org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper クラス

org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper の継承関係図

org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper 連携図

公開メンバ関数
abstract String	getIdPrefix ()
abstract String	generateSub (ProtocolMapperModel mappingModel, String sectorIdentifier, String localSub)
List< ProviderConfigProperty >	getAdditionalConfigProperties ()
void	validateAdditionalConfig (KeycloakSession session, RealmModel realm, ProtocolMapperContainerModel mapperContainer, ProtocolMapperModel mapperModel) throws ProtocolMapperConfigException
final String	getDisplayCategory ()
IDToken	transformIDToken (IDToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, AuthenticatedClientSessionModel clientSession)
AccessToken	transformAccessToken (AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, AuthenticatedClientSessionModel clientSession)
AccessToken	transformUserInfoToken (AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, AuthenticatedClientSessionModel clientSession)
final List< ProviderConfigProperty >	getConfigProperties ()
final void	validateConfig (KeycloakSession session, RealmModel realm, ProtocolMapperContainerModel mapperContainer, ProtocolMapperModel mapperModel) throws ProtocolMapperConfigException
final String	getId ()
String	getProtocol ()
void	close ()
final ProtocolMapper	create (KeycloakSession session)
void	init (Config.Scope config)
void	postInit (KeycloakSessionFactory factory)
String	getDisplayType ()
default int	order ()
String	getHelpText ()

静的公開変数類
static final String	PROVIDER_ID_SUFFIX = "-pairwise-sub-mapper"
static final String	TOKEN_MAPPER_CATEGORY = "Token mapper"

限定公開メンバ関数
void	setIDTokenSubject (IDToken token, String pairwiseSub)
void	setAccessTokenSubject (IDToken token, String pairwiseSub)
void	setUserInfoTokenSubject (IDToken token, String pairwiseSub)
void	setClaim (IDToken token, ProtocolMapperModel mappingModel, UserSessionModel userSession)
void	setClaim (IDToken token, ProtocolMapperModel mappingModel, UserSessionModel userSession, KeycloakSession keycloakSession)

非公開メンバ関数
String	getSectorIdentifier (ClientModel client, ProtocolMapperModel mappingModel)

詳解

Set the 'sub' claim to pairwise .

著者

Martin Hardselius

関数詳解

close()

void org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.close ( )

inlineinherited

org.keycloak.provider.Providerを実装しています。

                        {

    }

create()

final ProtocolMapper org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.create ( KeycloakSession  session )

inlineinherited

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                                                                {
        throw new RuntimeException("UNSUPPORTED METHOD");
    }

generateSub()

abstract String org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.generateSub ( ProtocolMapperModel  mappingModel, String  sectorIdentifier, String  localSub  )

abstract

Generates a pairwise subject identifier.

引数

mappingModel
sectorIdentifier	client sector identifier
localSub	local subject identifier (user id)

戻り値

A pairwise subject identifier

getAdditionalConfigProperties()

List<ProviderConfigProperty> org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.getAdditionalConfigProperties ( )

inline

Override to add additional provider configuration properties. By default, a pairwise sub mapper will only contain configuration for a sector identifier URI.

戻り値

A list of provider configuration properties.

                                                                        {
        return new LinkedList<>();
    }

getConfigProperties()

final List<ProviderConfigProperty> org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.getConfigProperties ( )

inline

org.keycloak.provider.ConfiguredProviderを実装しています。

                                                                    {
        List<ProviderConfigProperty> configProperties = new LinkedList<>();
        configProperties.add(PairwiseSubMapperHelper.createSectorIdentifierConfig());
        configProperties.addAll(getAdditionalConfigProperties());
        return configProperties;
    }

getDisplayCategory()

final String org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.getDisplayCategory ( )

inline

org.keycloak.protocol.ProtocolMapperを実装しています。

                                             {
        return AbstractOIDCProtocolMapper.TOKEN_MAPPER_CATEGORY;
    }

getDisplayType()

