public class DefaultKeycloakClient extends Object implements KeycloakClient
| Modifier and Type | Field and Description |
|---|---|
protected static String |
AUTHORIZATION_HEADER |
static String |
DEFAULT_BASE_URL |
protected static org.slf4j.Logger |
logger |
AVATAR_URI_PATH, D4S_CONTEXT_HEADER_NAME, D4S_DYNAMIC_SCOPE_NAME, D4S_DYNAMIC_SCOPE_NAME_TOKEN_CLAIM, D4S_EU_EXTENDED_PROFILE_SCOPE, D4S_IDENTITY_SCOPE, DEFAULT_DYNAMIC_SCOPE_SEPARATOR, DEFAULT_REALM, JWK_URI_PATH, OPEN_ID_URI_PATH, PROD_ROOT_SCOPE, TOKEN_INTROSPECT_URI_PATH, TOKEN_URI_PATH| Constructor and Description |
|---|
DefaultKeycloakClient() |
| Modifier and Type | Method and Description |
|---|---|
KeycloakClient |
addDynamicScope(String dynamicScope,
String value)
Adds the dynamic scope to the list of scopes to use for the next OIDC token
requests
|
KeycloakClient |
addScopes(List<String> scopes)
Adds the provided OIDC scopes to the list of scopes to use for the next OIDC
token requests
|
URL |
computeIntrospectionEndpointURL(URL tokenEndpointURL)
Compute the keycloak
introspection endpoint URL starting
from the provided token endpoint. |
protected static String |
constructBasicAuthenticationHeader(String clientId,
String clientSecret) |
protected static String |
constructBeareAuthenticationHeader(TokenResponse oidcTokenResponse) |
protected static String |
constructDynamicScope(String dynamicScope,
String value) |
protected TokenResponse |
exchangeToken(URL tokenURL,
String oidcAccessToken,
String clientId,
String clientSecret,
String audience,
String requestedTokenType,
String scope)
Queries from the OIDC server an exchanged token by using provided access
token, for the given audience (context),
in URLEncoded form or not,
|
TokenResponse |
exchangeTokenForAccessToken(String context,
String oidcAccessToken,
String clientId,
String clientSecret,
String audience)
Exchanges a token for another access token for a specific client and a
specific audience
|
TokenResponse |
exchangeTokenForAccessToken(URL tokenURL,
String oidcAccessToken,
String clientId,
String clientSecret,
String audience)
Exchanges a token for another access token for a specific client and a
specific audience
|
TokenResponse |
exchangeTokenForOfflineToken(String context,
String oidcAccessToken,
String clientId,
String clientSecret,
String audience)
Exchanges a token for another access and an offline refresh tokens for a
specific client and a specific audience
The refresh token will be of the offline type only if the original token has
the
offline_access within its scopes |
TokenResponse |
exchangeTokenForOfflineToken(URL tokenURL,
String oidcAccessToken,
String clientId,
String clientSecret,
String audience)
Exchanges a token for another access and an offline refresh tokens for a
specific client and a specific audience
The refresh token will be of the offline type only if the original token has
the scope
offline_access within its scopes |
TokenResponse |
exchangeTokenForRefreshToken(String context,
String oidcAccessToken,
String clientId,
String clientSecret,
String audience)
Exchanges a token for another access and a refresh tokens for a specific
client and a specific audience
|
TokenResponse |
exchangeTokenForRefreshToken(URL tokenURL,
String oidcAccessToken,
String clientId,
String clientSecret,
String audience)
Exchanges a token for another access and a refresh tokens for a specific
client and a specific audience
|
byte[] |
getAvatarData(String context,
TokenResponse tokenResponse)
Retrieves the user's avatar image data from Keycloak server.
|
byte[] |
getAvatarData(URL avatarURL,
String authorization)
Retrieves the user's avatar image data from Keycloak server.
|
byte[] |
getAvatarData(URL avatarURL,
TokenResponse tokenResponse)
Retrieves the user's avatar image data from Keycloak server.
|
URL |
getAvatarEndpointURL(URL realmBaseURL)
Constructs the Keycloak
avatar endpoint URL from the
realm's base URL. |
String |
getCustomBaseURL() |
URL |
getIntrospectionEndpointURL(URL realmBaseURL)
Constructs the Keycloak
introspection endpoint URL from
the realm's base URL. |
URL |
getJWKEndpointURL(URL realmBaseURL)
Constructs the Keycloak
JWK endpoint URL from the
realm's base URL. |
URL |
getRealmBaseURL(String context)
Returns the Keycloak base
URL for the given context and the default
realm (d4science) |
URL |
getRealmBaseURL(String context,
String realm)
Returns the Keycloak base
URL for the given context and in the given
realm. |
PublishedRealmRepresentation |
getRealmInfo(URL realmURL)
Gets the realm info setup (RSA
public_key,
token-service URL,
account-service URL and tokens-not-before setting) |
JSONWebKeySet |
getRealmJSONWebKeySet(URL jwkURL)
Loads the actual JWK from the Keycloak server
|
URL |
getTokenEndpointURL(URL realmBaseURL)
Constructs the Keycloak
token endpoint URL from the
realm's base URL. |
TokenIntrospectionResponse |
introspectAccessToken(String context,
String clientId,
String clientSecret,
String accessTokenJWTString)
Introspects an access token against the Keycloak server.
