Split OAuth2GrantType and OAuth2GrantTypeFactory

This commit is contained in:
Dmitry Telegin 2024-02-20 06:11:29 +00:00 committed by Pedro Igor
parent c73516ba5b
commit be3d0b6202
22 changed files with 506 additions and 125 deletions

View file

@ -33,7 +33,6 @@ import org.keycloak.models.ClientModel;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
import org.keycloak.provider.Provider;
import org.keycloak.provider.ProviderFactory;
import org.keycloak.representations.dpop.DPoP;
import org.keycloak.services.cors.Cors;
@ -42,7 +41,7 @@ import org.keycloak.services.cors.Cors;
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a>
*/
public interface OAuth2GrantType extends Provider, ProviderFactory<OAuth2GrantType> {
public interface OAuth2GrantType extends Provider {
/**
* Returns the event type associated with this OAuth 2.0 grant type.

View file

@ -0,0 +1,29 @@
/*
* Copyright 2024 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.protocol.oidc.grants;
import org.keycloak.provider.ProviderFactory;
/**
* Provider interface for OAuth 2.0 grant types
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a>
*/
public interface OAuth2GrantTypeFactory extends ProviderFactory<OAuth2GrantType> {
}

View file

@ -47,7 +47,7 @@ public class OAuth2GrantTypeSpi implements Spi {
@Override
public Class<? extends ProviderFactory> getProviderFactoryClass() {
return OAuth2GrantType.class;
return OAuth2GrantTypeFactory.class;
}
}

View file

@ -192,19 +192,9 @@ public class AuthorizationCodeGrantType extends OAuth2GrantTypeBase {
return createTokenResponse(user, userSession, clientSessionCtx, scopeParam, true, s -> {return new TokenResponseContext(formParams, parseResult, clientSessionCtx, s);});
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new AuthorizationCodeGrantType();
}
@Override
public EventType getEventType() {
return EventType.CODE_TO_TOKEN;
}
@Override
public String getId() {
return OAuth2Constants.AUTHORIZATION_CODE;
}
}

View file

@ -0,0 +1,54 @@
/*
* Copyright 2024 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.protocol.oidc.grants;
import org.keycloak.Config;
import org.keycloak.OAuth2Constants;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
/**
* Factory for OAuth 2.0 Authorization Code Grant
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a>
*/
public class AuthorizationCodeGrantTypeFactory implements OAuth2GrantTypeFactory {
@Override
public String getId() {
return OAuth2Constants.AUTHORIZATION_CODE;
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new AuthorizationCodeGrantType();
}
@Override
public void init(Config.Scope config) {
}
@Override
public void postInit(KeycloakSessionFactory factory) {
}
@Override
public void close() {
}
}

View file

@ -174,19 +174,9 @@ public class ClientCredentialsGrantType extends OAuth2GrantTypeBase {
return cors.builder(Response.ok(res, MediaType.APPLICATION_JSON_TYPE)).build();
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new ClientCredentialsGrantType();
}
@Override
public EventType getEventType() {
return EventType.CLIENT_LOGIN;
}
@Override
public String getId() {
return OAuth2Constants.CLIENT_CREDENTIALS;
}
}

View file

@ -0,0 +1,55 @@
/*
* Copyright 2024 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.protocol.oidc.grants;
import org.keycloak.Config;
import org.keycloak.OAuth2Constants;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
/**
* Factory for OAuth 2.0 Client Credentials Grant
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a>
*/
public class ClientCredentialsGrantTypeFactory implements OAuth2GrantTypeFactory {
@Override
public String getId() {
return OAuth2Constants.CLIENT_CREDENTIALS;
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new ClientCredentialsGrantType();
}
@Override
public void init(Config.Scope config) {
}
@Override
public void postInit(KeycloakSessionFactory factory) {
}
@Override
public void close() {
}
}

