org.keycloak.services.resources.LoginActionsServiceChecks クラス

org.keycloak.services.resources.LoginActionsServiceChecks 連携図

クラス
class	AuthenticationSessionUserIdMatchesOneFromToken
class	IsActionRequired
class	IsRedirectValid

静的公開メンバ関数
static< T extends JsonWebToken > void	checkNotLoggedInYet (ActionTokenContext< T > context, String authSessionId) throws VerificationException
static void	checkIsUserValid (KeycloakSession session, RealmModel realm, String userId, Consumer< UserModel > userSetter) throws VerificationException
static< T extends JsonWebToken &ActionTokenKeyModel > void	checkIsUserValid (T token, ActionTokenContext< T > context) throws VerificationException
static void	checkIsClientValid (KeycloakSession session, ClientModel client) throws VerificationException
static< T extends JsonWebToken > void	checkIsClientValid (T token, ActionTokenContext< T > context) throws VerificationException
static< T extends JsonWebToken > boolean	doesAuthenticationSessionFromCookieMatchOneFromToken (ActionTokenContext< T > context, AuthenticationSessionModel authSessionFromCookie, String authSessionCompoundIdFromToken) throws VerificationException
static< T extends JsonWebToken &ActionTokenKeyModel > void	checkTokenWasNotUsedYet (T token, ActionTokenContext< T > context) throws VerificationException

静的非公開変数類
static final Logger	LOG = Logger.getLogger(LoginActionsServiceChecks.class.getName())

詳解

著者

hmlnarik

関数詳解

checkIsClientValid() [1/2]

static void org.keycloak.services.resources.LoginActionsServiceChecks.checkIsClientValid ( KeycloakSession  session, ClientModel  client  ) throws VerificationException

inlinestatic

Verifies whether the client denoted by client ID in token's

iss 

(

issuedFor 

) field both exists and is enabled.

                                                                                                                    {
        if (client == null) {
            throw new ExplainedVerificationException(Errors.CLIENT_NOT_FOUND, Messages.UNKNOWN_LOGIN_REQUESTER);
        }

        if (! client.isEnabled()) {
            throw new ExplainedVerificationException(Errors.CLIENT_NOT_FOUND, Messages.LOGIN_REQUESTER_NOT_ENABLED);
        }
    }

checkIsClientValid() [2/2]

static <T extends JsonWebToken> void org.keycloak.services.resources.LoginActionsServiceChecks.checkIsClientValid ( T  token, ActionTokenContext< T >  context  ) throws VerificationException

inlinestatic

Verifies whether the client denoted by client ID in token's

iss 

(

issuedFor 

) field both exists and is enabled.

                                                                                                                                        {
        String clientId = token.getIssuedFor();
        AuthenticationSessionModel authSession = context.getAuthenticationSession();
        ClientModel client = authSession == null ? null : authSession.getClient();

        try {
            checkIsClientValid(context.getSession(), client);

            if (clientId != null && ! Objects.equals(client.getClientId(), clientId)) {
                throw new ExplainedTokenVerificationException(token, Errors.CLIENT_NOT_FOUND, Messages.UNKNOWN_LOGIN_REQUESTER);
            }
        } catch (ExplainedVerificationException ex) {
            throw new ExplainedTokenVerificationException(token, ex);
        }
    }

checkIsUserValid() [1/2]

static void org.keycloak.services.resources.LoginActionsServiceChecks.checkIsUserValid ( KeycloakSession  session, RealmModel  realm, String  userId, Consumer< UserModel >  userSetter  ) throws VerificationException

inlinestatic

Verifies whether the user given by ID both exists in the current realm. If yes, it optionally also injects the user using the given function (e.g. into session context).

                                                                                                                                                               {
        UserModel user = userId == null ? null : session.users().getUserById(userId, realm);

        if (user == null) {
            throw new ExplainedVerificationException(Errors.USER_NOT_FOUND, Messages.INVALID_USER);
        }

        if (! user.isEnabled()) {
            throw new ExplainedVerificationException(Errors.USER_DISABLED, Messages.INVALID_USER);
        }

        if (userSetter != null) {
            userSetter.accept(user);
        }
    }

checkIsUserValid() [2/2]

static <T extends JsonWebToken & ActionTokenKeyModel> void org.keycloak.services.resources.LoginActionsServiceChecks.checkIsUserValid ( T  token, ActionTokenContext< T >  context  ) throws VerificationException

inlinestatic

Verifies whether the user given by ID both exists in the current realm. If yes, it optionally also injects the user using the given function (e.g. into session context).

