keycloak-oidc-service
公開メンバ関数 | 静的公開変数類 | 限定公開メンバ関数 | 静的限定公開変数類 | 静的変数 | 非公開メンバ関数 | 全メンバ一覧
org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator クラス
org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator の継承関係図
Inheritance graph
org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator 連携図
Collaboration graph

公開メンバ関数

void close ()
 
void authenticate (AuthenticationFlowContext context)
 
void action (AuthenticationFlowContext context)
 
CertificateValidator.CertificateValidatorBuilder certificateValidationParameters (X509AuthenticatorConfigModel config) throws Exception
 
UserIdentityExtractor getUserIdentityExtractor (X509AuthenticatorConfigModel config)
 
UserIdentityToModelMapper getUserIdentityToModelMapper (X509AuthenticatorConfigModel config)
 
boolean requiresUser ()
 
boolean configuredFor (KeycloakSession session, RealmModel realm, UserModel user)
 
void setRequiredActions (KeycloakSession session, RealmModel realm, UserModel user)
 

静的公開変数類

static final String DEFAULT_ATTRIBUTE_NAME = "usercertificate"
 
static final String REGULAR_EXPRESSION = "x509-cert-auth.regular-expression"
 
static final String ENABLE_CRL = "x509-cert-auth.crl-checking-enabled"
 
static final String ENABLE_OCSP = "x509-cert-auth.ocsp-checking-enabled"
 
static final String ENABLE_CRLDP = "x509-cert-auth.crldp-checking-enabled"
 
static final String CRL_RELATIVE_PATH = "x509-cert-auth.crl-relative-path"
 
static final String OCSPRESPONDER_URI = "x509-cert-auth.ocsp-responder-uri"
 
static final String MAPPING_SOURCE_SELECTION = "x509-cert-auth.mapping-source-selection"
 
static final String MAPPING_SOURCE_CERT_SUBJECTDN = "Match SubjectDN using regular expression"
 
static final String MAPPING_SOURCE_CERT_SUBJECTDN_EMAIL = "Subject's e-mail"
 
static final String MAPPING_SOURCE_CERT_SUBJECTALTNAME_EMAIL = "Subject's Alternative Name E-mail"
 
static final String MAPPING_SOURCE_CERT_SUBJECTDN_CN = "Subject's Common Name"
 
static final String MAPPING_SOURCE_CERT_ISSUERDN = "Match IssuerDN using regular expression"
 
static final String MAPPING_SOURCE_CERT_ISSUERDN_EMAIL = "Issuer's e-mail"
 
static final String MAPPING_SOURCE_CERT_ISSUERDN_CN = "Issuer's Common Name"
 
static final String MAPPING_SOURCE_CERT_SERIALNUMBER = "Certificate Serial Number"
 
static final String USER_MAPPER_SELECTION = "x509-cert-auth.mapper-selection"
 
static final String USER_ATTRIBUTE_MAPPER = "Custom Attribute Mapper"
 
static final String USERNAME_EMAIL_MAPPER = "Username or Email"
 
static final String CUSTOM_ATTRIBUTE_NAME = "x509-cert-auth.mapper-selection.user-attribute-name"
 
static final String CERTIFICATE_KEY_USAGE = "x509-cert-auth.keyusage"
 
static final String CERTIFICATE_EXTENDED_KEY_USAGE = "x509-cert-auth.extendedkeyusage"
 
static final String CONFIRMATION_PAGE_DISALLOWED = "x509-cert-auth.confirmation-page-disallowed"
 

限定公開メンバ関数

Response createInfoResponse (AuthenticationFlowContext context, String infoMessage, Object ... parameters)
 
X509Certificate [] getCertificateChain (AuthenticationFlowContext context)
 

静的限定公開変数類

static ServicesLogger logger = ServicesLogger.LOGGER
 

静的変数

static final String DEFAULT_MATCH_ALL_EXPRESSION = "(.*?)(?:$)"
 

非公開メンバ関数

Response createErrorResponse (AuthenticationFlowContext context, String subjectDN, String errorMessage, String ... errorParameters)
 
