mirror/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-05-08 08:01:18 -05:00
Code Issues Packages Projects Releases Wiki Activity

Enhancing Pluggable Features of Token Manager

Browse Source 
closes #21182
This commit is contained in:
Takashi Norimatsu
2023-06-24 11:34:06 +09:00
committed by Marek Posolda
parent 2efd79f982
commit 05b8b9ee51
15 changed files with 270 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java
+6 -1
View File
@@ -1018,6 +1018,8 @@ public class TokenManager {
String stateHash;
private AccessTokenResponse response;
public AccessTokenResponseBuilder(RealmModel realm, ClientModel client, EventBuilder event, KeycloakSession session,
UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
this.realm = realm;
@@ -1152,6 +1154,8 @@ public class TokenManager {
}
public AccessTokenResponse build() {
if (response != null) return response;
if (accessToken != null) {
event.detail(Details.TOKEN_ID, accessToken.getId());
}
@@ -1214,7 +1218,8 @@ public class TokenManager {
res.setScope(responseScope);
event.detail(Details.SCOPE, responseScope);
return res;
response = res;
return response;
}
services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java
+1
View File
@@ -512,6 +512,7 @@ public class LogoutEndpoint {
try {
session.clientPolicy().triggerOnEvent(new LogoutRequestContext(form));
refreshToken = form.getFirst(OAuth2Constants.REFRESH_TOKEN);
} catch (ClientPolicyException cpe) {
throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
}
services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java
+2
View File
@@ -497,6 +497,7 @@ public class TokenEndpoint {
} else {
res = responseBuilder.build();
}
event.success();
return cors.builder(Response.ok(res).type(MediaType.APPLICATION_JSON_TYPE)).build();
@@ -528,6 +529,7 @@ public class TokenEndpoint {
try {
session.clientPolicy().triggerOnEvent(new TokenRefreshContext(formParams));
refreshToken = formParams.getFirst(OAuth2Constants.REFRESH_TOKEN);
} catch (ClientPolicyException cpe) {
event.error(cpe.getError());
throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenIntrospectionEndpoint.java
+3 -2
View File
@@ -46,8 +46,8 @@ import jakarta.ws.rs.core.Response.Status;
*/
public class TokenIntrospectionEndpoint {
private static final String PARAM_TOKEN_TYPE_HINT = "token_type_hint";
private static final String PARAM_TOKEN = "token";
public static final String PARAM_TOKEN_TYPE_HINT = "token_type_hint";
public static final String PARAM_TOKEN = "token";
private final KeycloakSession session;
@@ -100,6 +100,7 @@ public class TokenIntrospectionEndpoint {
try {
session.clientPolicy().triggerOnEvent(new TokenIntrospectContext(formParams));
token = formParams.getFirst(PARAM_TOKEN);
} catch (ClientPolicyException cpe) {
throw throwErrorResponseException(Errors.INVALID_REQUEST, cpe.getErrorDetail(), Status.BAD_REQUEST);
}
services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java
+9 -1
View File
@@ -50,6 +50,7 @@ import org.keycloak.representations.AccessToken;
import org.keycloak.services.CorsErrorResponseException;
import org.keycloak.services.clientpolicy.ClientPolicyException;
import org.keycloak.services.clientpolicy.context.TokenRevokeContext;
import org.keycloak.services.clientpolicy.context.TokenRevokeResponseContext;
import org.keycloak.services.managers.UserSessionCrossDCManager;
import org.keycloak.services.managers.UserSessionManager;
import org.keycloak.services.resources.Cors;
@@ -59,7 +60,7 @@ import org.keycloak.util.TokenUtil;
* @author <a href="mailto:yoshiyuki.tabata.jy@hitachi.com">Yoshiyuki Tabata</a>
*/
public class TokenRevocationEndpoint {
private static final String PARAM_TOKEN = "token";
public static final String PARAM_TOKEN = "token";
private final KeycloakSession session;
@@ -120,6 +121,13 @@ public class TokenRevocationEndpoint {
event.success();
try {
session.clientPolicy().triggerOnEvent(new TokenRevokeResponseContext(formParams));
} catch (ClientPolicyException cpe) {
event.error(cpe.getError());
throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
}
session.getProvider(SecurityHeadersProvider.class).options().allowEmptyContentType();
return cors.builder(Response.ok()).build();
}
services/src/main/java/org/keycloak/protocol/oidc/endpoints/UserInfoEndpoint.java
+19 -6
View File
@@ -100,7 +100,7 @@ public class UserInfoEndpoint {
private final RealmModel realm;
private final OAuth2Error error;
private Cors cors;
private String authorization;
private TokenForUserInfo tokenForUserInfo = new TokenForUserInfo();
public UserInfoEndpoint(KeycloakSession session, org.keycloak.protocol.oidc.TokenManager tokenManager) {
this.session = session;
@@ -163,7 +163,7 @@ public class UserInfoEndpoint {
