Examples with ClientModel org.keycloak.models.ClientModel used on opensource projects

Example 11 with ClientModel

use of org.keycloak.models.ClientModel in project keycloak by keycloak.

the class CibaClientValidation method validate.

public void validate() {
    ClientModel client = context.getObjectToValidate();
    // Check only ping mode and poll mode allowed
    CibaConfig cibaConfig = client.getRealm().getCibaPolicy();
    String cibaMode = cibaConfig.getBackchannelTokenDeliveryMode(client);
    if (!CibaConfig.CIBA_SUPPORTED_MODES.contains(cibaMode)) {
        context.addError("cibaBackchannelTokenDeliveryMode", "Unsupported requested CIBA Backchannel Token Delivery Mode", "invalidCibaBackchannelTokenDeliveryMode");
    }
    // Check clientNotificationEndpoint URL configured for ping mode
    if (CibaConfig.CIBA_PING_MODE.equals(cibaMode)) {
        if (cibaConfig.getBackchannelClientNotificationEndpoint(client) == null) {
            context.addError("cibaBackchannelClientNotificationEndpoint", "CIBA Backchannel Client Notification Endpoint must be set for the CIBA ping mode", "missingCibaBackchannelClientNotificationEndpoint");
        }
    }
    // Validate clientNotificationEndpoint URL itself
    try {
        checkUrl(client.getRealm().getSslRequired(), cibaConfig.getBackchannelClientNotificationEndpoint(client), "backchannel_client_notification_endpoint");
    } catch (RuntimeException re) {
        context.addError("cibaBackchannelClientNotificationEndpoint", re.getMessage(), "invalidBackchannelClientNotificationEndpoint");
    }
    Algorithm alg = cibaConfig.getBackchannelAuthRequestSigningAlg(client);
    if (alg != null && !isSupportedBackchannelAuthenticationRequestSigningAlg(context.getSession(), alg.name())) {
        context.addError("cibaBackchannelAuthRequestSigningAlg", "Unsupported requested CIBA Backchannel Authentication Request Signing Algorithm", "invalidCibaBackchannelAuthRequestSigningAlg");
    }
}

Example 12 with ClientModel

use of org.keycloak.models.ClientModel in project keycloak by keycloak.

the class HttpAuthenticationChannelProvider method requestAuthentication.

@Override
public boolean requestAuthentication(CIBAAuthenticationRequest request, String infoUsedByAuthenticator) {
    // Creates JWT formatted/JWS signed/JWE encrypted Authentication Channel ID by the same manner in creating auth_req_id.
    // Authentication Channel ID binds Backchannel Authentication Request with Authentication by Authentication Device (AD).
    // JWE serialized Authentication Channel ID works as a bearer token. It includes client_id
    // that can be used on Authentication Channel Callback Endpoint to recognize the Consumption Device (CD)
    // that sent Backchannel Authentication Request.
    // The following scopes should be displayed on AD:
    // 1. scopes specified explicitly as query parameter in the authorization request
    // 2. scopes specified implicitly as default client scope in keycloak
    checkAuthenticationChannel();
    ClientModel client = request.getClient();
    try {
        AuthenticationChannelRequest channelRequest = new AuthenticationChannelRequest();
        channelRequest.setScope(request.getScope());
        channelRequest.setBindingMessage(request.getBindingMessage());
        channelRequest.setLoginHint(infoUsedByAuthenticator);
        channelRequest.setConsentRequired(client.isConsentRequired());
        channelRequest.setAcrValues(request.getAcrValues());
        channelRequest.setAdditionalParameters(request.getOtherClaims());
        SimpleHttp simpleHttp = SimpleHttp.doPost(httpAuthenticationChannelUri, session).header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON).json(channelRequest).auth(createBearerToken(request, client));
        int status = completeDecoupledAuthnRequest(simpleHttp, channelRequest).asStatus();
        if (status == Status.CREATED.getStatusCode()) {
            return true;
        }
    } catch (IOException ioe) {
        throw new RuntimeException("Authentication Channel Access failed.", ioe);
    }
    return false;
}

Example 13 with ClientModel

use of org.keycloak.models.ClientModel in project keycloak by keycloak.

the class ScopeMappedResource method getScopeMappings.

/**
 * Get all scope mappings for the client
 *
 * @return
 * @deprecated the method is not used neither from admin console or from admin client. It may be removed in future releases.
 */
@GET
@Produces(MediaType.APPLICATION_JSON)
@NoCache
@Deprecated
public MappingsRepresentation getScopeMappings() {
    viewPermission.require();
    if (scopeContainer == null) {
        throw new NotFoundException("Could not find client");
    }
    MappingsRepresentation all = new MappingsRepresentation();
    List<RoleRepresentation> realmRep = scopeContainer.getRealmScopeMappingsStream().map(ModelToRepresentation::toBriefRepresentation).collect(Collectors.toList());
    if (!realmRep.isEmpty()) {
        all.setRealmMappings(realmRep);
    }
    Stream<ClientModel> clients = realm.getClientsStream();
    Map<String, ClientMappingsRepresentation> clientMappings = clients.map(c -> ScopeMappedUtil.toClientMappingsRepresentation(c, scopeContainer)).filter(Objects::nonNull).collect(Collectors.toMap(ClientMappingsRepresentation::getClient, Function.identity()));
    if (!clientMappings.isEmpty()) {
        all.setClientMappings(clientMappings);
    }
    return all;
}

Example 14 with ClientModel

use of org.keycloak.models.ClientModel in project keycloak by keycloak.

the class UserResource method getOfflineSessions.

/**
 * Get offline sessions associated with the user and client
 *
 * @return
 */
@Path("offline-sessions/{clientUuid}")
@GET
@NoCache
@Produces(MediaType.APPLICATION_JSON)
public Stream<UserSessionRepresentation> getOfflineSessions(@PathParam("clientUuid") final String clientUuid) {
    auth.users().requireView(user);
    ClientModel client = realm.getClientById(clientUuid);
    if (client == null) {
        throw new NotFoundException("Client not found");
    }
    return new UserSessionManager(session).findOfflineSessionsStream(realm, user).map(session -> toUserSessionRepresentation(session, clientUuid)).filter(Objects::nonNull);
}

Example 15 with ClientModel

use of org.keycloak.models.ClientModel in project keycloak by keycloak.

the class MgmtPermissions method initializeRealmResourceServer.

public ResourceServer initializeRealmResourceServer() {
    if (!Profile.isFeatureEnabled(Profile.Feature.AUTHORIZATION))
        return null;
    if (realmResourceServer != null)
        return realmResourceServer;
    ClientModel client = getRealmManagementClient();
    realmResourceServer = authz.getStoreFactory().getResourceServerStore().findByClient(client);
    if (realmResourceServer == null) {
        realmResourceServer = authz.getStoreFactory().getResourceServerStore().create(client);
    }
    return realmResourceServer;
}