Package org.keycloak.protocol.oidc.grants

Class OAuth2GrantTypeBase

java.lang.Object
org.keycloak.protocol.oidc.grants.OAuth2GrantTypeBase
All Implemented Interfaces:
org.keycloak.protocol.oidc.grants.OAuth2GrantType, org.keycloak.provider.Provider
Direct Known Subclasses:
AuthorizationCodeGrantType, CibaGrantType, ClientCredentialsGrantType, DeviceGrantType, JWTAuthorizationGrantType, PermissionGrantType, PreAuthorizedCodeGrantType, RefreshTokenGrantType, ResourceOwnerPasswordCredentialsGrantType, TokenExchangeGrantType
public abstract class OAuth2GrantTypeBase extends Object implements org.keycloak.protocol.oidc.grants.OAuth2GrantType
Base class for OAuth 2.0 grant types
Author:
Dmitry Telegin (et al.)

  • Nested Class Summary

    Nested classes/interfaces inherited from interface org.keycloak.protocol.oidc.grants.OAuth2GrantType

    org.keycloak.protocol.oidc.grants.OAuth2GrantType.Context

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    protected org.keycloak.models.ClientModel
    client
     
    protected Map<String,String>
    clientAuthAttributes
     
    protected OIDCAdvancedConfigWrapper
    clientConfig
     
    protected org.keycloak.common.ClientConnection
    clientConnection
     
    protected org.keycloak.protocol.oidc.grants.OAuth2GrantType.Context
    context
     
    protected org.keycloak.services.cors.Cors
    cors
     
    protected org.keycloak.events.EventBuilder
    event
     
    protected jakarta.ws.rs.core.MultivaluedMap<String,String>
    formParams
     
    protected jakarta.ws.rs.core.HttpHeaders
    headers
     
    protected org.keycloak.models.RealmModel
    realm
     
    protected org.keycloak.http.HttpRequest
    request
     
    protected org.keycloak.http.HttpResponse
    response
     
    protected org.keycloak.models.KeycloakSession
    session
     
    protected TokenManager
    tokenManager
     

  • Constructor Summary

    Constructors
    Constructor
    Description
    OAuth2GrantTypeBase()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    addCustomTokenResponseClaims(org.keycloak.representations.AccessTokenResponse res, org.keycloak.models.ClientSessionContext clientSessionCtx)
    Extension point for subclasses to add custom claims to the AccessTokenResponse before it is returned.
    protected void
    afterAuthorizationDetailsProcessed(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, List<org.keycloak.representations.AuthorizationDetailsJSONRepresentation> authorizationDetailsResponse)
    Hook method called after authorization_details are processed and before the token response is created.
    protected void
    checkAndBindMtlsHoKToken(TokenManager.AccessTokenResponseBuilder responseBuilder, boolean useRefreshToken)
     
    protected void
    checkClient()
     
    void
    close()
     
    protected jakarta.ws.rs.core.Response
    createTokenResponse(org.keycloak.models.UserModel user, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, String scopeParam, boolean code, Function<TokenManager.AccessTokenResponseBuilder,org.keycloak.services.clientpolicy.ClientPolicyContext> clientPolicyContextGenerator)
     
    protected jakarta.ws.rs.core.Response
    createTokenResponse(TokenManager.AccessTokenResponseBuilder responseBuilder, org.keycloak.models.ClientSessionContext clientSessionCtx, boolean code)
     
    protected TokenManager.AccessTokenResponseBuilder
    createTokenResponseBuilder(org.keycloak.models.UserModel user, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, String scopeParam, Function<TokenManager.AccessTokenResponseBuilder,org.keycloak.services.clientpolicy.ClientPolicyContext> clientPolicyContextGenerator)
     
    protected String
    getRequestedScopes()
     
    protected List<org.keycloak.representations.AuthorizationDetailsJSONRepresentation>
    handleMissingAuthorizationDetails(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
    Allows processors to generate an authorization details response when the authorization_details parameter is missing in the request.
    protected List<org.keycloak.representations.AuthorizationDetailsJSONRepresentation>
    processAuthorizationDetails(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
    Processes the authorization_details parameter using provider discovery.
    protected List<org.keycloak.representations.AuthorizationDetailsJSONRepresentation>
    processStoredAuthorizationDetails(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
    Process stored authorization_details from the authorization request (e.g., from PAR).
    protected void
    setContext(org.keycloak.protocol.oidc.grants.OAuth2GrantType.Context context)
     
    void
    updateClientSession(org.keycloak.models.AuthenticatedClientSessionModel clientSession)
     
    void
    updateUserSessionFromClientAuth(org.keycloak.models.UserSessionModel userSession)
     
    protected boolean
    useRefreshToken()
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface org.keycloak.protocol.oidc.grants.OAuth2GrantType

    getEventType, getSupportedMultivaluedRequestParameters, getTokenParameterNames, isTokenAllowed, preProcess, process

