState)

限定公開変数類
RealmModel	realm
EventBuilder	event
AuthenticationManager	authManager
HttpHeaders	headers
HttpRequest	httpRequest
KeycloakSession	session
ClientConnection	clientConnection

静的限定公開変数類
static final Logger	logger = Logger.getLogger(DockerEndpoint.class)

非公開メンバ関数
void	updateAuthenticationSession ()

非公開変数類
final EventType	login
String	account
String	service
String	scope
ClientModel	client
AuthenticationSessionModel	authenticationSession

詳解

Implements a docker-client understandable format.

構築子と解体子

DockerEndpoint()

org.keycloak.protocol.docker.DockerEndpoint.DockerEndpoint ( final RealmModel  realm, final EventBuilder  event, final EventType  login  )

inline

                                                                                                   {
        super(realm, event);
        this.login = login;
    }

関数詳解

build()

Response org.keycloak.protocol.docker.DockerEndpoint.build ( )

inline

                            {
        ProfileHelper.requireFeature(Profile.Feature.DOCKER);

        final MultivaluedMap<String, String> params = session.getContext().getUri().getQueryParameters();

        account = params.getFirst(DockerAuthV2Protocol.ACCOUNT_PARAM);
        if (account == null) {
            logger.debug("Account parameter not provided by docker auth.  This is techincally required, but not actually used since " +
                    "username is provided by Basic auth header.");
        }
        service = params.getFirst(DockerAuthV2Protocol.SERVICE_PARAM);
        if (service == null) {
            throw new ErrorResponseException("invalid_request", "service parameter must be provided", Response.Status.BAD_REQUEST);
        }
        client = realm.getClientByClientId(service);
        if (client == null) {
            logger.errorv("Failed to lookup client given by service={0} parameter for realm: {1}.", service, realm.getName());
            throw new ErrorResponseException("invalid_client", "Client specified by 'service' parameter does not exist", Response.Status.BAD_REQUEST);
        }
        scope = params.getFirst(DockerAuthV2Protocol.SCOPE_PARAM);

        checkSsl();
        checkRealm();

        final AuthorizationEndpointRequest authRequest = AuthorizationEndpointRequestParserProcessor.parseRequest(event, session, client, params);
        authenticationSession = createAuthenticationSession(client, authRequest.getState());

        updateAuthenticationSession();

        // So back button doesn't work
        CacheControlUtil.noBackButtonCacheControlHeader();

        return handleBrowserAuthenticationRequest(authenticationSession, new DockerAuthV2Protocol(session, realm, session.getContext().getUri(), headers, event.event(login)), false, false);
    }

checkRealm()

void org.keycloak.protocol.AuthorizationEndpointBase.checkRealm ( )

inlineprotectedinherited

                                {
        if (!realm.isEnabled()) {
            event.error(Errors.REALM_DISABLED);
            throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.REALM_NOT_ENABLED);
        }
    }

checkSsl()

void org.keycloak.protocol.AuthorizationEndpointBase.checkSsl ( )

inlineprotectedinherited

                              {
        if (!session.getContext().getUri().getBaseUri().getScheme().equals("https") && realm.getSslRequired().isRequired(clientConnection)) {
            event.error(Errors.SSL_REQUIRED);
            throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.HTTPS_REQUIRED);
        }
    }

createAuthenticationSession()

AuthenticationSessionModel org.keycloak.protocol.AuthorizationEndpointBase.createAuthenticationSession ( ClientModel  client, String  requestState  )

inlineprotectedinherited

                                                                                                              {
        AuthenticationSessionManager manager = new AuthenticationSessionManager(session);
        RootAuthenticationSessionModel rootAuthSession = manager.getCurrentRootAuthenticationSession(realm);

        AuthenticationSessionModel authSession;

        if (rootAuthSession != null) {
            authSession = rootAuthSession.createAuthenticationSession(client);

            logger.debugf("Sent request to authz endpoint. Root authentication session with ID '%s' exists. Client is '%s' . Created new authentication session with tab ID: %s",
                    rootAuthSession.getId(), client.getClientId(), authSession.getTabId());
        } else {
            UserSessionCrossDCManager userSessionCrossDCManager = new UserSessionCrossDCManager(session);
            UserSessionModel userSession = userSessionCrossDCManager.getUserSessionIfExistsRemotely(manager, realm);

            if (userSession != null) {
                String userSessionId = userSession.getId();
                rootAuthSession = session.authenticationSessions().createRootAuthenticationSession(userSessionId, realm);
                authSession = rootAuthSession.createAuthenticationSession(client);
                logger.debugf("Sent request to authz endpoint. We don't have root authentication session with ID '%s' but we have userSession." +
                        "Re-created root authentication session with same ID. Client is: %s . New authentication session tab ID: %s", userSessionId, client.getClientId(), authSession.getTabId());
            } else {
                rootAuthSession = manager.createAuthenticationSession(realm, true);
                authSession = rootAuthSession.createAuthenticationSession(client);
                logger.debugf("Sent request to authz endpoint. Created new root authentication session with ID '%s' . Client: %s . New authentication session tab ID: %s",
                        rootAuthSession.getId(), client.getClientId(), authSession.getTabId());
            }
        }

        session.getProvider(LoginFormsProvider.class).setAuthenticationSession(authSession);

        return authSession;

    }

createProcessor()

