Examples with AuthenticatedClientSessionModel org.keycloak.models.AuthenticatedClientSessionModel used on opensource projects

Example 36 with AuthenticatedClientSessionModel

use of org.keycloak.models.AuthenticatedClientSessionModel in project keycloak by keycloak.

the class AuthenticationManager method backchannelLogoutAll.

private static BackchannelLogoutResponse backchannelLogoutAll(KeycloakSession session, RealmModel realm, UserSessionModel userSession, AuthenticationSessionModel logoutAuthSession, UriInfo uriInfo, HttpHeaders headers, boolean logoutBroker) {
    BackchannelLogoutResponse backchannelLogoutResponse = new BackchannelLogoutResponse();
    for (AuthenticatedClientSessionModel clientSession : userSession.getAuthenticatedClientSessions().values()) {
        Response clientSessionLogoutResponse = backchannelLogoutClientSession(session, realm, clientSession, logoutAuthSession, uriInfo, headers);
        String backchannelLogoutUrl = OIDCAdvancedConfigWrapper.fromClientModel(clientSession.getClient()).getBackchannelLogoutUrl();
        BackchannelLogoutResponse.DownStreamBackchannelLogoutResponse downStreamBackchannelLogoutResponse = new BackchannelLogoutResponse.DownStreamBackchannelLogoutResponse();
        downStreamBackchannelLogoutResponse.setWithBackchannelLogoutUrl(backchannelLogoutUrl != null);
        if (clientSessionLogoutResponse != null) {
            downStreamBackchannelLogoutResponse.setResponseCode(clientSessionLogoutResponse.getStatus());
        } else {
            downStreamBackchannelLogoutResponse.setResponseCode(null);
        }
        backchannelLogoutResponse.addClientResponses(downStreamBackchannelLogoutResponse);
    }
    if (logoutBroker) {
        String brokerId = userSession.getNote(Details.IDENTITY_PROVIDER);
        if (brokerId != null) {
            IdentityProvider identityProvider = IdentityBrokerService.getIdentityProvider(session, realm, brokerId);
            try {
                identityProvider.backchannelLogout(session, userSession, uriInfo, realm);
            } catch (Exception e) {
                logger.warn("Exception at broker backchannel logout for broker " + brokerId, e);
                backchannelLogoutResponse.setLocalLogoutSucceeded(false);
            }
        }
    }
    return backchannelLogoutResponse;
}

Example 37 with AuthenticatedClientSessionModel

use of org.keycloak.models.AuthenticatedClientSessionModel in project keycloak by keycloak.

the class ResourceAdminManager method logoutClientSessions.

protected Response logoutClientSessions(RealmModel realm, ClientModel resource, List<AuthenticatedClientSessionModel> clientSessions) {
    String managementUrl = getManagementUrl(session, resource);
    if (managementUrl != null) {
        // Key is host, value is list of http sessions for this host
        MultivaluedHashMap<String, String> adapterSessionIds = null;
        List<String> userSessions = new LinkedList<>();
        if (clientSessions != null && clientSessions.size() > 0) {
            adapterSessionIds = new MultivaluedHashMap<String, String>();
            for (AuthenticatedClientSessionModel clientSession : clientSessions) {
                String adapterSessionId = clientSession.getNote(AdapterConstants.CLIENT_SESSION_STATE);
                if (adapterSessionId != null) {
                    String host = clientSession.getNote(AdapterConstants.CLIENT_SESSION_HOST);
                    adapterSessionIds.add(host, adapterSessionId);
                }
                if (clientSession.getUserSession() != null)
                    userSessions.add(clientSession.getUserSession().getId());
            }
        }
        if (adapterSessionIds == null || adapterSessionIds.isEmpty()) {
            logger.debugv("Can't logout {0}: no logged adapter sessions", resource.getClientId());
            return null;
        }
        if (managementUrl.contains(CLIENT_SESSION_HOST_PROPERTY)) {
            // Send logout separately to each host (needed for single-sign-out in cluster for non-distributable apps - KEYCLOAK-748)
            for (Map.Entry<String, List<String>> entry : adapterSessionIds.entrySet()) {
                String host = entry.getKey();
                List<String> sessionIds = entry.getValue();
                String currentHostMgmtUrl = managementUrl.replace(CLIENT_SESSION_HOST_PROPERTY, host);
                sendLogoutRequest(realm, resource, sessionIds, userSessions, 0, currentHostMgmtUrl);
            }
            return Response.ok().build();
        } else {
            // Send single logout request
            List<String> allSessionIds = new ArrayList<String>();
            for (List<String> currentIds : adapterSessionIds.values()) {
                allSessionIds.addAll(currentIds);
            }
            return sendLogoutRequest(realm, resource, allSessionIds, userSessions, 0, managementUrl);
        }
    } else {
        logger.debugv("Can't logout {0}: no management url", resource.getClientId());
        return null;
    }
}

