Example #1
0
    public AccessTokenResponse build() {
      if (accessToken != null) {
        event.detail(Details.TOKEN_ID, accessToken.getId());
      }

      if (refreshToken != null) {
        if (event.getEvent().getDetails().containsKey(Details.REFRESH_TOKEN_ID)) {
          event.detail(Details.UPDATED_REFRESH_TOKEN_ID, refreshToken.getId());
        } else {
          event.detail(Details.REFRESH_TOKEN_ID, refreshToken.getId());
        }
      }

      AccessTokenResponse res = new AccessTokenResponse();
      if (idToken != null) {
        String encodedToken = new JWSBuilder().jsonContent(idToken).rsa256(realm.getPrivateKey());
        res.setIdToken(encodedToken);
      }
      if (accessToken != null) {
        String encodedToken =
            new JWSBuilder().jsonContent(accessToken).rsa256(realm.getPrivateKey());
        res.setToken(encodedToken);
        res.setTokenType("bearer");
        res.setSessionState(accessToken.getSessionState());
        if (accessToken.getExpiration() != 0) {
          res.setExpiresIn(accessToken.getExpiration() - Time.currentTime());
        }
      }
      if (refreshToken != null) {
        String encodedToken =
            new JWSBuilder().jsonContent(refreshToken).rsa256(realm.getPrivateKey());
        res.setRefreshToken(encodedToken);
        if (refreshToken.getExpiration() != 0) {
          res.setRefreshExpiresIn(refreshToken.getExpiration() - Time.currentTime());
        }
      }
      int notBefore = realm.getNotBefore();
      if (client.getNotBefore() > notBefore) notBefore = client.getNotBefore();
      res.setNotBeforePolicy(notBefore);
      return res;
    }
Example #2
0
  public TokenValidation validateToken(
      KeycloakSession session,
      UriInfo uriInfo,
      ClientConnection connection,
      RealmModel realm,
      AccessToken oldToken,
      HttpHeaders headers)
      throws OAuthErrorException {
    UserModel user = session.users().getUserById(oldToken.getSubject(), realm);
    if (user == null) {
      throw new OAuthErrorException(
          OAuthErrorException.INVALID_GRANT, "Invalid refresh token", "Unknown user");
    }

    if (!user.isEnabled()) {
      throw new OAuthErrorException(
          OAuthErrorException.INVALID_GRANT, "User disabled", "User disabled");
    }

    UserSessionModel userSession =
        session.sessions().getUserSession(realm, oldToken.getSessionState());
    if (!AuthenticationManager.isSessionValid(realm, userSession)) {
      AuthenticationManager.backchannelLogout(
          session, realm, userSession, uriInfo, connection, headers, true);
      throw new OAuthErrorException(
          OAuthErrorException.INVALID_GRANT, "Session not active", "Session not active");
    }
    ClientSessionModel clientSession = null;
    for (ClientSessionModel clientSessionModel : userSession.getClientSessions()) {
      if (clientSessionModel.getId().equals(oldToken.getClientSession())) {
        clientSession = clientSessionModel;
        break;
      }
    }

    if (clientSession == null) {
      throw new OAuthErrorException(
          OAuthErrorException.INVALID_GRANT,
          "Client session not active",
          "Client session not active");
    }

    ClientModel client = clientSession.getClient();

    if (!client.getClientId().equals(oldToken.getIssuedFor())) {
      throw new OAuthErrorException(
          OAuthErrorException.INVALID_GRANT, "Unmatching clients", "Unmatching clients");
    }

    if (oldToken.getIssuedAt() < client.getNotBefore()) {
      throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT, "Stale token");
    }
    if (oldToken.getIssuedAt() < realm.getNotBefore()) {
      throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT, "Stale token");
    }

    // recreate token.
    Set<RoleModel> requestedRoles = TokenManager.getAccess(null, clientSession.getClient(), user);
    AccessToken newToken =
        createClientAccessToken(
            session, requestedRoles, realm, client, user, userSession, clientSession);
    verifyAccess(oldToken, newToken);

    return new TokenValidation(user, userSession, clientSession, newToken);
  }
Example #3
0
 public int getNotBefore() {
   if (updated != null) return updated.getNotBefore();
   return cached.getNotBefore();
 }