org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy クラス

org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy の継承関係図

org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy 連携図

公開メンバ関数
	TrustedHostClientRegistrationPolicy (KeycloakSession session, ComponentModel componentModel)
void	beforeRegister (ClientRegistrationContext context) throws ClientRegistrationPolicyException
void	afterRegister (ClientRegistrationContext context, ClientModel clientModel)
void	beforeUpdate (ClientRegistrationContext context, ClientModel clientModel) throws ClientRegistrationPolicyException
void	afterUpdate (ClientRegistrationContext context, ClientModel clientModel)
void	beforeView (ClientRegistrationProvider provider, ClientModel clientModel) throws ClientRegistrationPolicyException
void	beforeDelete (ClientRegistrationProvider provider, ClientModel clientModel) throws ClientRegistrationPolicyException
default void	close ()

限定公開メンバ関数
void	verifyHost () throws ClientRegistrationPolicyException
List< String >	getTrustedHosts ()
List< String >	getTrustedDomains ()
String	verifyHostInTrustedHosts (String hostAddress, List< String > trustedHosts)
String	verifyHostInTrustedDomains (String hostAddress, List< String > trustedDomains)
void	verifyClientUrls (ClientRegistrationContext context) throws ClientRegistrationPolicyException
void	checkURLTrusted (String url, List< String > trustedHosts, List< String > trustedDomains) throws ClientRegistrationPolicyException

関数
boolean	isHostMustMatch ()
boolean	isClientUrisMustMatch ()

非公開メンバ関数
boolean	parseBoolean (String propertyKey)

静的非公開メンバ関数
static String	relativeToAbsoluteURI (String rootUrl, String relative)

非公開変数類
final KeycloakSession	session
final ComponentModel	componentModel

静的非公開変数類
static final Logger	logger = Logger.getLogger(TrustedHostClientRegistrationPolicy.class)

詳解

著者

Marek Posolda

構築子と解体子

TrustedHostClientRegistrationPolicy()

org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.TrustedHostClientRegistrationPolicy ( KeycloakSession  session, ComponentModel  componentModel  )

inline

                                                                                                       {
        this.session = session;
        this.componentModel = componentModel;
    }

関数詳解

afterRegister()

void org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.afterRegister ( ClientRegistrationContext  context, ClientModel  clientModel  )

inline

org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyを実装しています。

                                                                                          {
    }

afterUpdate()

void org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.afterUpdate ( ClientRegistrationContext  context, ClientModel  clientModel  )

inline

org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyを実装しています。

                                                                                        {

    }

beforeDelete()

void org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.beforeDelete ( ClientRegistrationProvider  provider, ClientModel  clientModel  ) throws ClientRegistrationPolicyException

inline

org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyを実装しています。

                                                                                                                                    {
        verifyHost();
    }

beforeRegister()

void org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.beforeRegister ( ClientRegistrationContext  context ) throws ClientRegistrationPolicyException

inline

org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyを実装しています。

                                                                                                           {
        verifyHost();
        verifyClientUrls(context);
    }

beforeUpdate()

void org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.beforeUpdate ( ClientRegistrationContext  context, ClientModel  clientModel  ) throws ClientRegistrationPolicyException

inline

org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyを実装しています。

                                                                                                                                  {
        verifyHost();
        verifyClientUrls(context);
    }

beforeView()

void org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.beforeView ( ClientRegistrationProvider  provider, ClientModel  clientModel  ) throws ClientRegistrationPolicyException

inline

org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyを実装しています。

                                                                                                                                  {
        verifyHost();
    }

checkURLTrusted()

void org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.checkURLTrusted ( String  url, List< String >  trustedHosts, List< String >  trustedDomains  ) throws ClientRegistrationPolicyException

inlineprotected

                                                                                                                                                {
        try {
            String host = new URL(url).getHost();

            for (String trustedHost : trustedHosts) {
                if (host.equals(trustedHost)) {
                    return;
                }
            }

            for (String trustedDomain : trustedDomains) {
                if (host.endsWith(trustedDomain)) {
                    return;
                }
            }
        } catch (MalformedURLException mfe) {
            logger.debugf(mfe, "URL '%s' is malformed", url);
            throw new ClientRegistrationPolicyException("URL is malformed");
        }

        ServicesLogger.LOGGER.urlDoesntMatch(url);
        throw new ClientRegistrationPolicyException("URL doesn't match any trusted host or trusted domain");
    }

close()

default void org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy.close ( )

inlineinherited

org.keycloak.provider.Providerを実装しています。

                         {
    }

getTrustedDomains()

List<String> org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.getTrustedDomains ( )

inlineprotected

                                               {
        List<String> trustedHostsConfig = componentModel.getConfig().getList(TrustedHostClientRegistrationPolicyFactory.TRUSTED_HOSTS);
        List<String> domains = new LinkedList<>();

        for (String hostname : trustedHostsConfig) {
            if (hostname.startsWith("*.")) {
                hostname = hostname.substring(2);
                domains.add(hostname);
            }
        }

        return domains;
    }

getTrustedHosts()

List<String> org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.getTrustedHosts ( )

inlineprotected

                                             {
        List<String> trustedHostsConfig = componentModel.getConfig().getList(TrustedHostClientRegistrationPolicyFactory.TRUSTED_HOSTS);
        return trustedHostsConfig.stream().filter((String hostname) -> {

            return !hostname.startsWith("*.");

