KEYCLOAK-12316 Simplify conditions in packages: authentication, broker, credential, protocol from module "services"
This commit is contained in:
parent
9f69386a53
commit
c61cc1a493
10 changed files with 15 additions and 16 deletions
|
@ -127,7 +127,7 @@ public class JWTClientAuthenticator extends AbstractClientAuthenticator {
|
||||||
boolean signatureValid;
|
boolean signatureValid;
|
||||||
try {
|
try {
|
||||||
JsonWebToken jwt = context.getSession().tokens().decodeClientJWT(clientAssertion, client, JsonWebToken.class);
|
JsonWebToken jwt = context.getSession().tokens().decodeClientJWT(clientAssertion, client, JsonWebToken.class);
|
||||||
signatureValid = jwt == null ? false : true;
|
signatureValid = jwt != null;
|
||||||
} catch (RuntimeException e) {
|
} catch (RuntimeException e) {
|
||||||
Throwable cause = e.getCause() != null ? e.getCause() : e;
|
Throwable cause = e.getCause() != null ? e.getCause() : e;
|
||||||
throw new RuntimeException("Signature on JWT token failed validation", cause);
|
throw new RuntimeException("Signature on JWT token failed validation", cause);
|
||||||
|
|
|
@ -33,7 +33,7 @@ public class ConditionalUserConfiguredAuthenticator implements ConditionalAuthen
|
||||||
AuthenticatorFactory factory = (AuthenticatorFactory) context.getSession().getKeycloakSessionFactory().getProviderFactory(Authenticator.class, e.getAuthenticator());
|
AuthenticatorFactory factory = (AuthenticatorFactory) context.getSession().getKeycloakSessionFactory().getProviderFactory(Authenticator.class, e.getAuthenticator());
|
||||||
if (factory != null) {
|
if (factory != null) {
|
||||||
Authenticator auth = factory.create(context.getSession());
|
Authenticator auth = factory.create(context.getSession());
|
||||||
if (auth != null && auth instanceof ConditionalAuthenticator) {
|
if (auth instanceof ConditionalAuthenticator) {
|
||||||
isConditionalAuthenticator = true;
|
isConditionalAuthenticator = true;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -165,7 +165,7 @@ public class WebAuthnRegister implements RequiredActionProvider, CredentialRegis
|
||||||
Challenge challenge = new DefaultChallenge(context.getAuthenticationSession().getAuthNote(WebAuthnConstants.AUTH_CHALLENGE_NOTE));
|
Challenge challenge = new DefaultChallenge(context.getAuthenticationSession().getAuthNote(WebAuthnConstants.AUTH_CHALLENGE_NOTE));
|
||||||
ServerProperty serverProperty = new ServerProperty(origin, rpId, challenge, null);
|
ServerProperty serverProperty = new ServerProperty(origin, rpId, challenge, null);
|
||||||
// check User Verification by considering a malicious user might modify the result of calling WebAuthn API
|
// check User Verification by considering a malicious user might modify the result of calling WebAuthn API
|
||||||
boolean isUserVerificationRequired = policy.getUserVerificationRequirement().equals(WebAuthnConstants.OPTION_REQUIRED) == true ? true : false;
|
boolean isUserVerificationRequired = policy.getUserVerificationRequirement().equals(WebAuthnConstants.OPTION_REQUIRED);
|
||||||
|
|
||||||
try {
|
try {
|
||||||
WebAuthnRegistrationContext registrationContext = new WebAuthnRegistrationContext(clientDataJSON, attestationObject, serverProperty, isUserVerificationRequired);
|
WebAuthnRegistrationContext registrationContext = new WebAuthnRegistrationContext(clientDataJSON, attestationObject, serverProperty, isUserVerificationRequired);
|
||||||
|
|
|
@ -103,7 +103,7 @@ public class OIDCIdentityProviderConfig extends OAuth2IdentityProviderConfig {
|
||||||
|
|
||||||
public boolean isDisableUserInfoService() {
|
public boolean isDisableUserInfoService() {
|
||||||
String disableUserInfo = getConfig().get("disableUserInfo");
|
String disableUserInfo = getConfig().get("disableUserInfo");
|
||||||
return disableUserInfo == null ? false : Boolean.valueOf(disableUserInfo);
|
return Boolean.parseBoolean(disableUserInfo);
|
||||||
}
|
}
|
||||||
|
|
||||||
public void setDisableUserInfoService(boolean disable) {
|
public void setDisableUserInfoService(boolean disable) {
|
||||||
|
|
|
@ -152,7 +152,7 @@ public class UserCredentialStoreManager implements UserCredentialManager, OnUser
