Java Code Examples for org.keycloak.adapters.spi.AuthOutcome#FAILED

public AuthOutcome authenticate() {
    String code = getCode();
    if (code == null) {
        log.debug("there was no code");
        String error = getError();
        if (error != null) {
            // todo how do we send a response?
            log.warn("There was an error: " + error);
            challenge = challenge(400, OIDCAuthenticationError.Reason.OAUTH_ERROR, error);
            return AuthOutcome.FAILED;
        } else {
            log.debug("redirecting to auth server");
            challenge = loginRedirect();
            return AuthOutcome.NOT_ATTEMPTED;
        }
    } else {
        log.debug("there was a code, resolving");
        challenge = resolveCode(code);
        if (challenge != null) {
            return AuthOutcome.FAILED;
        }
        return AuthOutcome.AUTHENTICATED;
    }

}
 

/**
 * Call this inside your authenticate method.
 */
protected AuthenticationMechanismOutcome keycloakAuthenticate(HttpServerExchange exchange, SecurityContext securityContext, RequestAuthenticator authenticator) {
    AuthOutcome outcome = authenticator.authenticate();
    if (outcome == AuthOutcome.AUTHENTICATED) {
        registerNotifications(securityContext);
        return AuthenticationMechanismOutcome.AUTHENTICATED;
    }
    AuthChallenge challenge = authenticator.getChallenge();
    if (challenge != null) {
        exchange.putAttachment(KEYCLOAK_CHALLENGE_ATTACHMENT_KEY, challenge);
    }

    if (outcome == AuthOutcome.FAILED) {
        return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
    }
    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
}
 

private void bearerAuthentication(JaxrsHttpFacade facade, ContainerRequestContext request, KeycloakDeployment resolvedDeployment) {
    BearerTokenRequestAuthenticator authenticator = new BearerTokenRequestAuthenticator(resolvedDeployment);
    AuthOutcome outcome = authenticator.authenticate(facade);

    if (outcome == AuthOutcome.NOT_ATTEMPTED) {
        authenticator = new QueryParamterTokenRequestAuthenticator(resolvedDeployment);
        outcome = authenticator.authenticate(facade);
    }

    if (outcome == AuthOutcome.NOT_ATTEMPTED && resolvedDeployment.isEnableBasicAuth()) {
        authenticator = new BasicAuthRequestAuthenticator(resolvedDeployment);
        outcome = authenticator.authenticate(facade);
    }

    if (outcome == AuthOutcome.FAILED || outcome == AuthOutcome.NOT_ATTEMPTED) {
        AuthChallenge challenge = authenticator.getChallenge();
        boolean challengeSent = challenge.challenge(facade);
        if (!challengeSent) {
            // Use some default status code
            facade.getResponse().setStatus(Response.Status.UNAUTHORIZED.getStatusCode());
        }

        // Send response now (if not already sent)
        if (!facade.isResponseFinished()) {
            facade.getResponse().end();
        }
        return;
    } else {
        if (verifySslFailed(facade, resolvedDeployment)) {
            return;
        }
    }

    propagateSecurityContext(facade, request, resolvedDeployment, authenticator);
    handleAuthActions(facade, resolvedDeployment);
}
 

protected void bearerAuthentication(JaxrsHttpFacade facade, ContainerRequestContext request, KeycloakDeployment resolvedDeployment) {
    BearerTokenRequestAuthenticator authenticator = new BearerTokenRequestAuthenticator(resolvedDeployment);
    AuthOutcome outcome = authenticator.authenticate(facade);
    
    if (outcome == AuthOutcome.NOT_ATTEMPTED && resolvedDeployment.isEnableBasicAuth()) {
        authenticator = new BasicAuthRequestAuthenticator(resolvedDeployment);
        outcome = authenticator.authenticate(facade);
    }
    
    if (outcome == AuthOutcome.FAILED || outcome == AuthOutcome.NOT_ATTEMPTED) {
        AuthChallenge challenge = authenticator.getChallenge();
        log.fine("Authentication outcome: " + outcome);
        boolean challengeSent = challenge.challenge(facade);
        if (!challengeSent) {
            // Use some default status code
            facade.getResponse().setStatus(Response.Status.UNAUTHORIZED.getStatusCode());
        }

