Examples with ExchangeTokenToIdentityProviderToken org.keycloak.broker.provider.ExchangeTokenToIdentityProviderToken used on opensource projects

Example 1 with ExchangeTokenToIdentityProviderToken

use of org.keycloak.broker.provider.ExchangeTokenToIdentityProviderToken in project keycloak by keycloak.

the class DefaultTokenExchangeProvider method exchangeToIdentityProvider.

protected Response exchangeToIdentityProvider(UserModel targetUser, UserSessionModel targetUserSession, String requestedIssuer) {
    event.detail(Details.REQUESTED_ISSUER, requestedIssuer);
    IdentityProviderModel providerModel = realm.getIdentityProviderByAlias(requestedIssuer);
    if (providerModel == null) {
        event.detail(Details.REASON, "unknown requested_issuer");
        event.error(Errors.UNKNOWN_IDENTITY_PROVIDER);
        throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Invalid issuer", Response.Status.BAD_REQUEST);
    }
    IdentityProvider provider = IdentityBrokerService.getIdentityProvider(session, realm, requestedIssuer);
    if (!(provider instanceof ExchangeTokenToIdentityProviderToken)) {
        event.detail(Details.REASON, "exchange unsupported by requested_issuer");
        event.error(Errors.UNKNOWN_IDENTITY_PROVIDER);
        throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Issuer does not support token exchange", Response.Status.BAD_REQUEST);
    }
    if (!AdminPermissions.management(session, realm).idps().canExchangeTo(client, providerModel)) {
        event.detail(Details.REASON, "client not allowed to exchange for requested_issuer");
        event.error(Errors.NOT_ALLOWED);
        throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
    }
    Response response = ((ExchangeTokenToIdentityProviderToken) provider).exchangeFromToken(session.getContext().getUri(), event, client, targetUserSession, targetUser, formParams);
    return cors.builder(Response.fromResponse(response)).build();
}