Examples with OIDCIdentityProvider org.keycloak.broker.oidc.OIDCIdentityProvider used on opensource projects

Example 1 with OIDCIdentityProvider

use of org.keycloak.broker.oidc.OIDCIdentityProvider in project keycloak by keycloak.

the class TokenManager method verifyLogoutToken.

public LogoutTokenValidationCode verifyLogoutToken(KeycloakSession session, RealmModel realm, String encodedLogoutToken) {
    Optional<LogoutToken> logoutTokenOptional = toLogoutToken(encodedLogoutToken);
    if (!logoutTokenOptional.isPresent()) {
        return LogoutTokenValidationCode.DECODE_TOKEN_FAILED;
    }
    LogoutToken logoutToken = logoutTokenOptional.get();
    List<OIDCIdentityProvider> identityProviders = getOIDCIdentityProviders(realm, session).collect(Collectors.toList());
    if (identityProviders.isEmpty()) {
        return LogoutTokenValidationCode.COULD_NOT_FIND_IDP;
    }
    Stream<OIDCIdentityProvider> validOidcIdentityProviders = validateLogoutTokenAgainstIdpProvider(identityProviders.stream(), encodedLogoutToken, logoutToken);
    if (validOidcIdentityProviders.count() == 0) {
        return LogoutTokenValidationCode.TOKEN_VERIFICATION_WITH_IDP_FAILED;
    }
    if (logoutToken.getSubject() == null && logoutToken.getSid() == null) {
        return LogoutTokenValidationCode.MISSING_SID_OR_SUBJECT;
    }
    if (!checkLogoutTokenForEvents(logoutToken)) {
        return LogoutTokenValidationCode.BACKCHANNEL_LOGOUT_EVENT_MISSING;
    }
    if (logoutToken.getOtherClaims().get(NONCE) != null) {
        return LogoutTokenValidationCode.NONCE_CLAIM_IN_TOKEN;
    }
    if (logoutToken.getId() == null) {
        return LogoutTokenValidationCode.LOGOUT_TOKEN_ID_MISSING;
    }
    if (logoutToken.getIat() == null) {
        return LogoutTokenValidationCode.MISSING_IAT_CLAIM;
    }
    return LogoutTokenValidationCode.VALIDATION_SUCCESS;
}