Examples with AuthzEndpointParParser org.keycloak.protocol.oidc.par.endpoints.request.AuthzEndpointParParser used on opensource projects

Example 1 with AuthzEndpointParParser

use of org.keycloak.protocol.oidc.par.endpoints.request.AuthzEndpointParParser in project keycloak by keycloak.

the class AuthorizationEndpointRequestParserProcessor method parseRequest.

public static AuthorizationEndpointRequest parseRequest(EventBuilder event, KeycloakSession session, ClientModel client, MultivaluedMap<String, String> requestParams) {
    try {
        AuthorizationEndpointRequest request = new AuthorizationEndpointRequest();
        AuthzEndpointQueryStringParser parser = new AuthzEndpointQueryStringParser(requestParams);
        parser.parseRequest(request);
        if (parser.getInvalidRequestMessage() != null) {
            request.invalidRequestMessage = parser.getInvalidRequestMessage();
            return request;
        }
        String requestParam = requestParams.getFirst(OIDCLoginProtocol.REQUEST_PARAM);
        String requestUriParam = requestParams.getFirst(OIDCLoginProtocol.REQUEST_URI_PARAM);
        if (requestParam != null && requestUriParam != null) {
            throw new RuntimeException("Illegal to use both 'request' and 'request_uri' parameters together");
        }
        String requestObjectRequired = OIDCAdvancedConfigWrapper.fromClientModel(client).getRequestObjectRequired();
        if (OIDCConfigAttributes.REQUEST_OBJECT_REQUIRED_REQUEST_OR_REQUEST_URI.equals(requestObjectRequired) && requestParam == null && requestUriParam == null) {
            throw new RuntimeException("Client is required to use 'request' or 'request_uri' parameter.");
        } else if (OIDCConfigAttributes.REQUEST_OBJECT_REQUIRED_REQUEST.equals(requestObjectRequired) && requestParam == null) {
            throw new RuntimeException("Client is required to use 'request' parameter.");
        } else if (OIDCConfigAttributes.REQUEST_OBJECT_REQUIRED_REQUEST_URI.equals(requestObjectRequired) && requestUriParam == null) {
            throw new RuntimeException("Client is required to use 'request_uri' parameter.");
        }
        if (requestParam != null) {
            new AuthzEndpointRequestObjectParser(session, requestParam, client).parseRequest(request);
        } else if (requestUriParam != null) {
            // Define, if the request is `PAR` or usual `Request Object`.
            RequestUriType requestUriType = getRequestUriType(requestUriParam);
            if (requestUriType == RequestUriType.PAR) {
                new AuthzEndpointParParser(session, client, requestUriParam).parseRequest(request);
            } else {
                // Validate "requestUriParam" with allowed requestUris
                List<String> requestUris = OIDCAdvancedConfigWrapper.fromClientModel(client).getRequestUris();
                String requestUri = RedirectUtils.verifyRedirectUri(session, client.getRootUrl(), requestUriParam, new HashSet<>(requestUris), false);
                if (requestUri == null) {
                    throw new RuntimeException("Specified 'request_uri' not allowed for this client.");
                }
                try (InputStream is = session.getProvider(HttpClientProvider.class).get(requestUri)) {
                    String retrievedRequest = StreamUtil.readString(is);
                    new AuthzEndpointRequestObjectParser(session, retrievedRequest, client).parseRequest(request);
                }
            }
        }
        if (Profile.isFeatureEnabled(Profile.Feature.DYNAMIC_SCOPES)) {
            request.authorizationRequestContext = AuthorizationContextUtil.getAuthorizationRequestContextFromScopes(session, request.getScope());
        }
        return request;
    } catch (Exception e) {
        ServicesLogger.LOGGER.invalidRequest(e);
        event.error(Errors.INVALID_REQUEST);
        throw new ErrorPageException(session, Response.Status.BAD_REQUEST, Messages.INVALID_REQUEST);
    }
}