Top Description Fields Constructors Methods
org.keycloak.protocol.oidc.client.authentication

public Class JWTClientSecretCredentialsProvider

extends Object
implements ClientCredentialsProvider
Class Inheritance
All Implemented Interfaces
org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider
Imports
java.nio.charset.StandardCharsets, java.util.Map, .UUID, javax.crypto.SecretKey, javax.crypto.spec.SecretKeySpec, org.jboss.logging.Logger, org.keycloak.OAuth2Constants, org.keycloak.common.util.Time, org.keycloak.crypto.Algorithm, .JavaAlgorithm, org.keycloak.jose.jws.JWSBuilder, org.keycloak.representations.JsonWebToken, org.keycloak.representations.adapters.config.AdapterConfig
Client authentication based on JWT signed by client secret instead of private key . See specs for more details.

Field Summary

Modifier and TypeField and Description
private SecretKey
clientSecret

private String
clientSecretJwtAlg

private static final Logger
logger

public static final String
PROVIDER_ID

Constructor Summary

AccessConstructor and Description
public
JWTClientSecretCredentialsProvider()

Method Summary

Modifier and TypeMethod and Description
protected JsonWebToken
createRequestToken(String clientId, String realmInfoUrl)

public String
createSignedRequestToken(String clientId, String realmInfoUrl)

public String
createSignedRequestToken(String clientId, String realmInfoUrl, String algorithm)

public String
getId()

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.getId.

Return the ID of the provider.
public void
init(AdapterConfig
the adapter configuration
deployment, Object
the configuration of your provider read from keycloak.json . For the kerberos-keytab example above, it will return map with the single key "keytab" with value "/tmp/foo"
config)

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.init.

Called by adapter during deployment of your application.
private boolean
isValidClientSecretJwtAlg(String clientSecretJwtAlg)

public void
setClientCredentials(AdapterConfig
Fully resolved deployment
deployment, Map<String, String>
You should put any HTTP request headers you want to use for authentication of client. These headers will be attached to the HTTP request sent to Keycloak server
requestHeaders, Map<String, String>
You should put any request parameters you want to use for authentication of client. These parameters will be attached to the HTTP request sent to Keycloak server
formParams)

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.setClientCredentials.

Called every time adapter needs to perform backchannel request
public void
setClientSecret(String clientSecretString)

public void
setClientSecret(String clientSecretString, String algorithm)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

clientSecretback to summary
private SecretKey clientSecret
clientSecretJwtAlgback to summary
private String clientSecretJwtAlg
loggerback to summary
private static final Logger logger
PROVIDER_IDback to summary
public static final String PROVIDER_ID

Constructor Detail

JWTClientSecretCredentialsProviderback to summary
public JWTClientSecretCredentialsProvider()

Method Detail

createRequestTokenback to summary
protected JsonWebToken createRequestToken(String clientId, String realmInfoUrl)
createSignedRequestTokenback to summary
public String createSignedRequestToken(String clientId, String realmInfoUrl)
createSignedRequestTokenback to summary
public String createSignedRequestToken(String clientId, String realmInfoUrl, String algorithm)
getIdback to summary
public String getId()

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.getId.

Doc from org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.getId.

Return the ID of the provider. Use this ID in the keycloak.json configuration as the subelement of the "credentials" element For example if your provider has ID "kerberos-keytab" , use the configuration like this in keycloak.json "credentials": { "kerberos-keytab": { "keytab": "/tmp/foo" } }

Annotations
@Override
initback to summary
public void init(AdapterConfig deployment, Object config)

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.init.

Doc from org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.init.

Called by adapter during deployment of your application. You can for example read configuration and init your authenticator here

Parameters
deployment:AdapterConfig

the adapter configuration

config:Object

the configuration of your provider read from keycloak.json . For the kerberos-keytab example above, it will return map with the single key "keytab" with value "/tmp/foo"

Annotations
@Override
isValidClientSecretJwtAlgback to summary
private boolean isValidClientSecretJwtAlg(String clientSecretJwtAlg)
setClientCredentialsback to summary
public void setClientCredentials(AdapterConfig deployment, Map<String, String> requestHeaders, Map<String, String> formParams)

Implements org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.setClientCredentials.

Doc from org.keycloak.protocol.oidc.client.authentication.ClientCredentialsProvider.setClientCredentials.

Called every time adapter needs to perform backchannel request

Parameters
deployment:AdapterConfig

Fully resolved deployment

requestHeaders:Map<String, String>

You should put any HTTP request headers you want to use for authentication of client. These headers will be attached to the HTTP request sent to Keycloak server

formParams:Map<String, String>

You should put any request parameters you want to use for authentication of client. These parameters will be attached to the HTTP request sent to Keycloak server

Annotations
@Override
setClientSecretback to summary
public void setClientSecret(String clientSecretString)
setClientSecretback to summary
public void setClientSecret(String clientSecretString, String algorithm)