View file

@ -28,7 +28,6 @@ import java.util.function.Function;
import org.jboss.logging.Logger;
import org.keycloak.Config;
import org.keycloak.OAuth2Constants;
import org.keycloak.OAuthErrorException;
import org.keycloak.common.ClientConnection;
@ -43,7 +42,6 @@ import org.keycloak.models.AuthenticatedClientSessionModel;
import org.keycloak.models.ClientModel;
import org.keycloak.models.ClientSessionContext;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel;
import org.keycloak.models.UserSessionModel;
@ -271,12 +269,4 @@ public abstract class OAuth2GrantTypeBase implements OAuth2GrantType {
public void close() {
}
@Override
public void postInit(KeycloakSessionFactory factory) {
}
@Override
public void init(Config.Scope config) {
}
}

View file

@ -185,19 +185,9 @@ public class PermissionGrantType extends OAuth2GrantTypeBase {
return authorizationResponse;
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new PermissionGrantType();
}
@Override
public EventType getEventType() {
return EventType.PERMISSION_TOKEN;
}
@Override
public String getId() {
return OAuth2Constants.UMA_GRANT_TYPE;
}
}

View file

@ -0,0 +1,55 @@
/*
* Copyright 2024 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.protocol.oidc.grants;
import org.keycloak.Config;
import org.keycloak.OAuth2Constants;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
/**
* Factory for User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a>
*/
public class PermissionGrantTypeFactory implements OAuth2GrantTypeFactory {
@Override
public String getId() {
return OAuth2Constants.UMA_GRANT_TYPE;
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new PermissionGrantType();
}
@Override
public void init(Config.Scope config) {
}
@Override
public void postInit(KeycloakSessionFactory factory) {
}
@Override
public void close() {
}
}

View file

@ -105,19 +105,9 @@ public class RefreshTokenGrantType extends OAuth2GrantTypeBase {
return cors.builder(Response.ok(res, MediaType.APPLICATION_JSON_TYPE)).build();
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new RefreshTokenGrantType();
}
@Override
public EventType getEventType() {
return EventType.REFRESH_TOKEN;
}
@Override
public String getId() {
return OAuth2Constants.REFRESH_TOKEN;
}
}

View file

@ -0,0 +1,55 @@
/*
* Copyright 2024 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.protocol.oidc.grants;
import org.keycloak.Config;
import org.keycloak.OAuth2Constants;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
/**
* Factory for OAuth 2.0 Refresh Token Grant
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a>
*/
public class RefreshTokenGrantTypeFactory implements OAuth2GrantTypeFactory {
@Override
public String getId() {
return OAuth2Constants.REFRESH_TOKEN;
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new RefreshTokenGrantType();
}
@Override
public void init(Config.Scope config) {
}
@Override
public void postInit(KeycloakSessionFactory factory) {
}
@Override
public void close() {
}
}

View file

@ -154,19 +154,9 @@ public class ResourceOwnerPasswordCredentialsGrantType extends OAuth2GrantTypeBa
return cors.builder(Response.ok(res, MediaType.APPLICATION_JSON_TYPE)).build();
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new ResourceOwnerPasswordCredentialsGrantType();
}
@Override
public EventType getEventType() {
return EventType.LOGIN;
}
@Override
public String getId() {
return OAuth2Constants.PASSWORD;
}
}

View file

@ -0,0 +1,55 @@
/*
* Copyright 2024 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.protocol.oidc.grants;
import org.keycloak.Config;
import org.keycloak.OAuth2Constants;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
/**
* Factory for OAuth 2.0 Resource Owner Password Credentials Grant
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a>
*/
public class ResourceOwnerPasswordCredentialsGrantTypeFactory implements OAuth2GrantTypeFactory {
@Override
public String getId() {
return OAuth2Constants.PASSWORD;
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new ResourceOwnerPasswordCredentialsGrantType();
}
@Override
public void init(Config.Scope config) {
}
@Override
public void postInit(KeycloakSessionFactory factory) {
}
@Override
public void close() {
}
}