|
TokenIntrospectionResponse |
introspectAccessToken(URL introspectionURL,
String clientId,
String clientSecret,
String accessTokenJWTString)
Introspects an access token against the Keycloak server.
|
boolean |
isAccessTokenVerified(String context,
String clientId,
String clientSecret,
String accessTokenJWTString)
Verifies an access token against the Keycloak server.
|
boolean |
isAccessTokenVerified(URL introspectionURL,
String clientId,
String clientSecret,
String accessTokenJWTString)
Verifies an access token against the Keycloak server.
|
protected <T> T |
performRequest(Class<T> returnObjectClass,
URL url,
Map<String,String> headers,
Map<String,List<String>> params) |
protected TokenResponse |
performRequest(URL tokenURL,
Map<String,String> headers,
Map<String,List<String>> params) |
TokenResponse |
queryOIDCToken(String context,
String authorization)
Queries an OIDC token from the Keycloak server, by using provided
authorization.
|
TokenResponse |
queryOIDCToken(String context,
String authorization,
Map<String,String> extraHeaders)
Queries an OIDC token from the Keycloak server, by using provided
authorization.
|
TokenResponse |
queryOIDCToken(String context,
String clientId,
String clientSecret)
Queries an OIDC token from the context's Keycloak server, by using provided
clientId and client secret.
|
TokenResponse |
queryOIDCToken(String context,
String clientId,
String clientSecret,
Map<String,String> extraHeaders)
Queries an OIDC token from the context's Keycloak server, by using provided
clientId and client secret.
|
TokenResponse |
queryOIDCToken(URL tokenURL,
String authorization)
Queries an OIDC token from the Keycloak server, by using provided
authorization.
|
TokenResponse |
queryOIDCToken(URL tokenURL,
String authorization,
Map<String,String> extraHeaders)
Queries an OIDC token from the Keycloak server, by using provided
authorization.
|
TokenResponse |
queryOIDCToken(URL tokenURL,
String clientId,
String clientSecret)
Queries an OIDC token from the Keycloak server, by using provided clientId
and client secret.
|
TokenResponse |
queryOIDCToken(URL tokenURL,
String clientId,
String clientSecret,
Map<String,String> extraHeaders)
Queries an OIDC token from the Keycloak server, by using provided clientId
and client secret.
|
TokenResponse |
queryOIDCTokenOfUser(String context,
String clientId,
String clientSecret,
String username,
String password)
Queries an OIDC token for a specific user from the context's Keycloak server,
by using provided clientId and client secret and user's username and
password.
|
TokenResponse |
queryOIDCTokenOfUser(String context,
String clientId,
String clientSecret,
String username,
String password,
Map<String,String> extraHeaders)
Queries an OIDC token for a specific user from the context's Keycloak server,
by using provided clientId and client secret and user's username and
password.
|
TokenResponse |
queryOIDCTokenOfUserWithContext(String context,
String authorization,
String username,
String password,
String audience)
Queries an OIDC token for a specific user from the context's Keycloak server,
by using provided clientId and client secret and user's username and
password.
|
TokenResponse |
queryOIDCTokenOfUserWithContext(String context,
String authorization,
String username,
String password,
String audience,
Map<String,String> extraHeaders)
Queries an OIDC token for a specific user from the context's Keycloak server,
by using provided clientId and client secret and user's username and
password.
|
TokenResponse |
queryOIDCTokenOfUserWithContext(String context,
String clientId,
String clientSecret,
String username,
String password,
String audience)
Queries an OIDC token for a specific user from the Keycloak server, by using
provided clientId and client secret and user's username and password,
reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenOfUserWithContext(String context,
String clientId,
String clientSecret,
String username,
String password,
String audience,
Map<String,String> extraHeaders)
Queries an OIDC token for a specific user from the Keycloak server, by using
provided clientId and client secret and user's username and password,
reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenOfUserWithContext(URL tokenURL,
String authorization,
String username,
String password,
String audience)
Queries an OIDC token for a specific user from the context's Keycloak server,
by using provided clientId and client secret and user's username and
password.
|
TokenResponse |
queryOIDCTokenOfUserWithContext(URL tokenURL,
String authorization,
String username,
String password,
String audience,
Map<String,String> extraHeaders)
Queries an OIDC token for a specific user from the context's Keycloak server,
by using provided clientId and client secret and user's username and
password.
