Package org.keycloak.protocol.oidc.mappers

Class AbstractPairwiseSubMapper

java.lang.Object

org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper

org.keycloak.protocol.oidc.mappers.AbstractPairwiseSubMapper

All Implemented Interfaces:

OIDCAccessTokenMapper, OIDCIDTokenMapper, TokenIntrospectionTokenMapper, UserInfoTokenMapper, ProtocolMapper, ConfiguredProvider, Provider, ProviderFactory<ProtocolMapper>

Direct Known Subclasses:

SHA256PairwiseSubMapper

public abstract class AbstractPairwiseSubMapper
extends AbstractOIDCProtocolMapper
implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper, TokenIntrospectionTokenMapper

Set the 'sub' claim to pairwise .

Author:

Martin Hardselius

Field Summary

Fields

Modifier and Type	Field	Description
static final String	PROVIDER_ID_SUFFIX

Fields inherited from class org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper

TOKEN_MAPPER_CATEGORY

Constructor Summary

Constructors

Constructor	Description
AbstractPairwiseSubMapper()

Method Summary

Modifier and Type	Method	Description
abstract String	generateSub(ProtocolMapperModel mappingModel, String sectorIdentifier, String localSub)	Generates a pairwise subject identifier.
List<ProviderConfigProperty>	getAdditionalConfigProperties()	Override to add additional provider configuration properties.
final List<ProviderConfigProperty>	getConfigProperties()
final String	getDisplayCategory()
final String	getId()
abstract String	getIdPrefix()
protected void	setAccessTokenSubject(IDToken token, String pairwiseSub)
protected void	setIDTokenSubject(IDToken token, String pairwiseSub)
protected void	setUserInfoTokenSubject(IDToken token, String pairwiseSub)
AccessToken	transformAccessToken(AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
IDToken	transformIDToken(IDToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
AccessToken	transformIntrospectionToken(AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
AccessToken	transformUserInfoToken(AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx)
void	validateAdditionalConfig(KeycloakSession session, RealmModel realm, ProtocolMapperContainerModel mapperContainer, ProtocolMapperModel mapperModel)	Override to add additional configuration validation.
final void	validateConfig(KeycloakSession session, RealmModel realm, ProtocolMapperContainerModel mapperContainer, ProtocolMapperModel mapperModel)

Methods inherited from class org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper

close, create, getEffectiveModel, getProtocol, init, postInit, setClaim, setClaim, setClaim, transformAccessTokenResponse

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.provider.ConfiguredProvider

getConfig, getHelpText

Methods inherited from interface org.keycloak.protocol.ProtocolMapper

getDisplayType, getPriority

Methods inherited from interface org.keycloak.provider.ProviderFactory

getConfigMetadata, order

Field Details

PROVIDER_ID_SUFFIX

public static final String PROVIDER_ID_SUFFIX

See Also:

• Constant Field Values

Constructor Details

AbstractPairwiseSubMapper

public AbstractPairwiseSubMapper()

Method Details

getIdPrefix

public abstract String getIdPrefix()

generateSub

public abstract String generateSub(ProtocolMapperModel mappingModel,
 String sectorIdentifier,
 String localSub)

Generates a pairwise subject identifier.

Parameters:

mappingModel -

sectorIdentifier - client sector identifier

localSub - local subject identifier (user id)

Returns:

A pairwise subject identifier

getAdditionalConfigProperties

public List<ProviderConfigProperty> getAdditionalConfigProperties()

Override to add additional provider configuration properties. By default, a pairwise sub mapper will only contain configuration for a sector identifier URI.

Returns:

A list of provider configuration properties.

validateAdditionalConfig

public void validateAdditionalConfig(KeycloakSession session,
 RealmModel realm,
 ProtocolMapperContainerModel mapperContainer,
 ProtocolMapperModel mapperModel)
                              throws ProtocolMapperConfigException

Override to add additional configuration validation. Called when instance of mapperModel is created/updated for this protocolMapper through admin endpoint.

Parameters:

session -

realm -

mapperContainer - client or clientScope

mapperModel -

Throws:

ProtocolMapperConfigException - if configuration provided in mapperModel is not valid

getDisplayCategory

public final String getDisplayCategory()

Specified by:

getDisplayCategory in interface ProtocolMapper

transformIDToken

public IDToken transformIDToken(IDToken token,
 ProtocolMapperModel mappingModel,
 KeycloakSession session,
 UserSessionModel userSession,
 ClientSessionContext clientSessionCtx)

Specified by:

transformIDToken in interface OIDCIDTokenMapper

Overrides:

transformIDToken in class AbstractOIDCProtocolMapper

transformAccessToken

public AccessToken transformAccessToken(AccessToken token,
 ProtocolMapperModel mappingModel,
 KeycloakSession session,
 UserSessionModel userSession,
 ClientSessionContext clientSessionCtx)

Specified by:

transformAccessToken in interface OIDCAccessTokenMapper

Overrides:

transformAccessToken in class AbstractOIDCProtocolMapper

transformIntrospectionToken

public AccessToken transformIntrospectionToken(AccessToken token,
 ProtocolMapperModel mappingModel,
 KeycloakSession session,
 UserSessionModel userSession,
 ClientSessionContext clientSessionCtx)

Specified by:

transformIntrospectionToken in interface TokenIntrospectionTokenMapper

Overrides:

transformIntrospectionToken in class AbstractOIDCProtocolMapper

transformUserInfoToken

public AccessToken transformUserInfoToken(AccessToken token,
 ProtocolMapperModel mappingModel,
 KeycloakSession session,
 UserSessionModel userSession,
 ClientSessionContext clientSessionCtx)

Specified by:

transformUserInfoToken in interface UserInfoTokenMapper

Overrides:

transformUserInfoToken in class AbstractOIDCProtocolMapper

setIDTokenSubject

protected void setIDTokenSubject(IDToken token,
 String pairwiseSub)

setAccessTokenSubject

protected void setAccessTokenSubject(IDToken token,
 String pairwiseSub)

setUserInfoTokenSubject

protected void setUserInfoTokenSubject(IDToken token,
 String pairwiseSub)

getConfigProperties

public final List<ProviderConfigProperty> getConfigProperties()

Specified by:

getConfigProperties in interface ConfiguredProvider

validateConfig

public final void validateConfig(KeycloakSession session,
 RealmModel realm,
 ProtocolMapperContainerModel mapperContainer,
 ProtocolMapperModel mapperModel)
                          throws ProtocolMapperConfigException

Specified by:

validateConfig in interface ProtocolMapper

Throws:

ProtocolMapperConfigException

getId

public final String getId()

Specified by:

getId in interface ProviderFactory<ProtocolMapper>