Examples with TokenManager org.keycloak.protocol.oidc.TokenManager used on opensource projects

Example 1 with TokenManager

use of org.keycloak.protocol.oidc.TokenManager in project keycloak by keycloak.

the class TokenEndpoint method tokenExchange.

public Response tokenExchange() {
    ProfileHelper.requireFeature(Profile.Feature.TOKEN_EXCHANGE);
    event.detail(Details.AUTH_METHOD, "token_exchange");
    event.client(client);
    TokenExchangeContext context = new TokenExchangeContext(session, formParams, cors, realm, event, client, clientConnection, headers, tokenManager, clientAuthAttributes);
    return session.getKeycloakSessionFactory().getProviderFactoriesStream(TokenExchangeProvider.class).sorted((f1, f2) -> f2.order() - f1.order()).map(f -> session.getProvider(TokenExchangeProvider.class, f.getId())).filter(p -> p.supports(context)).findFirst().orElseThrow(() -> new InternalServerErrorException("No token exchange provider available")).exchange(context);
}

Example 2 with TokenManager

use of org.keycloak.protocol.oidc.TokenManager in project keycloak by keycloak.

the class ClientScopeEvaluateResource method generateExampleAccessToken.

/**
 * Create JSON with payload of example access token
 *
 * @return
 */
@GET
@Path("generate-example-access-token")
@NoCache
@Produces(MediaType.APPLICATION_JSON)
public AccessToken generateExampleAccessToken(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId) {
    auth.clients().requireView(client);
    UserModel user = getUserModel(userId);
    logger.debugf("generateExampleAccessToken invoked. User: %s, Scope param: %s", user.getUsername(), scopeParam);
    return sessionAware(user, scopeParam, (userSession, clientSessionCtx) -> {
        TokenManager tokenManager = new TokenManager();
        return tokenManager.responseBuilder(realm, client, null, session, userSession, clientSessionCtx).generateAccessToken().getAccessToken();
    });
}

Example 3 with TokenManager

use of org.keycloak.protocol.oidc.TokenManager in project keycloak by keycloak.

the class ClientScopeEvaluateResource method generateExampleUserinfo.

/**
 * Create JSON with payload of example user info
 *
 * @return
 */
@GET
@Path("generate-example-userinfo")
@NoCache
@Produces(MediaType.APPLICATION_JSON)
public Map<String, Object> generateExampleUserinfo(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId) {
    auth.clients().requireView(client);
    UserModel user = getUserModel(userId);
    logger.debugf("generateExampleUserinfo invoked. User: %s", user.getUsername());
    return sessionAware(user, scopeParam, (userSession, clientSessionCtx) -> {
        AccessToken userInfo = new AccessToken();
        TokenManager tokenManager = new TokenManager();
        tokenManager.transformUserInfoAccessToken(session, userInfo, userSession, clientSessionCtx);
        return tokenManager.generateUserInfoClaims(userInfo, user);
    });
}

Example 4 with TokenManager

use of org.keycloak.protocol.oidc.TokenManager in project keycloak by keycloak.

the class ClientScopeEvaluateResource method generateExampleIdToken.

/**
 * Create JSON with payload of example id token
 *
 * @return
 */
@GET
@Path("generate-example-id-token")
@NoCache
@Produces(MediaType.APPLICATION_JSON)
public IDToken generateExampleIdToken(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId) {
    auth.clients().requireView(client);
    UserModel user = getUserModel(userId);
    logger.debugf("generateExampleIdToken invoked. User: %s, Scope param: %s", user.getUsername(), scopeParam);
    return sessionAware(user, scopeParam, (userSession, clientSessionCtx) -> {
        TokenManager tokenManager = new TokenManager();
        return tokenManager.responseBuilder(realm, client, null, session, userSession, clientSessionCtx).generateAccessToken().generateIDToken().getIdToken();
    });
}

Example 5 with TokenManager

use of org.keycloak.protocol.oidc.TokenManager in project keycloak by keycloak.

the class AuthorizationTokenService method createAuthorizationResponse.