|
TokenResponse |
queryOIDCTokenOfUserWithContext(URL tokenURL,
String clientId,
String clientSecret,
String username,
String password,
String audience)
Queries an OIDC token for a specific user from the context's Keycloak server,
by using provided clientId and client secret and user's username and
password, reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenOfUserWithContext(URL tokenURL,
String clientId,
String clientSecret,
String username,
String password,
String audience,
Map<String,String> extraHeaders)
Queries an OIDC token for a specific user from the context's Keycloak server,
by using provided clientId and client secret and user's username and
password, , reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenWithContext(String context,
String authorization,
String audience)
Queries an OIDC token from the Keycloak server, by using provided
authorization, reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenWithContext(String context,
String authorization,
String audience,
Map<String,String> extraHeaders)
Queries an OIDC token from the Keycloak server, by using provided
authorization, reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenWithContext(String context,
String clientId,
String clientSecret,
String audience)
Queries an OIDC token from the context's Keycloak server, by using provided
clientId and client secret, reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenWithContext(String context,
String clientId,
String clientSecret,
String audience,
Map<String,String> extraHeaders)
Queries an OIDC token from the context's Keycloak server, by using provided
clientId and client secret, reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenWithContext(URL tokenURL,
String authorization,
String audience)
Queries an OIDC token from the Keycloak server, by using provided
authorization, reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenWithContext(URL tokenURL,
String authorization,
String audience,
Map<String,String> extraHeaders)
Queries an OIDC token from the Keycloak server, by using provided
authorization, reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenWithContext(URL tokenURL,
String clientId,
String clientSecret,
String audience)
Queries an OIDC token from the Keycloak server, by using provided clientId
and client secret, reducing the audience to the requested one.
|
TokenResponse |
queryOIDCTokenWithContext(URL tokenURL,
String clientId,
String clientSecret,
String audience,
Map<String,String> extraHeaders)
Queries an OIDC token from the Keycloak server, by using provided clientId
and client secret, reducing the audience to the requested one.
|
TokenResponse |
queryUMAToken(String context,
String authorization,
String audience,
List<String> permissions)
Queries an UMA token from the Keycloak server, by using provided
authorization, for the given audience (context),
in URLEncoded form or not, and optionally a list of permissions.
|
TokenResponse |
queryUMAToken(String context,
String clientId,
String clientSecret,
String audience,
List<String> permissions)
Queries an UMA token from the Keycloak server, by using provided clientId and
client secret for the given audience
(context), in URLEncoded form or not, and optionally a list of permissions.
|
TokenResponse |
queryUMAToken(String context,
TokenResponse oidcTokenResponse,
String audience,
List<String> permissions)
Queries an UMA token from the Keycloak server, by using access-token provided
by the
TokenResponse object
for the given audience (context), in URLEncoded form or not, and optionally a
list of permissions. |
TokenResponse |
queryUMAToken(URL tokenURL,
String authorization,
String audience,
List<String> permissions)
Queries an UMA token from the Keycloak server, by using provided
authorization, for the given audience (context),
in URLEncoded form or not, and optionally a list of permissions.
|
TokenResponse |
queryUMAToken(URL tokenURL,
String clientId,
String clientSecret,
String audience,
List<String> permissions)
Queries an UMA token from the Keycloak server, by using provided clientId and
client secret for the given audience
(context), in URLEncoded form or not, and optionally a list of permissions.
|
TokenResponse |
queryUMAToken(URL tokenURL,
TokenResponse oidcTokenResponse,
String audience,
List<String> permissions)
Queries an UMA token from the Keycloak server, by using access-token provided
by the
TokenResponse object
for the given audience (context), in URLEncoded form or not, and optionally a
list of permissions. |
TokenResponse |
refreshToken(String context,
String clientId,
String clientSecret,
String refreshTokenJWTString)
Refreshes a previously issued token from the Keycloak server by using the
client id and secret
and the refresh token JWT encoded string obtained with the access token in
the previous token response.
|
TokenResponse |
refreshToken(String context,
String clientId,
String clientSecret,
TokenResponse tokenResponse)
Refreshes a previously issued token from the Keycloak server using the
refresh token JWT encoded string in the
token response object and the provided client id and secret.
|
TokenResponse |
refreshToken(String context,
TokenResponse tokenResponse)
Refreshes a previously issued token from the Keycloak server using the
refresh token JWT encoded string in the
token response object.
|
TokenResponse |
refreshToken(URL tokenURL,
String clientId,
String clientSecret,
String refreshTokenJWTString)
Refreshes a previously issued token from the Keycloak server by using the
client id and secret
and the refresh token JWT encoded string obtained with the access token in
the previous token response.
|
TokenResponse |
refreshToken(URL tokenURL,
String clientId,
String clientSecret,
TokenResponse tokenResponse)
Refreshes a previously issued token from the Keycloak server using the
refresh token JWT encoded string in the
token response object and the provided client id and secret.
