org.keycloak.services.util.MtlsHoKTokenUtil クラス

org.keycloak.services.util.MtlsHoKTokenUtil 連携図

静的公開メンバ関数
static AccessToken.CertConf	bindTokenWithClientCertificate (HttpRequest request, KeycloakSession session)
static boolean	verifyTokenBindingWithClientCertificate (AccessToken token, HttpRequest request, KeycloakSession session)

静的公開変数類
static final String	CERT_VERIFY_ERROR_DESC = "Client certificate missing, or its thumbprint and one in the refresh token did NOT match"

静的限定公開変数類
static final Logger	logger = Logger.getLogger(MtlsHoKTokenUtil.class)

静的非公開メンバ関数
static X509Certificate []	getCertificateChain (HttpRequest request, KeycloakSession session)
static String	getCertificateThumbprintInSHA256DERX509Base64UrlEncoded (X509Certificate cert) throws NoSuchAlgorithmException, CertificateEncodingException
static void	dumpCertInfo (X509Certificate[] certs) throws CertificateEncodingException

静的非公開変数類
static final String	DIGEST_ALG = "SHA-256"

詳解

関数詳解

bindTokenWithClientCertificate()

static AccessToken.CertConf org.keycloak.services.util.MtlsHoKTokenUtil.bindTokenWithClientCertificate ( HttpRequest  request, KeycloakSession  session  )

inlinestatic

                                                                                                                    {
        X509Certificate[] certs = getCertificateChain(request, session);

        if (certs == null || certs.length < 1) {
            logger.warnf("no client certificate available.");
            return null;
        }

        String DERX509Base64UrlEncoded = null;
        try {
            // On Certificate Chain, first entry is considered to be client certificate.
            DERX509Base64UrlEncoded = getCertificateThumbprintInSHA256DERX509Base64UrlEncoded(certs[0]);
            if (logger.isTraceEnabled()) dumpCertInfo(certs);
        } catch (NoSuchAlgorithmException | CertificateEncodingException e) {
            // give up issuing MTLS HoK Token
            logger.warnf("give up issuing hok token. %s", e);
            return null;
        }

        AccessToken.CertConf certConf = new AccessToken.CertConf();
        certConf.setCertThumbprint(DERX509Base64UrlEncoded);
        return certConf;
    }

dumpCertInfo()

static void org.keycloak.services.util.MtlsHoKTokenUtil.dumpCertInfo ( X509Certificate []  certs ) throws CertificateEncodingException

inlinestaticprivate

                                                                                                   {
        logger.tracef(":: Try Holder of Key Token");
        logger.tracef(":: # of x509 Client Certificate in Certificate Chain = %d", certs.length);
        for (int i = 0; i < certs.length; i++) {
            logger.tracef(":: certs[%d] Raw Bytes Counts of first x509 Client Certificate in Certificate Chain = %d", i, certs[i].toString().length());
            logger.tracef(":: certs[%d] Raw Bytes String of first x509 Client Certificate in Certificate Chain = %s", i, certs[i].toString());
            logger.tracef(":: certs[%d] DER Dump Bytes of first x509 Client Certificate in Certificate Chain = %d", i, certs[i].getEncoded().length);
            String DERX509Base64UrlEncoded = null;
            try {
                DERX509Base64UrlEncoded = getCertificateThumbprintInSHA256DERX509Base64UrlEncoded(certs[i]);
            } catch (Exception e) {}
            logger.tracef(":: certs[%d] Base64URL Encoded SHA-256 Hash of DER formatted first x509 Client Certificate in Certificate Chain = %s", i, DERX509Base64UrlEncoded);
            logger.tracef(":: certs[%d] DER Dump Bytes of first x509 Client Certificate TBScertificate in Certificate Chain = %d", i, certs[i].getTBSCertificate().length);
            logger.tracef(":: certs[%d] Signature Algorithm of first x509 Client Certificate in Certificate Chain = %s", i, certs[i].getSigAlgName());
            logger.tracef(":: certs[%d] Certfication Type of first x509 Client Certificate in Certificate Chain = %s", i, certs[i].getType());
            logger.tracef(":: certs[%d] Issuer DN of first x509 Client Certificate in Certificate Chain = %s", i, certs[i].getIssuerDN().getName());
            logger.tracef(":: certs[%d] Subject DN of first x509 Client Certificate in Certificate Chain = %s", i, certs[i].getSubjectDN().getName());
        }
    }

