Package org.keycloak.protocol

Interface LoginProtocol

All Superinterfaces:
Provider
All Known Implementing Classes:
DockerAuthV2Protocol, OIDCLoginProtocol, SamlProtocol, TokenEndpoint.TokenExchangeSamlProtocol
public interface LoginProtocol extends Provider
Version:
$Revision: 1 $
Author:
Bill Burke

  • Method Details

    • setSession

      LoginProtocol setSession(KeycloakSession session)

    • setRealm

      LoginProtocol setRealm(RealmModel realm)

    • setUriInfo

      LoginProtocol setUriInfo(jakarta.ws.rs.core.UriInfo uriInfo)

    • setHttpHeaders

      LoginProtocol setHttpHeaders(jakarta.ws.rs.core.HttpHeaders headers)

    • setEventBuilder

      LoginProtocol setEventBuilder(EventBuilder event)

    • authenticated

      jakarta.ws.rs.core.Response authenticated(AuthenticationSessionModel authSession, UserSessionModel userSession, ClientSessionContext clientSessionCtx)

    • sendError

      jakarta.ws.rs.core.Response sendError(AuthenticationSessionModel authSession, LoginProtocol.Error error)

    • getClientData

      ClientData getClientData(AuthenticationSessionModel authSession)
      Returns client data, which will be wrapped in the "clientData" parameter sent within "authentication flow" requests. The purpose of clientData is to be able to send HTTP error response back to the client if authentication fails due some error and authenticationSession is not available anymore (was either expired or removed). So clientData need to contain all the data to be able to send such response. For instance redirect-uri, state in case of OIDC or RelayState in case of SAML etc.
      Parameters:
      authSession - session from which particular clientData can be retrieved
      Returns:
      client data, which will be wrapped in the "clientData" parameter sent within "authentication flow" requests

    • sendError

      jakarta.ws.rs.core.Response sendError(ClientModel client, ClientData clientData, LoginProtocol.Error error)
      Send the specified error to the specified client with the use of this protocol. ClientData can contain additional metadata about how to send error response to the client in a correct way for particular protocol. For instance redirect-uri where to send error, state to be used in OIDC authorization endpoint response etc. This method is usually used when we don't have authenticationSession anymore (it was removed or expired) as otherwise it is recommended to use sendError(AuthenticationSessionModel, Error) NOTE: This method should also validate if provided clientData are valid according to given client (for instance if redirect-uri is valid) as clientData is request parameter, which can be injected to HTTP URLs by anyone.
      Parameters:
      client - client where to send error
      clientData - clientData with additional protocol specific metadata needed for being able to properly send error with the use of this protocol
      error - error to be used
      Returns:
      response if error was sent. Null if error was not sent.

    • backchannelLogout

      jakarta.ws.rs.core.Response backchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession)

    • frontchannelLogout

      jakarta.ws.rs.core.Response frontchannelLogout(UserSessionModel userSession, AuthenticatedClientSessionModel clientSession)

    • finishBrowserLogout

      jakarta.ws.rs.core.Response finishBrowserLogout(UserSessionModel userSession, AuthenticationSessionModel logoutSession)
      This method is called when browser logout is going to be finished. It is not triggered during backchannel logout
      Parameters:
      userSession - user session, which was logged out
      logoutSession - authentication session, which was used during logout to track the logout state
      Returns:
      response to be sent to the client

    • requireReauthentication

      boolean requireReauthentication(UserSessionModel userSession, AuthenticationSessionModel authSession)
      Parameters:
      userSession -
      authSession -
      Returns:
      true if SSO cookie authentication can't be used. User will need to "actively" reauthenticate

    • sendPushRevocationPolicyRequest

      default boolean sendPushRevocationPolicyRequest(RealmModel realm, ClientModel resource, int notBefore, String managementUrl)
      Send not-before revocation policy to the given client.
      Parameters:
      realm -
      resource -
      notBefore -
      managementUrl -
      Returns:
      true if revocation policy was successfully updated at the client, false otherwise.