|
TokenResponse |
refreshToken(URL tokenURL,
TokenResponse tokenResponse)
Refreshes a previously issued token from the Keycloak server using the
refresh token JWT encoded string in the
token response object.
|
KeycloakClient |
removeAllScopes()
Removes all the custom OIDC scopes from the list of scopes to use the next
OIDC token requests
|
KeycloakClient |
removeScopes(List<String> scopes)
Removes the provided OIDC scopes from the list of scopes to use for the next
OIDC token requests
|
protected void |
safeSetAsExternalCallForOldAPI(org.gcube.common.gxhttp.request.GXHTTPStringRequest request) |
void |
setCustomBaseURL(String customBaseURL) |
KeycloakClient |
useDynamicScopeInsteadOfCustomHeaderForContextRestricion(boolean useDynamicScopeInsteadOfCustomHeaderForContextRestricion)
Sets a flag to use dynamic scope (
KeycloakClient.D4S_DYNAMIC_SCOPE_NAME =
"d4s-context") instead of custom header
(KeycloakClient.D4S_CONTEXT_HEADER_NAME = "x-d4science-context")
when an OIDC token with context is used |
KeycloakClient |
useScopes(List<String> scopes)
Replaces the list of the provided OIDC scopes for the next OIDC token
requests
|
protected static org.slf4j.Logger logger
protected static final String AUTHORIZATION_HEADER
public static final String DEFAULT_BASE_URL
public void setCustomBaseURL(String customBaseURL)
public KeycloakClient useScopes(List<String> scopes)
KeycloakClientuseScopes in interface KeycloakClientscopes - the list of scopes to use in the callspublic KeycloakClient addScopes(List<String> scopes)
KeycloakClientaddScopes in interface KeycloakClientscopes - the list of scopes to addpublic KeycloakClient removeScopes(List<String> scopes)
KeycloakClientremoveScopes in interface KeycloakClientscopes - the list of scopes to removepublic KeycloakClient addDynamicScope(String dynamicScope, String value)
KeycloakClientaddDynamicScope in interface KeycloakClientdynamicScope - the dynamic scope that will be the prefixvalue - the value of the dynamic scopeprotected static String constructDynamicScope(String dynamicScope, String value)
public KeycloakClient removeAllScopes()
KeycloakClientremoveAllScopes in interface KeycloakClientpublic KeycloakClient useDynamicScopeInsteadOfCustomHeaderForContextRestricion(boolean useDynamicScopeInsteadOfCustomHeaderForContextRestricion)
KeycloakClientKeycloakClient.D4S_DYNAMIC_SCOPE_NAME =
"d4s-context") instead of custom header
(KeycloakClient.D4S_CONTEXT_HEADER_NAME = "x-d4science-context")
when an OIDC token with context is useduseDynamicScopeInsteadOfCustomHeaderForContextRestricion in interface KeycloakClientuseDynamicScopeInsteadOfCustomHeaderForContextRestricion - use or not use dynamic scopepublic String getCustomBaseURL()
public URL getRealmBaseURL(String context) throws KeycloakClientException
KeycloakClientURL for the given context and the default
realm (d4science)getRealmBaseURL in interface KeycloakClientcontext - the context where the endpoint is needed (e.g.
/gcube for DEV)token endpoint URLKeycloakClientException - if something goes wrong discovering the
endpoint URLpublic URL getRealmBaseURL(String context, String realm) throws KeycloakClientException
KeycloakClientURL for the given context and in the given
realm.getRealmBaseURL in interface KeycloakClientcontext - the context where the endpoint is needed (e.g.