        // Send response now (if not already sent)
        if (!facade.isResponseFinished()) {
            facade.getResponse().end();
        }
        return;
    } else {
        if (verifySslFailed(facade, resolvedDeployment)) {
            return;
        }
    }

    propagateSecurityContext(facade, request, resolvedDeployment, authenticator);
    handleAuthActions(facade, resolvedDeployment);
}
 

public AuthOutcome authenticate(HttpFacade exchange)  {
    List<String> authHeaders = exchange.getRequest().getHeaders("Authorization");
    if (authHeaders == null || authHeaders.isEmpty()) {
        challenge = challengeResponse(exchange, OIDCAuthenticationError.Reason.NO_AUTHORIZATION_HEADER, null, null);
        return AuthOutcome.NOT_ATTEMPTED;
    }

    tokenString = null;
    for (String authHeader : authHeaders) {
        String[] split = authHeader.trim().split("\\s+");
        if (split.length != 2) continue;
        if (!split[0].equalsIgnoreCase("Basic")) continue;
        tokenString = split[1];
    }

    if (tokenString == null) {
        challenge = challengeResponse(exchange, OIDCAuthenticationError.Reason.INVALID_TOKEN, null, null);
        return AuthOutcome.NOT_ATTEMPTED;
    }

    AccessTokenResponse atr=null;        
    try {
        String userpw=new String(Base64.decode(tokenString));
        int seperatorIndex = userpw.indexOf(":");
        String user = userpw.substring(0, seperatorIndex);
        String pw = userpw.substring(seperatorIndex + 1);
        atr = getToken(user, pw);
        tokenString = atr.getToken();
    } catch (Exception e) {
        log.debug("Failed to obtain token", e);
        challenge = challengeResponse(exchange, OIDCAuthenticationError.Reason.INVALID_TOKEN, "no_token", e.getMessage());
        return AuthOutcome.FAILED;
    }

    return authenticateToken(exchange, atr.getToken());
}
 

@Override
protected AuthOutcome logoutRequest(LogoutRequestType request, String relayState) {
    if (request.getSessionIndex() == null || request.getSessionIndex().isEmpty()) {
        sessionStore.logoutByPrincipal(request.getNameID().getValue());
    } else {
        sessionStore.logoutBySsoId(request.getSessionIndex());
    }

    String issuerURL = deployment.getEntityID();
    SAML2LogoutResponseBuilder builder = new SAML2LogoutResponseBuilder();
    builder.logoutRequestID(request.getID());
    builder.destination(deployment.getIDP().getSingleLogoutService().getResponseBindingUrl());
    builder.issuer(issuerURL);
    BaseSAML2BindingBuilder binding = new BaseSAML2BindingBuilder().relayState(relayState);
    if (deployment.getIDP().getSingleLogoutService().signResponse()) {
        if (deployment.getSignatureCanonicalizationMethod() != null)
            binding.canonicalizationMethod(deployment.getSignatureCanonicalizationMethod());
        binding.signatureAlgorithm(deployment.getSignatureAlgorithm())
                .signWith(null, deployment.getSigningKeyPair())
                .signDocument();
        // TODO: As part of KEYCLOAK-3810, add KeyID to the SAML document
        //   <related DocumentBuilder>.addExtension(new KeycloakKeySamlExtensionGenerator(<key ID>));
    }


    try {
        SamlUtil.sendSaml(false, facade, deployment.getIDP().getSingleLogoutService().getResponseBindingUrl(), binding, builder.buildDocument(),
                deployment.getIDP().getSingleLogoutService().getResponseBinding());
    } catch (Exception e) {
        log.error("Could not send logout response SAML request", e);
        return AuthOutcome.FAILED;
    }
    return AuthOutcome.NOT_ATTEMPTED;
}
 

