From eac334124175156a762bff0dd6d4e56f02c9c46e Mon Sep 17 00:00:00 2001 From: Michito Okai Date: Thu, 1 Oct 2020 15:49:06 +0900 Subject: [PATCH] KEYCLOAK-15779 Authorization Server Metadata for the URL of the authorization server's JWK Set [JWK] document --- .../org/keycloak/protocol/oidc/OIDCWellKnownProvider.java | 6 +++++- .../keycloak/testsuite/oidc/OIDCWellKnownProviderTest.java | 2 ++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/services/src/main/java/org/keycloak/protocol/oidc/OIDCWellKnownProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/OIDCWellKnownProvider.java index aa5f09ec6a..bbf94d0053 100755 --- a/services/src/main/java/org/keycloak/protocol/oidc/OIDCWellKnownProvider.java +++ b/services/src/main/java/org/keycloak/protocol/oidc/OIDCWellKnownProvider.java @@ -94,7 +94,11 @@ public class OIDCWellKnownProvider implements WellKnownProvider { config.setIntrospectionEndpoint(backendUriBuilder.clone().path(OIDCLoginProtocolService.class, "token").path(TokenEndpoint.class, "introspect").build(realm.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL).toString()); config.setUserinfoEndpoint(backendUriBuilder.clone().path(OIDCLoginProtocolService.class, "issueUserInfo").build(realm.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL).toString()); config.setLogoutEndpoint(frontendUriBuilder.clone().path(OIDCLoginProtocolService.class, "logout").build(realm.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL).toString()); - config.setJwksUri(backendUriBuilder.clone().path(OIDCLoginProtocolService.class, "certs").build(realm.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL).toString()); + URI jwksUri = backendUriBuilder.clone().path(OIDCLoginProtocolService.class, "certs").build(realm.getName(), + OIDCLoginProtocol.LOGIN_PROTOCOL); + if (isHttps(jwksUri)) { + config.setJwksUri(jwksUri.toString()); + } config.setCheckSessionIframe(frontendUriBuilder.clone().path(OIDCLoginProtocolService.class, "getLoginStatusIframe").build(realm.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL).toString()); config.setRegistrationEndpoint(RealmsResource.clientRegistrationUrl(backendUriInfo).path(ClientRegistrationService.class, "provider").build(realm.getName(), OIDCClientRegistrationProviderFactory.ID).toString()); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCWellKnownProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCWellKnownProviderTest.java index 28c73f2508..e75220c88e 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCWellKnownProviderTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCWellKnownProviderTest.java @@ -183,6 +183,8 @@ public class OIDCWellKnownProviderTest extends AbstractKeycloakTest { try { OIDCConfigurationRepresentation oidcConfig = getOIDCDiscoveryRepresentation(client, "http://localhost:8180/auth"); + assertNull(oidcConfig.getJwksUri()); + // Token Revocation assertNull(oidcConfig.getRevocationEndpoint()); Assert.assertNull(oidcConfig.getRevocationEndpointAuthMethodsSupported());