getCertificateChain()

static X509Certificate [] org.keycloak.services.util.MtlsHoKTokenUtil.getCertificateChain ( HttpRequest  request, KeycloakSession  session  )

inlinestaticprivate

                                                                                                       {
        try {
               // Get a x509 client certificate
            X509ClientCertificateLookup provider = session.getProvider(X509ClientCertificateLookup.class);
            if (provider == null) {
                logger.errorv("\"{0}\" Spi is not available, did you forget to update the configuration?", X509ClientCertificateLookup.class);
            return null;
            }
            X509Certificate[] certs = provider.getCertificateChain(request);
            return certs;
        } catch (GeneralSecurityException e) {
            logger.error(e.getMessage(), e);
        }
        return null;
    }

getCertificateThumbprintInSHA256DERX509Base64UrlEncoded()

static String org.keycloak.services.util.MtlsHoKTokenUtil.getCertificateThumbprintInSHA256DERX509Base64UrlEncoded ( X509Certificate  cert ) throws NoSuchAlgorithmException, CertificateEncodingException

inlinestaticprivate

                                                                                                                                                                       {
        // need to calculate over DER encoding of the X.509 certificate
        //   https://tools.ietf.org/html/draft-ietf-oauth-mtls-08#section-3.1
        // in order to do that, call getEncoded()
        //   https://docs.oracle.com/javase/8/docs/api/java/security/cert/Certificate.html#getEncoded--
        byte[] DERX509Hash = cert.getEncoded();
        MessageDigest md = MessageDigest.getInstance(DIGEST_ALG);
        md.update(DERX509Hash);
        String DERX509Base64UrlEncoded = Base64Url.encode(md.digest());
        return DERX509Base64UrlEncoded;
    }

verifyTokenBindingWithClientCertificate()

static boolean org.keycloak.services.util.MtlsHoKTokenUtil.verifyTokenBindingWithClientCertificate ( AccessToken  token, HttpRequest  request, KeycloakSession  session  )

inlinestatic

                                                                                                                                   {
        if (token == null) {
            logger.warnf("token is null");
            return false;
        }

        // Bearer Token, not MTLS HoK Token
        if (token.getCertConf() == null) {
            logger.warnf("bearer token received instead of hok token.");
            return false;
        }

        X509Certificate[] certs = getCertificateChain(request, session);

        // HoK Token, but no Client Certificate available
        if (certs == null || certs.length < 1) {
            logger.warnf("missing client certificate.");
            return false;
        }

        String DERX509Base64UrlEncoded = null;
        String x5ts256 = token.getCertConf().getCertThumbprint();
        logger.tracef("hok token cnf-x5t#s256 = %s", x5ts256);

        try {
            // On Certificate Chain, first entry is considered to be client certificate.
            DERX509Base64UrlEncoded = getCertificateThumbprintInSHA256DERX509Base64UrlEncoded(certs[0]);
            if (logger.isTraceEnabled()) dumpCertInfo(certs);
        } catch (NoSuchAlgorithmException | CertificateEncodingException e) {
            logger.warnf("client certificate exception. %s", e);
            return false;
        }

        if (!MessageDigest.isEqual(x5ts256.getBytes(), DERX509Base64UrlEncoded.getBytes())) {
            logger.warnf("certificate's thumbprint and one in the refresh token did not match.");
            return false;
        }

        return true;
    }

メンバ詳解

CERT_VERIFY_ERROR_DESC

final String org.keycloak.services.util.MtlsHoKTokenUtil.CERT_VERIFY_ERROR_DESC = "Client certificate missing, or its thumbprint and one in the refresh token did NOT match"

static

DIGEST_ALG

final String org.keycloak.services.util.MtlsHoKTokenUtil.DIGEST_ALG = "SHA-256"

staticprivate

logger

final Logger org.keycloak.services.util.MtlsHoKTokenUtil.logger = Logger.getLogger(MtlsHoKTokenUtil.class)

staticprotected

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/rest-service/src/services/src/main/java/org/keycloak/services/util/MtlsHoKTokenUtil.java