keycloak-service
静的公開メンバ関数 | 静的非公開メンバ関数 | 全メンバ一覧
org.keycloak.services.clientregistration.oidc.DescriptionConverter クラス
org.keycloak.services.clientregistration.oidc.DescriptionConverter 連携図
Collaboration graph

静的公開メンバ関数

static ClientRepresentation toInternal (KeycloakSession session, OIDCClientRepresentation clientOIDC) throws ClientRegistrationException
 
static OIDCClientRepresentation toExternalResponse (KeycloakSession session, ClientRepresentation client, URI uri)
 

静的非公開メンバ関数

static boolean setPublicKey (OIDCClientRepresentation clientOIDC, ClientRepresentation clientRep)
 
static List< String > getOIDCResponseTypes (ClientRepresentation client)
 
static List< String > getOIDCGrantTypes (ClientRepresentation client)
 

詳解

著者
Stian Thorgersen

関数詳解

◆ getOIDCGrantTypes()

static List<String> org.keycloak.services.clientregistration.oidc.DescriptionConverter.getOIDCGrantTypes ( ClientRepresentation  client)
inlinestaticprivate
242  {
243  List<String> grantTypes = new ArrayList<>();
244  if (client.isStandardFlowEnabled()) {
245  grantTypes.add(OAuth2Constants.AUTHORIZATION_CODE);
246  }
247  if (client.isImplicitFlowEnabled()) {
248  grantTypes.add(OAuth2Constants.IMPLICIT);
249  }
250  if (client.isDirectAccessGrantsEnabled()) {
251  grantTypes.add(OAuth2Constants.PASSWORD);
252  }
253  if (client.isServiceAccountsEnabled()) {
254  grantTypes.add(OAuth2Constants.CLIENT_CREDENTIALS);
255  }
256  if (client.getAuthorizationServicesEnabled() != null && client.getAuthorizationServicesEnabled()) {
257  grantTypes.add(OAuth2Constants.UMA_GRANT_TYPE);
258  }
259  grantTypes.add(OAuth2Constants.REFRESH_TOKEN);
260  return grantTypes;
261  }

◆ getOIDCResponseTypes()

static List<String> org.keycloak.services.clientregistration.oidc.DescriptionConverter.getOIDCResponseTypes ( ClientRepresentation  client)
inlinestaticprivate
224  {
225  List<String> responseTypes = new ArrayList<>();
226  if (client.isStandardFlowEnabled()) {
227  responseTypes.add(OAuth2Constants.CODE);
228  responseTypes.add(OIDCResponseType.NONE);
229  }
230  if (client.isImplicitFlowEnabled()) {
231  responseTypes.add(OIDCResponseType.ID_TOKEN);
232  responseTypes.add("id_token token");
233  }
234  if (client.isStandardFlowEnabled() && client.isImplicitFlowEnabled()) {
235  responseTypes.add("code id_token");
236  responseTypes.add("code token");
237  responseTypes.add("code id_token token");
238  }
239  return responseTypes;
240  }

◆ setPublicKey()

static boolean org.keycloak.services.clientregistration.oidc.DescriptionConverter.setPublicKey ( OIDCClientRepresentation  clientOIDC,
ClientRepresentation  clientRep 
)
inlinestaticprivate
132  {
133  if (clientOIDC.getJwksUri() == null && clientOIDC.getJwks() == null) {
134  return false;
135  }
136 
137  if (clientOIDC.getJwksUri() != null && clientOIDC.getJwks() != null) {
138  throw new ClientRegistrationException("Illegal to use both jwks_uri and jwks");
139  }
140 
141  OIDCAdvancedConfigWrapper configWrapper = OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep);
142 
143  if (clientOIDC.getJwks() != null) {
144  JSONWebKeySet keySet = clientOIDC.getJwks();
145  JWK publicKeyJWk = JWKSUtils.getKeyForUse(keySet, JWK.Use.SIG);
146  if (publicKeyJWk == null) {
147  return false;
148  } else {
149  PublicKey publicKey = JWKParser.create(publicKeyJWk).toPublicKey();
150  String publicKeyPem = KeycloakModelUtils.getPemFromKey(publicKey);
151  CertificateRepresentation rep = new CertificateRepresentation();
152  rep.setPublicKey(publicKeyPem);
153  rep.setKid(publicKeyJWk.getKeyId());
154  CertificateInfoHelper.updateClientRepresentationCertificateInfo(clientRep, rep, JWTClientAuthenticator.ATTR_PREFIX);
155 
156  configWrapper.setUseJwksUrl(false);
157 
158  return true;
159  }
160  } else {
161  configWrapper.setUseJwksUrl(true);
162  configWrapper.setJwksUrl(clientOIDC.getJwksUri());
163  return true;
164  }
165  }