String org.keycloak.protocol.ProtocolMapper.getDisplayType ( )

inherited

org.keycloak.protocol.oidc.mappers.AddressMapper, org.keycloak.protocol.oidc.mappers.ScriptBasedOIDCProtocolMapper, org.keycloak.protocol.oidc.mappers.SHA256PairwiseSubMapper, org.keycloak.protocol.oidc.mappers.UserClientRoleMappingMapper, org.keycloak.protocol.oidc.mappers.AudienceProtocolMapper, org.keycloak.protocol.oidc.mappers.RoleNameMapper, org.keycloak.protocol.oidc.mappers.UserAttributeMapper, org.keycloak.protocol.oidc.mappers.UserRealmRoleMappingMapper, org.keycloak.protocol.oidc.mappers.GroupMembershipMapper, org.keycloak.protocol.oidc.mappers.HardcodedClaim, org.keycloak.protocol.oidc.mappers.HardcodedRole, org.keycloak.protocol.oidc.mappers.UserPropertyMapper, org.keycloak.protocol.oidc.mappers.UserSessionNoteMapper, org.keycloak.protocol.oidc.mappers.FullNameMapperで実装されています。

getHelpText()

String org.keycloak.provider.ConfiguredProvider.getHelpText ( )

inherited

org.keycloak.authentication.forms.RegistrationRecaptcha, org.keycloak.authentication.authenticators.client.JWTClientSecretAuthenticator, org.keycloak.authentication.authenticators.client.JWTClientAuthenticator, org.keycloak.authentication.authenticators.resetcred.ResetCredentialEmail, org.keycloak.authentication.authenticators.client.X509ClientAuthenticator, org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator, org.keycloak.authentication.authenticators.resetcred.ResetCredentialChooseUser, org.keycloak.broker.oidc.mappers.UserAttributeMapper, org.keycloak.authentication.authenticators.directgrant.ValidateUsername, org.keycloak.broker.oidc.mappers.ExternalKeycloakRoleToRoleMapper, org.keycloak.authentication.authenticators.directgrant.ValidateOTP, org.keycloak.keys.GeneratedRsaKeyProviderFactory, org.keycloak.broker.oidc.mappers.ClaimToRoleMapper, org.keycloak.broker.oidc.mappers.UsernameTemplateMapper, org.keycloak.protocol.oidc.mappers.AddressMapper, org.keycloak.authentication.authenticators.browser.ScriptBasedAuthenticatorFactory, org.keycloak.broker.oidc.mappers.AbstractJsonUserAttributeMapper, org.keycloak.protocol.oidc.mappers.ScriptBasedOIDCProtocolMapper, org.keycloak.authentication.authenticators.browser.ConditionalOtpFormAuthenticatorFactory, org.keycloak.authentication.authenticators.browser.OTPFormAuthenticatorFactory, org.keycloak.authentication.authenticators.directgrant.ValidatePassword, org.keycloak.broker.provider.HardcodedUserSessionAttributeMapper, org.keycloak.authentication.authenticators.browser.SpnegoAuthenticatorFactory, org.keycloak.broker.provider.HardcodedAttributeMapper, org.keycloak.authentication.authenticators.browser.UsernamePasswordFormFactory, org.keycloak.keys.ImportedRsaKeyProviderFactory, org.keycloak.protocol.oidc.mappers.UserClientRoleMappingMapper, org.keycloak.protocol.oidc.mappers.AudienceProtocolMapper, org.keycloak.authentication.authenticators.browser.CookieAuthenticatorFactory, org.keycloak.authentication.authenticators.broker.IdpReviewProfileAuthenticatorFactory, org.keycloak.authentication.authenticators.broker.IdpCreateUserIfUniqueAuthenticatorFactory, org.keycloak.broker.provider.HardcodedRoleMapper, org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticatorFactory, org.keycloak.authentication.authenticators.broker.IdpEmailVerificationAuthenticatorFactory, org.keycloak.authentication.authenticators.challenge.BasicAuthAuthenticatorFactory, org.keycloak.authentication.authenticators.challenge.BasicAuthOTPAuthenticatorFactory, org.keycloak.authentication.authenticators.challenge.NoCookieFlowRedirectAuthenticatorFactory, org.keycloak.authentication.authenticators.broker.IdpConfirmLinkAuthenticatorFactory, org.keycloak.authentication.authenticators.console.ConsoleUsernamePasswordAuthenticatorFactory, org.keycloak.authentication.authenticators.broker.IdpAutoLinkAuthenticatorFactory, org.keycloak.keys.JavaKeystoreKeyProviderFactory, org.keycloak.protocol.oidc.mappers.RoleNameMapper, org.keycloak.protocol.oidc.mappers.UserAttributeMapper, org.keycloak.protocol.oidc.mappers.UserRealmRoleMappingMapper, org.keycloak.protocol.oidc.mappers.GroupMembershipMapper, org.keycloak.protocol.oidc.mappers.HardcodedClaim, org.keycloak.keys.GeneratedEcdsaKeyProviderFactory, org.keycloak.protocol.oidc.mappers.HardcodedRole, org.keycloak.storage.UserStorageProviderFactory< T extends UserStorageProvider >, org.keycloak.protocol.oidc.mappers.UserPropertyMapper, org.keycloak.protocol.oidc.mappers.UserSessionNoteMapper, org.keycloak.storage.client.ClientStorageProviderFactory< T extends ClientStorageProvider >, org.keycloak.authentication.authenticators.browser.IdentityProviderAuthenticatorFactory, org.keycloak.services.clientregistration.policy.impl.ProtocolMappersClientRegistrationPolicyFactory, org.keycloak.protocol.oidc.mappers.FullNameMapper, org.keycloak.authentication.forms.RegistrationPage, org.keycloak.services.clientregistration.policy.impl.MaxClientsClientRegistrationPolicyFactory, org.keycloak.protocol.oidc.mappers.SHA256PairwiseSubMapper, org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicyFactory, org.keycloak.authentication.forms.RegistrationPassword, org.keycloak.authentication.forms.RegistrationUserCreation, org.keycloak.services.clientregistration.policy.impl.ClientScopesClientRegistrationPolicyFactory, org.keycloak.authentication.authenticators.resetcred.ResetPassword, org.keycloak.authentication.authenticators.resetcred.ResetOTP, org.keycloak.authentication.forms.RegistrationProfile, org.keycloak.authentication.authenticators.broker.IdpUsernamePasswordFormFactory, org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticatorFactory, org.keycloak.services.clientregistration.policy.impl.ClientDisabledClientRegistrationPolicyFactory, org.keycloak.services.clientregistration.policy.impl.ConsentRequiredClientRegistrationPolicyFactory, org.keycloak.services.clientregistration.policy.impl.ScopeClientRegistrationPolicyFactory, org.keycloak.authentication.authenticators.x509.ValidateX509CertificateUsernameFactory (計71項目)で実装されています。