|
||||||
} else {
|
} else {
|
||||||
if (user.getFederationLink() != null) {
|
if (user.getFederationLink() != null) {
|
||||||
UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
|
UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
|
||||||
if (provider != null && provider instanceof CredentialInputValidator) {
|
if (provider instanceof CredentialInputValidator) {
|
||||||
if (!UserStorageManager.isStorageProviderEnabled(realm, user.getFederationLink())) return false;
|
if (!UserStorageManager.isStorageProviderEnabled(realm, user.getFederationLink())) return false;
|
||||||
validate(realm, user, toValidate, ((CredentialInputValidator)provider));
|
validate(realm, user, toValidate, ((CredentialInputValidator)provider));
|
||||||
}
|
}
|
||||||
|
@ -205,7 +205,7 @@ public class UserCredentialStoreManager implements UserCredentialManager, OnUser
|
||||||
} else {
|
} else {
|
||||||
if (user.getFederationLink() != null) {
|
if (user.getFederationLink() != null) {
|
||||||
UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
|
UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
|
||||||
if (provider != null && provider instanceof CredentialInputUpdater) {
|
if (provider instanceof CredentialInputUpdater) {
|
||||||
if (!UserStorageManager.isStorageProviderEnabled(realm, user.getFederationLink())) return;
|
if (!UserStorageManager.isStorageProviderEnabled(realm, user.getFederationLink())) return;
|
||||||
if (((CredentialInputUpdater) provider).updateCredential(realm, user, input)) return;
|
if (((CredentialInputUpdater) provider).updateCredential(realm, user, input)) return;
|
||||||
}
|
}
|
||||||
|
@ -236,7 +236,7 @@ public class UserCredentialStoreManager implements UserCredentialManager, OnUser
|
||||||
} else {
|
} else {
|
||||||
if (user.getFederationLink() != null) {
|
if (user.getFederationLink() != null) {
|
||||||
UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
|
UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
|
||||||
if (provider != null && provider instanceof CredentialInputUpdater) {
|
if (provider instanceof CredentialInputUpdater) {
|
||||||
if (!UserStorageManager.isStorageProviderEnabled(realm, user.getFederationLink())) return;
|
if (!UserStorageManager.isStorageProviderEnabled(realm, user.getFederationLink())) return;
|
||||||
((CredentialInputUpdater) provider).disableCredentialType(realm, user, credentialType);
|
((CredentialInputUpdater) provider).disableCredentialType(realm, user, credentialType);
|
||||||
}
|
}
|
||||||
|
@ -268,7 +268,7 @@ public class UserCredentialStoreManager implements UserCredentialManager, OnUser
|
||||||
} else {
|
} else {
|
||||||
if (user.getFederationLink() != null) {
|
if (user.getFederationLink() != null) {
|
||||||
UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
|
UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
|
||||||
if (provider != null && provider instanceof CredentialInputUpdater) {
|
if (provider instanceof CredentialInputUpdater) {
|
||||||
if (!UserStorageManager.isStorageProviderEnabled(realm, user.getFederationLink())) return Collections.EMPTY_SET;
|
if (!UserStorageManager.isStorageProviderEnabled(realm, user.getFederationLink())) return Collections.EMPTY_SET;
|
||||||
types.addAll(((CredentialInputUpdater) provider).getDisableableCredentialTypes(realm, user));
|
types.addAll(((CredentialInputUpdater) provider).getDisableableCredentialTypes(realm, user));
|
||||||
}
|
}
|
||||||
|
@ -298,7 +298,7 @@ public class UserCredentialStoreManager implements UserCredentialManager, OnUser
|
||||||
} else {
|
} else {
|
||||||
if (user.getFederationLink() != null) {
|
if (user.getFederationLink() != null) {
|
||||||
UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
|
UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
|
||||||
if (provider != null && provider instanceof CredentialInputValidator) {
|
if (provider instanceof CredentialInputValidator) {
|
||||||
if (!UserStorageManager.isStorageProviderEnabled(realm, user.getFederationLink())) return false;
|
if (!UserStorageManager.isStorageProviderEnabled(realm, user.getFederationLink())) return false;
|
||||||
