Examples with JsonWebToken org.keycloak.representations.JsonWebToken used on opensource projects

Example 26 with JsonWebToken

use of org.keycloak.representations.JsonWebToken in project keycloak by keycloak.

the class ExternalKeycloakRoleToRoleMapper method applies.

@Override
protected boolean applies(IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
    JsonWebToken token = (JsonWebToken) context.getContextData().get(KeycloakOIDCIdentityProvider.VALIDATED_ACCESS_TOKEN);
    String[] parseRole = KeycloakModelUtils.parseRole(mapperModel.getConfig().get(EXTERNAL_ROLE));
    String externalRoleName = parseRole[1];
    String claimName = parseRole[0] == null ? "realm_access.roles" : "resource_access." + parseRole[0] + ".roles";
    Object claim = getClaimValue(token, claimName);
    return valueEquals(externalRoleName, claim);
}

Example 27 with JsonWebToken

use of org.keycloak.representations.JsonWebToken in project keycloak by keycloak.

the class GoogleIdentityProvider method validateToken.

@Override
protected JsonWebToken validateToken(final String encodedToken, final boolean ignoreAudience) {
    JsonWebToken token = super.validateToken(encodedToken, ignoreAudience);
    String hostedDomain = ((GoogleIdentityProviderConfig) getConfig()).getHostedDomain();
    if (hostedDomain == null) {
        return token;
    }
    Object receivedHdParam = token.getOtherClaims().get(OIDC_PARAMETER_HOSTED_DOMAINS);
    if (receivedHdParam == null) {
        throw new IdentityBrokerException("Identity token does not contain hosted domain parameter.");
    }
    if (hostedDomain.equals("*") || hostedDomain.equals(receivedHdParam)) {
        return token;
    }
    throw new IdentityBrokerException("Hosted domain does not match.");
}

Example 28 with JsonWebToken

use of org.keycloak.representations.JsonWebToken in project keycloak by keycloak.

the class KeycloakOIDCIdentityProvider method processAccessTokenResponse.

@Override
protected void processAccessTokenResponse(BrokeredIdentityContext context, AccessTokenResponse response) {
    // Don't verify audience on accessToken as it may not be there. It was verified on IDToken already
    JsonWebToken access = validateToken(response.getToken(), true);
    context.getContextData().put(VALIDATED_ACCESS_TOKEN, access);
}

Example 29 with JsonWebToken

use of org.keycloak.representations.JsonWebToken in project keycloak by keycloak.

the class AbstractOAuth2IdentityProvider method generateToken.

protected JsonWebToken generateToken() {
    JsonWebToken jwt = new JsonWebToken();
    jwt.id(KeycloakModelUtils.generateId());
    jwt.type(OAuth2Constants.JWT);
    jwt.issuer(getConfig().getClientId());
    jwt.subject(getConfig().getClientId());
    jwt.audience(getConfig().getTokenUrl());
    int expirationDelay = session.getContext().getRealm().getAccessCodeLifespan();
    jwt.expiration(Time.currentTime() + expirationDelay);
    jwt.issuedNow();
    return jwt;
}

Example 30 with JsonWebToken

use of org.keycloak.representations.JsonWebToken in project keycloak by keycloak.

the class OIDCJwksClientRegistrationTest method getClientSignedJWT.

private String getClientSignedJWT(String clientId, KeyPair keyPair, final String kid) {
    String realmInfoUrl = KeycloakUriBuilder.fromUri(getAuthServerRoot()).path(ServiceUrlConstants.REALM_INFO_PATH).build(REALM_NAME).toString();
    // Use token-endpoint as audience as OIDC conformance testsuite is using it too.
    JWTClientCredentialsProvider jwtProvider = new JWTClientCredentialsProvider() {

        @Override
        public String createSignedRequestToken(String clientId, String realmInfoUrl) {
            if (KEEP_GENERATED_KID.equals(kid)) {
                return super.createSignedRequestToken(clientId, realmInfoUrl);
            } else {
                JsonWebToken jwt = createRequestToken(clientId, realmInfoUrl);
                return new JWSBuilder().kid(kid).jsonContent(jwt).rsa256(keyPair.getPrivate());
            }
        }

        @Override
        protected JsonWebToken createRequestToken(String clientId, String realmInfoUrl) {
            JsonWebToken jwt = super.createRequestToken(clientId, realmInfoUrl);
            String tokenEndpointUrl = OIDCLoginProtocolService.tokenUrl(UriBuilder.fromUri(getAuthServerRoot())).build(REALM_NAME).toString();
            jwt.audience(tokenEndpointUrl);
            return jwt;
        }
    };
    jwtProvider.setupKeyPair(keyPair);
    jwtProvider.setTokenTimeout(10);
    return jwtProvider.createSignedRequestToken(clientId, realmInfoUrl);
}