org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider クラス

org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider の継承関係図

org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider 連携図

公開メンバ関数
String	getId ()
void	init (KeycloakDeployment deployment, Object config)
void	setClientCredentials (KeycloakDeployment deployment, Map< String, String > requestHeaders, Map< String, String > formParams)
void	setClientSecret (String clientSecretString)
String	createSignedRequestToken (String clientId, String realmInfoUrl)

静的公開変数類
static final String	PROVIDER_ID = "secret-jwt"

非公開メンバ関数
JsonWebToken	createRequestToken (String clientId, String realmInfoUrl)

非公開変数類
SecretKey	clientSecret

静的非公開変数類
static final Logger	logger = Logger.getLogger(JWTClientSecretCredentialsProvider.class)

詳解

Client authentication based on JWT signed by client secret instead of private key . See specs for more details.

著者

Takashi Norimatsu

関数詳解

createRequestToken()

JsonWebToken org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider.createRequestToken ( String  clientId, String  realmInfoUrl  )

inlineprivate

                                                                                  {
        // According to <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC's client authentication spec</a>,
        // JWT claims is the same as one by private_key_jwt
        
        JsonWebToken reqToken = new JsonWebToken();
        reqToken.id(AdapterUtils.generateId());
        reqToken.issuer(clientId);
        reqToken.subject(clientId);
        reqToken.audience(realmInfoUrl);

        int now = Time.currentTime();
        reqToken.issuedAt(now);
        // the same as in KEYCLOAK-2986, JWTClientCredentialsProvider's timeout field
        reqToken.expiration(now + 10);
        reqToken.notBefore(now);
        return reqToken;
    }

createSignedRequestToken()

String org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider.createSignedRequestToken ( String  clientId, String  realmInfoUrl  )

inline

                                                                                 {
        JsonWebToken jwt = createRequestToken(clientId, realmInfoUrl);
        // JOSE header {"alg":"HS256","typ" : "JWT"} no need "kid" due to using only one registered client secret.
        // Use "HmacSHA256" consulting <a href="https://docs.oracle.com/javase/jp/8/docs/api/javax/crypto/Mac.html">java8 api</a>.
        // because it must be implemented in every java platform.
        return new JWSBuilder().jsonContent(jwt).hmac256(clientSecret);
    }

getId()

String org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider.getId ( )

inline

org.keycloak.adapters.authentication.ClientCredentialsProviderを実装しています。

                          {
        return PROVIDER_ID;
    }

init()

void org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider.init ( KeycloakDeployment  deployment, Object  config  )

inline

org.keycloak.adapters.authentication.ClientCredentialsProviderを実装しています。

                                                                   {
        if (config == null || !(config instanceof Map)) {
            throw new RuntimeException("Configuration of jwt credentials by client secret is missing or incorrect for client '" + deployment.getResourceName() + "'. Check your adapter configuration");
        }
        
        Map<String, Object> cfg = (Map<String, Object>) config;
        String clientSecretString = (String) cfg.get("secret");
        if (clientSecretString == null) {
            throw new RuntimeException("Missing parameter secret-jwt in configuration of jwt for client " + deployment.getResourceName());
        }
        setClientSecret(clientSecretString); 
    }

setClientCredentials()

void org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider.setClientCredentials ( KeycloakDeployment  deployment, Map< String, String >  requestHeaders, Map< String, String >  formParams  )

inline

org.keycloak.adapters.authentication.ClientCredentialsProviderを実装しています。

                                                                                                                                        {
        String signedToken = createSignedRequestToken(deployment.getResourceName(), deployment.getRealmInfoUrl());
        formParams.put(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT);
        formParams.put(OAuth2Constants.CLIENT_ASSERTION, signedToken);
    }

setClientSecret()

void org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider.setClientSecret ( String  clientSecretString )

inline

                                                           {
        // Get client secret and validate signature
        // According to <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC's client authentication spec</a>,
        // The HMAC (Hash-based Message Authentication Code) is calculated using the octets of the UTF-8 representation of the client_secret as the shared key. 
        // Use "HmacSHA256" consulting <a href="https://docs.oracle.com/javase/jp/8/docs/api/javax/crypto/Mac.html">java8 api</a>
        // because it must be implemented in every java platform.
        try {
            clientSecret = new SecretKeySpec(clientSecretString.getBytes("UTF-8"), "HmacSHA256");
        } catch (UnsupportedEncodingException e) {
            throw new RuntimeException("Failed to create secret key spec due to unsupported encoding.");
        }
    }

メンバ詳解

clientSecret

SecretKey org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider.clientSecret

private

logger

final Logger org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider.logger = Logger.getLogger(JWTClientSecretCredentialsProvider.class)

staticprivate

PROVIDER_ID

final String org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider.PROVIDER_ID = "secret-jwt"

static

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/keycloak/doxygen/src/adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authentication/JWTClientSecretCredentialsProvider.java