◆ toExternalResponse()

static OIDCClientRepresentation org.keycloak.services.clientregistration.oidc.DescriptionConverter.toExternalResponse ( KeycloakSession  session,
ClientRepresentation  client,
URI  uri 
)
inlinestatic
168  {
169  OIDCClientRepresentation response = new OIDCClientRepresentation();
170  response.setClientId(client.getClientId());
171 
172  ClientAuthenticatorFactory clientAuth = (ClientAuthenticatorFactory) session.getKeycloakSessionFactory().getProviderFactory(ClientAuthenticator.class, client.getClientAuthenticatorType());
173  Set<String> oidcClientAuthMethods = clientAuth.getProtocolAuthenticatorMethods(OIDCLoginProtocol.LOGIN_PROTOCOL);
174  if (oidcClientAuthMethods != null && !oidcClientAuthMethods.isEmpty()) {
175  response.setTokenEndpointAuthMethod(oidcClientAuthMethods.iterator().next());
176  }
177 
178  if (client.getClientAuthenticatorType().equals(ClientIdAndSecretAuthenticator.PROVIDER_ID)) {
179  response.setClientSecret(client.getSecret());
180  response.setClientSecretExpiresAt(0);
181  }
182 
183  response.setClientName(client.getName());
184  response.setClientUri(client.getBaseUrl());
185  response.setRedirectUris(client.getRedirectUris());
186  response.setRegistrationAccessToken(client.getRegistrationAccessToken());
187  response.setRegistrationClientUri(uri.toString());
188  response.setResponseTypes(getOIDCResponseTypes(client));
189  response.setGrantTypes(getOIDCGrantTypes(client));
190 
191  OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientRepresentation(client);
192  if (config.isUserInfoSignatureRequired()) {
193  response.setUserinfoSignedResponseAlg(config.getUserInfoSignedResponseAlg().toString());
194  }
195  if (config.getRequestObjectSignatureAlg() != null) {
196  response.setRequestObjectSigningAlg(config.getRequestObjectSignatureAlg().toString());
197  }
198  if (config.isUseJwksUrl()) {
199  response.setJwksUri(config.getJwksUrl());
200  }
201  // KEYCLOAK-6771 Certificate Bound Token
202  // https://tools.ietf.org/html/draft-ietf-oauth-mtls-08#section-6.5
203  if (config.isUseMtlsHokToken()) {
204  response.setTlsClientCertificateBoundAccessTokens(Boolean.TRUE);
205  } else {
206  response.setTlsClientCertificateBoundAccessTokens(Boolean.FALSE);
207  }
208  if (config.getIdTokenSignedResponseAlg() != null) {
209  response.setIdTokenSignedResponseAlg(config.getIdTokenSignedResponseAlg());
210  }
211 
212  List<ProtocolMapperRepresentation> foundPairwiseMappers = PairwiseSubMapperUtils.getPairwiseSubMappers(client);
213  SubjectType subjectType = foundPairwiseMappers.isEmpty() ? SubjectType.PUBLIC : SubjectType.PAIRWISE;
214  response.setSubjectType(subjectType.toString().toLowerCase());
215  if (subjectType.equals(SubjectType.PAIRWISE)) {
216  // Get sectorIdentifier from 1st found
217  String sectorIdentifierUri = PairwiseSubMapperHelper.getSectorIdentifierUri(foundPairwiseMappers.get(0));
218  response.setSectorIdentifierUri(sectorIdentifierUri);
219  }
220 
221  return response;
222  }
org.keycloak.services.clientregistration.oidc.DescriptionConverter.getOIDCResponseTypes
static List< String > getOIDCResponseTypes(ClientRepresentation client)
Definition: DescriptionConverter.java:224
org.keycloak.services.clientregistration.oidc.DescriptionConverter.getOIDCGrantTypes
static List< String > getOIDCGrantTypes(ClientRepresentation client)
Definition: DescriptionConverter.java:242