/gcube for DEV)realm - the realm to use to construct the base URLtoken endpoint URLKeycloakClientException - if something goes wrong discovering the
endpoint URLpublic URL getTokenEndpointURL(URL realmBaseURL) throws KeycloakClientException
KeycloakClienttoken endpoint URL from the
realm's base URL.getTokenEndpointURL in interface KeycloakClientrealmBaseURL - the realm's base URL to usetoken endpoint URLKeycloakClientException - if something goes wrong discovering the
endpoint URLpublic URL getJWKEndpointURL(URL realmBaseURL) throws KeycloakClientException
KeycloakClientJWK endpoint URL from the
realm's base URL.getJWKEndpointURL in interface KeycloakClientrealmBaseURL - the realm's base URL to useJWK endpoint URLKeycloakClientException - if something goes wrong discovering the
endpoint URLpublic URL getIntrospectionEndpointURL(URL realmBaseURL) throws KeycloakClientException
KeycloakClientintrospection endpoint URL from
the realm's base URL.getIntrospectionEndpointURL in interface KeycloakClientrealmBaseURL - the realm's base URL to useintrospection endpoint URLKeycloakClientException - if something goes wrong discovering the
endpoint URLpublic URL getAvatarEndpointURL(URL realmBaseURL) throws KeycloakClientException
KeycloakClientavatar endpoint URL from the
realm's base URL.getAvatarEndpointURL in interface KeycloakClientrealmBaseURL - the realm's base URL to useavatar endpoint URLKeycloakClientException - if something goes wrong discovering the
endpoint URLpublic URL computeIntrospectionEndpointURL(URL tokenEndpointURL) throws KeycloakClientException
KeycloakClientintrospection endpoint URL starting
from the provided token endpoint.computeIntrospectionEndpointURL in interface KeycloakClienttokenEndpointURL - the token endpoint to use in the computeintrospection endpoint URLKeycloakClientException - if something goes wrong discovering the
endpoint URLpublic PublishedRealmRepresentation getRealmInfo(URL realmURL) throws KeycloakClientException
KeycloakClientpublic_key,
token-service URL,
account-service URL and tokens-not-before setting)getRealmInfo in interface KeycloakClientrealmURL - the realm URLKeycloakClientException - if something goes wrong getting realm infopublic JSONWebKeySet getRealmJSONWebKeySet(URL jwkURL) throws KeycloakClientException
KeycloakClientgetRealmJSONWebKeySet in interface KeycloakClientjwkURL - the server's jwk URL to useKeycloakClientException - if something goes wrong getting JWK infopublic TokenResponse queryOIDCToken(String context, String clientId, String clientSecret) throws KeycloakClientException
KeycloakClientqueryOIDCToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the client idclientSecret - the client secretTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCToken(String context, String clientId, String clientSecret, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientqueryOIDCToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the client idclientSecret - the client secretextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCToken(URL tokenURL, String clientId, String clientSecret) throws KeycloakClientException
KeycloakClientqueryOIDCToken in interface KeycloakClienttokenURL - the token endpoint URL of the Keycloak serverclientId - the client idclientSecret - the client secretTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCToken(URL tokenURL, String clientId, String clientSecret, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientqueryOIDCToken in interface KeycloakClienttokenURL - the token endpoint URL of the Keycloak serverclientId - the client idclientSecret - the client secretextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCToken(String context, String authorization) throws KeycloakClientException
KeycloakClientqueryOIDCToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)authorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)TokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCToken(URL tokenURL, String authorization) throws KeycloakClientException
KeycloakClientqueryOIDCToken in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC serverauthorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)TokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCToken(String context, String authorization, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientqueryOIDCToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)authorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)extraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCToken(URL tokenURL, String authorization, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientqueryOIDCToken in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC serverauthorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)extraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenOfUser(String context, String clientId, String clientSecret, String username, String password) throws KeycloakClientException
KeycloakClientqueryOIDCTokenOfUser in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the client idclientSecret - the client secretusername - the user's usernamepassword - the user's passwordTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenOfUser(String context, String clientId, String clientSecret, String username, String password, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientqueryOIDCTokenOfUser in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the client idclientSecret - the client secretusername - the user's usernamepassword - the user's passwordextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenWithContext(String context, String clientId, String clientSecret, String audience) throws KeycloakClientException
KeycloakClientx-d4science-context HTTP
header that the proper mapper on Keycloak uses to reduce the audiencequeryOIDCTokenWithContext in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the client idclientSecret - the client secretaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenWithContext(String context, String authorization, String audience) throws KeycloakClientException
KeycloakClientqueryOIDCTokenWithContext in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)authorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)audience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenWithContext(URL tokenURL, String clientId, String clientSecret, String audience) throws KeycloakClientException
KeycloakClientx-d4science-context HTTP
header that the proper mapper on Keycloak uses to reduce the audiencequeryOIDCTokenWithContext in interface KeycloakClienttokenURL - the token endpoint URL of the Keycloak serverclientId - the client idclientSecret - the client secretaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenWithContext(String context, String clientId, String clientSecret, String audience, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientx-d4science-context HTTP