View file

@ -20,14 +20,10 @@ package org.keycloak.protocol.oidc.grants;
import jakarta.ws.rs.InternalServerErrorException;
import jakarta.ws.rs.core.Response;
import org.keycloak.OAuth2Constants;
import org.keycloak.common.Profile;
import org.keycloak.events.Details;
import org.keycloak.events.EventType;
import org.keycloak.models.KeycloakSession;
import org.keycloak.protocol.oidc.TokenExchangeContext;
import org.keycloak.protocol.oidc.TokenExchangeProvider;
import org.keycloak.provider.EnvironmentDependentProviderFactory;
/**
* OAuth 2.0 Authorization Code Grant
@ -35,7 +31,7 @@ import org.keycloak.provider.EnvironmentDependentProviderFactory;
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a> (et al.)
*/
public class TokenExchangeGrantType extends OAuth2GrantTypeBase implements EnvironmentDependentProviderFactory {
public class TokenExchangeGrantType extends OAuth2GrantTypeBase {
@Override
public Response process() {
@ -64,24 +60,9 @@ public class TokenExchangeGrantType extends OAuth2GrantTypeBase implements Envir
.exchange(exchange);
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new TokenExchangeGrantType();
}
@Override
public boolean isSupported() {
return Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE);
}
@Override
public EventType getEventType() {
return EventType.TOKEN_EXCHANGE;
}
@Override
public String getId() {
return OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE;
}
}

View file

@ -0,0 +1,62 @@
/*
* Copyright 2024 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.protocol.oidc.grants;
import org.keycloak.Config;
import org.keycloak.OAuth2Constants;
import org.keycloak.common.Profile;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.provider.EnvironmentDependentProviderFactory;
/**
* Factory for OAuth 2.0 Authorization Code Grant
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a>
*/
public class TokenExchangeGrantTypeFactory implements OAuth2GrantTypeFactory, EnvironmentDependentProviderFactory {
@Override
public String getId() {
return OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE;
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new TokenExchangeGrantType();
}
@Override
public boolean isSupported() {
return Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE);
}
@Override
public void init(Config.Scope config) {
}
@Override
public void postInit(KeycloakSessionFactory factory) {
}
@Override
public void close() {
}
}

View file

@ -56,7 +56,6 @@ import org.keycloak.services.CorsErrorResponseException;
import org.keycloak.services.ErrorResponseException;
import org.keycloak.services.Urls;
import org.keycloak.services.clientpolicy.ClientPolicyException;
import org.keycloak.services.cors.Cors;
import org.keycloak.services.managers.AuthenticationManager;
import org.keycloak.services.managers.UserConsentManager;
import org.keycloak.services.util.DefaultClientSessionContext;
@ -69,7 +68,7 @@ import org.keycloak.sessions.RootAuthenticationSessionModel;
*
* @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
*/
public class CibaGrantType extends OAuth2GrantTypeBase implements EnvironmentDependentProviderFactory {
public class CibaGrantType extends OAuth2GrantTypeBase {
private static final Logger logger = Logger.getLogger(CibaGrantType.class);
@ -290,24 +289,9 @@ public class CibaGrantType extends OAuth2GrantTypeBase implements EnvironmentDep
logger.debugf("CIBA Grant :: authentication channel %s clientId = %s, authResultId = %s", message, request.getIssuedFor(), request.getAuthResultId());
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new CibaGrantType();
}
@Override
public boolean isSupported() {
return Profile.isFeatureEnabled(Profile.Feature.CIBA);
}
@Override
public EventType getEventType() {
return EventType.AUTHREQID_TO_TOKEN;
}
@Override
public String getId() {
return OAuth2Constants.CIBA_GRANT_TYPE;
}
}

View file

@ -0,0 +1,64 @@
/*
* Copyright 2021 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package org.keycloak.protocol.oidc.grants.ciba;
import org.keycloak.Config;
import org.keycloak.OAuth2Constants;
import org.keycloak.common.Profile;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.protocol.oidc.grants.OAuth2GrantType;
import org.keycloak.protocol.oidc.grants.OAuth2GrantTypeFactory;
import org.keycloak.provider.EnvironmentDependentProviderFactory;
/**
* Factory for OpenID Connect Client-Initiated Backchannel Authentication Flow
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a>
*/
public class CibaGrantTypeFactory implements OAuth2GrantTypeFactory, EnvironmentDependentProviderFactory {
@Override
public String getId() {
return OAuth2Constants.CIBA_GRANT_TYPE;
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new CibaGrantType();
}
@Override
public boolean isSupported() {
return Profile.isFeatureEnabled(Profile.Feature.CIBA);
}
@Override
public void init(Config.Scope config) {
}
@Override
public void postInit(KeycloakSessionFactory factory) {
}
@Override
public void close() {
}
}