                                                                                                                                                            {
        try {
            checkIsUserValid(context.getSession(), context.getRealm(), token.getUserId(), context.getAuthenticationSession()::setAuthenticatedUser);
        } catch (ExplainedVerificationException ex) {
            throw new ExplainedTokenVerificationException(token, ex);
        }
    }

checkNotLoggedInYet()

static <T extends JsonWebToken> void org.keycloak.services.resources.LoginActionsServiceChecks.checkNotLoggedInYet ( ActionTokenContext< T >  context, String  authSessionId  ) throws VerificationException

inlinestatic

Verifies that the authentication session has not yet been converted to user session, in other words that the user has not yet completed authentication and logged in.

                                                                                                                                                      {
        if (authSessionId == null) {
            return;
        }

        UserSessionModel userSession = context.getSession().sessions().getUserSession(context.getRealm(), authSessionId);
        if (userSession != null && userSession.getUser().getRequiredActions().isEmpty()) {
            LoginFormsProvider loginForm = context.getSession().getProvider(LoginFormsProvider.class).setAuthenticationSession(context.getAuthenticationSession())
              .setSuccess(Messages.ALREADY_LOGGED_IN);

            if (context.getSession().getContext().getClient() == null) {
                loginForm.setAttribute(Constants.SKIP_LINK, true);
            }

            throw new LoginActionsServiceException(loginForm.createInfoPage());
        }
    }

checkTokenWasNotUsedYet()

static <T extends JsonWebToken & ActionTokenKeyModel> void org.keycloak.services.resources.LoginActionsServiceChecks.checkTokenWasNotUsedYet ( T  token, ActionTokenContext< T >  context  ) throws VerificationException

inlinestatic

                                                                                                                                                                   {
        ActionTokenStoreProvider actionTokenStore = context.getSession().getProvider(ActionTokenStoreProvider.class);

        if (actionTokenStore.get(token) != null) {
            throw new ExplainedTokenVerificationException(token, Errors.EXPIRED_CODE, Messages.EXPIRED_ACTION);
        }
    }

doesAuthenticationSessionFromCookieMatchOneFromToken()

static <T extends JsonWebToken> boolean org.keycloak.services.resources.LoginActionsServiceChecks.doesAuthenticationSessionFromCookieMatchOneFromToken ( ActionTokenContext< T >  context, AuthenticationSessionModel  authSessionFromCookie, String  authSessionCompoundIdFromToken  ) throws VerificationException

inlinestatic

This check verifies that current authentication session is consistent with the one specified in token. Examples:

• 1. Email from administrator with reset e-mail - token does not contain auth session ID
• 2. Email from "verify e-mail" step within flow - token contains auth session ID.
• 3. User clicked the link in an e-mail and gets to a new browser - authentication session cookie is not set
• 4. User clicked the link in an e-mail while having authentication running - authentication session cookie is already set in the browser

• For combinations 1 and 3, 1 and 4, and 2 and 3: Requests next step
• For combination 2 and 4:
  • If the auth session IDs from token and cookie match, pass
  • Else if the auth session from cookie was forked and its parent auth session ID matches that of token, replaces current auth session with that of parent and passes
  • Else requests restart by throwing RestartFlow exception

When the check passes, it also sets the authentication session in token context accordingly.

引数

<T>

                                                                                                                                                                 {
        if (authSessionCompoundIdFromToken == null) {
            return false;
        }


        if (Objects.equals(AuthenticationSessionCompoundId.fromAuthSession(authSessionFromCookie).getEncodedId(), authSessionCompoundIdFromToken)) {
            context.setAuthenticationSession(authSessionFromCookie, false);
            return true;
        }

        // Check if it's forked session. It would have same parent (rootSession) as our browser authenticationSession
        String parentTabId = authSessionFromCookie.getAuthNote(AuthenticationProcessor.FORKED_FROM);
        if (parentTabId == null) {
            return false;
        }


        AuthenticationSessionModel authSessionFromParent = authSessionFromCookie.getParentSession().getAuthenticationSession(authSessionFromCookie.getClient(), parentTabId);
        if (authSessionFromParent == null) {
            return false;
        }

        // It's the correct browser. We won't continue login
        // from the login form (browser flow) but from the token's flow
        // Don't expire KC_RESTART cookie at this point
        LOG.debugf("Switched to forked tab: %s from: %s . Root session: %s", authSessionFromParent.getTabId(), authSessionFromCookie.getTabId(), authSessionFromCookie.getParentSession().getId());

        context.setAuthenticationSession(authSessionFromParent, false);
        context.setExecutionId(authSessionFromParent.getAuthNote(AuthenticationProcessor.LAST_PROCESSED_EXECUTION));

        return true;
    }

メンバ詳解

LOG

final Logger org.keycloak.services.resources.LoginActionsServiceChecks.LOG = Logger.getLogger(LoginActionsServiceChecks.class.getName())

staticprivate

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/rest-service/src/services/src/main/java/org/keycloak/services/resources/LoginActionsServiceChecks.java