Response createSuccessResponse (AuthenticationFlowContext context, String subjectDN)
 
Response createResponse (AuthenticationFlowContext context, String subjectDN, boolean isUserEnabled, String errorMessage, Object[] errorParameters)
 
void dumpContainerAttributes (AuthenticationFlowContext context)
 
boolean userEnabled (AuthenticationFlowContext context, UserModel user)
 
boolean invalidUser (AuthenticationFlowContext context, UserModel user)
 

詳解

著者
Peter Nalyvayko
バージョン
Revision
1

関数詳解

◆ action()

void org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.action ( AuthenticationFlowContext  context)
inline

org.keycloak.authentication.Authenticatorを実装しています。

256  {
257  MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
258  if (formData.containsKey("cancel")) {
259  context.clearUser();
260  context.attempted();
261  return;
262  }
263  if (context.getUser() != null) {
264  context.success();
265  return;
266  }
267  context.attempted();
268  }

◆ authenticate()

void org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.authenticate ( AuthenticationFlowContext  context)
inline

org.keycloak.authentication.Authenticatorを実装しています。

54  {
55 
56  try {
57 
58  dumpContainerAttributes(context);
59 
60  X509Certificate[] certs = getCertificateChain(context);
61  if (certs == null || certs.length == 0) {
62  // No x509 client cert, fall through and
63  // continue processing the rest of the authentication flow
64  logger.debug("[X509ClientCertificateAuthenticator:authenticate] x509 client certificate is not available for mutual SSL.");
65  context.attempted();
66  return;
67  }
68 
69  X509AuthenticatorConfigModel config = null;
70  if (context.getAuthenticatorConfig() != null && context.getAuthenticatorConfig().getConfig() != null) {
71  config = new X509AuthenticatorConfigModel(context.getAuthenticatorConfig());
72  }
73  if (config == null) {
74  logger.warn("[X509ClientCertificateAuthenticator:authenticate] x509 Client Certificate Authentication configuration is not available.");
75  context.challenge(createInfoResponse(context, "X509 client authentication has not been configured yet"));
76  context.attempted();
77  return;
78  }
79 
80  // Validate X509 client certificate
81  try {
82  CertificateValidator.CertificateValidatorBuilder builder = certificateValidationParameters(config);
83  CertificateValidator validator = builder.build(certs);
84  validator.checkRevocationStatus()
85  .validateKeyUsage()
86  .validateExtendedKeyUsage();
87  } catch(Exception e) {
88  logger.error(e.getMessage(), e);
89  // TODO use specific locale to load error messages
90  String errorMessage = "Certificate validation's failed.";
91  // TODO is calling form().setErrors enough to show errors on login screen?
92  context.challenge(createErrorResponse(context, certs[0].getSubjectDN().getName(),
93  errorMessage, e.getMessage()));
94  context.attempted();
95  return;
96  }
97 
98  Object userIdentity = getUserIdentityExtractor(config).extractUserIdentity(certs);
99  if (userIdentity == null) {
100  context.getEvent().error(Errors.INVALID_USER_CREDENTIALS);
101  logger.warnf("[X509ClientCertificateAuthenticator:authenticate] Unable to extract user identity from certificate.");
102  // TODO use specific locale to load error messages
103  String errorMessage = "Unable to extract user identity from specified certificate";
104  // TODO is calling form().setErrors enough to show errors on login screen?
105  context.challenge(createErrorResponse(context, certs[0].getSubjectDN().getName(), errorMessage));
106  context.attempted();
107  return;
108  }
109 
110  UserModel user;
111  try {
112  context.getEvent().detail(Details.USERNAME, userIdentity.toString());
113  context.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME, userIdentity.toString());
114  user = getUserIdentityToModelMapper(config).find(context, userIdentity);
115  }
116  catch(ModelDuplicateException e) {
117  logger.modelDuplicateException(e);
118  String errorMessage = "X509 certificate authentication's failed.";
119  // TODO is calling form().setErrors enough to show errors on login screen?
120  context.challenge(createErrorResponse(context, certs[0].getSubjectDN().getName(),
121  errorMessage, e.getMessage()));
122  context.attempted();
123  return;
124  }
125 
126  if (invalidUser(context, user)) {
127  // TODO use specific locale to load error messages
128  String errorMessage = "X509 certificate authentication's failed.";
129  // TODO is calling form().setErrors enough to show errors on login screen?
130  context.challenge(createErrorResponse(context, certs[0].getSubjectDN().getName(),
131  errorMessage, "Invalid user"));
132  context.attempted();
133  return;
134  }
135 
136  if (!userEnabled(context, user)) {
137  // TODO use specific locale to load error messages
138  String errorMessage = "X509 certificate authentication's failed.";