if (((CredentialInputValidator) provider).isConfiguredFor(realm, user, type)) return true;
|
if (((CredentialInputValidator) provider).isConfiguredFor(realm, user, type)) return true;
|
||||||
}
|
}
|
||||||
|
|
|
@ -321,7 +321,7 @@ public class AuthorizationEndpoint extends AuthorizationEndpointBase {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
Matcher m = VALID_CODE_CHALLENGE_PATTERN.matcher(codeChallenge);
|
Matcher m = VALID_CODE_CHALLENGE_PATTERN.matcher(codeChallenge);
|
||||||
return m.matches() ? true : false;
|
return m.matches();
|
||||||
}
|
}
|
||||||
|
|
||||||
private Response checkParamsForPkceEnforcedClient(String codeChallengeMethod, String pkceCodeChallengeMethod, String codeChallenge) {
|
private Response checkParamsForPkceEnforcedClient(String codeChallengeMethod, String pkceCodeChallengeMethod, String codeChallenge) {
|
||||||
|
|
|
@ -1203,7 +1203,7 @@ public class TokenEndpoint {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
Matcher m = VALID_CODE_VERIFIER_PATTERN.matcher(codeVerifier);
|
Matcher m = VALID_CODE_VERIFIER_PATTERN.matcher(codeVerifier);
|
||||||
return m.matches() ? true : false;
|
return m.matches();
|
||||||
}
|
}
|
||||||
|
|
||||||
// https://tools.ietf.org/html/rfc7636#section-4.6
|
// https://tools.ietf.org/html/rfc7636#section-4.6
|
||||||
|
|
|
@ -115,7 +115,7 @@ abstract class AbstractUserRoleMappingMapper extends AbstractOIDCProtocolMapper
|
||||||
if (i == length) {
|
if (i == length) {
|
||||||
// Case when we want to add to existing set of roles
|
// Case when we want to add to existing set of roles
|
||||||
Object last = jsonObject.get(component);
|
Object last = jsonObject.get(component);
|
||||||
if (last != null && last instanceof Collection && attributeValue instanceof Collection) {
|
if (last instanceof Collection && attributeValue instanceof Collection) {
|
||||||
((Collection) last).addAll((Collection) attributeValue);
|
((Collection) last).addAll((Collection) attributeValue);
|
||||||
} else {
|
} else {
|
||||||
jsonObject.put(component, attributeValue);
|
jsonObject.put(component, attributeValue);
|
||||||
|
|
|
@ -347,7 +347,7 @@ public class SamlService extends AuthorizationEndpointBase {
|
||||||
SubjectType.STSubType subType = subject.getSubType();
|
SubjectType.STSubType subType = subject.getSubType();
|
||||||
if (subType != null) {
|
if (subType != null) {
|
||||||
BaseIDAbstractType baseID = subject.getSubType().getBaseID();
|
BaseIDAbstractType baseID = subject.getSubType().getBaseID();
|
||||||
if (baseID != null && baseID instanceof NameIDType) {
|
if (baseID instanceof NameIDType) {
|
||||||
NameIDType nameID = (NameIDType) baseID;
|
NameIDType nameID = (NameIDType) baseID;
|
||||||
authSession.setClientNote(OIDCLoginProtocol.LOGIN_HINT_PARAM, nameID.getValue());
|
authSession.setClientNote(OIDCLoginProtocol.LOGIN_HINT_PARAM, nameID.getValue());
|
||||||
}
|
}
|
||||||
|
@ -366,8 +366,7 @@ public class SamlService extends AuthorizationEndpointBase {
|
||||||
}
|
}
|
||||||
|
|
||||||
//If unset we fall back to default "false"
|
//If unset we fall back to default "false"
|
||||||
final boolean isPassive = (null == requestAbstractType.isIsPassive() ?
|
final boolean isPassive = (null != requestAbstractType.isIsPassive() && requestAbstractType.isIsPassive().booleanValue());
|
||||||
false : requestAbstractType.isIsPassive().booleanValue());
|
|
||||||
return newBrowserAuthentication(authSession, isPassive, redirectToAuthentication);
|
return newBrowserAuthentication(authSession, isPassive, redirectToAuthentication);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -104,7 +104,7 @@ public class HttpBasicAuthenticator implements Authenticator {
|
||||||
if (authHeader.startsWith(BASIC_PREFIX)) {
|
if (authHeader.startsWith(BASIC_PREFIX)) {
|
||||||
final String[] split = authHeader.trim().split("\\s+");
|
final String[] split = authHeader.trim().split("\\s+");
|
||||||
|
|
||||||
if (split == null || split.length != 2) return null;
|
if (split.length != 2) return null;
|
||||||
|
|
||||||
credentials = split[1];
|
credentials = split[1];
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue