org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator クラス

org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator の継承関係図

org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator 連携図

公開メンバ関数
void	authenticateClient (ClientAuthenticationFlowContext context)
String	getDisplayType ()
boolean	isConfigurable ()
AuthenticationExecutionModel.Requirement []	getRequirementChoices ()
String	getHelpText ()
List< ProviderConfigProperty >	getConfigProperties ()
List< ProviderConfigProperty >	getConfigPropertiesPerClient ()
Map< String, Object >	getAdapterConfiguration (ClientModel client)
String	getId ()
Set< String >	getProtocolAuthenticatorMethods (String loginProtocol)
ClientAuthenticator	create ()
ClientAuthenticator	create (KeycloakSession session)
void	close ()
void	init (Config.Scope config)
void	postInit (KeycloakSessionFactory factory)
boolean	isUserSetupAllowed ()
String	getReferenceCategory ()
default int	order ()

静的公開変数類
static final String	PROVIDER_ID = "client-secret"
static final AuthenticationExecutionModel.Requirement []	REQUIREMENT_CHOICES

詳解

Validates client based on "client_id" and "client_secret" sent either in request parameters or in "Authorization: Basic" header .

See org.keycloak.adapters.authentication.ClientIdAndSecretAuthenticator for the adapter

著者

Marek Posolda

関数詳解

authenticateClient()

void org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.authenticateClient ( ClientAuthenticationFlowContext  context )

inline

org.keycloak.authentication.ClientAuthenticatorを実装しています。

                                                                            {
        String client_id = null;
        String clientSecret = null;

        String authorizationHeader = context.getHttpRequest().getHttpHeaders().getRequestHeaders().getFirst(HttpHeaders.AUTHORIZATION);

        MediaType mediaType = context.getHttpRequest().getHttpHeaders().getMediaType();
        boolean hasFormData = mediaType != null && mediaType.isCompatible(MediaType.APPLICATION_FORM_URLENCODED_TYPE);

        MultivaluedMap<String, String> formData = hasFormData ? context.getHttpRequest().getDecodedFormParameters() : null;

        if (authorizationHeader != null) {
            String[] usernameSecret = BasicAuthHelper.parseHeader(authorizationHeader);
            if (usernameSecret != null) {
                client_id = usernameSecret[0];
                clientSecret = usernameSecret[1];
            } else {

                // Don't send 401 if client_id parameter was sent in request. For example IE may automatically send "Authorization: Negotiate" in XHR requests even for public clients
                if (formData != null && !formData.containsKey(OAuth2Constants.CLIENT_ID)) {
                    Response challengeResponse = Response.status(Response.Status.UNAUTHORIZED).header(HttpHeaders.WWW_AUTHENTICATE, "Basic realm=\"" + context.getRealm().getName() + "\"").build();
                    context.challenge(challengeResponse);
                    return;
                }
            }
        }

        if (formData != null) {
            // even if basic challenge response exist, we check if client id was explicitly set in the request as a form param,
            // so we can also support clients overriding flows and using challenges (e.g: basic) to authenticate their users
            if (formData.containsKey(OAuth2Constants.CLIENT_ID)) {
                client_id = formData.getFirst(OAuth2Constants.CLIENT_ID);
            }
            if (formData.containsKey(OAuth2Constants.CLIENT_SECRET)) {
                clientSecret = formData.getFirst(OAuth2Constants.CLIENT_SECRET);
            }
        }

        if (client_id == null) {
            client_id = context.getSession().getAttribute("client_id", String.class);
        }

        if (client_id == null) {
            Response challengeResponse = ClientAuthUtil.errorResponse(Response.Status.BAD_REQUEST.getStatusCode(), "invalid_client", "Missing client_id parameter");
            context.challenge(challengeResponse);
            return;
        }

        context.getEvent().client(client_id);

        ClientModel client = context.getRealm().getClientByClientId(client_id);
        if (client == null) {
            context.failure(AuthenticationFlowError.CLIENT_NOT_FOUND, null);
            return;
        }

        context.setClient(client);

        if (!client.isEnabled()) {
            context.failure(AuthenticationFlowError.CLIENT_DISABLED, null);
            return;
        }

        // Skip client_secret validation for public client
        if (client.isPublicClient()) {
            context.success();
            return;
        }

        if (clientSecret == null) {
            Response challengeResponse = ClientAuthUtil.errorResponse(Response.Status.BAD_REQUEST.getStatusCode(), "unauthorized_client", "Client secret not provided in request");
            context.challenge(challengeResponse);
            return;
        }

        if (client.getSecret() == null) {
            Response challengeResponse = ClientAuthUtil.errorResponse(Response.Status.BAD_REQUEST.getStatusCode(), "unauthorized_client", "Invalid client secret");
            context.failure(AuthenticationFlowError.INVALID_CLIENT_CREDENTIALS, challengeResponse);
            return;
        }

        if (!client.validateSecret(clientSecret)) {
            Response challengeResponse = ClientAuthUtil.errorResponse(Response.Status.BAD_REQUEST.getStatusCode(), "unauthorized_client", "Invalid client secret");
            context.failure(AuthenticationFlowError.INVALID_CLIENT_CREDENTIALS, challengeResponse);
            return;
        }

        context.success();
    }

close()

void org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.close ( )

inlineinherited

org.keycloak.provider.Providerを実装しています。

                        {

    }

create() [1/2]

