Top Description Fields Constructors Methods
org.keycloak.protocol.oidc.client.authentication

public Class JWTClientCredentialsProvider

extends Object
implements ClientCredentialsProvider
Class Inheritance
All Implemented Interfaces
org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider
Imports
java.security.KeyPair, .PublicKey, java.util.Map, .UUID, org.keycloak.OAuth2Constants, org.keycloak.common.util.KeyUtils, .KeystoreUtil, .Time, org.keycloak.crypto.Algorithm, .AsymmetricSignatureSignerContext, .ECDSASignatureSignerContext, .JavaAlgorithm, .KeyType, .KeyUse, .KeyWrapper, .SignatureSignerContext, org.keycloak.jose.jws.JWSBuilder, org.keycloak.representations.JsonWebToken, org.keycloak.representations.adapters.config.AdapterConfig
Client authentication based on JWT signed by client private key . See specs for more details.
Author
Marek Posolda

Field Summary

Modifier and TypeField and Description
private KeyPair
keyPair

public static final String
PROVIDER_ID

private SignatureSignerContext
sigCtx

private int
tokenTimeout

Constructor Summary

AccessConstructor and Description
public
JWTClientCredentialsProvider()

Method Summary

Modifier and TypeMethod and Description
private Integer
asInt(Map<String, Object> cfg, String cfgKey, int defaultValue)

protected JsonWebToken
createRequestToken(String clientId, String realmInfoUrl)

public String
createSignedRequestToken(String clientId, String realmInfoUrl)

public String
getId()

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.getId.

Return the ID of the provider.
public PublicKey
getPublicKey()

protected int
getTokenTimeout()

public void
init(AdapterConfig
the adapter configuration
deployment, Object
the configuration of your provider read from keycloak.json . For the kerberos-keytab example above, it will return map with the single key "keytab" with value "/tmp/foo"
config)

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.init.

Called by adapter during deployment of your application.
public void
setClientCredentials(AdapterConfig
Fully resolved deployment
deployment, Map<String, String>
You should put any HTTP request headers you want to use for authentication of client. These headers will be attached to the HTTP request sent to Keycloak server
requestHeaders, Map<String, String>
You should put any request parameters you want to use for authentication of client. These parameters will be attached to the HTTP request sent to Keycloak server
formParams)

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.setClientCredentials.

Called every time adapter needs to perform backchannel request
public void
setTokenTimeout(int tokenTimeout)

public void
setupKeyPair(KeyPair keyPair)

public void
setupKeyPair(KeyPair keyPair, String algorithm)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

keyPairback to summary
private KeyPair keyPair
PROVIDER_IDback to summary
public static final String PROVIDER_ID
sigCtxback to summary
private SignatureSignerContext sigCtx
tokenTimeoutback to summary
private int tokenTimeout

Constructor Detail

JWTClientCredentialsProviderback to summary
public JWTClientCredentialsProvider()

Method Detail

asIntback to summary
private Integer asInt(Map<String, Object> cfg, String cfgKey, int defaultValue)
createRequestTokenback to summary
protected JsonWebToken createRequestToken(String clientId, String realmInfoUrl)
createSignedRequestTokenback to summary
public String createSignedRequestToken(String clientId, String realmInfoUrl)
getIdback to summary
public String getId()

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.getId.

Doc from org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.getId.

Return the ID of the provider. Use this ID in the keycloak.json configuration as the subelement of the "credentials" element For example if your provider has ID "kerberos-keytab" , use the configuration like this in keycloak.json "credentials": { "kerberos-keytab": { "keytab": "/tmp/foo" } }

Annotations
@Override
getPublicKeyback to summary
public PublicKey getPublicKey()
getTokenTimeoutback to summary
protected int getTokenTimeout()
initback to summary
public void init(AdapterConfig deployment, Object config)

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.init.

Doc from org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.init.

Called by adapter during deployment of your application. You can for example read configuration and init your authenticator here

Parameters
deployment:AdapterConfig

the adapter configuration

config:Object

the configuration of your provider read from keycloak.json . For the kerberos-keytab example above, it will return map with the single key "keytab" with value "/tmp/foo"

Annotations
@Override
setClientCredentialsback to summary
public void setClientCredentials(AdapterConfig deployment, Map<String, String> requestHeaders, Map<String, String> formParams)

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.setClientCredentials.

Doc from org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.setClientCredentials.

Called every time adapter needs to perform backchannel request

Parameters
deployment:AdapterConfig

Fully resolved deployment

requestHeaders:Map<String, String>

You should put any HTTP request headers you want to use for authentication of client. These headers will be attached to the HTTP request sent to Keycloak server

formParams:Map<String, String>

You should put any request parameters you want to use for authentication of client. These parameters will be attached to the HTTP request sent to Keycloak server

Annotations
@Override
setTokenTimeoutback to summary
public void setTokenTimeout(int tokenTimeout)
setupKeyPairback to summary
public void setupKeyPair(KeyPair keyPair)
setupKeyPairback to summary
public void setupKeyPair(KeyPair keyPair, String algorithm)