Example 38 with AuthenticatedClientSessionModel

use of org.keycloak.models.AuthenticatedClientSessionModel in project keycloak by keycloak.

the class UserSessionManager method revokeOfflineToken.

public boolean revokeOfflineToken(UserModel user, ClientModel client) {
    RealmModel realm = client.getRealm();
    AtomicBoolean anyRemoved = new AtomicBoolean(false);
    kcSession.sessions().getOfflineUserSessionsStream(realm, user).collect(Collectors.toList()).forEach(userSession -> {
        AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
        if (clientSession != null) {
            if (logger.isTraceEnabled()) {
                logger.tracef("Removing existing offline token for user '%s' and client '%s' .", user.getUsername(), client.getClientId());
            }
            clientSession.detachFromUserSession();
            checkOfflineUserSessionHasClientSessions(realm, user, userSession);
            anyRemoved.set(true);
        }
    });
    return anyRemoved.get();
}

Example 39 with AuthenticatedClientSessionModel

use of org.keycloak.models.AuthenticatedClientSessionModel in project keycloak by keycloak.

the class UserSessionManager method createOrUpdateOfflineSession.

public void createOrUpdateOfflineSession(AuthenticatedClientSessionModel clientSession, UserSessionModel userSession) {
    UserModel user = userSession.getUser();
    // Create and persist offline userSession if we don't have one
    UserSessionModel offlineUserSession = kcSession.sessions().getOfflineUserSession(clientSession.getRealm(), userSession.getId());
    if (offlineUserSession == null) {
        offlineUserSession = createOfflineUserSession(user, userSession);
    } else {
        // update lastSessionRefresh but don't need to persist
        offlineUserSession.setLastSessionRefresh(Time.currentTime());
    }
    // Create and persist clientSession
    AuthenticatedClientSessionModel offlineClientSession = offlineUserSession.getAuthenticatedClientSessionByClient(clientSession.getClient().getId());
    if (offlineClientSession == null) {
        createOfflineClientSession(user, clientSession, offlineUserSession);
    }
}

Example 40 with AuthenticatedClientSessionModel

use of org.keycloak.models.AuthenticatedClientSessionModel in project keycloak by keycloak.

the class OIDCAdvancedRequestParamsTest method processClaimsQueryParam.

// CLAIMS
// included in the session client notes, so custom providers can make use of it
@Test
public void processClaimsQueryParam() throws IOException {
    Map<String, Object> claims = ImmutableMap.of("id_token", ImmutableMap.of("test_claim", ImmutableMap.of("essential", true)));
    String claimsJson = JsonSerialization.writeValueAsString(claims);
    driver.navigate().to(oauth.getLoginFormUrl() + "&" + OIDCLoginProtocol.CLAIMS_PARAM + "=" + claimsJson);
    // need to login so session id can be read from event
    loginPage.assertCurrent();
    loginPage.login("test-user@localhost", "password");
    Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
    EventRepresentation loginEvent = events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
    String sessionId = loginEvent.getSessionId();
    String clientId = loginEvent.getClientId();
    testingClient.server("test").run(session -> {
        RealmModel realmModel = session.getContext().getRealm();
        String clientUuid = realmModel.getClientByClientId(clientId).getId();
        UserSessionModel userSession = session.sessions().getUserSession(realmModel, sessionId);
        AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessions().get(clientUuid);
        String claimsInSession = clientSession.getNote(OIDCLoginProtocol.CLAIMS_PARAM);
        assertEquals(claimsJson, claimsInSession);
    });
}