header that the proper mapper on Keycloak uses to reduce the audiencequeryOIDCTokenWithContext in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the client idclientSecret - the client secretaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenWithContext(URL tokenURL, String clientId, String clientSecret, String audience, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientx-d4science-context HTTP
header that the proper mapper on Keycloak uses to reduce the audiencequeryOIDCTokenWithContext in interface KeycloakClienttokenURL - the token endpoint URL of the Keycloak serverclientId - the client idclientSecret - the client secretaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenWithContext(String context, String authorization, String audience, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientqueryOIDCTokenWithContext in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)authorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)audience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenWithContext(URL tokenURL, String authorization, String audience) throws KeycloakClientException
KeycloakClientqueryOIDCTokenWithContext in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC serverauthorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)audience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakTokenResponse objectKeycloakClientException - if something goes wrong performing the queryprotected static String constructBasicAuthenticationHeader(String clientId, String clientSecret)
public TokenResponse queryOIDCTokenOfUserWithContext(String context, String clientId, String clientSecret, String username, String password, String audience) throws KeycloakClientException
KeycloakClientx-d4science-context HTTP
header that the proper mapper on Keycloak uses to reduce the audiencequeryOIDCTokenOfUserWithContext in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the client idclientSecret - the client secretusername - the user's usernamepassword - the user's passwordaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenOfUserWithContext(String context, String clientId, String clientSecret, String username, String password, String audience, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientx-d4science-context HTTP
header that the proper mapper on Keycloak uses to reduce the audiencequeryOIDCTokenOfUserWithContext in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the client idclientSecret - the client secretusername - the user's usernamepassword - the user's passwordaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenOfUserWithContext(String context, String authorization, String username, String password, String audience) throws KeycloakClientException
KeycloakClientqueryOIDCTokenOfUserWithContext in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)authorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)username - the user's usernamepassword - the user's passwordaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenOfUserWithContext(String context, String authorization, String username, String password, String audience, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientqueryOIDCTokenOfUserWithContext in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)authorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)username - the user's usernamepassword - the user's passwordaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenOfUserWithContext(URL tokenURL, String clientId, String clientSecret, String username, String password, String audience) throws KeycloakClientException
KeycloakClientx-d4science-context HTTP
header that the proper mapper on Keycloak uses to reduce the audiencequeryOIDCTokenOfUserWithContext in interface KeycloakClienttokenURL - the token endpoint URL of the Keycloak serverclientId - the client idclientSecret - the client secretusername - the user's usernamepassword - the user's passwordaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenOfUserWithContext(URL tokenURL, String clientId, String clientSecret, String username, String password, String audience, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientqueryOIDCTokenOfUserWithContext in interface KeycloakClienttokenURL - the token endpoint URL of the Keycloak serverclientId - the client idclientSecret - the client secretusername - the user's usernamepassword - the user's passwordaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenOfUserWithContext(URL tokenURL, String authorization, String username, String password, String audience) throws KeycloakClientException
KeycloakClientqueryOIDCTokenOfUserWithContext in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC serverauthorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)username - the user's usernamepassword - the user's passwordaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenOfUserWithContext(URL tokenURL, String authorization, String username, String password, String audience, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientqueryOIDCTokenOfUserWithContext in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC serverauthorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)username - the user's usernamepassword - the user's passwordaudience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryOIDCTokenWithContext(URL tokenURL, String authorization, String audience, Map<String,String> extraHeaders) throws KeycloakClientException
KeycloakClientqueryOIDCTokenWithContext in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC serverauthorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)audience - an optional parameter to shrink the token's audience to
the requested one (e.g. a specific context), by
leveraging on the custom HTTP header and corresponding
mapper on KeycloakextraHeaders - extra HTTP headers to add to the requestTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryUMAToken(String context, TokenResponse oidcTokenResponse, String audience, List<String> permissions) throws KeycloakClientException
KeycloakClientTokenResponse object
for the given audience (context), in URLEncoded form or not, and optionally a
list of permissions.queryUMAToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)oidcTokenResponse - the previously issued token as TokenResponse
objectaudience - the audience (context) where to request the issuing
of the ticketpermissions - a list of permissions, can be nullTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryUMAToken(URL tokenURL, TokenResponse oidcTokenResponse, String audience, List<String> permissions) throws KeycloakClientException
KeycloakClientTokenResponse object