private AuthorizationResponse createAuthorizationResponse(KeycloakIdentity identity, Collection<Permission> entitlements, KeycloakAuthorizationRequest request, ClientModel targetClient) {
    KeycloakSession keycloakSession = request.getKeycloakSession();
    AccessToken accessToken = identity.getAccessToken();
    RealmModel realm = request.getRealm();
    UserSessionProvider sessions = keycloakSession.sessions();
    UserSessionModel userSessionModel;
    if (accessToken.getSessionState() == null) {
        // Create temporary (request-scoped) transient session
        UserModel user = TokenManager.lookupUserFromStatelessToken(keycloakSession, realm, accessToken);
        userSessionModel = sessions.createUserSession(KeycloakModelUtils.generateId(), realm, user, user.getUsername(), request.getClientConnection().getRemoteAddr(), ServiceAccountConstants.CLIENT_AUTH, false, null, null, UserSessionModel.SessionPersistenceState.TRANSIENT);
    } else {
        userSessionModel = sessions.getUserSession(realm, accessToken.getSessionState());
        if (userSessionModel == null) {
            userSessionModel = sessions.getOfflineUserSession(realm, accessToken.getSessionState());
        }
    }
    ClientModel client = realm.getClientByClientId(accessToken.getIssuedFor());
    AuthenticatedClientSessionModel clientSession = userSessionModel.getAuthenticatedClientSessionByClient(targetClient.getId());
    ClientSessionContext clientSessionCtx;
    if (clientSession == null) {
        RootAuthenticationSessionModel rootAuthSession = keycloakSession.authenticationSessions().getRootAuthenticationSession(realm, userSessionModel.getId());
        if (rootAuthSession == null) {
            if (userSessionModel.getUser().getServiceAccountClientLink() == null) {
                rootAuthSession = keycloakSession.authenticationSessions().createRootAuthenticationSession(realm, userSessionModel.getId());
            } else {
                // if the user session is associated with a service account
                rootAuthSession = new AuthenticationSessionManager(keycloakSession).createAuthenticationSession(realm, false);
            }
        }
        AuthenticationSessionModel authSession = rootAuthSession.createAuthenticationSession(targetClient);
        authSession.setAuthenticatedUser(userSessionModel.getUser());
        authSession.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
        authSession.setClientNote(OIDCLoginProtocol.ISSUER, Urls.realmIssuer(keycloakSession.getContext().getUri().getBaseUri(), realm.getName()));
        AuthenticationManager.setClientScopesInSession(authSession);
        clientSessionCtx = TokenManager.attachAuthenticationSession(keycloakSession, userSessionModel, authSession);
    } else {
        clientSessionCtx = DefaultClientSessionContext.fromClientSessionScopeParameter(clientSession, keycloakSession);
    }
    TokenManager tokenManager = request.getTokenManager();
    EventBuilder event = request.getEvent();
    AccessTokenResponseBuilder responseBuilder = tokenManager.responseBuilder(realm, client, event, keycloakSession, userSessionModel, clientSessionCtx).generateAccessToken();
    AccessToken rpt = responseBuilder.getAccessToken();
    Authorization authorization = new Authorization();
    authorization.setPermissions(entitlements);
    rpt.setAuthorization(authorization);
    if (accessToken.getSessionState() == null) {
        // Skip generating refresh token for accessToken without sessionState claim. This is "stateless" accessToken not pointing to any real persistent userSession
        rpt.setSessionState(null);
    } else {
        if (OIDCAdvancedConfigWrapper.fromClientModel(client).isUseRefreshToken()) {
            responseBuilder.generateRefreshToken();
            RefreshToken refreshToken = responseBuilder.getRefreshToken();
            refreshToken.issuedFor(client.getClientId());
            refreshToken.setAuthorization(authorization);
        }
    }
    if (!rpt.hasAudience(targetClient.getClientId())) {
        rpt.audience(targetClient.getClientId());
    }
    return new AuthorizationResponse(responseBuilder.build(), isUpgraded(request, authorization));
}