AuthenticationProcessor org.keycloak.protocol.AuthorizationEndpointBase.createProcessor ( AuthenticationSessionModel  authSession, String  flowId, String  flowPath  )

inlineprotectedinherited

                                                                                                                              {
        AuthenticationProcessor processor = new AuthenticationProcessor();
        processor.setAuthenticationSession(authSession)
                .setFlowPath(flowPath)
                .setFlowId(flowId)
                .setBrowserFlow(true)
                .setConnection(clientConnection)
                .setEventBuilder(event)
                .setRealm(realm)
                .setSession(session)
                .setUriInfo(session.getContext().getUri())
                .setRequest(httpRequest);

        authSession.setAuthNote(AuthenticationProcessor.CURRENT_FLOW_PATH, flowPath);

        return processor;
    }

getAuthenticationFlow()

AuthenticationFlowModel org.keycloak.protocol.docker.DockerEndpoint.getAuthenticationFlow ( AuthenticationSessionModel  authSession )

inlineprotected

                                                                                                    {
        return realm.getDockerAuthenticationFlow();
    }

handleBrowserAuthenticationRequest()

Response org.keycloak.protocol.AuthorizationEndpointBase.handleBrowserAuthenticationRequest ( AuthenticationSessionModel  authSession, LoginProtocol  protocol, boolean  isPassive, boolean  redirectToAuthentication  )

inlineprotectedinherited

Common method to handle browser authentication request in protocols unified way.

引数

authSession	for current request
protocol	handler for protocol used to initiate login
isPassive	set to true if login should be passive (without login screen shown)
redirectToAuthentication	if true redirect to flow url. If initial call to protocol is a POST, you probably want to do this. This is so we can disable the back button on browser

戻り値

response to be returned to the browser

                                                                                                                                                                               {
        AuthenticationFlowModel flow = getAuthenticationFlow(authSession);
        String flowId = flow.getId();
        AuthenticationProcessor processor = createProcessor(authSession, flowId, LoginActionsService.AUTHENTICATE_PATH);
        event.detail(Details.CODE_ID, authSession.getParentSession().getId());
        if (isPassive) {
            // OIDC prompt == NONE or SAML 2 IsPassive flag
            // This means that client is just checking if the user is already completely logged in.
            // We cancel login if any authentication action or required action is required
            try {
                if (processor.authenticateOnly() == null) {
                    // processor.attachSession();
                } else {
                    Response response = protocol.sendError(authSession, Error.PASSIVE_LOGIN_REQUIRED);
                    return response;
                }

                AuthenticationManager.setClientScopesInSession(authSession);

                if (processor.nextRequiredAction() != null) {
                    Response response = protocol.sendError(authSession, Error.PASSIVE_INTERACTION_REQUIRED);
                    return response;
                }

                // Attach session once no requiredActions or other things are required
                processor.attachSession();
            } catch (Exception e) {
                return processor.handleBrowserException(e);
            }
            return processor.finishAuthentication(protocol);
        } else {
            try {
                RestartLoginCookie.setRestartCookie(session, realm, clientConnection, session.getContext().getUri(), authSession);
                if (redirectToAuthentication) {
                    return processor.redirectToFlow();
                }
                return processor.authenticate();
            } catch (Exception e) {
                return processor.handleBrowserException(e);
            }
        }
    }

updateAuthenticationSession()

void org.keycloak.protocol.docker.DockerEndpoint.updateAuthenticationSession ( )

inlineprivate

                                               {
        authenticationSession.setProtocol(DockerAuthV2Protocol.LOGIN_PROTOCOL);
        authenticationSession.setAction(CommonClientSessionModel.Action.AUTHENTICATE.name());

        // Docker specific stuff
        authenticationSession.setClientNote(DockerAuthV2Protocol.ACCOUNT_PARAM, account);
        authenticationSession.setClientNote(DockerAuthV2Protocol.SERVICE_PARAM, service);
        authenticationSession.setClientNote(DockerAuthV2Protocol.SCOPE_PARAM, scope);
        authenticationSession.setClientNote(DockerAuthV2Protocol.ISSUER, Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));

    }

メンバ詳解

account

String org.keycloak.protocol.docker.DockerEndpoint.account

private

APP_INITIATED_FLOW

final String org.keycloak.protocol.AuthorizationEndpointBase.APP_INITIATED_FLOW = "APP_INITIATED_FLOW"

staticinherited

authenticationSession

AuthenticationSessionModel org.keycloak.protocol.docker.DockerEndpoint.authenticationSession

private

authManager

AuthenticationManager org.keycloak.protocol.AuthorizationEndpointBase.authManager

protectedinherited

client

ClientModel org.keycloak.protocol.docker.DockerEndpoint.client

private

clientConnection

ClientConnection org.keycloak.protocol.AuthorizationEndpointBase.clientConnection

protectedinherited

event

EventBuilder org.keycloak.protocol.AuthorizationEndpointBase.event

protectedinherited

headers

HttpHeaders org.keycloak.protocol.AuthorizationEndpointBase.headers

protectedinherited

httpRequest

HttpRequest org.keycloak.protocol.AuthorizationEndpointBase.httpRequest

protectedinherited

logger

final Logger org.keycloak.protocol.docker.DockerEndpoint.logger = Logger.getLogger(DockerEndpoint.class)

staticprotected

login

final EventType org.keycloak.protocol.docker.DockerEndpoint.login

private

realm

RealmModel org.keycloak.protocol.AuthorizationEndpointBase.realm

protectedinherited

scope

String org.keycloak.protocol.docker.DockerEndpoint.scope

private

service

String org.keycloak.protocol.docker.DockerEndpoint.service

private

session

KeycloakSession org.keycloak.protocol.AuthorizationEndpointBase.session

protectedinherited

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/src/keycloak/src/main/java/org/keycloak/protocol/docker/DockerEndpoint.java