  • Field Details

    • context

      protected org.keycloak.protocol.oidc.grants.OAuth2GrantType.Context context

    • session

      protected org.keycloak.models.KeycloakSession session

    • realm

      protected org.keycloak.models.RealmModel realm

    • client

      protected org.keycloak.models.ClientModel client

    • clientConfig

      protected OIDCAdvancedConfigWrapper clientConfig

    • clientConnection

      protected org.keycloak.common.ClientConnection clientConnection

    • clientAuthAttributes

      protected Map<String,String> clientAuthAttributes

    • formParams

      protected jakarta.ws.rs.core.MultivaluedMap<String,String> formParams

    • event

      protected org.keycloak.events.EventBuilder event

    • cors

      protected org.keycloak.services.cors.Cors cors

    • tokenManager

      protected TokenManager tokenManager

    • request

      protected org.keycloak.http.HttpRequest request

    • response

      protected org.keycloak.http.HttpResponse response

    • headers

      protected jakarta.ws.rs.core.HttpHeaders headers

  • Constructor Details

    • OAuth2GrantTypeBase

      public OAuth2GrantTypeBase()

  • Method Details

    • setContext

      protected void setContext(org.keycloak.protocol.oidc.grants.OAuth2GrantType.Context context)

    • createTokenResponseBuilder

      protected TokenManager.AccessTokenResponseBuilder createTokenResponseBuilder(org.keycloak.models.UserModel user, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, String scopeParam, Function<TokenManager.AccessTokenResponseBuilder,org.keycloak.services.clientpolicy.ClientPolicyContext> clientPolicyContextGenerator)

    • createTokenResponse

      protected jakarta.ws.rs.core.Response createTokenResponse(TokenManager.AccessTokenResponseBuilder responseBuilder, org.keycloak.models.ClientSessionContext clientSessionCtx, boolean code)

    • createTokenResponse

      protected jakarta.ws.rs.core.Response createTokenResponse(org.keycloak.models.UserModel user, org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, String scopeParam, boolean code, Function<TokenManager.AccessTokenResponseBuilder,org.keycloak.services.clientpolicy.ClientPolicyContext> clientPolicyContextGenerator)

    • checkAndBindMtlsHoKToken

      protected void checkAndBindMtlsHoKToken(TokenManager.AccessTokenResponseBuilder responseBuilder, boolean useRefreshToken)

    • updateClientSession

      public void updateClientSession(org.keycloak.models.AuthenticatedClientSessionModel clientSession)

    • updateUserSessionFromClientAuth

      public void updateUserSessionFromClientAuth(org.keycloak.models.UserSessionModel userSession)

    • getRequestedScopes

      protected String getRequestedScopes()

    • checkClient

      protected void checkClient()

    • addCustomTokenResponseClaims

      protected void addCustomTokenResponseClaims(org.keycloak.representations.AccessTokenResponse res, org.keycloak.models.ClientSessionContext clientSessionCtx)
      Extension point for subclasses to add custom claims to the AccessTokenResponse before it is returned. Default implementation does nothing.

    • afterAuthorizationDetailsProcessed

      protected void afterAuthorizationDetailsProcessed(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx, List<org.keycloak.representations.AuthorizationDetailsJSONRepresentation> authorizationDetailsResponse)
      Hook method called after authorization_details are processed and before the token response is created. This allows authorization details processors to perform post-processing actions (e.g., creating state objects). Processors can store information in session notes during processing, and this hook allows them to act on it.
      Parameters:
      userSession - the user session
      clientSessionCtx - the client session context
      authorizationDetailsResponse - the processed authorization details response

    • processAuthorizationDetails

      protected List<org.keycloak.representations.AuthorizationDetailsJSONRepresentation> processAuthorizationDetails(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
      Processes the authorization_details parameter using provider discovery. This method can be overridden by subclasses to customize the behavior.
      Parameters:
      userSession - the user session
      clientSessionCtx - the client session context
      Returns:
      the authorization details response if processing was successful, null otherwise

    • handleMissingAuthorizationDetails

      protected List<org.keycloak.representations.AuthorizationDetailsJSONRepresentation> handleMissingAuthorizationDetails(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx)
      Allows processors to generate an authorization details response when the authorization_details parameter is missing in the request. This applies to flows where pre-authorization or credential offers are present, and is general to all AuthorizationDetailsProcessor implementations.
      Parameters:
      userSession - the user session
      clientSessionCtx - the client session context
      Returns:
      the authorization details response if generation was successful, null otherwise

    • processStoredAuthorizationDetails

      protected List<org.keycloak.representations.AuthorizationDetailsJSONRepresentation> processStoredAuthorizationDetails(org.keycloak.models.UserSessionModel userSession, org.keycloak.models.ClientSessionContext clientSessionCtx) throws CorsErrorResponseException
      Process stored authorization_details from the authorization request (e.g., from PAR). This method is specifically for Authorization Code Flow where authorization_details was used in the authorization request but is missing from the token request.
      Parameters:
      userSession - the user session
      clientSessionCtx - the client session context
      Returns:
      the authorization details response if processing was successful, null otherwise
      Throws:
      CorsErrorResponseException

    • useRefreshToken

      protected boolean useRefreshToken()

    • close

      public void close()
      Specified by:
      close in interface org.keycloak.provider.Provider