getId()

final String org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.getId ( )

inline

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                                {
        return "oidc-" + getIdPrefix() + PROVIDER_ID_SUFFIX;
    }

getIdPrefix()

abstract String org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.getIdPrefix ( )

abstract

getProtocol()

String org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.getProtocol ( )

inlineinherited

org.keycloak.protocol.ProtocolMapperを実装しています。

                                {
        return OIDCLoginProtocol.LOGIN_PROTOCOL;
    }

getSectorIdentifier()

String org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.getSectorIdentifier ( ClientModel  client, ProtocolMapperModel  mappingModel  )

inlineprivate

                                                                                             {
        String sectorIdentifierUri = PairwiseSubMapperHelper.getSectorIdentifierUri(mappingModel);
        if (sectorIdentifierUri != null && !sectorIdentifierUri.isEmpty()) {
            return PairwiseSubMapperUtils.resolveValidSectorIdentifier(sectorIdentifierUri);
        }
        return PairwiseSubMapperUtils.resolveValidSectorIdentifier(client.getRootUrl(), client.getRedirectUris());
    }

init()

void org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.init ( Config.Scope  config )

inlineinherited

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                                          {
    }

order()

default int org.keycloak.provider.ProviderFactory< T extends Provider >.order ( )

inlineinherited

org.keycloak.urls.HostnameProviderFactory, org.keycloak.protocol.oidc.ext.OIDCExtProviderFactoryで実装されています。

                        {
        return 0;
    }

postInit()

void org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.postInit ( KeycloakSessionFactory  factory )

inlineinherited

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                                                         {

    }

setAccessTokenSubject()

void org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.setAccessTokenSubject ( IDToken  token, String  pairwiseSub  )

inlineprotected

                                                                            {
        token.setSubject(pairwiseSub);
    }

setClaim() [1/2]

void org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.setClaim ( IDToken  token, ProtocolMapperModel  mappingModel, UserSessionModel  userSession  )

inlineprotectedinherited

Intended to be overridden in ProtocolMapper implementations to add claims to an token.

