Package org.keycloak.services.managers

Class GrantTypeEndpointRestrictionValidator

java.lang.Object
org.keycloak.services.managers.GrantTypeEndpointRestrictionValidator
All Implemented Interfaces:
org.keycloak.TokenVerifier.Predicate<org.keycloak.representations.AccessToken>
public class GrantTypeEndpointRestrictionValidator extends Object implements org.keycloak.TokenVerifier.Predicate<org.keycloak.representations.AccessToken>
Validates that tokens are only used on endpoints allowed by their grant type. This ensures Pre-Authorized Code tokens are restricted to the credential endpoint, and other grant types only access their intended endpoints.

  • Method Summary

    Modifier and Type
    Method
    Description
    static org.keycloak.TokenVerifier.Predicate<org.keycloak.representations.AccessToken>
    check(org.keycloak.models.KeycloakSession session)
    Creates a TokenVerifier.Predicate for grant type endpoint restriction validation.
    boolean
    test(org.keycloak.representations.AccessToken token)
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Method Details

    • check

      public static org.keycloak.TokenVerifier.Predicate<org.keycloak.representations.AccessToken> check(org.keycloak.models.KeycloakSession session)
      Creates a TokenVerifier.Predicate for grant type endpoint restriction validation. Can be used with TokenVerifier.withChecks() for inline verification.
      Parameters:
      session - The Keycloak session
      Returns:
      A predicate that validates grant type restrictions

    • test

      public boolean test(org.keycloak.representations.AccessToken token) throws org.keycloak.common.VerificationException
      Specified by:
      test in interface org.keycloak.TokenVerifier.Predicate<org.keycloak.representations.AccessToken>
      Throws:
      org.keycloak.common.VerificationException