private AuthOutcome globalLogout() {
    SamlSession account = sessionStore.getAccount();
    if (account == null) {
        return AuthOutcome.NOT_ATTEMPTED;
    }
    SAML2LogoutRequestBuilder logoutBuilder = new SAML2LogoutRequestBuilder()
            .assertionExpiration(30)
            .issuer(deployment.getEntityID())
            .sessionIndex(account.getSessionIndex())
            .nameId(account.getPrincipal().getNameID())
            .destination(deployment.getIDP().getSingleLogoutService().getRequestBindingUrl());
    BaseSAML2BindingBuilder binding = new BaseSAML2BindingBuilder();
    if (deployment.getIDP().getSingleLogoutService().signRequest()) {
        if (deployment.getSignatureCanonicalizationMethod() != null)
            binding.canonicalizationMethod(deployment.getSignatureCanonicalizationMethod());
        binding.signatureAlgorithm(deployment.getSignatureAlgorithm());
        binding.signWith(null, deployment.getSigningKeyPair())
                .signDocument();
        // TODO: As part of KEYCLOAK-3810, add KeyID to the SAML document
        //   <related DocumentBuilder>.addExtension(new KeycloakKeySamlExtensionGenerator(<key ID>));
    }

    binding.relayState("logout");

    try {
        SamlUtil.sendSaml(true, facade, deployment.getIDP().getSingleLogoutService().getRequestBindingUrl(), binding, logoutBuilder.buildDocument(), deployment.getIDP().getSingleLogoutService().getRequestBinding());
        sessionStore.setCurrentAction(SamlSessionStore.CurrentAction.LOGGING_OUT);
    } catch (Exception e) {
        log.error("Could not send global logout SAML request", e);
        return AuthOutcome.FAILED;
    }
    return AuthOutcome.NOT_ATTEMPTED;
}
 

/**
 * Extracts the user name from the JWT in the given request.
 * 
 * @param request The request containing the JWT
 * @return The user name or null if it can not be determined
 */
private String extractUserFromHeader(HttpServletRequest request)
{
    String userName = null;
    
    IdentityServiceHttpFacade facade = new IdentityServiceHttpFacade(request);
    
    // try authenticating with bearer token first
    if (logger.isDebugEnabled())
    {
        logger.debug("Trying bearer token...");
    }

    AlfrescoBearerTokenRequestAuthenticator tokenAuthenticator = 
                new AlfrescoBearerTokenRequestAuthenticator(this.keycloakDeployment);
    AuthOutcome tokenOutcome = tokenAuthenticator.authenticate(facade);
    
    if (logger.isDebugEnabled())
    {
        logger.debug("Bearer token outcome: " + tokenOutcome);
    }
    
    if (tokenOutcome == AuthOutcome.FAILED && !isValidationFailureSilent)
    {
        throw new AuthenticationException("Token validation failed: " + 
                    tokenAuthenticator.getValidationFailureDescription());
    }
    
    if (tokenOutcome == AuthOutcome.AUTHENTICATED)
    {
        userName = extractUserFromToken(tokenAuthenticator.getToken());
    }
    else
    {
        if (logger.isDebugEnabled())
        {
            logger.debug("User could not be authenticated by IdentityServiceRemoteUserMapper.");
        }
    }
    
    return userName;
}
 

/**
 * Call this inside your authenticate method.
 */
public AuthenticationMechanismOutcome authenticate(HttpServerExchange exchange, SecurityContext securityContext) {
    UndertowHttpFacade facade = createFacade(exchange);
    SamlDeployment deployment = deploymentContext.resolveDeployment(facade);
    if (!deployment.isConfigured()) {
        return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
    }
    SamlSessionStore sessionStore = getTokenStore(exchange, facade, deployment, securityContext);
    SamlAuthenticator authenticator = null;
    if (exchange.getRequestPath().endsWith("/saml")) {
        authenticator = new UndertowSamlEndpoint(facade, deploymentContext.resolveDeployment(facade), sessionStore);
    } else {
        authenticator = new UndertowSamlAuthenticator(securityContext, facade, deploymentContext.resolveDeployment(facade), sessionStore);

