org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestObjectParser クラス

org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestObjectParser の継承関係図

org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestObjectParser 連携図

クラス
class	TypedHashMap

公開メンバ関数
	AuthzEndpointRequestObjectParser (KeycloakSession session, String requestObject, ClientModel client) throws Exception
void	parseRequest (AuthorizationEndpointRequest request)

静的公開変数類
static final int	ADDITIONAL_REQ_PARAMS_MAX_MUMBER = 5
static final int	ADDITIONAL_REQ_PARAMS_MAX_SIZE = 200

限定公開メンバ関数
String	getParameter (String paramName)
Integer	getIntParameter (String paramName)
Set< String >	keySet ()
void	extractAdditionalReqParams (Map< String, String > additionalReqParams)

関数
protected< T > T	replaceIfNotNull (T previousVal, T newVal)

静的関数
	[static initializer]

非公開変数類
final JsonNode	requestParams

詳解

Parse the parameters from OIDC "request" object

著者

Marek Posolda

構築子と解体子

AuthzEndpointRequestObjectParser()

org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestObjectParser.AuthzEndpointRequestObjectParser ( KeycloakSession  session, String  requestObject, ClientModel  client  ) throws Exception

inline

                                                                                                                                {
        JWSInput input = new JWSInput(requestObject);
        JWSHeader header = input.getHeader();

        Algorithm requestedSignatureAlgorithm = OIDCAdvancedConfigWrapper.fromClientModel(client).getRequestObjectSignatureAlg();

        if (requestedSignatureAlgorithm != null && requestedSignatureAlgorithm != header.getAlgorithm()) {
            throw new RuntimeException("Request object signed with different algorithm than client requested algorithm");
        }

        if (header.getAlgorithm() == Algorithm.none) {
            this.requestParams = JsonSerialization.readValue(input.getContent(), JsonNode.class);
        } else if (header.getAlgorithm() == Algorithm.RS256) {
            PublicKey clientPublicKey = PublicKeyStorageManager.getClientPublicKey(session, client, input);
            if (clientPublicKey == null) {
                throw new RuntimeException("Client public key not found");
            }

            boolean verified = RSAProvider.verify(input, clientPublicKey);
            if (!verified) {
                throw new RuntimeException("Failed to verify signature on 'request' object");
            }

            this.requestParams = JsonSerialization.readValue(input.getContent(), JsonNode.class);
        } else {
            throw new RuntimeException("Unsupported JWA algorithm used for signed request");
        }
    }

関数詳解

[static initializer]()

org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestParser.[static initializer] ( )

inlinestaticpackageinherited

extractAdditionalReqParams()

void org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestParser.extractAdditionalReqParams ( Map< String, String >  additionalReqParams )

inlineprotectedinherited

                                                                                       {
        for (String paramName : keySet()) {
            if (!KNOWN_REQ_PARAMS.contains(paramName)) {
                String value = getParameter(paramName);
                if (value != null && value.trim().isEmpty()) {
                    value = null;
                }
                if (value != null && value.length() <= ADDITIONAL_REQ_PARAMS_MAX_SIZE) {
                    if (additionalReqParams.size() >= ADDITIONAL_REQ_PARAMS_MAX_MUMBER) {
                        logger.debug("Maximal number of additional OIDC params (" + ADDITIONAL_REQ_PARAMS_MAX_MUMBER + ") exceeded, ignoring rest of them!");
                        break;
                    }
                    additionalReqParams.put(paramName, value);
                } else {
                    logger.debug("OIDC Additional param " + paramName + " ignored because value is empty or longer than " + ADDITIONAL_REQ_PARAMS_MAX_SIZE);
                }
            }

        }
    }

getIntParameter()

Integer org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestObjectParser.getIntParameter ( String  paramName )

inlineprotected

                                                        {
        Object val = this.requestParams.get(paramName);
        return val==null ? null : Integer.parseInt(getParameter(paramName));
    }

getParameter()