引数

token
mappingModel
userSession

非推奨:

override setClaim(IDToken, ProtocolMapperModel, UserSessionModel, KeycloakSession) instead.

                                                                                                           {
    }

setClaim() [2/2]

void org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.setClaim ( IDToken  token, ProtocolMapperModel  mappingModel, UserSessionModel  userSession, KeycloakSession  keycloakSession  )

inlineprotectedinherited

Intended to be overridden in ProtocolMapper implementations to add claims to an token.

引数

token
mappingModel
userSession
keycloakSession

                                                                                                                                            {
        // we delegate to the old #setClaim(...) method for backwards compatibility
        setClaim(token, mappingModel, userSession);
    }

setIDTokenSubject()

void org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.setIDTokenSubject ( IDToken  token, String  pairwiseSub  )

inlineprotected

                                                                        {
        token.setSubject(pairwiseSub);
    }

setUserInfoTokenSubject()

void org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.setUserInfoTokenSubject ( IDToken  token, String  pairwiseSub  )

inlineprotected

                                                                              {
        token.getOtherClaims().put("sub", pairwiseSub);
    }

transformAccessToken()

AccessToken org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.transformAccessToken ( AccessToken  token, ProtocolMapperModel  mappingModel, KeycloakSession  session, UserSessionModel  userSession, AuthenticatedClientSessionModel  clientSession  )

inline

org.keycloak.protocol.oidc.mappers.OIDCAccessTokenMapperを実装しています。

                                                                                                                                                                                                       {
        setAccessTokenSubject(token, generateSub(mappingModel, getSectorIdentifier(clientSession.getClient(), mappingModel), userSession.getUser().getId()));
        return token;
    }

transformIDToken()

IDToken org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.transformIDToken ( IDToken  token, ProtocolMapperModel  mappingModel, KeycloakSession  session, UserSessionModel  userSession, AuthenticatedClientSessionModel  clientSession  )

inline

org.keycloak.protocol.oidc.mappers.OIDCIDTokenMapperを実装しています。

                                                                                                                                                                                           {
        setIDTokenSubject(token, generateSub(mappingModel, getSectorIdentifier(clientSession.getClient(), mappingModel), userSession.getUser().getId()));
        return token;
    }

transformUserInfoToken()

AccessToken org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.transformUserInfoToken ( AccessToken  token, ProtocolMapperModel  mappingModel, KeycloakSession  session, UserSessionModel  userSession, AuthenticatedClientSessionModel  clientSession  )

inline

org.keycloak.protocol.oidc.mappers.UserInfoTokenMapperを実装しています。

                                                                                                                                                                                                         {
        setUserInfoTokenSubject(token, generateSub(mappingModel, getSectorIdentifier(clientSession.getClient(), mappingModel), userSession.getUser().getId()));
        return token;
    }

validateAdditionalConfig()

void org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.validateAdditionalConfig ( KeycloakSession  session, RealmModel  realm, ProtocolMapperContainerModel  mapperContainer, ProtocolMapperModel  mapperModel  ) throws ProtocolMapperConfigException

inline

Override to add additional configuration validation. Called when instance of mapperModel is created/updated for this protocolMapper through admin endpoint.

引数

session
realm
mapperContainer	client or clientScope
mapperModel

例外

ProtocolMapperConfigException

if configuration provided in mapperModel is not valid

                                                                                                                                                                                                        {
    }

validateConfig()

final void org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.validateConfig ( KeycloakSession  session, RealmModel  realm, ProtocolMapperContainerModel  mapperContainer, ProtocolMapperModel  mapperModel  ) throws ProtocolMapperConfigException

inline

org.keycloak.protocol.ProtocolMapperを実装しています。

                                                                                                                                                                                                    {
        ClientModel client = null;
        if (mapperContainer instanceof ClientModel) {
            client = (ClientModel) mapperContainer;
            PairwiseSubMapperValidator.validate(session, client, mapperModel);
        }
        validateAdditionalConfig(session, realm, mapperContainer, mapperModel);
    }

メンバ詳解

PROVIDER_ID_SUFFIX

final String org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper.PROVIDER_ID_SUFFIX = "-pairwise-sub-mapper"

static

TOKEN_MAPPER_CATEGORY

final String org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper.TOKEN_MAPPER_CATEGORY = "Token mapper"

staticinherited

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/oidc-service/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractPairwiseSubMapper.java