for the given audience (context), in URLEncoded form or not, and optionally a
list of permissions.queryUMAToken in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC serveroidcTokenResponse - the previously issued token as TokenResponse
objectaudience - the audience (context) where to request the issuing
of the ticketpermissions - a list of permissions, can be nullTokenResponse objectKeycloakClientException - if something goes wrong performing the queryprotected static String constructBeareAuthenticationHeader(TokenResponse oidcTokenResponse)
public TokenResponse queryUMAToken(String context, String clientId, String clientSecret, String audience, List<String> permissions) throws KeycloakClientException
KeycloakClientqueryUMAToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the client idclientSecret - the client secretaudience - the audience (context) where to request the issuing of
the ticketpermissions - a list of permissions, can be nullTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryUMAToken(URL tokenURL, String clientId, String clientSecret, String audience, List<String> permissions) throws KeycloakClientException
KeycloakClientqueryUMAToken in interface KeycloakClienttokenURL - the token endpoint URL of the Keycloak serverclientId - the client idclientSecret - the client secretaudience - the audience (context) where to request the issuing of
the ticketpermissions - a list of permissions, can be nullTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryUMAToken(String context, String authorization, String audience, List<String> permissions) throws KeycloakClientException
KeycloakClientqueryUMAToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)authorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)audience - the audience (context) where to request the issuing of
the ticket (URLEncoded)permissions - a list of permissions, can be nullTokenResponse objectKeycloakClientException - if something goes wrong performing the querypublic TokenResponse queryUMAToken(URL tokenURL, String authorization, String audience, List<String> permissions) throws KeycloakClientException
KeycloakClientqueryUMAToken in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC serverauthorization - the authorization to be set as header (e.g. a "Basic
...." auth or an encoded JWT access token preceded by
the "Bearer " string)audience - the audience (context) where to request the issuing of
the ticket (URLEncoded)permissions - a list of permissions, can be nullTokenResponse objectKeycloakClientException - if something goes wrong performing the queryprotected TokenResponse performRequest(URL tokenURL, Map<String,String> headers, Map<String,List<String>> params) throws KeycloakClientException
KeycloakClientExceptionprotected <T> T performRequest(Class<T> returnObjectClass, URL url, Map<String,String> headers, Map<String,List<String>> params) throws KeycloakClientException
KeycloakClientExceptionpublic TokenResponse refreshToken(String context, TokenResponse tokenResponse) throws KeycloakClientException
KeycloakClientpublic clients types only.refreshToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)tokenResponse - the previously issued token as TokenResponse
objectTokenResponse objectKeycloakClientException - if something goes wrong performing the
refresh querypublic TokenResponse refreshToken(URL tokenURL, TokenResponse tokenResponse) throws KeycloakClientException
KeycloakClientpublic clients types only.refreshToken in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC servertokenResponse - the previously issued token as TokenResponse
objectTokenResponse objectKeycloakClientException - if something goes wrong performing the
refresh querypublic TokenResponse refreshToken(String context, String clientId, String clientSecret, TokenResponse tokenResponse) throws KeycloakClientException
KeycloakClientrefreshToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the requestor client id, may be null and in
this case will be take from the access token "issued
for" claimclientSecret - the requestor client secret, may be null
for non-confidential clientstokenResponse - the previously issued token as TokenResponse
objectTokenResponse objectKeycloakClientException - if something goes wrong performing the
refresh querypublic TokenResponse refreshToken(URL tokenURL, String clientId, String clientSecret, TokenResponse tokenResponse) throws KeycloakClientException
KeycloakClientrefreshToken in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC serverclientId - the requestor client id, may be null and in
this case will be take from the access token "issued
for" claimclientSecret - the requestor client secret, may be null
for non-confidential clientstokenResponse - the previously issued token as TokenResponse
objectTokenResponse objectKeycloakClientException - if something goes wrong performing the
refresh querypublic TokenResponse refreshToken(String context, String clientId, String clientSecret, String refreshTokenJWTString) throws KeycloakClientException
KeycloakClientrefreshToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the requestor client idclientSecret - the requestor client secret, may be
null for non-confidential clientsrefreshTokenJWTString - the previously issued refresh token JWT stringTokenResponse objectKeycloakClientException - if something goes wrong performing the
refresh querypublic TokenResponse refreshToken(URL tokenURL, String clientId, String clientSecret, String refreshTokenJWTString) throws KeycloakClientException
KeycloakClientrefreshToken in interface KeycloakClienttokenURL - the token endpoint URL of the OIDC
serverclientId - the requestor client idclientSecret - the requestor client secret, may be
null for non-confidential clientsrefreshTokenJWTString - the previously issued refresh token JWT stringTokenResponse objectKeycloakClientException - if something goes wrong performing the
refresh querypublic TokenResponse exchangeTokenForAccessToken(String context, String oidcAccessToken, String clientId, String clientSecret, String audience) throws KeycloakClientException
KeycloakClientexchangeTokenForAccessToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)oidcAccessToken - the original access token to exchangeclientId - the authorized client's idclientSecret - the authorized client's secretaudience - the requested token audienceKeycloakClientException - if an error occurs during the exchangepublic TokenResponse exchangeTokenForAccessToken(URL tokenURL, String oidcAccessToken, String clientId, String clientSecret, String audience) throws KeycloakClientException
