import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
@Nullable
public synchronized AccessTokenResponse getAccessToken()
{
  if ( null == _currentToken )
  {
    return grantToken();
  }
  else if ( tokenExpired() )
  {
    return refreshToken();
  }
  else
  {
    return _currentToken;
  }
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
public KeycloakAuthentication getKeycloakAuthentication(HttpServletRequest request) throws Exception {
	String redirect = redirectUrl(request);

	AccessTokenResponse tokenResponse = ServerRequest.invokeAccessCodeToToken(keycloakDeployment, request.getParameter("code"), redirect, null);
	String idTokenString = tokenResponse.getIdToken();
	String refreashToken = tokenResponse.getRefreshToken();
	String tokenString = tokenResponse.getToken();
	AccessToken token = RSATokenVerifier.verifyToken(tokenString, keycloakDeployment.getRealmKey(), keycloakDeployment.getRealm());

	if (idTokenString != null) {
		JWSInput input = new JWSInput(idTokenString);
		IDToken idToken = input.readJsonContent(IDToken.class);
		return new KeycloakAuthentication(idToken, token, refreashToken);
	} 
	throw new RuntimeException("Invalid User ");
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
public AccessTokenResponse grantToken(){
    WebTarget target = client.target(config.getServerUrl());

    Form form = new Form()
            .param("grant_type", "password")
            .param("username", config.getUsername())
            .param("password", config.getPassword());

    if (config.isPublicClient()) {
        form.param("client_id", config.getClientId());
    } else {
        target.register(new BasicAuthFilter(config.getClientId(), config.getClientSecret()));
    }

    TokenService tokenService = WebResourceFactory.newResource(TokenService.class, target);

    AccessTokenResponse response = tokenService.grantToken(config.getRealm(), form.asMap());

    defineCurrentToken(response);
    return response;
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
public AccessTokenResponse refreshToken(){
	WebTarget target = client.target(config.getServerUrl());

    Form form = new Form()
            .param("grant_type", "refresh_token")
            .param("refresh_token", currentToken.getRefreshToken());

    if (config.isPublicClient()) {
        form.param("client_id", config.getClientId());
    } else {
        target.register(new BasicAuthFilter(config.getClientId(), config.getClientSecret()));
    }

    TokenService tokenService = WebResourceFactory.newResource(TokenService.class, target);

    try {
        AccessTokenResponse response = tokenService.refreshToken(config.getRealm(), form.asMap());
        defineCurrentToken(response);
        return response;
    } catch (BadRequestException e) {
        return grantToken();
    }
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
/**
 * Creates a new {@link RefreshableKeycloakSecurityContext} from the given {@link KeycloakDeployment} and {@link AccessTokenResponse}.
 *
 * @param deployment the <code>KeycloakDeployment</code> for which to create a <code>RefreshableKeycloakSecurityContext</code> (required)
 * @param accessTokenResponse the <code>AccessTokenResponse</code> from which to create a RefreshableKeycloakSecurityContext (required)
 *
 * @return a <code>RefreshableKeycloakSecurityContext</code> created from the given <code>accessTokenResponse</code>
 * @throws VerificationException if the given <code>AccessTokenResponse</code> contains an invalid {@link IDToken}
 */
public static RefreshableKeycloakSecurityContext createKeycloakSecurityContext(KeycloakDeployment deployment, AccessTokenResponse accessTokenResponse) throws VerificationException {
    String tokenString = accessTokenResponse.getToken();
    String idTokenString = accessTokenResponse.getIdToken();
    AccessToken accessToken = RSATokenVerifier
            .verifyToken(tokenString, deployment.getRealmKey(), deployment.getRealmInfoUrl());
    IDToken idToken;

    try {
        JWSInput input = new JWSInput(idTokenString);
        idToken = input.readJsonContent(IDToken.class);
    } catch (JWSInputException e) {
        throw new VerificationException("Unable to verify ID token", e);
    }

