diff --git a/src/main/java/org/gcube/common/keycloak/DefaultKeycloakClient.java b/src/main/java/org/gcube/common/keycloak/DefaultKeycloakClient.java index 2596e07..5cd2ea5 100644 --- a/src/main/java/org/gcube/common/keycloak/DefaultKeycloakClient.java +++ b/src/main/java/org/gcube/common/keycloak/DefaultKeycloakClient.java @@ -737,6 +737,20 @@ public class DefaultKeycloakClient implements KeycloakClient { OFFLINE_ACCESS_SCOPE); } + /** + * Queries from the OIDC server an exchanged token by using provided access token, for the given audience (context), + * in URLEncoded form or not, + * + * @param tokenURL the token endpoint {@link URL} of the OIDC server + * @param oidcAccessToken the auth token (the access token URLEncoded by the "Bearer " string) + * @param clientId the client id + * @param clientSecret the client secret + * @param audience the audience (context) where to request the issuing of the ticket (URLEncoded) + * @param requestedTokenType the token type (e.g. refresh) + * @param scope the scope, optional can be null + * @return the issued exchanged token + * @throws KeycloakClientException if an error occurs, inspect the exception for details + */ protected TokenResponse exchangeToken(URL tokenURL, String oidcAccessToken, String clientId, String clientSecret, String audience, String requestedTokenType, String scope) throws KeycloakClientException { @@ -768,18 +782,6 @@ public class DefaultKeycloakClient implements KeycloakClient { return performRequest(tokenURL, null, params); } - /** - * Queries from the OIDC server an exchanged token by using provided access token, for the given audience (context), - * in URLEncoded form or not, and optionally a list of permissions. - * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server - * @param authorization the auth token (the access token URLEncoded by the "Bearer " string) - * @param audience the audience (context) where to request the issuing of the ticket (URLEncoded) - * @param permissions a list of permissions, can be null - * @return the issued token - * @throws OpenIdConnectRESTHelperException if an error occurs (also an unauthorized call), inspect the exception for details - */ - @Override public TokenIntrospectionResponse introspectAccessToken(String context, String clientId, String clientSecret, String accessTokenJWTString) throws KeycloakClientException { diff --git a/src/main/java/org/gcube/common/keycloak/KeycloakClient.java b/src/main/java/org/gcube/common/keycloak/KeycloakClient.java index 082cc8a..33703eb 100644 --- a/src/main/java/org/gcube/common/keycloak/KeycloakClient.java +++ b/src/main/java/org/gcube/common/keycloak/KeycloakClient.java @@ -92,7 +92,7 @@ public interface KeycloakClient { * * @param realmURL the realm URL * @return the configured realm info - * @throws KeycloakClientException + * @throws KeycloakClientException if something goes wrong getting realm info */ PublishedRealmRepresentation getRealmInfo(URL realmURL) throws KeycloakClientException; @@ -149,7 +149,6 @@ public interface KeycloakClient { * Queries an OIDC token from the Keycloak server, by using provided authorization. * * @param context the context where the Keycloak's is needed (e.g. /gcube for DEV) - * @param tokenUrl the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @return the issued token as {@link TokenResponse} object * @throws KeycloakClientException if something goes wrong performing the query @@ -161,7 +160,6 @@ public interface KeycloakClient { * Optionally extra HTTP headers can be provided to be used in the call. * * @param context the context where the Keycloak's is needed (e.g. /gcube for DEV) - * @param tokenUrl the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @param extraHeaders extra HTTP headers to add to the request * @return the issued token as {@link TokenResponse} object @@ -172,7 +170,7 @@ public interface KeycloakClient { /** * Queries an OIDC token from the Keycloak server, by using provided authorization. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server + * @param tokenURL the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @return the issued token as {@link TokenResponse} object * @throws KeycloakClientException if something goes wrong performing the query @@ -183,7 +181,7 @@ public interface KeycloakClient { * Queries an OIDC token from the Keycloak server, by using provided authorization. * Optionally extra HTTP headers can be provided to be used in the call. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server + * @param tokenURL the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @param extraHeaders extra HTTP headers to add to the request * @return the issued token as {@link TokenResponse} object @@ -259,7 +257,6 @@ public interface KeycloakClient { * Queries an OIDC token from the Keycloak server, by using provided authorization, reducing the audience to the requested one. * * @param context the context where the Keycloak's is needed (e.g. /gcube for DEV) - * @param tokenUrl the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @param audience an optional parameter to shrink the token's audience to the requested one (e.g. a specific context), by leveraging on the custom HTTP header and corresponding mapper on Keycloak * @return the issued token as {@link TokenResponse} object @@ -273,7 +270,6 @@ public interface KeycloakClient { * Optionally extra HTTP headers can be provided to be used in the call. * * @param context the context where the Keycloak's is needed (e.g. /gcube for DEV) - * @param tokenUrl the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @param audience an optional parameter to shrink the token's audience to the requested one (e.g. a specific context), by leveraging on the custom HTTP header and corresponding mapper on Keycloak * @param extraHeaders extra HTTP headers to add to the request @@ -286,7 +282,7 @@ public interface KeycloakClient { /** * Queries an OIDC token from the Keycloak server, by using provided authorization, reducing the audience to the requested one. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server + * @param tokenURL the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @param audience an optional parameter to shrink the token's audience to the requested one (e.g. a specific context), by leveraging on the custom HTTP header and corresponding mapper on Keycloak * @return the issued token as {@link TokenResponse} object @@ -299,7 +295,7 @@ public interface KeycloakClient { * Queries an OIDC token from the Keycloak server, by using provided authorization, reducing the audience to the requested one. * Optionally extra HTTP headers can be provided to be used in the call. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server + * @param tokenURL the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @param audience an optional parameter to shrink the token's audience to the requested one (e.g. a specific context), by leveraging on the custom HTTP header and corresponding mapper on Keycloak * @param extraHeaders extra HTTP headers to add to the request @@ -358,7 +354,7 @@ public interface KeycloakClient { * * The implementation uses the custom X-D4Science-Context HTTP header that the proper mapper on Keycloak uses to reduce the audience * - * @param tokenURL the token endpoint {@link URL} of the Keycloak server + * @param context the context where the Keycloak's is needed (e.g. /gcube for DEV) * @param clientId the client id * @param clientSecret the client secret * @param username the user's username @@ -376,7 +372,7 @@ public interface KeycloakClient { * * The implementation uses the custom X-D4Science-Context HTTP header that the proper mapper on Keycloak uses to reduce the audience * - * @param tokenURL the token endpoint {@link URL} of the Keycloak server + * @param context the context where the Keycloak's is needed (e.g. /gcube for DEV) * @param clientId the client id * @param clientSecret the client secret * @param username the user's username @@ -442,7 +438,7 @@ public interface KeycloakClient { /** * Queries an OIDC token for a specific user from the context's Keycloak server, by using provided clientId and client secret and user's username and password. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server + * @param tokenURL the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @param username the user's username * @param password the user's password @@ -457,7 +453,7 @@ public interface KeycloakClient { * Queries an OIDC token for a specific user from the context's Keycloak server, by using provided clientId and client secret and user's username and password. * Optionally extra HTTP headers can be provided to be used in the call. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server + * @param tokenURL the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @param username the user's username * @param password the user's password @@ -487,7 +483,7 @@ public interface KeycloakClient { * Queries an UMA token from the Keycloak server, by using provided authorization, for the given audience (context), * in URLEncoded form or not, and optionally a list of permissions. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server + * @param tokenURL the token endpoint {@link URL} of the OIDC server * @param authorization the authorization to be set as header (e.g. a "Basic ...." auth or an encoded JWT access token preceded by the "Bearer " string) * @param audience the audience (context) where to request the issuing of the ticket (URLEncoded) * @param permissions a list of permissions, can be null @@ -502,7 +498,7 @@ public interface KeycloakClient { * for the given audience (context), in URLEncoded form or not, and optionally a list of permissions. * * @param context the context where the Keycloak's is needed (e.g. /gcube for DEV) - * @param tokenResponse the previously issued token as {@link TokenResponse} object + * @param oidcTokenResponse the previously issued token as {@link TokenResponse} object * @param audience the audience (context) where to request the issuing of the ticket * @param permissions a list of permissions, can be null * @return the issued token as {@link TokenResponse} object @@ -515,8 +511,8 @@ public interface KeycloakClient { * Queries an UMA token from the Keycloak server, by using access-token provided by the {@link TokenResponse} object * for the given audience (context), in URLEncoded form or not, and optionally a list of permissions. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server - * @param tokenResponse the previously issued token as {@link TokenResponse} object + * @param tokenURL the token endpoint {@link URL} of the OIDC server + * @param oidcTokenResponse the previously issued token as {@link TokenResponse} object * @param audience the audience (context) where to request the issuing of the ticket * @param permissions a list of permissions, can be null * @return the issued token as {@link TokenResponse} object @@ -576,7 +572,7 @@ public interface KeycloakClient { * Client id will be read from "issued for" access token's claim and client secret will be not sent. *