View file

@ -73,7 +73,7 @@ import java.util.Map;
* @author <a href="mailto:h2-wada@nri.co.jp">Hiroyuki Wada</a>
* @author <a href="mailto:michito.okai.zn@hitachi.com">Michito Okai</a>
*/
public class DeviceGrantType extends OAuth2GrantTypeBase implements EnvironmentDependentProviderFactory {
public class DeviceGrantType extends OAuth2GrantTypeBase {
// OAuth 2.0 Device Authorization Grant
public static final String OAUTH2_DEVICE_VERIFIED_USER_CODE = "OAUTH2_DEVICE_VERIFIED_USER_CODE";
@ -338,24 +338,9 @@ public class DeviceGrantType extends OAuth2GrantTypeBase implements EnvironmentD
return createTokenResponse(user, userSession, clientSessionCtx, scopeParam, false, s -> {return new DeviceTokenResponseContext(deviceCodeModel, formParams, clientSession, s);});
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new DeviceGrantType();
}
@Override
public boolean isSupported() {
return Profile.isFeatureEnabled(Profile.Feature.DEVICE_FLOW);
}
@Override
public EventType getEventType() {
return EventType.OAUTH2_DEVICE_CODE_TO_TOKEN;
}
@Override
public String getId() {
return OAuth2Constants.DEVICE_CODE_GRANT_TYPE;
}
}

View file

@ -0,0 +1,64 @@
/*
* Copyright 2019 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.protocol.oidc.grants.device;
import org.keycloak.OAuth2Constants;
import org.keycloak.common.Profile;
import org.keycloak.models.KeycloakSession;
import org.keycloak.provider.EnvironmentDependentProviderFactory;
import org.keycloak.protocol.oidc.grants.OAuth2GrantType;
import org.keycloak.Config;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.protocol.oidc.grants.OAuth2GrantTypeFactory;
/**
* Factory for OAuth 2.0 Device Authorization Grant
*
* @author <a href="mailto:demetrio@carretti.pro">Dmitry Telegin</a>
*/
public class DeviceGrantTypeFactory implements OAuth2GrantTypeFactory, EnvironmentDependentProviderFactory {
@Override
public String getId() {
return OAuth2Constants.DEVICE_CODE_GRANT_TYPE;
}
@Override
public OAuth2GrantType create(KeycloakSession session) {
return new DeviceGrantType();
}
@Override
public boolean isSupported() {
return Profile.isFeatureEnabled(Profile.Feature.DEVICE_FLOW);
}
@Override
public void init(Config.Scope config) {
}
@Override
public void postInit(KeycloakSessionFactory factory) {
}
@Override
public void close() {
}
}

View file

@ -1,9 +0,0 @@
org.keycloak.protocol.oidc.grants.AuthorizationCodeGrantType
org.keycloak.protocol.oidc.grants.ClientCredentialsGrantType
org.keycloak.protocol.oidc.grants.PermissionGrantType
org.keycloak.protocol.oidc.grants.RefreshTokenGrantType
org.keycloak.protocol.oidc.grants.ResourceOwnerPasswordCredentialsGrantType
org.keycloak.protocol.oidc.grants.TokenExchangeGrantType
org.keycloak.protocol.oidc.grants.ciba.CibaGrantType
org.keycloak.protocol.oidc.grants.device.DeviceGrantType

View file

@ -0,0 +1,8 @@
org.keycloak.protocol.oidc.grants.AuthorizationCodeGrantTypeFactory
org.keycloak.protocol.oidc.grants.ClientCredentialsGrantTypeFactory
org.keycloak.protocol.oidc.grants.PermissionGrantTypeFactory
org.keycloak.protocol.oidc.grants.RefreshTokenGrantTypeFactory
org.keycloak.protocol.oidc.grants.ResourceOwnerPasswordCredentialsGrantTypeFactory
org.keycloak.protocol.oidc.grants.TokenExchangeGrantTypeFactory
org.keycloak.protocol.oidc.grants.ciba.CibaGrantTypeFactory
org.keycloak.protocol.oidc.grants.device.DeviceGrantTypeFactory