ClientAuthenticator org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.create ( )

inlineinherited

org.keycloak.authentication.ClientAuthenticatorFactoryを実装しています。

                                        {
        return this;
    }

create() [2/2]

ClientAuthenticator org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.create ( KeycloakSession  session )

inlineinherited

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                                                               {
        return this;
    }

getAdapterConfiguration()

Map<String, Object> org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.getAdapterConfiguration ( ClientModel  client )

inline

org.keycloak.authentication.ClientAuthenticatorFactoryを実装しています。

                                                                           {
        Map<String, Object> result = new HashMap<>();
        result.put(CredentialRepresentation.SECRET, client.getSecret());
        return result;
    }

getConfigProperties()

List<ProviderConfigProperty> org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.getConfigProperties ( )

inline

org.keycloak.provider.ConfiguredProviderを実装しています。

                                                              {
        return new LinkedList<>();
    }

getConfigPropertiesPerClient()

List<ProviderConfigProperty> org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.getConfigPropertiesPerClient ( )

inline

org.keycloak.authentication.ClientAuthenticatorFactoryを実装しています。

                                                                       {
        // This impl doesn't use generic screen in admin console, but has its own screen. So no need to return anything here
        return Collections.emptyList();
    }

getDisplayType()

String org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.getDisplayType ( )

inline

org.keycloak.authentication.ConfigurableAuthenticatorFactoryを実装しています。

                                   {
        return "Client Id and Secret";
    }

getHelpText()

String org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.getHelpText ( )

inline

org.keycloak.provider.ConfiguredProviderを実装しています。

                                {
        return "Validates client based on 'client_id' and 'client_secret' sent either in request parameters or in 'Authorization: Basic' header";
    }

getId()

String org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.getId ( )

inline

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                          {
        return PROVIDER_ID;
    }

getProtocolAuthenticatorMethods()

Set<String> org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.getProtocolAuthenticatorMethods ( String  loginProtocol )

inline

org.keycloak.authentication.ClientAuthenticatorFactoryを実装しています。

                                                                             {
        if (loginProtocol.equals(OIDCLoginProtocol.LOGIN_PROTOCOL)) {
            Set<String> results = new LinkedHashSet<>();
            results.add(OIDCLoginProtocol.CLIENT_SECRET_BASIC);
            results.add(OIDCLoginProtocol.CLIENT_SECRET_POST);
            return results;
        } else {
            return Collections.emptySet();
        }
    }

getReferenceCategory()

String org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.getReferenceCategory ( )

inlineinherited

org.keycloak.authentication.ConfigurableAuthenticatorFactoryを実装しています。

                                         {
        return null;
    }

getRequirementChoices()

AuthenticationExecutionModel.Requirement [] org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.getRequirementChoices ( )

inline

org.keycloak.authentication.ConfigurableAuthenticatorFactoryを実装しています。

                                                                              {
        return REQUIREMENT_CHOICES;
    }

init()

void org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.init ( Config.Scope  config )

inlineinherited

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                                          {

    }

isConfigurable()

boolean org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.isConfigurable ( )

inline

org.keycloak.authentication.ClientAuthenticatorFactoryを実装しています。

                                    {
        return false;
    }

isUserSetupAllowed()

boolean org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.isUserSetupAllowed ( )

inlineinherited

org.keycloak.authentication.ConfigurableAuthenticatorFactoryを実装しています。

                                        {
        return false;
    }

order()

default int org.keycloak.provider.ProviderFactory< T extends Provider >.order ( )

inlineinherited

org.keycloak.urls.HostnameProviderFactory, org.keycloak.protocol.oidc.ext.OIDCExtProviderFactoryで実装されています。

                        {
        return 0;
    }

postInit()

void org.keycloak.authentication.authenticators.client.AbstractClientAuthenticator.postInit ( KeycloakSessionFactory  factory )

inlineinherited

org.keycloak.provider.ProviderFactory< T extends Provider >を実装しています。

                                                         {

    }

メンバ詳解

PROVIDER_ID

final String org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.PROVIDER_ID = "client-secret"

static

REQUIREMENT_CHOICES

final AuthenticationExecutionModel.Requirement [] org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator.REQUIREMENT_CHOICES

static

初期値:

= {
            AuthenticationExecutionModel.Requirement.ALTERNATIVE,
            AuthenticationExecutionModel.Requirement.DISABLED
    }

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/oidc-service/src/main/java/org/keycloak/authentication/authenticators/client/ClientIdAndSecretAuthenticator.java