        }).collect(Collectors.toList());
    }

isClientUrisMustMatch()

boolean org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.isClientUrisMustMatch ( )

inlinepackage

                                    {
        return parseBoolean(TrustedHostClientRegistrationPolicyFactory.CLIENT_URIS_MUST_MATCH);
    }

isHostMustMatch()

boolean org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.isHostMustMatch ( )

inlinepackage

                              {
        return parseBoolean(TrustedHostClientRegistrationPolicyFactory.HOST_SENDING_REGISTRATION_REQUEST_MUST_MATCH);
    }

parseBoolean()

boolean org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.parseBoolean ( String  propertyKey )

inlineprivate

                                                     {
        String val = componentModel.getConfig().getFirst(propertyKey);
        return val==null || Boolean.parseBoolean(val);
    }

relativeToAbsoluteURI()

static String org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.relativeToAbsoluteURI ( String  rootUrl, String  relative  )

inlinestaticprivate

                                                                                 {
        if (relative == null) {
            return null;
        }

        if (!relative.startsWith("/")) {
            return relative;
        } else if (rootUrl == null || rootUrl.isEmpty()) {
            return null;
        }

        return rootUrl + relative;
    }

verifyClientUrls()

void org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.verifyClientUrls ( ClientRegistrationContext  context ) throws ClientRegistrationPolicyException

inlineprotected

                                                                                                                {
        boolean redirectUriMustMatch = isClientUrisMustMatch();
        if (!redirectUriMustMatch) {
            return;
        }

        List<String> trustedHosts = getTrustedHosts();
        List<String> trustedDomains = getTrustedDomains();

        ClientRepresentation client = context.getClient();
        String rootUrl = client.getRootUrl();
        String baseUrl = client.getBaseUrl();
        String adminUrl = client.getAdminUrl();
        List<String> redirectUris = client.getRedirectUris();

        baseUrl = relativeToAbsoluteURI(rootUrl, baseUrl);
        adminUrl = relativeToAbsoluteURI(rootUrl, adminUrl);
        Set<String> resolvedRedirects = PairwiseSubMapperUtils.resolveValidRedirectUris(rootUrl, redirectUris);

        if (rootUrl != null) {
            checkURLTrusted(rootUrl, trustedHosts, trustedDomains);
        }

        if (baseUrl != null) {
            checkURLTrusted(baseUrl, trustedHosts, trustedDomains);
        }
        if (adminUrl != null) {
            checkURLTrusted(adminUrl, trustedHosts, trustedDomains);
        }
        for (String redirect : resolvedRedirects) {
            checkURLTrusted(redirect, trustedHosts, trustedDomains);
        }

    }

verifyHost()

void org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.verifyHost ( ) throws ClientRegistrationPolicyException

inlineprotected

                                                                         {
        boolean hostMustMatch = isHostMustMatch();
        if (!hostMustMatch) {
            return;
        }

        String hostAddress = session.getContext().getConnection().getRemoteAddr();

        logger.debugf("Verifying remote host : %s", hostAddress);

        List<String> trustedHosts = getTrustedHosts();
        List<String> trustedDomains = getTrustedDomains();

        // Verify trustedHosts by their IP addresses
        String verifiedHost = verifyHostInTrustedHosts(hostAddress, trustedHosts);
        if (verifiedHost != null) {
            return;
        }

        // Verify domains if hostAddress hostname belongs to the domain. This assumes proper DNS setup
        verifiedHost = verifyHostInTrustedDomains(hostAddress, trustedDomains);
        if (verifiedHost != null) {
            return;
        }

        ServicesLogger.LOGGER.failedToVerifyRemoteHost(hostAddress);
        throw new ClientRegistrationPolicyException("Host not trusted.");
    }

verifyHostInTrustedDomains()

String org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.verifyHostInTrustedDomains ( String  hostAddress, List< String >  trustedDomains  )

inlineprotected

                                                                                                 {
        if (!trustedDomains.isEmpty()) {
            try {
                String hostname = InetAddress.getByName(hostAddress).getHostName();

                logger.debugf("Trying verify request from address '%s' of host '%s' by domains", hostAddress, hostname);

                for (String confDomain : trustedDomains) {
                    if (hostname.endsWith(confDomain)) {
                        logger.debugf("Successfully verified host '%s' by trusted domain '%s'", hostname, confDomain);
                        return hostname;
                    }
                }
            } catch (UnknownHostException uhe) {
                logger.debugf(uhe, "Request of address '%s' came from unknown host. Skip verification by domains", hostAddress);
            }
        }

        return null;
    }

verifyHostInTrustedHosts()

String org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.verifyHostInTrustedHosts ( String  hostAddress, List< String >  trustedHosts  )

inlineprotected

                                                                                             {
        for (String confHostName : trustedHosts) {
            try {
                String hostIPAddress = InetAddress.getByName(confHostName).getHostAddress();

                logger.tracef("Trying host '%s' of address '%s'", confHostName, hostIPAddress);
                if (hostIPAddress.equals(hostAddress)) {
                    logger.debugf("Successfully verified host : %s", confHostName);
                    return confHostName;
                }
            } catch (UnknownHostException uhe) {
                logger.debugf(uhe, "Unknown host from realm configuration: %s", confHostName);
            }
        }

        return null;
    }

メンバ詳解

componentModel

final ComponentModel org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.componentModel

private

logger

final Logger org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.logger = Logger.getLogger(TrustedHostClientRegistrationPolicy.class)

staticprivate

session

final KeycloakSession org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicy.session

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/oidc-service/src/main/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicy.java