String org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestObjectParser.getParameter ( String  paramName )

inlineprotected

                                                    {
        JsonNode val = this.requestParams.get(paramName);
        if (val == null) {
            return null;
        } else if (val.isValueNode()) {
            return val.asText();
        } else {
            return val.toString();
        }
    }

keySet()

Set<String> org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestObjectParser.keySet ( )

inlineprotected

                                   {
        HashSet<String> keys = new HashSet<>();
        requestParams.fieldNames().forEachRemaining(keys::add);
        return keys;
    }

parseRequest()

void org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestParser.parseRequest ( AuthorizationEndpointRequest  request )

inlineinherited

                                                                   {
        String clientId = getParameter(OIDCLoginProtocol.CLIENT_ID_PARAM);

        if (request.clientId != null && !request.clientId.equals(clientId)) {
            throw new IllegalArgumentException("The client_id parameter doesn't match the one from OIDC 'request' or 'request_uri'");
        }

        request.clientId = clientId;
        request.responseType = replaceIfNotNull(request.responseType, getParameter(OIDCLoginProtocol.RESPONSE_TYPE_PARAM));
        request.responseMode = replaceIfNotNull(request.responseMode, getParameter(OIDCLoginProtocol.RESPONSE_MODE_PARAM));
        request.redirectUriParam = replaceIfNotNull(request.redirectUriParam, getParameter(OIDCLoginProtocol.REDIRECT_URI_PARAM));
        request.state = replaceIfNotNull(request.state, getParameter(OIDCLoginProtocol.STATE_PARAM));
        request.scope = replaceIfNotNull(request.scope, getParameter(OIDCLoginProtocol.SCOPE_PARAM));
        request.loginHint = replaceIfNotNull(request.loginHint, getParameter(OIDCLoginProtocol.LOGIN_HINT_PARAM));
        request.prompt = replaceIfNotNull(request.prompt, getParameter(OIDCLoginProtocol.PROMPT_PARAM));
        request.idpHint = replaceIfNotNull(request.idpHint, getParameter(AdapterConstants.KC_IDP_HINT));
        request.nonce = replaceIfNotNull(request.nonce, getParameter(OIDCLoginProtocol.NONCE_PARAM));
        request.maxAge = replaceIfNotNull(request.maxAge, getIntParameter(OIDCLoginProtocol.MAX_AGE_PARAM));
        request.claims = replaceIfNotNull(request.claims, getParameter(OIDCLoginProtocol.CLAIMS_PARAM));
        request.acr = replaceIfNotNull(request.acr, getParameter(OIDCLoginProtocol.ACR_PARAM));
        request.display = replaceIfNotNull(request.display, getParameter(OAuth2Constants.DISPLAY));

        // https://tools.ietf.org/html/rfc7636#section-6.1
        request.codeChallenge = replaceIfNotNull(request.codeChallenge, getParameter(OIDCLoginProtocol.CODE_CHALLENGE_PARAM));
        request.codeChallengeMethod = replaceIfNotNull(request.codeChallengeMethod, getParameter(OIDCLoginProtocol.CODE_CHALLENGE_METHOD_PARAM));

        extractAdditionalReqParams(request.additionalReqParams);
    }

replaceIfNotNull()

protected<T> T org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestParser.replaceIfNotNull ( T  previousVal, T  newVal  )

inlinepackageinherited

                                                              {
        return newVal==null ? previousVal : newVal;
    }

メンバ詳解

ADDITIONAL_REQ_PARAMS_MAX_MUMBER

final int org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestParser.ADDITIONAL_REQ_PARAMS_MAX_MUMBER = 5

staticinherited

Max number of additional req params copied into client session note to prevent DoS attacks

ADDITIONAL_REQ_PARAMS_MAX_SIZE

final int org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestParser.ADDITIONAL_REQ_PARAMS_MAX_SIZE = 200

staticinherited

Max size of additional req param value copied into client session note to prevent DoS attacks - params with longer value are ignored

requestParams

final JsonNode org.keycloak.protocol.oidc.endpoints.request.AuthzEndpointRequestObjectParser.requestParams

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/rest-service/src/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthzEndpointRequestObjectParser.java