org.keycloak.services.resources

## Class TokenService

- java.lang.Object
- - org.keycloak.services.resources.TokenService

-     public class TokenService
      extends Object

  Resource class for the oauth/openid connect token service
  Version:
    $Revision: 1 $
  Author:
    Bill Burke

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `protected AuthenticationManager` | `authManager`
    `protected ClientConnection` | `clientConnection`
    `protected javax.ws.rs.core.HttpHeaders` | `headers`
    `protected static org.jboss.logging.Logger` | `logger`
    `protected javax.ws.rs.ext.Providers` | `providers`
    `protected RealmModel` | `realm`
    `protected org.jboss.resteasy.spi.HttpRequest` | `request`
    `protected org.jboss.resteasy.spi.HttpResponse` | `response`
    `protected javax.ws.rs.core.SecurityContext` | `securityContext`
    `protected KeycloakSession` | `session`
    `protected TokenManager` | `tokenManager`
    `protected javax.ws.rs.core.UriInfo` | `uriInfo`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `TokenService(RealmModel realm, TokenManager tokenManager, Audit audit, AuthenticationManager authManager)`

  - ### Method Summary

    Methods
    Modifier and Type | Method and Description
    --- | ---
    `javax.ws.rs.core.Response` | `accessCodeToToken(String authorizationHeader, javax.ws.rs.core.MultivaluedMap<String,String> formData)` URL invoked by adapter to turn an access code to access token
    `javax.ws.rs.core.Response` | `accessCodeToTokenPreflight()` CORS preflight path for access code to token
    `static javax.ws.rs.core.UriBuilder` | `accessCodeToTokenUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)`
    `static javax.ws.rs.core.UriBuilder` | `accessCodeToTokenUrl(javax.ws.rs.core.UriInfo uriInfo)`
    `protected ClientModel` | `authorizeClient(String authorizationHeader, javax.ws.rs.core.MultivaluedMap<String,String> formData, Audit audit)`
    `RequiredActionsService` | `getRequiredActionsService()`
    `static Set<String>` | `getValidateRedirectUris(RealmModel realm)`
    `javax.ws.rs.core.Response` | `grantAccessToken(String authorizationHeader, javax.ws.rs.core.MultivaluedMap<String,String> form)` Direct grant REST invocation.
    `static javax.ws.rs.core.UriBuilder` | `grantAccessTokenUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)`
    `static javax.ws.rs.core.UriBuilder` | `grantAccessTokenUrl(javax.ws.rs.core.UriInfo uriInfo)`
    `javax.ws.rs.core.Response` | `installedAppUrnCallback(String code, String error, String errorDescription)`
    `javax.ws.rs.core.Response` | `loginPage(String responseType, String redirect, String clientId, String scopeParam, String state, String prompt, String loginHint)` Login page.
    `static javax.ws.rs.core.UriBuilder` | `loginPageUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)`
    `static javax.ws.rs.core.UriBuilder` | `loginPageUrl(javax.ws.rs.core.UriInfo uriInfo)`
    `javax.ws.rs.core.Response` | `logout(String redirectUri)` Logout user session.
    `javax.ws.rs.core.Response` | `logoutToken(String authorizationHeader, javax.ws.rs.core.MultivaluedMap<String,String> form)` Logout a session via a non-browser invocation.
    `static javax.ws.rs.core.UriBuilder` | `logoutUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)`
    `static javax.ws.rs.core.UriBuilder` | `logoutUrl(javax.ws.rs.core.UriInfo uriInfo)`
    `static boolean` | `matchesRedirects(Set<String> validRedirects, String redirect)`
    `javax.ws.rs.core.Response` | `processLogin(String clientId, String scopeParam, String state, String redirect, javax.ws.rs.core.MultivaluedMap<String,String> formData)` URL called after login page.
    `static javax.ws.rs.core.UriBuilder` | `processLoginUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)`
    `static javax.ws.rs.core.UriBuilder` | `processLoginUrl(javax.ws.rs.core.UriInfo uriInfo)`
    `javax.ws.rs.core.Response` | `processOAuth(javax.ws.rs.core.MultivaluedMap<String,String> formData)` OAuth grant page.
    `static javax.ws.rs.core.UriBuilder` | `processOAuthUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)`
    `static javax.ws.rs.core.UriBuilder` | `processOAuthUrl(javax.ws.rs.core.UriInfo uriInfo)`
    `javax.ws.rs.core.Response` | `processRegister(String clientId, String scopeParam, String state, String redirect, javax.ws.rs.core.MultivaluedMap<String,String> formData)` Registration
    `protected javax.ws.rs.core.Response` | `redirectAccessDenied(String redirect, String state)`
    `javax.ws.rs.core.Response` | `refreshAccessToken(String authorizationHeader, javax.ws.rs.core.MultivaluedMap<String,String> form)` URL for making refresh token requests.
    `static javax.ws.rs.core.UriBuilder` | `refreshUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)`
    `javax.ws.rs.core.Response` | `registerPage(String responseType, String redirect, String clientId, String scopeParam, String state)` Registration page.
    `static String` | `relativeToAbsoluteURI(javax.ws.rs.core.UriInfo uriInfo, String relative)`
    `static Set<String>` | `resolveValidRedirects(javax.ws.rs.core.UriInfo uriInfo, Set<String> validRedirects)`
    `static javax.ws.rs.core.UriBuilder` | `tokenServiceBaseUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)`
    `static javax.ws.rs.core.UriBuilder` | `tokenServiceBaseUrl(javax.ws.rs.core.UriInfo uriInfo)`
    `javax.ws.rs.core.Response` | `validateAccessToken(String tokenString)` Validate encoded access token.
    `static javax.ws.rs.core.UriBuilder` | `validateAccessTokenUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)`
    `static String` | `verifyRealmRedirectUri(javax.ws.rs.core.UriInfo uriInfo, String redirectUri, RealmModel realm)`
    `static String` | `verifyRedirectUri(javax.ws.rs.core.UriInfo uriInfo, String redirectUri, RealmModel realm, ClientModel client)`
    `static String` | `verifyRedirectUri(javax.ws.rs.core.UriInfo uriInfo, String redirectUri, RealmModel realm, Set<String> validRedirects)`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### logger

          protected static final org.jboss.logging.Logger logger

    - #### realm

          protected RealmModel realm

    - #### tokenManager

          protected TokenManager tokenManager

    - #### authManager

          protected AuthenticationManager authManager

    - #### providers

          @Context
          protected javax.ws.rs.ext.Providers providers

    - #### securityContext

          @Context
          protected javax.ws.rs.core.SecurityContext securityContext

    - #### uriInfo

          @Context
          protected javax.ws.rs.core.UriInfo uriInfo

    - #### headers

          @Context
          protected javax.ws.rs.core.HttpHeaders headers

    - #### request

          @Context
          protected org.jboss.resteasy.spi.HttpRequest request

    - #### response

          @Context
          protected org.jboss.resteasy.spi.HttpResponse response

    - #### session

          @Context
          protected KeycloakSession session

    - #### clientConnection

          @Context
          protected ClientConnection clientConnection

  - ### Constructor Detail

    - #### TokenService

          public TokenService(RealmModel realm,
                      TokenManager tokenManager,
                      Audit audit,
                      AuthenticationManager authManager)

  - ### Method Detail

    - #### tokenServiceBaseUrl

          public static javax.ws.rs.core.UriBuilder tokenServiceBaseUrl(javax.ws.rs.core.UriInfo uriInfo)

    - #### tokenServiceBaseUrl

          public static javax.ws.rs.core.UriBuilder tokenServiceBaseUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)

    - #### accessCodeToTokenUrl

          public static javax.ws.rs.core.UriBuilder accessCodeToTokenUrl(javax.ws.rs.core.UriInfo uriInfo)

    - #### accessCodeToTokenUrl

          public static javax.ws.rs.core.UriBuilder accessCodeToTokenUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)

    - #### validateAccessTokenUrl

          public static javax.ws.rs.core.UriBuilder validateAccessTokenUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)

    - #### grantAccessTokenUrl

          public static javax.ws.rs.core.UriBuilder grantAccessTokenUrl(javax.ws.rs.core.UriInfo uriInfo)

    - #### grantAccessTokenUrl

          public static javax.ws.rs.core.UriBuilder grantAccessTokenUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)

    - #### loginPageUrl

          public static javax.ws.rs.core.UriBuilder loginPageUrl(javax.ws.rs.core.UriInfo uriInfo)

    - #### loginPageUrl

          public static javax.ws.rs.core.UriBuilder loginPageUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)

    - #### logoutUrl

          public static javax.ws.rs.core.UriBuilder logoutUrl(javax.ws.rs.core.UriInfo uriInfo)

    - #### logoutUrl

          public static javax.ws.rs.core.UriBuilder logoutUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)

    - #### processLoginUrl

          public static javax.ws.rs.core.UriBuilder processLoginUrl(javax.ws.rs.core.UriInfo uriInfo)

    - #### processLoginUrl

          public static javax.ws.rs.core.UriBuilder processLoginUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)

    - #### processOAuthUrl

          public static javax.ws.rs.core.UriBuilder processOAuthUrl(javax.ws.rs.core.UriInfo uriInfo)

    - #### processOAuthUrl

          public static javax.ws.rs.core.UriBuilder processOAuthUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)

    - #### refreshUrl

          public static javax.ws.rs.core.UriBuilder refreshUrl(javax.ws.rs.core.UriBuilder baseUriBuilder)

    - #### grantAccessToken

          @Path(value="grants/access")
          @POST
          @Consumes(value="application/x-www-form-urlencoded")
          @Produces(value="application/json")
          public javax.ws.rs.core.Response grantAccessToken(@HeaderParam(value="Authorization")
                                                                               String authorizationHeader,
                                                                               javax.ws.rs.core.MultivaluedMap<String,String> form)

      Direct grant REST invocation. One stop call to obtain an access token. If the client is a confidential client you must include the client-id (application name or oauth client name) and secret in an Basic Auth Authorization header. If the client is a public client, then you must include a "client_id" form parameter with the app's or oauth client's name. The realm must be configured to allow these types of auth requests. (Direct Grant API in admin console Settings page)
      Parameters:
        `authorizationHeader` -
        `form` -
      Returns:
        @see org.keycloak.representations.AccessTokenResponse

    - #### validateAccessToken

          @Path(value="validate")
          @GET
          @Produces(value="application/json")
          public javax.ws.rs.core.Response validateAccessToken(@QueryParam(value="access_token")
                                                                        String tokenString)

      Validate encoded access token.
      Parameters:
        `tokenString` -
      Returns:
        Unmarshalled token

    - #### refreshAccessToken

          @Path(value="refresh")
          @POST
          @Consumes(value="application/x-www-form-urlencoded")
          @Produces(value="application/json")
          public javax.ws.rs.core.Response refreshAccessToken(@HeaderParam(value="Authorization")
                                                                                 String authorizationHeader,
                                                                                 javax.ws.rs.core.MultivaluedMap<String,String> form)

      URL for making refresh token requests.
      Parameters:
        `authorizationHeader` -
        `form` -
      Returns:

    - #### processLogin

          @Path(value="auth/request/login")
          @POST
          @Consumes(value="application/x-www-form-urlencoded")
          public javax.ws.rs.core.Response processLogin(@QueryParam(value="client_id")
                                                                  String clientId,
                                                                  @QueryParam(value="scope")
                                                                  String scopeParam,
                                                                  @QueryParam(value="state")
                                                                  String state,
                                                                  @QueryParam(value="redirect_uri")
                                                                  String redirect,
                                                                  javax.ws.rs.core.MultivaluedMap<String,String> formData)

      URL called after login page. YOU SHOULD NEVER INVOKE THIS DIRECTLY!
      Parameters:
        `clientId` -
        `scopeParam` -
        `state` -
        `redirect` -
        `formData` -
      Returns:

    - #### getRequiredActionsService

          @Path(value="auth/request/login-actions")
          public RequiredActionsService getRequiredActionsService()

    - #### processRegister

          @Path(value="registrations")
          @POST
          @Consumes(value="application/x-www-form-urlencoded")
          public javax.ws.rs.core.Response processRegister(@QueryParam(value="client_id")
                                                                     String clientId,
                                                                     @QueryParam(value="scope")
                                                                     String scopeParam,
                                                                     @QueryParam(value="state")
                                                                     String state,
                                                                     @QueryParam(value="redirect_uri")
                                                                     String redirect,
                                                                     javax.ws.rs.core.MultivaluedMap<String,String> formData)

      Registration
      Parameters:
        `clientId` -
        `scopeParam` -
        `state` -
        `redirect` -
        `formData` -
      Returns:

    - #### accessCodeToTokenPreflight

          @Path(value="access/codes")
          @OPTIONS
          @Produces(value="application/json")
          public javax.ws.rs.core.Response accessCodeToTokenPreflight()

      CORS preflight path for access code to token
      Returns:

    - #### accessCodeToToken

          @Path(value="access/codes")
          @POST
          @Produces(value="application/json")
          public javax.ws.rs.core.Response accessCodeToToken(@HeaderParam(value="Authorization")
                                                                       String authorizationHeader,
                                                                       javax.ws.rs.core.MultivaluedMap<String,String> formData)

      URL invoked by adapter to turn an access code to access token
      Parameters:
        `authorizationHeader` -
        `formData` -
      Returns:

    - #### authorizeClient

          protected ClientModel authorizeClient(String authorizationHeader,
                                    javax.ws.rs.core.MultivaluedMap<String,String> formData,
                                    Audit audit)

