118 UserSessionModel userSession = null;
119 boolean offline = TokenUtil.TOKEN_TYPE_OFFLINE.equals(oldToken.getType());
123 UserSessionManager sessionManager =
new UserSessionManager(session);
124 userSession = sessionManager.findOfflineUserSession(realm, oldToken.getSessionState());
125 if (userSession != null) {
128 if (!AuthenticationManager.isOfflineSessionValid(realm, userSession)) {
129 sessionManager.revokeOfflineUserSession(userSession);
130 throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT,
"Offline session not active",
"Offline session not active");
134 throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT,
"Offline user session not found",
"Offline user session not found");
138 userSession = session.sessions().getUserSession(realm, oldToken.getSessionState());
139 if (!AuthenticationManager.isSessionValid(realm, userSession)) {
140 AuthenticationManager.backchannelLogout(session, realm, userSession, uriInfo, connection, headers,
true);
141 throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT,
"Session not active",
"Session not active");
145 UserModel user = userSession.getUser();
147 throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT,
"Invalid refresh token",
"Unknown user");
150 if (!user.isEnabled()) {
151 throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT,
"User disabled",
"User disabled");
154 ClientModel client = session.getContext().getClient();
155 AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
158 if (clientSession == null) {
159 userSession =
new UserSessionCrossDCManager(session).getUserSessionWithClient(realm, userSession.getId(), offline, client.getId());
160 if (userSession != null) {
161 clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
163 throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT,
"Session doesn't have required client",
"Session doesn't have required client");
167 if (!client.getClientId().equals(oldToken.getIssuedFor())) {
168 throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT,
"Unmatching clients",
"Unmatching clients");
171 if (oldToken.getIssuedAt() < client.getNotBefore()) {
172 throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT,
"Stale token");
174 if (oldToken.getIssuedAt() < realm.getNotBefore()) {
175 throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT,
"Stale token");
177 if (oldToken.getIssuedAt() < session.users().getNotBeforeOfUser(realm, user)) {
178 throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT,
"Stale token");
183 String oldTokenScope = oldToken.getScope();
186 if (oldTokenScope == null && userSession.isOffline()) {
187 logger.debugf(
"Migrating offline token of user '%s' for client '%s' of realm '%s'", user.getUsername(), client.getClientId(), realm.getName());
188 MigrationUtils.migrateOldOfflineToken(session, realm, client, user);
191 ClientSessionContext clientSessionCtx = DefaultClientSessionContext.fromClientSessionAndScopeParameter(clientSession, oldTokenScope);
195 throw new OAuthErrorException(OAuthErrorException.INVALID_SCOPE,
"Client no longer has requested consent from user");
202 return new TokenValidation(user, userSession, clientSessionCtx, newToken);
static boolean verifyConsentStillAvailable(KeycloakSession session, UserModel user, ClientModel client, Set< ClientScopeModel > requestedClientScopes)
Definition: TokenManager.java:549
static final Logger logger
Definition: TokenManager.java:85
void verifyAccess(AccessToken token, AccessToken newToken)
Definition: TokenManager.java:572
AccessToken createClientAccessToken(KeycloakSession session, RealmModel realm, ClientModel client, UserModel user, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
Definition: TokenManager.java:415