139  // TODO is calling form().setErrors enough to show errors on login screen?
140  context.challenge(createErrorResponse(context, certs[0].getSubjectDN().getName(),
141  errorMessage, "User is disabled"));
142  context.attempted();
143  return;
144  }
145  if (context.getRealm().isBruteForceProtected()) {
146  if (context.getProtector().isTemporarilyDisabled(context.getSession(), context.getRealm(), user)) {
147  context.getEvent().user(user);
148  context.getEvent().error(Errors.USER_TEMPORARILY_DISABLED);
149  // TODO use specific locale to load error messages
150  String errorMessage = "X509 certificate authentication's failed.";
151  // TODO is calling form().setErrors enough to show errors on login screen?
152  context.challenge(createErrorResponse(context, certs[0].getSubjectDN().getName(),
153  errorMessage, "User is temporarily disabled. Contact administrator."));
154  context.attempted();
155  return;
156  }
157  }
158  context.setUser(user);
159 
160  // Check whether to display the identity confirmation
161  if (!config.getConfirmationPageDisallowed()) {
162  // FIXME calling forceChallenge was the only way to display
163  // a form to let users either choose the user identity from certificate
164  // or to ignore it and proceed to a normal login screen. Attempting
165  // to call the method "challenge" results in a wrong/unexpected behavior.
166  // The question is whether calling "forceChallenge" here is ok from
167  // the design viewpoint?
168  context.forceChallenge(createSuccessResponse(context, certs[0].getSubjectDN().getName()));
169  // Do not set the flow status yet, we want to display a form to let users
170  // choose whether to accept the identity from certificate or to specify username/password explicitly
171  }
172  else {
173  // Bypass the confirmation page and log the user in
174  context.success();
175  }
176  }
177  catch(Exception e) {
178  logger.errorf("[X509ClientCertificateAuthenticator:authenticate] Exception: %s", e.getMessage());
179  context.attempted();
180  }
181  }
org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.getUserIdentityExtractor
UserIdentityExtractor getUserIdentityExtractor(X509AuthenticatorConfigModel config)
Definition: AbstractX509ClientCertificateAuthenticator.java:222
org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.getUserIdentityToModelMapper
UserIdentityToModelMapper getUserIdentityToModelMapper(X509AuthenticatorConfigModel config)
Definition: AbstractX509ClientCertificateAuthenticator.java:226
org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.logger
static ServicesLogger logger
Definition: AbstractX509ClientCertificateAuthenticator.java:49
org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.createErrorResponse
Response createErrorResponse(AuthenticationFlowContext context, String subjectDN, String errorMessage, String ... errorParameters)
Definition: X509ClientCertificateAuthenticator.java:183
org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.createInfoResponse
Response createInfoResponse(AuthenticationFlowContext context, String infoMessage, Object ... parameters)
Definition: AbstractX509ClientCertificateAuthenticator.java:76
org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.getCertificateChain
X509Certificate [] getCertificateChain(AuthenticationFlowContext context)
Definition: AbstractX509ClientCertificateAuthenticator.java:196
org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.certificateValidationParameters
CertificateValidator.CertificateValidatorBuilder certificateValidationParameters(X509AuthenticatorConfigModel config)
Definition: AbstractX509ClientCertificateAuthenticator.java:101
org.keycloak.services.ServicesLogger.modelDuplicateException
void modelDuplicateException(@Cause ModelDuplicateException mde)
org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.userEnabled
boolean userEnabled(AuthenticationFlowContext context, UserModel user)
Definition: X509ClientCertificateAuthenticator.java:238
org.keycloak.authentication.authenticators.x509.UserIdentityToModelMapper.find
abstract UserModel find(AuthenticationFlowContext context, Object userIdentity)
org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.createSuccessResponse
Response createSuccessResponse(AuthenticationFlowContext context, String subjectDN)
Definition: X509ClientCertificateAuthenticator.java:191
org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.invalidUser
boolean invalidUser(AuthenticationFlowContext context, UserModel user)
Definition: X509ClientCertificateAuthenticator.java:247
org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.dumpContainerAttributes
void dumpContainerAttributes(AuthenticationFlowContext context)
Definition: X509ClientCertificateAuthenticator.java:229
org.keycloak.authentication.authenticators.x509.UserIdentityExtractor.extractUserIdentity
abstract Object extractUserIdentity(X509Certificate[] certs)