    // FIXME: does it make sense to pass null for the token store?
    return new RefreshableKeycloakSecurityContext(deployment, null, tokenString, accessToken, idTokenString, idToken, accessTokenResponse.getRefreshToken());
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
@Override
public RefreshableKeycloakSecurityContext login(String username, String password) throws VerificationException {

    final MultiValueMap<String,String> body = new LinkedMultiValueMap<>();
    final HttpHeaders headers = new HttpHeaders();

    headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
    headers.setAccept(Arrays.asList(MediaType.APPLICATION_JSON));
    body.set("username", username);
    body.set("password", password);
    body.set(OAuth2Constants.GRANT_TYPE, OAuth2Constants.PASSWORD);

    AccessTokenResponse response = template.postForObject(keycloakDeployment.getTokenUrl(), new HttpEntity<>(body, headers), AccessTokenResponse.class);

    return KeycloakSpringAdapterUtils.createKeycloakSecurityContext(keycloakDeployment, response);
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
private void logout(AccessTokenResponse accessTokenResponse) {
    try(CloseableHttpClient client = HttpClientBuilder.create().build()) {
        HttpPost post = new HttpPost(KeycloakUriBuilder.fromUri(baseUrl)
                .path(ServiceUrlConstants.TOKEN_SERVICE_LOGOUT_PATH).build(LiveOak.LIVEOAK_APP_REALM));

        List<NameValuePair> formparams = new ArrayList<>();
        formparams.add(new BasicNameValuePair(OAuth2Constants.REFRESH_TOKEN, accessTokenResponse.getRefreshToken()));
        formparams.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, "liveoak-admin-client"));
        UrlEncodedFormEntity form = new UrlEncodedFormEntity(formparams, "UTF-8");
        post.setEntity(form);

        client.execute(post);
    } catch (IOException e) {
        // Not a problem we need to report
    }

    this.accessTokenResponse = null;
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
/**
 * Call token service to refresh token, and then attempt to grant token if the refresh fails.
 */
@Nullable
private AccessTokenResponse refreshToken()
{
  assert null != _currentToken;
  getAccessToken( refreshTokenParameters() );
  return null != _currentToken ? _currentToken : grantToken();
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
/**
 * Invoke the token web service with specified parameters.
 */
@Nullable
private AccessTokenResponse callTokenService( @Nonnull final MultivaluedMap<String, String> parameters )
{
  final ClientBuilder builder =
    ClientBuilder.newBuilder().register( JacksonFeature.class );
  final String clientSecret = _config.getClientSecret();
  if ( null != clientSecret )
  {
    builder.register( new BasicAuthFilter( _config.getClientID(), clientSecret ) );
  }
  final Client client = builder.build();
  try
  {
    final WebTarget target = client.
      target( _config.getServerUrl() ).
      path( "/realms/" ).path( _config.getRealm() ).path( "/protocol/openid-connect/token" );
    final Response response = target.
      request( MediaType.APPLICATION_FORM_URLENCODED ).
      accept( MediaType.APPLICATION_JSON ).
      post( Entity.form( parameters ) );
    if ( Response.Status.Family.SUCCESSFUL == response.getStatusInfo().getFamily() )
    {
      return response.readEntity( AccessTokenResponse.class );
    }
    else
    {
      return null;
    }
  }
  finally
  {
    client.close();
  }
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
public TokenManager(AccessTokenResponse currentToken, Config config, Client client){
    this.config = config;
    this.client = client;
    if (currentToken != null) {
    	defineCurrentToken(currentToken);
    }
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
public AccessTokenResponse getAccessToken(){
    if (currentToken == null) {
        grantToken();
    } else if(tokenExpired()) {
        refreshToken();
    }
    return currentToken;
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
@Nullable
public String getAccessTokenString()
{
  final AccessTokenResponse token = getAccessToken();
  return null == token ? null : token.getToken();
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
/**
 * Call token service to grant token.
 */
@Nullable
private AccessTokenResponse grantToken()
{
  return getAccessToken( grantTokenParameters() );
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
/**
 * This is where the user comes back to at the end of the OpenID redirect
 * ping-pong.
 * 
 * @throws HttpFailure
 * @throws VerificationException
 */
public HttpResponse doFinishLogin(StaplerRequest request) {