cors.allowAllOrigins();
try {
session.clientPolicy().triggerOnEvent(new UserInfoRequestContext(authorization));
session.clientPolicy().triggerOnEvent(new UserInfoRequestContext(tokenForUserInfo));
} catch (ClientPolicyException cpe) {
throw error.error(cpe.getError()).errorDescription(cpe.getErrorDetail()).status(cpe.getErrorStatus()).build();
}
@@ -172,7 +172,7 @@ public class UserInfoEndpoint {
.event(EventType.USER_INFO_REQUEST)
.detail(Details.AUTH_METHOD, Details.VALIDATE_ACCESS_TOKEN);
if (authorization == null) {
if (tokenForUserInfo.getToken() == null) {
event.error(Errors.INVALID_TOKEN);
throw error.unauthorized();
}
@@ -180,7 +180,7 @@ public class UserInfoEndpoint {
AccessToken token;
ClientModel clientModel = null;
try {
TokenVerifier<AccessToken> verifier = TokenVerifier.create(authorization, AccessToken.class).withDefaultChecks()
TokenVerifier<AccessToken> verifier = TokenVerifier.create(tokenForUserInfo.getToken(), AccessToken.class).withDefaultChecks()
.realmUrl(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
SignatureVerifierContext verifierContext = session.getProvider(SignatureProvider.class, verifier.getHeader().getAlgorithm().name()).verifier(verifier.getHeader().getKeyId());
@@ -417,11 +417,24 @@ public class UserInfoEndpoint {
private void authorization(String accessToken) {
if (accessToken != null) {
if (authorization == null) {
authorization = accessToken;
if (tokenForUserInfo.getToken() == null) {
tokenForUserInfo.setToken(accessToken);
} else {
throw error.cors(cors.allowAllOrigins()).invalidRequest("More than one method used for including an access token");
}
}
}
public static class TokenForUserInfo {
private String token;
public String getToken() {
return token;
}
public void setToken(String token) {
this.token = token;
}
}
}
services/src/main/java/org/keycloak/services/clientpolicy/context/LogoutRequestContext.java
-1
View File
@@ -17,7 +17,6 @@
package org.keycloak.services.clientpolicy.context;
import jakarta.ws.rs.core.MultivaluedHashMap;
import jakarta.ws.rs.core.MultivaluedMap;
import org.keycloak.services.clientpolicy.ClientPolicyContext;
services/src/main/java/org/keycloak/services/clientpolicy/context/TokenRevokeResponseContext.java
+45
View File
@@ -0,0 +1,45 @@
/*
* Copyright 2020 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.services.clientpolicy.context;
import jakarta.ws.rs.core.MultivaluedMap;
import org.keycloak.services.clientpolicy.ClientPolicyContext;
import org.keycloak.services.clientpolicy.ClientPolicyEvent;
/**
* @author <a href="mailto:takashi.norimatsu.ws@hitachi.com">Takashi Norimatsu</a>
*/
public class TokenRevokeResponseContext implements ClientPolicyContext {
private final MultivaluedMap<String, String> params;
public TokenRevokeResponseContext(MultivaluedMap<String, String> params) {
this.params = params;
}
@Override
public ClientPolicyEvent getEvent() {
return ClientPolicyEvent.TOKEN_REVOKE_RESPONSE;
}
public MultivaluedMap<String, String> getParams() {
return params;
}
}
services/src/main/java/org/keycloak/services/clientpolicy/context/UserInfoRequestContext.java
+6 -5
View File
@@ -17,6 +17,7 @@
package org.keycloak.services.clientpolicy.context;
import org.keycloak.protocol.oidc.endpoints.UserInfoEndpoint;
import org.keycloak.services.clientpolicy.ClientPolicyContext;
import org.keycloak.services.clientpolicy.ClientPolicyEvent;
@@ -25,10 +26,10 @@ import org.keycloak.services.clientpolicy.ClientPolicyEvent;
*/
public class UserInfoRequestContext implements ClientPolicyContext {
private final String tokenString;
private UserInfoEndpoint.TokenForUserInfo tokenForUserInfo;
public UserInfoRequestContext(String tokenString) {
this.tokenString = tokenString;
public UserInfoRequestContext(UserInfoEndpoint.TokenForUserInfo tokenForUserInfo) {
this.tokenForUserInfo = tokenForUserInfo;
}
@Override
@@ -36,8 +37,8 @@ public class UserInfoRequestContext implements ClientPolicyContext {
return ClientPolicyEvent.USERINFO_REQUEST;
}
public String getTokenString() {
return tokenString;
public UserInfoEndpoint.TokenForUserInfo getTokenForUserInfo() {
return tokenForUserInfo;
}
}
services/src/main/java/org/keycloak/services/clientpolicy/executor/HolderOfKeyEnforcerExecutor.java
+1 -1
View File
@@ -143,7 +143,7 @@ public class HolderOfKeyEnforcerExecutor implements ClientPolicyExecutorProvider
}
private void checkUserInfo(UserInfoRequestContext context, HttpRequest request) throws ClientPolicyException {
String encodedAccessToken = context.getTokenString();
String encodedAccessToken = context.getTokenForUserInfo().getToken();
AccessToken accessToken = session.tokens().decode(encodedAccessToken, AccessToken.class);
if (accessToken == null) {