libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

KEYCLOAK-14940 refresh expired idtoken

Browse source
This commit is contained in:
Helder Alves 2020-07-29 11:12:29 -03:00 committed by Pedro Igor
parent 1e6c37e423
commit 541063f2ce
1 changed files with 18 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/RefreshableKeycloakSecurityContext.java
View file

@ -63,6 +63,18 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
return super.getTokenString(); return super.getTokenString();
} }
@Override
public IDToken getIdToken() {
refreshExpiredToken(true);
return super.getIdToken();
}
@Override
public String getIdTokenString() {
refreshExpiredToken(true);
return super.getIdTokenString();
}
public String getRefreshToken() { public String getRefreshToken() {
return refreshToken; return refreshToken;
} }
@ -139,25 +151,28 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
} }
String tokenString = response.getToken(); String tokenString = response.getToken();
AccessToken token = null; AccessToken token = null;
IDToken idToken = null;
try { try {
AdapterTokenVerifier.VerifiedTokens tokens = AdapterTokenVerifier.verifyTokens(tokenString, response.getIdToken(), deployment); AdapterTokenVerifier.VerifiedTokens tokens = AdapterTokenVerifier.verifyTokens(tokenString, response.getIdToken(), deployment);
token = tokens.getAccessToken(); token = tokens.getAccessToken();
idToken = tokens.getIdToken();
log.debug("Token Verification succeeded!"); log.debug("Token Verification succeeded!");
} catch (VerificationException e) { } catch (VerificationException e) {
log.error("failed verification of token"); log.error("failed verification of token");
return false; return false;
} }
// If the TTL is greater-or-equal to the expire time on the refreshed token, have to abort or go into an infinite refresh loop // If the TTL is greater-or-equal to the expire time on the refreshed token, have to abort or go into an infinite refresh loop
if (!isTokenTimeToLiveSufficient(token)) { if (!isTokenTimeToLiveSufficient(token)) {
log.error("failed to refresh the token with a longer time-to-live than the minimum"); log.error("failed to refresh the token with a longer time-to-live than the minimum");
return false; return false;
} }
if (response.getNotBeforePolicy() > deployment.getNotBefore()) { if (response.getNotBeforePolicy() > deployment.getNotBefore()) {
deployment.updateNotBefore(response.getNotBeforePolicy()); deployment.updateNotBefore(response.getNotBeforePolicy());
} }
if (idToken != null) {
this.idToken = idToken;
this.idTokenString = response.getIdToken();
}
this.token = token; this.token = token;
if (response.getRefreshToken() != null) { if (response.getRefreshToken() != null) {
if (log.isTraceEnabled()) { if (log.isTraceEnabled()) {