	String redirect = redirectUrl(request);

	try {

		AccessTokenResponse tokenResponse = ServerRequest.invokeAccessCodeToToken(getKeycloakDeployment(),
				request.getParameter("code"), redirect, null);

		String tokenString = tokenResponse.getToken();
		String idTokenString = tokenResponse.getIdToken();
		String refreashToken = tokenResponse.getRefreshToken();

		AccessToken token = AdapterRSATokenVerifier.verifyToken(tokenString, getKeycloakDeployment());
		if (idTokenString != null) {
			JWSInput input = new JWSInput(idTokenString);

			IDToken idToken = input.readJsonContent(IDToken.class);
			SecurityContextHolder.getContext()
					.setAuthentication(new KeycloakAuthentication(idToken, token, refreashToken));

			User currentUser = User.current();
			if (currentUser != null) {
				currentUser.setFullName(idToken.getPreferredUsername());

				if (!currentUser.getProperty(Mailer.UserProperty.class).hasExplicitlyConfiguredAddress()) {
					currentUser.addProperty(new Mailer.UserProperty(idToken.getEmail()));
				}
			}
		}

	} catch (Exception e) {
		LOGGER.log(Level.SEVERE, "Authentication Exception ", e);
	}

	String referer = (String) request.getSession().getAttribute(REFERER_ATTRIBUTE);
	if (referer != null) {
		return HttpResponses.redirectTo(referer);
	}
	return HttpResponses.redirectToContextRoot();
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
private void defineCurrentToken(AccessTokenResponse accessTokenResponse){
    currentToken = accessTokenResponse;
    setExpirationTime();
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
public static BlazeStorage getInstance(String serverUrl, AccessTokenResponse accessToken, Config keycloakConfig) {
	Client client = ClientBuilder.newClient();
	TokenManager tokenManager = new TokenManager(accessToken, keycloakConfig, client);
	return BlazeStorageClient.getInstance(serverUrl, new BearerAuthFilter(tokenManager));
}
 

import org.keycloak.representations.AccessTokenResponse; //导入依赖的package包/类
public String accessToken() throws IOException {
    if (openConnections.get() == 0 && accessTokenResponse == null) {

        synchronized (this) {
            if (accessTokenResponse == null) {
                // Not connected
                int attempts = 0;
                boolean intr = false;

                try {
                    while (accessTokenResponse == null && attempts < MAX_RETRIES) {

                        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {

                            HttpPost post = new HttpPost(KeycloakUriBuilder.fromUri(baseUrl)
                                    .path(ServiceUrlConstants.TOKEN_SERVICE_DIRECT_GRANT_PATH).build(LiveOak.LIVEOAK_APP_REALM));

                            List<NameValuePair> formparams = new ArrayList<>();
                            formparams.add(new BasicNameValuePair("username", "liveoak-server"));

                            String initialPassword = System.getProperty("liveoak.initial.password");
                            if (initialPassword != null) {
                                formparams.add(new BasicNameValuePair("password", initialPassword));
                            } else {
                                formparams.add(new BasicNameValuePair("password", "password"));
                            }

                            formparams.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, "liveoak-admin-client"));
                            UrlEncodedFormEntity form = new UrlEncodedFormEntity(formparams, "UTF-8");
                            post.setEntity(form);

                            HttpResponse response = client.execute(post);
                            int status = response.getStatusLine().getStatusCode();
                            HttpEntity entity = response.getEntity();

                            if (status == 404) {
                                attempts++;
                                wait(TIMEOUT);
                                continue;
                            } else if (status != 200) {
                                String json = EntityUtils.toString(entity);
                                throw new IOException("Bad status: " + status + ", response: " + json);
                            }

                            if (entity == null) {
                                throw new IOException("No Entity");
                            }

                            accessTokenResponse = JsonSerialization.readValue(EntityUtils.toString(entity), AccessTokenResponse.class);
                        } catch (InterruptedException e) {
                            intr = true;
                        }
                    }
                } finally {
                    if (intr) Thread.currentThread().interrupt();
                }
            }
        }
    }

    openConnections.incrementAndGet();
    return accessTokenResponse.getToken();
}