KeycloakClientexchangeTokenForAccessToken in interface KeycloakClienttokenURL - the token endpoint URLoidcAccessToken - the original access token to exchangeclientId - the authorized client's idclientSecret - the authorized client's secretaudience - the requested token audienceKeycloakClientException - if an error occurs during the exchangepublic TokenResponse exchangeTokenForRefreshToken(String context, String oidcAccessToken, String clientId, String clientSecret, String audience) throws KeycloakClientException
KeycloakClientexchangeTokenForRefreshToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)oidcAccessToken - the original access token to exchangeclientId - the authorized client's idclientSecret - the authorized client's secretaudience - the requested token audienceKeycloakClientException - if an error occurs during the exchangepublic TokenResponse exchangeTokenForRefreshToken(URL tokenURL, String oidcAccessToken, String clientId, String clientSecret, String audience) throws KeycloakClientException
KeycloakClientexchangeTokenForRefreshToken in interface KeycloakClienttokenURL - the token endpoint URLoidcAccessToken - the original access token to exchangeclientId - the authorized client's idclientSecret - the authorized client's secretaudience - the requested token audienceKeycloakClientException - if an error occurs during the exchangepublic TokenResponse exchangeTokenForOfflineToken(String context, String oidcAccessToken, String clientId, String clientSecret, String audience) throws IllegalArgumentException, KeycloakClientException
KeycloakClientoffline_access within its scopesexchangeTokenForOfflineToken in interface KeycloakClientcontext - the token endpoint URLoidcAccessToken - the original access token to exchangeclientId - the authorized client's idclientSecret - the authorized client's secretaudience - the requested token audienceIllegalArgumentException - if the original token does'nt contains the
offline_access scope within its
scopes or if is impossible to parse the
access token as JSONKeycloakClientException - if an error occurs during the exchangepublic TokenResponse exchangeTokenForOfflineToken(URL tokenURL, String oidcAccessToken, String clientId, String clientSecret, String audience) throws IllegalArgumentException, KeycloakClientException
KeycloakClientoffline_access within its scopesexchangeTokenForOfflineToken in interface KeycloakClienttokenURL - the token endpoint URLoidcAccessToken - the original access token to exchangeclientId - the authorized client's idclientSecret - the authorized client's secretaudience - the requested token audienceIllegalArgumentException - if the original token does'nt contains the
offline_access scope within its
scopes or if is impossible to parse the
access token as JSONKeycloakClientException - if an error occurs during the exchangeprotected TokenResponse exchangeToken(URL tokenURL, String oidcAccessToken, String clientId, String clientSecret, String audience, String requestedTokenType, String scope) throws KeycloakClientException
tokenURL - the token endpoint URL of the OIDC serveroidcAccessToken - the auth token (the access token URLEncoded by the
"Bearer " string)clientId - the client idclientSecret - the client secretaudience - the audience (context) where to request the issuing
of the ticket (URLEncoded)requestedTokenType - the token type (e.g. refresh)scope - the scope, optional can be nullKeycloakClientException - if an error occurs, inspect the exception for
detailspublic TokenIntrospectionResponse introspectAccessToken(String context, String clientId, String clientSecret, String accessTokenJWTString) throws KeycloakClientException
KeycloakClientintrospectAccessToken in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the requestor client idclientSecret - the requestor client secretaccessTokenJWTString - the access token to verifyTokenIntrospectionResponse object with the introspection
results; in particular, the active field represents the
token validityKeycloakClientException - if something goes wrong performing the
verificationpublic TokenIntrospectionResponse introspectAccessToken(URL introspectionURL, String clientId, String clientSecret, String accessTokenJWTString) throws KeycloakClientException
KeycloakClientintrospectAccessToken in interface KeycloakClientintrospectionURL - the introspection endpoint URL of the
Keycloak serverclientId - the requestor client idclientSecret - the requestor client secretaccessTokenJWTString - the access token to verifyTokenIntrospectionResponse object with the introspection
results; in particular, the active field represents the
token validityKeycloakClientException - if something goes wrong performing the
verificationpublic boolean isAccessTokenVerified(String context, String clientId, String clientSecret, String accessTokenJWTString) throws KeycloakClientException
KeycloakClientisAccessTokenVerified in interface KeycloakClientcontext - the context where the Keycloak's is needed (e.g.
/gcube for DEV)clientId - the requestor client idclientSecret - the requestor client secretaccessTokenJWTString - the access token to verifytrue if the token is active, false
otherwiseKeycloakClientException - if something goes wrong performing the
verificationpublic boolean isAccessTokenVerified(URL introspectionURL, String clientId, String clientSecret, String accessTokenJWTString) throws KeycloakClientException
KeycloakClientisAccessTokenVerified in interface KeycloakClientintrospectionURL - the introspection endpoint URL of the
Keycloak serverclientId - the requestor client idclientSecret - the requestor client secretaccessTokenJWTString - the access token to verifytrue if the token is active, false
otherwiseKeycloakClientException - if something goes wrong performing the
verificationprotected void safeSetAsExternalCallForOldAPI(org.gcube.common.gxhttp.request.GXHTTPStringRequest request)
public byte[] getAvatarData(String context, TokenResponse tokenResponse) throws KeycloakClientException
KeycloakClientgetAvatarData in interface KeycloakClientcontext - the context used to compute the server endpoint in the
correct environmenttokenResponse - the token response where to get the bearer token for the
authorization header.KeycloakClientException - if something goes wrong in the requestpublic byte[] getAvatarData(URL avatarURL, TokenResponse tokenResponse) throws KeycloakClientException
KeycloakClientgetAvatarData in interface KeycloakClientavatarURL - the server's avatar endpoint URLtokenResponse - the token response where to get the bearer token for the
authorization header.KeycloakClientException - if something goes wrong in the requestpublic byte[] getAvatarData(URL avatarURL, String authorization) throws KeycloakClientException
KeycloakClientgetAvatarData in interface KeycloakClientavatarURL - the server's avatar endpoint URLauthorization - the string to user as authorization header (e.g. 'bearer xxxx')KeycloakClientException - if something goes wrong in the requestCopyright © 2026. All rights reserved.