NOTE: For public clients types only. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server + * @param tokenURL the token endpoint {@link URL} of the OIDC server * @param tokenResponse the previously issued token as {@link TokenResponse} object * @return the refreshed token as {@link TokenResponse} object * @throws KeycloakClientException if something goes wrong performing the refresh query @@ -601,7 +597,7 @@ public interface KeycloakClient { * Refreshes a previously issued token from the Keycloak server using the refresh token JWT encoded string in the * token response object and the provided client id and secret. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server + * @param tokenURL the token endpoint {@link URL} of the OIDC server * @param clientId the requestor client id, may be null and in this case will be take from the access token "issued for" claim * @param clientSecret the requestor client secret, may be null for non-confidential clients * @param tokenResponse the previously issued token as {@link TokenResponse} object @@ -629,7 +625,7 @@ public interface KeycloakClient { * Refreshes a previously issued token from the Keycloak server by using the client id and secret * and the refresh token JWT encoded string obtained with the access token in the previous token response. * - * @param tokenUrl the token endpoint {@link URL} of the OIDC server + * @param tokenURL the token endpoint {@link URL} of the OIDC server * @param clientId the requestor client id * @param clientSecret the requestor client secret, may be null for non-confidential clients * @param refreshTokenJWTString the previously issued refresh token JWT string diff --git a/src/main/java/org/gcube/common/keycloak/model/JsonWebToken.java b/src/main/java/org/gcube/common/keycloak/model/JsonWebToken.java index cdda20b..820e555 100644 --- a/src/main/java/org/gcube/common/keycloak/model/JsonWebToken.java +++ b/src/main/java/org/gcube/common/keycloak/model/JsonWebToken.java @@ -83,7 +83,7 @@ public class JsonWebToken implements Serializable { /** * Tests that the token is not expired and is not-before. * - * @return + * @return true if is not expired and is not-before */ @JsonIgnore public boolean isActive() { @@ -101,6 +101,7 @@ public class JsonWebToken implements Serializable { /** * Set issuedAt to the current time + * @return the token itself */ @JsonIgnore public JsonWebToken issuedNow() { @@ -186,7 +187,7 @@ public class JsonWebToken implements Serializable { /** * OAuth client the token was issued for. * - * @return + * @return the issued for vale */ public String getIssuedFor() { return issuedFor; @@ -200,7 +201,7 @@ public class JsonWebToken implements Serializable { /** * This is a map of any other claims and data that might be in the IDToken. Could be custom claims set up by the auth server * - * @return + * @return the object's other claims */ @JsonAnyGetter public Map getOtherClaims() { diff --git a/src/main/java/org/gcube/common/keycloak/model/ModelUtils.java b/src/main/java/org/gcube/common/keycloak/model/ModelUtils.java index 967084a..405d816 100644 --- a/src/main/java/org/gcube/common/keycloak/model/ModelUtils.java +++ b/src/main/java/org/gcube/common/keycloak/model/ModelUtils.java @@ -87,9 +87,8 @@ public class ModelUtils { * * @param token the base64 JWT token string * @param publicKey the realm's public key on server - * @param keyAlgorithm the public key algorithm * @return true if the token is valid, false otherwise - * @throws RuntimeException if an error occurs constructing the verifier + * @throws Exception if an error occurs constructing the verifier */ public static boolean isValid(String token, PublicKey publicKey) throws Exception { return isValid(token, publicKey, true); @@ -99,9 +98,10 @@ public class ModelUtils { * Verifies the token validity * * @param token the base64 JWT token string - * @param algorithm the algorithm to use for verification + * @param publicKey the public key to use for verification * @param checkExpiration if false token expiration check is disabled * @return true if the token is valid, false otherwise + * @throws Exception if an error occurs constructing the verifier */ public static boolean isValid(String token, PublicKey publicKey, boolean checkExpiration) throws Exception { JwtParser jwtParser = Jwts.parser().verifyWith(publicKey).build(); diff --git a/src/main/java/org/gcube/common/keycloak/model/UserInfo.java b/src/main/java/org/gcube/common/keycloak/model/UserInfo.java index 4f1ea83..55d5a8d 100644 --- a/src/main/java/org/gcube/common/keycloak/model/UserInfo.java +++ b/src/main/java/org/gcube/common/keycloak/model/UserInfo.java @@ -311,7 +311,7 @@ public class UserInfo { /** * This is a map of any other claims and data that might be in the UserInfo. Could be custom claims set up by the auth server * - * @return + * @return the object's other claims */ @JsonAnyGetter public Map getOtherClaims() { diff --git a/src/main/java/org/gcube/common/keycloak/model/util/Time.java b/src/main/java/org/gcube/common/keycloak/model/util/Time.java index 71b266e..1425ab3 100644 --- a/src/main/java/org/gcube/common/keycloak/model/util/Time.java +++ b/src/main/java/org/gcube/common/keycloak/model/util/Time.java @@ -26,7 +26,7 @@ public class Time { private static int offset; /** - * Returns current time in seconds adjusted by adding {@link #offset) seconds. + * Returns current time in seconds adjusted by adding {@link #offset} seconds. * @return see description */ public static int currentTime() { @@ -34,7 +34,7 @@ public class Time { } /** - * Returns current time in milliseconds adjusted by adding {@link #offset) seconds. + * Returns current time in milliseconds adjusted by adding {@link #offset} seconds. * @return see description */ public static long currentTimeMillis() {