◆ certificateValidationParameters()

CertificateValidator.CertificateValidatorBuilder org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.certificateValidationParameters ( X509AuthenticatorConfigModel  config) throws Exception
inlineinherited
101  {
102  return CertificateValidatorConfigBuilder.fromConfig(config);
103  }

◆ close()

void org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.close ( )
inline

org.keycloak.provider.Providerを実装しています。

49  {
50 
51  }

◆ configuredFor()

boolean org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.configuredFor ( KeycloakSession  session,
RealmModel  realm,
UserModel  user 
)
inlineinherited

org.keycloak.authentication.Authenticatorを実装しています。

235  {
236  return true;
237  }

◆ createErrorResponse()

Response org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.createErrorResponse ( AuthenticationFlowContext  context,
String  subjectDN,
String  errorMessage,
String ...  errorParameters 
)
inlineprivate
186  {
187 
188  return createResponse(context, subjectDN, false, errorMessage, errorParameters);
189  }
org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.createResponse
Response createResponse(AuthenticationFlowContext context, String subjectDN, boolean isUserEnabled, String errorMessage, Object[] errorParameters)
Definition: X509ClientCertificateAuthenticator.java:196

◆ createInfoResponse()

Response org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.createInfoResponse ( AuthenticationFlowContext  context,
String  infoMessage,
Object ...  parameters 
)
inlineprotectedinherited
76  {
77  LoginFormsProvider form = context.form();
78  return form.setInfo(infoMessage, parameters).createInfoPage();
79  }

◆ createResponse()

Response org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.createResponse ( AuthenticationFlowContext  context,
String  subjectDN,
boolean  isUserEnabled,
String  errorMessage,
Object []  errorParameters 
)
inlineprivate
200  {
201 
202  LoginFormsProvider form = context.form();
203  if (errorMessage != null && errorMessage.trim().length() > 0) {
204  List<FormMessage> errors = new LinkedList<>();
205 
206  errors.add(new FormMessage(errorMessage));
207  if (errorParameters != null) {
208 
209  for (Object errorParameter : errorParameters) {
210  if (errorParameter == null) continue;
211  for (String part : errorParameter.toString().split("\n")) {
212  errors.add(new FormMessage(part));
213  }
214  }
215  }
216  form.setErrors(errors);
217  }
218 
219  MultivaluedMap<String,String> formData = new MultivaluedHashMap<>();
220  formData.add("username", context.getUser() != null ? context.getUser().getUsername() : "unknown user");
221  formData.add("subjectDN", subjectDN);
222  formData.add("isUserEnabled", String.valueOf(isUserEnabled));
223 
224  form.setFormData(formData);
225 
226  return form.createX509ConfirmPage();
227  }

◆ createSuccessResponse()

