import org.keycloak.representations.IDToken; //导入依赖的package包/类
public KeycloakAuthentication getKeycloakAuthentication(HttpServletRequest request) throws Exception {
	String redirect = redirectUrl(request);

	AccessTokenResponse tokenResponse = ServerRequest.invokeAccessCodeToToken(keycloakDeployment, request.getParameter("code"), redirect, null);
	String idTokenString = tokenResponse.getIdToken();
	String refreashToken = tokenResponse.getRefreshToken();
	String tokenString = tokenResponse.getToken();
	AccessToken token = RSATokenVerifier.verifyToken(tokenString, keycloakDeployment.getRealmKey(), keycloakDeployment.getRealm());

	if (idTokenString != null) {
		JWSInput input = new JWSInput(idTokenString);
		IDToken idToken = input.readJsonContent(IDToken.class);
		return new KeycloakAuthentication(idToken, token, refreashToken);
	} 
	throw new RuntimeException("Invalid User ");
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
/**
 * Creates a new {@link RefreshableKeycloakSecurityContext} from the given {@link KeycloakDeployment} and {@link AccessTokenResponse}.
 *
 * @param deployment the <code>KeycloakDeployment</code> for which to create a <code>RefreshableKeycloakSecurityContext</code> (required)
 * @param accessTokenResponse the <code>AccessTokenResponse</code> from which to create a RefreshableKeycloakSecurityContext (required)
 *
 * @return a <code>RefreshableKeycloakSecurityContext</code> created from the given <code>accessTokenResponse</code>
 * @throws VerificationException if the given <code>AccessTokenResponse</code> contains an invalid {@link IDToken}
 */
public static RefreshableKeycloakSecurityContext createKeycloakSecurityContext(KeycloakDeployment deployment, AccessTokenResponse accessTokenResponse) throws VerificationException {
    String tokenString = accessTokenResponse.getToken();
    String idTokenString = accessTokenResponse.getIdToken();
    AccessToken accessToken = RSATokenVerifier
            .verifyToken(tokenString, deployment.getRealmKey(), deployment.getRealmInfoUrl());
    IDToken idToken;

    try {
        JWSInput input = new JWSInput(idTokenString);
        idToken = input.readJsonContent(IDToken.class);
    } catch (JWSInputException e) {
        throw new VerificationException("Unable to verify ID token", e);
    }

    // FIXME: does it make sense to pass null for the token store?
    return new RefreshableKeycloakSecurityContext(deployment, null, tokenString, accessToken, idTokenString, idToken, accessTokenResponse.getRefreshToken());
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
@Test
public void basicWorkflow()
  throws Exception
{
  final SimpleAuthService authService = mock( SimpleAuthService.class );
  final SimpleSecureSessionManager sm = new SimpleSecureSessionManager();
  setField( sm, authService );

  final String userID = ValueUtil.randomString();

  final OidcKeycloakAccount account = mock( OidcKeycloakAccount.class );
  final AccessToken token = new AccessToken();
  setField( token, userID );

  final KeycloakSecurityContext context =
    new KeycloakSecurityContext( ValueUtil.randomString(), token, ValueUtil.randomString(), new IDToken() );
  when( account.getKeycloakSecurityContext() ).thenReturn( context );
  when( authService.findAccount() ).thenReturn( account );

  final SessionInfo sessionInfo = sm.createSession();
  assertNotNull( sessionInfo );
  assertEquals( sessionInfo.getUserID(), userID );
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
public static User getCurrentUserWithAuthorities() {
    try {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    KeycloakPrincipal userDetails = (KeycloakPrincipal) authentication.getPrincipal();
    IDToken idToken = userDetails.getKeycloakSecurityContext().getIdToken();

    User user = new User();
    user.setEmail(idToken.getEmail());
    user.setFirstName(idToken.getGivenName());
    user.setFullName(idToken.getName());
    user.setEmail(idToken.getEmail());
    user.setGender(idToken.getGender());
    user.setLastName(idToken.getFamilyName());
    user.setLocale(idToken.getLocale());
    user.setLogin(idToken.getPreferredUsername());
    user.setPhoneNumber(idToken.getPhoneNumber());
    user.setPhoneNumberVerified(idToken.getPhoneNumberVerified());
    user.setPicture(idToken.getPicture());
    user.setProfile(idToken.getProfile());
    user.setWebsite(idToken.getWebsite());
    user.setUpdatedAt(idToken.getUpdatedAt());
    
    Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
    user.setAuthorities(authorities);
    return user;
    } catch (Exception e) {
        return null;
    }
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
@RequestMapping(value = "/info/user", method = RequestMethod.GET)
public String handlerUserInfoRequest(Model model)
{
    KeycloakAuthenticationToken authentication = (KeycloakAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
    IDToken token = authentication.getAccount().getKeycloakSecurityContext().getIdToken();

    model.addAttribute("token", token);
    model.addAttribute("claims", token.getOtherClaims());

    return "info";
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
/**
 *
 * @param token token to retrieve claim from
 * @param claim the claim (field key)
 * @return string representaion of claim
 */
public static String getClaim(IDToken token, String claim) {
  if (claim == null || token == null)
      return null;
  // Get the standard claim field, if available
  if (STANDARD_CLAIMS_FIELD_MAP.containsKey(claim)) {
      return callClaimChain(token, STANDARD_CLAIMS_FIELD_MAP.get(claim));
  } else { // Otherwise look up 'other claims'
      Object otherClaim = getOtherClaimValue(token, claim);
      return otherClaim == null ? null : otherClaim.toString();
  }
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
public static IDToken getIDToken(HttpServletRequest req) {
	if (req.getUserPrincipal() == null) {
		return null;
	}
	KeycloakSecurityContext session = ((KeycloakPrincipal<?>) req.getUserPrincipal()).getKeycloakSecurityContext();
	if (session == null) {
    	return null;
    }
	return getIDToken(req, session);
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
@Override
public String getAccountKey(HttpServletRequest request) {
	IDToken token = AdminClient.getIDToken(request);
	
	if (token == null) {
		return null;
	}
	
	return token.getId();
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
/**
 * Validate the user's session.
 * 
 * @param httpRequest the HTTP request object; may not be null
 * @param databaseId the identifier of the database to which the caller wants to connect; may not be null
 * @return the session token, or null if the user is not authenticated
 */
private SessionToken validateSession(HttpServletRequest httpRequest, String databaseId) {
    KeycloakSecurityContext session = (KeycloakSecurityContext) httpRequest.getAttribute(KeycloakSecurityContext.class.getName());
    IDToken token = session.getIdToken();
    if (token == null) return null;

    String device = httpRequest.getHeader("X-Debezium-Device");
    String userAgent = httpRequest.getHeader("User-Agent");

    return driver.connect(token.getPreferredUsername(), device, userAgent, databaseId);
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
/**
 * This is where the user comes back to at the end of the OpenID redirect
 * ping-pong.
 * 
 * @throws HttpFailure
 * @throws VerificationException
 */
public HttpResponse doFinishLogin(StaplerRequest request) {

	String redirect = redirectUrl(request);

	try {

		AccessTokenResponse tokenResponse = ServerRequest.invokeAccessCodeToToken(getKeycloakDeployment(),
				request.getParameter("code"), redirect, null);

		String tokenString = tokenResponse.getToken();
		String idTokenString = tokenResponse.getIdToken();
		String refreashToken = tokenResponse.getRefreshToken();

		AccessToken token = AdapterRSATokenVerifier.verifyToken(tokenString, getKeycloakDeployment());
		if (idTokenString != null) {
			JWSInput input = new JWSInput(idTokenString);

			IDToken idToken = input.readJsonContent(IDToken.class);
			SecurityContextHolder.getContext()
					.setAuthentication(new KeycloakAuthentication(idToken, token, refreashToken));

			User currentUser = User.current();
			if (currentUser != null) {
				currentUser.setFullName(idToken.getPreferredUsername());

				if (!currentUser.getProperty(Mailer.UserProperty.class).hasExplicitlyConfiguredAddress()) {
					currentUser.addProperty(new Mailer.UserProperty(idToken.getEmail()));
				}
			}
		}

	} catch (Exception e) {
		LOGGER.log(Level.SEVERE, "Authentication Exception ", e);
	}

	String referer = (String) request.getSession().getAttribute(REFERER_ATTRIBUTE);
	if (referer != null) {
		return HttpResponses.redirectTo(referer);
	}
	return HttpResponses.redirectToContextRoot();
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
public KeycloakAuthentication(IDToken idToken, AccessToken accessToken, String refreashToken) {
	super(buildRoles(accessToken));
	this.userName = idToken.getPreferredUsername();
	this.refreashToken = refreashToken;
	setAuthenticated(true);
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
public KeycloakAuthentication(IDToken idToken, AccessToken accessToken, String refreashToken) {
	buildRoles(accessToken);
	this.userName = idToken.getName();
	this.refreashToken = refreashToken;
	this.email = idToken.getEmail();
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
public void setIdToken(IDToken idToken) {
    this.idToken = idToken;
}
 

import org.keycloak.representations.IDToken; //导入依赖的package包/类
public IDToken getIdToken() {
    return idToken;
}