    }

    AuthOutcome outcome = authenticator.authenticate();
    if (outcome == AuthOutcome.AUTHENTICATED) {
        registerNotifications(securityContext);
        return AuthenticationMechanismOutcome.AUTHENTICATED;
    }
    if (outcome == AuthOutcome.NOT_AUTHENTICATED) {
        // we are in passive mode and user is not authenticated, let app server to try another auth mechanism
        // See KEYCLOAK-2107, AbstractSamlAuthenticationHandler
        return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
    }
    if (outcome == AuthOutcome.LOGGED_OUT) {
        securityContext.logout();
        if (deployment.getLogoutPage() != null) {
            redirectLogout(deployment, exchange);
        }
        return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
    }
    AuthChallenge challenge = authenticator.getChallenge();
    if (challenge != null) {
        exchange.putAttachment(KEYCLOAK_CHALLENGE_ATTACHMENT_KEY, challenge);
        if (authenticator instanceof UndertowSamlEndpoint) {
            exchange.getSecurityContext().setAuthenticationRequired();
        }
    }

    if (outcome == AuthOutcome.FAILED) {
        return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
    }
    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
}
 

private AuthOutcome failed(AuthChallenge challenge) {
    this.challenge = challenge;
    return AuthOutcome.FAILED;
}
 

@Override
public void evaluateRequest(HttpServerRequest request) throws HttpAuthenticationException {
    LOGGER.debugf("Evaluating request for path [%s]", request.getRequestURI());
    SamlDeploymentContext deploymentContext = getDeploymentContext(request);

    if (deploymentContext == null) {
        LOGGER.debugf("Ignoring request for path [%s] from mechanism [%s]. No deployment context found.", request.getRequestURI(), getMechanismName());
        request.noAuthenticationInProgress();
        return;
    }

    ElytronHttpFacade httpFacade = new ElytronHttpFacade(request, getSessionIdMapper(request), getSessionIdMapperUpdater(request), deploymentContext, callbackHandler);
    SamlDeployment deployment = httpFacade.getDeployment();

    if (!deployment.isConfigured()) {
        request.noAuthenticationInProgress();
        return;
    }

    if (deployment.getLogoutPage() != null && httpFacade.getRequest().getRelativePath().contains(deployment.getLogoutPage())) {
        LOGGER.debugf("Ignoring request for [%s] and logout page [%s].", request.getRequestURI(), deployment.getLogoutPage());
        httpFacade.authenticationCompleteAnonymous();
        return;
    }

    SamlAuthenticator authenticator;

    if (httpFacade.getRequest().getRelativePath().endsWith("/saml")) {
        authenticator = new ElytronSamlEndpoint(httpFacade, deployment);
    } else {
        authenticator = new ElytronSamlAuthenticator(httpFacade, deployment, callbackHandler);

    }

    AuthOutcome outcome = authenticator.authenticate();

    if (outcome == AuthOutcome.AUTHENTICATED) {
        httpFacade.authenticationComplete();
        return;
    }

    if (outcome == AuthOutcome.NOT_AUTHENTICATED) {
        httpFacade.noAuthenticationInProgress(null);
        return;
    }

    if (outcome == AuthOutcome.LOGGED_OUT) {
        if (deployment.getLogoutPage() != null) {
            redirectLogout(deployment, httpFacade);
        }
        httpFacade.authenticationInProgress();
        return;
    }

    AuthChallenge challenge = authenticator.getChallenge();

    if (challenge != null) {
        httpFacade.noAuthenticationInProgress(challenge);
        return;
    }

    if (outcome == AuthOutcome.FAILED) {
        httpFacade.authenticationFailed();
        return;
    }

    httpFacade.authenticationInProgress();
}