Response org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.createSuccessResponse ( AuthenticationFlowContext  context,
String  subjectDN 
)
inlineprivate
192  {
193  return createResponse(context, subjectDN, true, null, null);
194  }
org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.createResponse
Response createResponse(AuthenticationFlowContext context, String subjectDN, boolean isUserEnabled, String errorMessage, Object[] errorParameters)
Definition: X509ClientCertificateAuthenticator.java:196

◆ dumpContainerAttributes()

void org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.dumpContainerAttributes ( AuthenticationFlowContext  context)
inlineprivate
229  {
230 
231  Enumeration<String> attributeNames = context.getHttpRequest().getAttributeNames();
232  while(attributeNames.hasMoreElements()) {
233  String a = attributeNames.nextElement();
234  logger.tracef("[X509ClientCertificateAuthenticator:dumpContainerAttributes] \"%s\"", a);
235  }
236  }
org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.logger
static ServicesLogger logger
Definition: AbstractX509ClientCertificateAuthenticator.java:49

◆ getCertificateChain()

X509Certificate [] org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.getCertificateChain ( AuthenticationFlowContext  context)
inlineprotectedinherited
196  {
197  try {
198  // Get a x509 client certificate
199  X509ClientCertificateLookup provider = context.getSession().getProvider(X509ClientCertificateLookup.class);
200  if (provider == null) {
201  logger.errorv("\"{0}\" Spi is not available, did you forget to update the configuration?",
202  X509ClientCertificateLookup.class);
203  return null;
204  }
205 
206  X509Certificate[] certs = provider.getCertificateChain(context.getHttpRequest());
207 
208  if (certs != null) {
209  for (X509Certificate cert : certs) {
210  logger.tracev("\"{0}\"", cert.getSubjectDN().getName());
211  }
212  }
213 
214  return certs;
215  }
216  catch (GeneralSecurityException e) {
217  logger.error(e.getMessage(), e);
218  }
219  return null;
220  }
org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.logger
static ServicesLogger logger
Definition: AbstractX509ClientCertificateAuthenticator.java:49

◆ getUserIdentityExtractor()

UserIdentityExtractor org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.getUserIdentityExtractor ( X509AuthenticatorConfigModel  config)
inlineinherited
222  {
223  return UserIdentityExtractorBuilder.fromConfig(config);
224  }

◆ getUserIdentityToModelMapper()

UserIdentityToModelMapper org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.getUserIdentityToModelMapper ( X509AuthenticatorConfigModel  config)
inlineinherited
226  {
227  return UserIdentityToModelMapperBuilder.fromConfig(config);
228  }

◆ invalidUser()

boolean org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.invalidUser ( AuthenticationFlowContext  context,
UserModel  user 
)
inlineprivate
247  {
248  if (user == null) {
249  context.getEvent().error(Errors.USER_NOT_FOUND);
250  return true;
251  }
252  return false;
253  }

◆ requiresUser()

boolean org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.requiresUser ( )
inlineinherited

org.keycloak.authentication.Authenticatorを実装しています。

230  {
231  return false;
232  }

◆ setRequiredActions()

void org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.setRequiredActions ( KeycloakSession  session,
RealmModel  realm,
UserModel  user 
)
inlineinherited

org.keycloak.authentication.Authenticatorを実装しています。

240  {
241  }

◆ userEnabled()

boolean org.keycloak.authentication.authenticators.x509.X509ClientCertificateAuthenticator.userEnabled ( AuthenticationFlowContext  context,
UserModel  user 
)
inlineprivate
238  {
239  if (!user.isEnabled()) {
240  context.getEvent().user(user);
241  context.getEvent().error(Errors.USER_DISABLED);
242  return false;
243  }
244  return true;
245  }

メンバ詳解

◆ CERTIFICATE_EXTENDED_KEY_USAGE

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.CERTIFICATE_EXTENDED_KEY_USAGE = "x509-cert-auth.extendedkeyusage"
staticinherited

◆ CERTIFICATE_KEY_USAGE

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.CERTIFICATE_KEY_USAGE = "x509-cert-auth.keyusage"
staticinherited

◆ CONFIRMATION_PAGE_DISALLOWED

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.CONFIRMATION_PAGE_DISALLOWED = "x509-cert-auth.confirmation-page-disallowed"
staticinherited

