Package org.keycloak.protocol.oidc.rar

Interface AuthorizationDetailsProcessor<ADR extends org.keycloak.representations.AuthorizationDetailsJSONRepresentation>

All Superinterfaces:
org.keycloak.provider.Provider
public interface AuthorizationDetailsProcessor<ADR extends org.keycloak.representations.AuthorizationDetailsJSONRepresentation> extends org.keycloak.provider.Provider
Provider interface for processing authorization_details parameter in OAuth2/OIDC authorization and token requests. This follows the RAR (Rich Authorization Requests) specification and allows different implementations to handle various types of authorization details. The authorization_details parameter can be used in both authorization requests and token requests (as specified for example in the OpenID for Verifiable Credential Issuance specification).
Author:
Forkim Akwichek

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    afterAuthorizationDetailsProcessed(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, ADR authorizationDetailsResponse)
    Hook method called after authorization_details are processed and before the token response is created.
    default List<ADR>
    getSupportedAuthorizationDetails(List<org.keycloak.representations.AuthorizationDetailsJSONRepresentation> authzDetailsResponse)
     
    Class<ADR>
    getSupportedResponseJavaType()
     
    String
    getSupportedType()
     
    List<ADR>
    handleMissingAuthorizationDetails(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
    Method is invoked in cases when authorization_details parameter is missing in the request.
    boolean
    isSupported()
    Checks if this processor should be regarded as supported in the running context.
    ADR
    process(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, org.keycloak.representations.AuthorizationDetailsJSONRepresentation authorizationDetailsMember)
    Processes the authorization_details parameter and returns a response if this processor is able to handle the given authorization_details parameter.
    ADR
    processStoredAuthorizationDetails(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, org.keycloak.representations.AuthorizationDetailsJSONRepresentation storedAuthDetailsMember)
    Method is invoked when authorization_details was used in the authorization request but is missing from the token request.
    default ADR
    sanitizeBeforeSendingTokenResponse(ADR authzDetail)
    Sanitize authorization details before they are sent as part of the Token Response https://github.com/keycloak/keycloak/issues/50079
    ADR
    validateAuthorizationDetail(org.keycloak.representations.AuthorizationDetailsJSONRepresentation authzDetail)
    Validates an authorization detail against supported credentials and other constraints.

    Methods inherited from interface org.keycloak.provider.Provider

    close

  • Method Details

    • isSupported

      boolean isSupported()
      Checks if this processor should be regarded as supported in the running context.

    • getSupportedType

      String getSupportedType()
      Returns:
      supported type of authorization_details "type" claim, which this processor is able to process. This should usually correspond with the "providerId" of the AuthorizationDetailsProcessorFactory, which created this processor

    • getSupportedResponseJavaType

      Class<ADR> getSupportedResponseJavaType()
      Returns:
      supported Java type of AuthorizationDetailsJSONRepresentation subclass, which this processor can create in the token response

    • validateAuthorizationDetail

      ADR validateAuthorizationDetail(org.keycloak.representations.AuthorizationDetailsJSONRepresentation authzDetail) throws InvalidAuthorizationDetailsException
      Validates an authorization detail against supported credentials and other constraints.
      Throws:
      InvalidAuthorizationDetailsException

    • process

      ADR process(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, org.keycloak.representations.AuthorizationDetailsJSONRepresentation authorizationDetailsMember) throws InvalidAuthorizationDetailsException
      Processes the authorization_details parameter and returns a response if this processor is able to handle the given authorization_details parameter.
      Parameters:
      userSession - the user session
      clientSessionCtx - the client session context
      authorizationDetailsMember - the authorization_details member (usually one member from the list) sent in the "authorization_details" request parameter
      Returns:
      authorization details response if this processor can handle the parameter, null if the parameter is incompatible with this processor
      Throws:
      InvalidAuthorizationDetailsException

    • handleMissingAuthorizationDetails

      List<ADR> handleMissingAuthorizationDetails(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx) throws InvalidAuthorizationDetailsException
      Method is invoked in cases when authorization_details parameter is missing in the request. It allows processor to generate authorization details response in such a case
      Parameters:
      userSession - the user session
      clientSessionCtx - the client session context
      Returns:
      authorization details response if this processor can handle current request in case that authorization_details parameter was not provided
      Throws:
      InvalidAuthorizationDetailsException

    • processStoredAuthorizationDetails

      ADR processStoredAuthorizationDetails(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, org.keycloak.representations.AuthorizationDetailsJSONRepresentation storedAuthDetailsMember) throws InvalidAuthorizationDetailsException
      Method is invoked when authorization_details was used in the authorization request but is missing from the token request. This method should process the stored authorization_details and ensure they are returned in the token response.
      Parameters:
      userSession - the user session
      clientSessionCtx - the client session context
      storedAuthDetailsMember - the parsed member (usually one member of the list) from the authorization_details parameter that were stored during the authorization request
      Returns:
      authorization details response if this processor can handle the stored authorization_details, null if the processor cannot handle the stored authorization_details
      Throws:
      InvalidAuthorizationDetailsException

    • afterAuthorizationDetailsProcessed

      void afterAuthorizationDetailsProcessed(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, ADR authorizationDetailsResponse)
      Hook method called after authorization_details are processed and before the token response is created. This allows authorization details processors to perform post-processing actions (e.g., creating state objects).
      Parameters:
      userSession - the user session
      clientSessionCtx - the client session context
      authorizationDetailsResponse - The response object of the proper type, which is supposed to be processed by this processor.

    • sanitizeBeforeSendingTokenResponse

      default ADR sanitizeBeforeSendingTokenResponse(ADR authzDetail)
      Sanitize authorization details before they are sent as part of the Token Response https://github.com/keycloak/keycloak/issues/50079
      Parameters:
      authzDetail - The typed authorization detail
      Returns:
      A sanitized clone of the authorization detail

    • getSupportedAuthorizationDetails

      default List<ADR> getSupportedAuthorizationDetails(List<org.keycloak.representations.AuthorizationDetailsJSONRepresentation> authzDetailsResponse)
      Parameters:
      authzDetailsResponse - all the authorizationDetails. May contain also authorizationDetails entries, with different "type" than the type understandable by this processor
      Returns:
      sublist of the list provided by "authDetailsResponse" parameter, which will contain just the authorizationDetails of the corresponding type of this processor.