◆ toInternal()

static ClientRepresentation org.keycloak.services.clientregistration.oidc.DescriptionConverter.toInternal ( KeycloakSession  session,
OIDCClientRepresentation  clientOIDC 
) throws ClientRegistrationException
inlinestatic
58  {
59  ClientRepresentation client = new ClientRepresentation();
60 
61  client.setClientId(clientOIDC.getClientId());
62  client.setName(clientOIDC.getClientName());
63  client.setRedirectUris(clientOIDC.getRedirectUris());
64  client.setBaseUrl(clientOIDC.getClientUri());
65 
66  List<String> oidcResponseTypes = clientOIDC.getResponseTypes();
67  if (oidcResponseTypes == null || oidcResponseTypes.isEmpty()) {
68  oidcResponseTypes = Collections.singletonList(OIDCResponseType.CODE);
69  }
70  List<String> oidcGrantTypes = clientOIDC.getGrantTypes();
71 
72  try {
73  OIDCResponseType responseType = OIDCResponseType.parse(oidcResponseTypes);
74  client.setStandardFlowEnabled(responseType.hasResponseType(OIDCResponseType.CODE));
75  client.setImplicitFlowEnabled(responseType.isImplicitOrHybridFlow());
76 
77  client.setPublicClient(responseType.isImplicitFlow());
78 
79  if (oidcGrantTypes != null) {
80  client.setDirectAccessGrantsEnabled(oidcGrantTypes.contains(OAuth2Constants.PASSWORD));
81  client.setServiceAccountsEnabled(oidcGrantTypes.contains(OAuth2Constants.CLIENT_CREDENTIALS));
82  }
83  } catch (IllegalArgumentException iae) {
84  throw new ClientRegistrationException(iae.getMessage(), iae);
85  }
86 
87  String authMethod = clientOIDC.getTokenEndpointAuthMethod();
88  ClientAuthenticatorFactory clientAuthFactory;
89  if (authMethod == null) {
90  clientAuthFactory = (ClientAuthenticatorFactory) session.getKeycloakSessionFactory().getProviderFactory(ClientAuthenticator.class, KeycloakModelUtils.getDefaultClientAuthenticatorType());
91  } else {
92  clientAuthFactory = AuthorizeClientUtil.findClientAuthenticatorForOIDCAuthMethod(session, authMethod);
93  }
94 
95  if (clientAuthFactory == null) {
96  throw new ClientRegistrationException("Not found clientAuthenticator for requested token_endpoint_auth_method");
97  }
98  client.setClientAuthenticatorType(clientAuthFactory.getId());
99 
100  boolean publicKeySet = setPublicKey(clientOIDC, client);
101  if (authMethod != null && authMethod.equals(OIDCLoginProtocol.PRIVATE_KEY_JWT) && !publicKeySet) {
102  throw new ClientRegistrationException("Didn't find key of supported keyType for use " + JWK.Use.SIG.asString());
103  }
104 
105  OIDCAdvancedConfigWrapper configWrapper = OIDCAdvancedConfigWrapper.fromClientRepresentation(client);
106  if (clientOIDC.getUserinfoSignedResponseAlg() != null) {
107  Algorithm algorithm = Enum.valueOf(Algorithm.class, clientOIDC.getUserinfoSignedResponseAlg());
108  configWrapper.setUserInfoSignedResponseAlg(algorithm);
109  }
110 
111  if (clientOIDC.getRequestObjectSigningAlg() != null) {
112  Algorithm algorithm = Enum.valueOf(Algorithm.class, clientOIDC.getRequestObjectSigningAlg());
113  configWrapper.setRequestObjectSignatureAlg(algorithm);
114  }
115 
116  // KEYCLOAK-6771 Certificate Bound Token
117  // https://tools.ietf.org/html/draft-ietf-oauth-mtls-08#section-6.5
118  Boolean tlsClientCertificateBoundAccessTokens = clientOIDC.getTlsClientCertificateBoundAccessTokens();
119  if (tlsClientCertificateBoundAccessTokens != null) {
120  if (tlsClientCertificateBoundAccessTokens.booleanValue()) configWrapper.setUseMtlsHoKToken(true);
121  else configWrapper.setUseMtlsHoKToken(false);
122  }
123 
124  if (clientOIDC.getIdTokenSignedResponseAlg() != null) {
125  configWrapper.setIdTokenSignedResponseAlg(clientOIDC.getIdTokenSignedResponseAlg());
126  }
127 
128  return client;
129  }
org.keycloak.services.clientregistration.oidc.DescriptionConverter.setPublicKey
static boolean setPublicKey(OIDCClientRepresentation clientOIDC, ClientRepresentation clientRep)
Definition: DescriptionConverter.java:132
このクラス詳解は次のファイルから抽出されました:
2018年11月18日(日) 14時00分26秒作成 - keycloak-service / 構成:   doxygen 1.8.13