    - #### loginPage

          @Path(value="login")
          @GET
          public javax.ws.rs.core.Response loginPage(@QueryParam(value="response_type")
                                                     String responseType,
                                                     @QueryParam(value="redirect_uri")
                                                     String redirect,
                                                     @QueryParam(value="client_id")
                                                     String clientId,
                                                     @QueryParam(value="scope")
                                                     String scopeParam,
                                                     @QueryParam(value="state")
                                                     String state,
                                                     @QueryParam(value="prompt")
                                                     String prompt,
                                                     @QueryParam(value="login_hint")
                                                     String loginHint)

      Login page. Must be redirected to from the application or oauth client.
      Parameters:
        `responseType` -
        `redirect` -
        `clientId` -
        `scopeParam` -
        `state` -
        `prompt` -
      Returns:

    - #### registerPage

          @Path(value="registrations")
          @GET
          public javax.ws.rs.core.Response registerPage(@QueryParam(value="response_type")
                                                        String responseType,
                                                        @QueryParam(value="redirect_uri")
                                                        String redirect,
                                                        @QueryParam(value="client_id")
                                                        String clientId,
                                                        @QueryParam(value="scope")
                                                        String scopeParam,
                                                        @QueryParam(value="state")
                                                        String state)

      Registration page. Must be redirected to from login page.
      Parameters:
        `responseType` -
        `redirect` -
        `clientId` -
        `scopeParam` -
        `state` -
      Returns:

    - #### logout

          @Path(value="logout")
          @GET
          public javax.ws.rs.core.Response logout(@QueryParam(value="redirect_uri")
                                                  String redirectUri)

      Logout user session. User must be logged in via a session cookie.
      Parameters:
        `redirectUri` -
      Returns:

    - #### logoutToken

          @Path(value="logout")
          @POST
          @Consumes(value="application/x-www-form-urlencoded")
          public javax.ws.rs.core.Response logoutToken(@HeaderParam(value="Authorization")
                                                                 String authorizationHeader,
                                                                 javax.ws.rs.core.MultivaluedMap<String,String> form)

      Logout a session via a non-browser invocation. Similar signature to refresh token except there is no grant_type. You must pass in the refresh token and authenticate the client if it is not public. If the client is a confidential client you must include the client-id (application name or oauth client name) and secret in an Basic Auth Authorization header. If the client is a public client, then you must include a "client_id" form parameter with the app's or oauth client's name. returns 204 if successful, 400 if not with a json error response.
      Parameters:
        `authorizationHeader` -
        `form` -
      Returns:

    - #### processOAuth

          @Path(value="oauth/grant")
          @POST
          @Consumes(value="application/x-www-form-urlencoded")
          public javax.ws.rs.core.Response processOAuth(javax.ws.rs.core.MultivaluedMap<String,String> formData)

      OAuth grant page. You should not invoked this directly!
      Parameters:
        `formData` -
      Returns:

    - #### installedAppUrnCallback

          @Path(value="oauth/oob")
          @GET
          public javax.ws.rs.core.Response installedAppUrnCallback(@QueryParam(value="code")
                                                                   String code,
                                                                   @QueryParam(value="error")
                                                                   String error,
                                                                   @QueryParam(value="error_description")
                                                                   String errorDescription)

    - #### redirectAccessDenied

          protected javax.ws.rs.core.Response redirectAccessDenied(String redirect,
                                                       String state)

    - #### matchesRedirects

          public static boolean matchesRedirects(Set<String> validRedirects,
                                 String redirect)

    - #### getValidateRedirectUris

          public static Set<String> getValidateRedirectUris(RealmModel realm)

    - #### verifyRealmRedirectUri

          public static String verifyRealmRedirectUri(javax.ws.rs.core.UriInfo uriInfo,
                                      String redirectUri,
                                      RealmModel realm)

    - #### verifyRedirectUri

          public static String verifyRedirectUri(javax.ws.rs.core.UriInfo uriInfo,
                                 String redirectUri,
                                 RealmModel realm,
                                 ClientModel client)

    - #### verifyRedirectUri

          public static String verifyRedirectUri(javax.ws.rs.core.UriInfo uriInfo,
                                 String redirectUri,
                                 RealmModel realm,
                                 Set<String> validRedirects)

    - #### resolveValidRedirects

          public static Set<String> resolveValidRedirects(javax.ws.rs.core.UriInfo uriInfo,
                                          Set<String> validRedirects)

    - #### relativeToAbsoluteURI

          public static String relativeToAbsoluteURI(javax.ws.rs.core.UriInfo uriInfo,
                                     String relative)

Copyright © 2014. All Rights Reserved.