Package org.keycloak.protocol.oidc.scope

Interface ParameterizedScopeTypeProvider

All Superinterfaces:
org.keycloak.provider.Provider, org.keycloak.provider.ProviderFactory<ParameterizedScopeTypeProvider>
public interface ParameterizedScopeTypeProvider extends org.keycloak.provider.Provider, org.keycloak.provider.ProviderFactory<ParameterizedScopeTypeProvider>
Defines the type and validation rules for parameterized client scopes.

Built-in types (string, number, boolean, username) validate the captured parameter value via validateParameter(org.keycloak.models.ClientScopeModel, java.lang.String). Only the "custom" type uses an admin-defined regex for matching.

  • Method Summary

    Modifier and Type
    Method
    Description
    default void
    close()
     
    default ParameterizedScopeTypeProvider
    create(org.keycloak.models.KeycloakSession session)
     
    default String
    getId()
     
    String
    getTypeName()
     
    default void
    init(org.keycloak.Config.Scope config)
     
    default boolean
    isRepeatable()
    Whether this scope type allows the same parameterized scope to appear multiple times in a single request with different parameter values (e.g., scope:val1 scope:val2).
    default void
    postInit(org.keycloak.models.KeycloakSessionFactory factory)
     
    void
    validateParameter(org.keycloak.models.ClientScopeModel scope, String parameter)
    Validates the captured parameter value at request time (no authenticated user yet).
    default void
    validateParameterWithUser(org.keycloak.models.UserModel currentUser, org.keycloak.models.ClientScopeModel scope, String parameter)
    Validates the parameter when the authenticated user is known (code-to-token, refresh, token exchange).

    Methods inherited from interface org.keycloak.provider.ProviderFactory

    dependsOn, getConfigMetadata, order

  • Method Details

    • getTypeName

      String getTypeName()
      Returns:
      the unique type name, also used as the provider ID

    • isRepeatable

      default boolean isRepeatable()
      Whether this scope type allows the same parameterized scope to appear multiple times in a single request with different parameter values (e.g., scope:val1 scope:val2).
      Returns:
      true if multiple parameter values are allowed, false otherwise

    • validateParameter

      void validateParameter(@Nonnull org.keycloak.models.ClientScopeModel scope, @Nonnull String parameter) throws InvalidScopeParameterException
      Validates the captured parameter value at request time (no authenticated user yet). Implementations should normalize the parameter before validation (e.g. lowercase usernames, strip leading zeros from numbers).
      Parameters:
      scope - the client scope model, never null
      parameter - the captured parameter value, never null or empty
      Throws:
      InvalidScopeParameterException - if the parameter is invalid

    • validateParameterWithUser

      default void validateParameterWithUser(@Nonnull org.keycloak.models.UserModel currentUser, @Nonnull org.keycloak.models.ClientScopeModel scope, @Nonnull String parameter) throws InvalidScopeParameterException
      Validates the parameter when the authenticated user is known (code-to-token, refresh, token exchange). Use for authorization checks when the user is known after authorization. Default implementation is the same than the non-user variant.
      Parameters:
      currentUser - the authenticated user, never null
      scope - the client scope model, never null
      parameter - the captured parameter value, never null or empty
      Throws:
      InvalidScopeParameterException - if the parameter is invalid for the given user

    • create

      default ParameterizedScopeTypeProvider create(org.keycloak.models.KeycloakSession session)
      Specified by:
      create in interface org.keycloak.provider.ProviderFactory<ParameterizedScopeTypeProvider>

    • getId

      default String getId()
      Specified by:
      getId in interface org.keycloak.provider.ProviderFactory<ParameterizedScopeTypeProvider>

    • init

      default void init(org.keycloak.Config.Scope config)
      Specified by:
      init in interface org.keycloak.provider.ProviderFactory<ParameterizedScopeTypeProvider>

    • postInit

      default void postInit(org.keycloak.models.KeycloakSessionFactory factory)
      Specified by:
      postInit in interface org.keycloak.provider.ProviderFactory<ParameterizedScopeTypeProvider>

    • close

      default void close()
      Specified by:
      close in interface org.keycloak.provider.Provider
      Specified by:
      close in interface org.keycloak.provider.ProviderFactory<ParameterizedScopeTypeProvider>