◆ CRL_RELATIVE_PATH

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.CRL_RELATIVE_PATH = "x509-cert-auth.crl-relative-path"
staticinherited

◆ CUSTOM_ATTRIBUTE_NAME

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.CUSTOM_ATTRIBUTE_NAME = "x509-cert-auth.mapper-selection.user-attribute-name"
staticinherited

◆ DEFAULT_ATTRIBUTE_NAME

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.DEFAULT_ATTRIBUTE_NAME = "usercertificate"
staticinherited

◆ DEFAULT_MATCH_ALL_EXPRESSION

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.DEFAULT_MATCH_ALL_EXPRESSION = "(.*?)(?:$)"
staticpackageinherited

◆ ENABLE_CRL

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.ENABLE_CRL = "x509-cert-auth.crl-checking-enabled"
staticinherited

◆ ENABLE_CRLDP

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.ENABLE_CRLDP = "x509-cert-auth.crldp-checking-enabled"
staticinherited

◆ ENABLE_OCSP

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.ENABLE_OCSP = "x509-cert-auth.ocsp-checking-enabled"
staticinherited

◆ logger

ServicesLogger org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.logger = ServicesLogger.LOGGER
staticprotectedinherited

◆ MAPPING_SOURCE_CERT_ISSUERDN

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.MAPPING_SOURCE_CERT_ISSUERDN = "Match IssuerDN using regular expression"
staticinherited

◆ MAPPING_SOURCE_CERT_ISSUERDN_CN

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.MAPPING_SOURCE_CERT_ISSUERDN_CN = "Issuer's Common Name"
staticinherited

◆ MAPPING_SOURCE_CERT_ISSUERDN_EMAIL

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.MAPPING_SOURCE_CERT_ISSUERDN_EMAIL = "Issuer's e-mail"
staticinherited

◆ MAPPING_SOURCE_CERT_SERIALNUMBER

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.MAPPING_SOURCE_CERT_SERIALNUMBER = "Certificate Serial Number"
staticinherited

◆ MAPPING_SOURCE_CERT_SUBJECTALTNAME_EMAIL

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.MAPPING_SOURCE_CERT_SUBJECTALTNAME_EMAIL = "Subject's Alternative Name E-mail"
staticinherited

◆ MAPPING_SOURCE_CERT_SUBJECTDN

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.MAPPING_SOURCE_CERT_SUBJECTDN = "Match SubjectDN using regular expression"
staticinherited

◆ MAPPING_SOURCE_CERT_SUBJECTDN_CN

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.MAPPING_SOURCE_CERT_SUBJECTDN_CN = "Subject's Common Name"
staticinherited

◆ MAPPING_SOURCE_CERT_SUBJECTDN_EMAIL

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.MAPPING_SOURCE_CERT_SUBJECTDN_EMAIL = "Subject's e-mail"
staticinherited

◆ MAPPING_SOURCE_SELECTION

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.MAPPING_SOURCE_SELECTION = "x509-cert-auth.mapping-source-selection"
staticinherited

◆ OCSPRESPONDER_URI

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.OCSPRESPONDER_URI = "x509-cert-auth.ocsp-responder-uri"
staticinherited

◆ REGULAR_EXPRESSION

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.REGULAR_EXPRESSION = "x509-cert-auth.regular-expression"
staticinherited

◆ USER_ATTRIBUTE_MAPPER

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.USER_ATTRIBUTE_MAPPER = "Custom Attribute Mapper"
staticinherited

◆ USER_MAPPER_SELECTION

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.USER_MAPPER_SELECTION = "x509-cert-auth.mapper-selection"
staticinherited

◆ USERNAME_EMAIL_MAPPER

final String org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.USERNAME_EMAIL_MAPPER = "Username or Email"
staticinherited
このクラス詳解は次のファイルから抽出されました:
2018年11月18日(日) 14時17分18秒作成 - keycloak-oidc-service / 構成:   doxygen 1.8.13