From 089c27a5eece7ab7cc5ce5b079158a1461901a9d Mon Sep 17 00:00:00 2001 From: Giuseppe Graziano Date: Fri, 3 Jul 2026 14:17:53 +0200 Subject: [PATCH 1/2] Add idp alias to store federated tokens in user session notes Closes #50533 Signed-off-by: Giuseppe Graziano --- .../provider/AbstractIdentityProvider.java | 27 +++++- .../oidc/AbstractOAuth2IdentityProvider.java | 84 ++++++++++++++++--- .../broker/oidc/OIDCIdentityProvider.java | 33 ++++---- .../broker/saml/SAMLIdentityProvider.java | 3 +- .../AbstractTokenExchangeProvider.java | 9 +- .../twitter/TwitterIdentityProvider.java | 6 +- ...rfaceIdentityProviderStoreTokenV2Test.java | 7 +- .../KcOidcBrokerNonceParameterTest.java | 2 +- 8 files changed, 134 insertions(+), 37 deletions(-) diff --git a/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java index 4a9262273e81..d74e2a395b2d 100755 --- a/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java +++ b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java @@ -72,6 +72,10 @@ public C getConfig() { return this.config; } + protected String getFederatedAccessTokenKey() { + return FEDERATED_ACCESS_TOKEN + ":" + getConfig().getAlias(); + } + @Override public void close() { // no-op @@ -231,13 +235,30 @@ public IdentityProviderDataMarshaller getMarshaller() { } protected String getFederatedAccessToken(UserSessionModel userSession) { - // return the FEDERATED_ACCESS_TOKEN but just if logged in using this identity provider - if (getConfig().getAlias().equals(userSession.getNote(Details.IDENTITY_PROVIDER))) { - return userSession.getNote(FEDERATED_ACCESS_TOKEN); + // First try alias-namespaced key (supports multiple linked IdPs) + String token = userSession.getNote(getFederatedAccessTokenKey()); + if (token != null) { + return token; + } + // Fallback to un-namespaced key for backward compatibility + String brokerId = userSession.getNote(Details.IDENTITY_PROVIDER); + if (brokerId == null) { + brokerId = userSession.getNote(EXTERNAL_IDENTITY_PROVIDER); + } + if (getConfig().getAlias().equals(brokerId)) { + return userSession.getNote(FEDERATED_ACCESS_TOKEN); } return null; } + protected void setFederatedAccessToken(UserSessionModel userSession, String token) { + userSession.setNote(getFederatedAccessTokenKey(), token); + } + + protected void setFederatedAccessToken(AuthenticationSessionModel authSession, String token) { + authSession.setUserSessionNote(getFederatedAccessTokenKey(), token); + } + protected Response buildTokenResponse(UriInfo uriInfo, EventBuilder event, ClientModel authorizedClient, UserSessionModel tokenUserSession, AccessTokenResponse tokenResponse, String issuedTokenType) { tokenResponse.setIdToken(null); diff --git a/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java b/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java index f0b63d20f124..344246487636 100755 --- a/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java +++ b/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java @@ -125,6 +125,67 @@ public abstract class AbstractOAuth2IdentityProvider params) { if (getConfig().getAlias().equals(tokenUserSession.getNote(OIDCIdentityProvider.EXCHANGE_PROVIDER))) { - String requestedType = params.getFirst(OAuth2Constants.REQUESTED_TOKEN_TYPE); if ((requestedType == null || requestedType.equals(OAuth2Constants.ACCESS_TOKEN_TYPE))) { - String accessToken = tokenUserSession.getNote(FEDERATED_ACCESS_TOKEN); + String accessToken = getFederatedAccessToken(tokenUserSession); if (accessToken != null) { AccessTokenResponse tokenResponse = new AccessTokenResponse(); tokenResponse.setToken(accessToken); return buildTokenResponse(session.getContext().getUri(), event, null, tokenUserSession, tokenResponse, OAuth2Constants.ACCESS_TOKEN_TYPE); } } else if (OAuth2Constants.ID_TOKEN_TYPE.equals(requestedType)) { - String idToken = tokenUserSession.getNote(OIDCIdentityProvider.FEDERATED_ID_TOKEN); + String idToken = getFederatedIdToken(tokenUserSession); if (idToken != null) { AccessTokenResponse tokenResponse = new AccessTokenResponse(); tokenResponse.setToken(null); @@ -472,7 +530,7 @@ protected Response exchangeStoredToken(UriInfo uriInfo, EventBuilder event, Clie } protected Response exchangeSessionToken(UriInfo uriInfo, EventBuilder event, ClientModel authorizedClient, UserSessionModel tokenUserSession, UserModel tokenSubject) { - String accessToken = tokenUserSession.getNote(FEDERATED_ACCESS_TOKEN); + String accessToken = getFederatedAccessToken(tokenUserSession); if (accessToken == null) { if (event != null) { @@ -620,7 +678,9 @@ public JsonNode asJsonNode(String json) throws IOException { @Override public void authenticationFinished(AuthenticationSessionModel authSession, BrokeredIdentityContext context) { String token = (String) context.getContextData().get(FEDERATED_ACCESS_TOKEN); - if (token != null) authSession.setUserSessionNote(FEDERATED_ACCESS_TOKEN, token); + if (token != null) { + setFederatedAccessToken(authSession, token); + } } public SimpleHttpRequest authenticateTokenRequest(final SimpleHttpRequest tokenRequest) { @@ -1076,10 +1136,12 @@ protected BrokeredIdentityContext exchangeExternalUserInfoValidationOnly(EventBu public void exchangeExternalComplete(UserSessionModel userSession, BrokeredIdentityContext context, MultivaluedMap params) { if (getConfig().isStoreTokenInSession()) { if (context.getContextData().containsKey(OIDCIdentityProvider.VALIDATED_ACCESS_TOKEN)) { - userSession.setNote(FEDERATED_ACCESS_TOKEN, params.getFirst(OAuth2Constants.SUBJECT_TOKEN)); + String subjectToken = params.getFirst(OAuth2Constants.SUBJECT_TOKEN); + setFederatedAccessToken(userSession, subjectToken); } if (context.getContextData().containsKey(OIDCIdentityProvider.VALIDATED_ID_TOKEN)) { - userSession.setNote(OIDCIdentityProvider.FEDERATED_ID_TOKEN, params.getFirst(OAuth2Constants.SUBJECT_TOKEN)); + String subjectToken = params.getFirst(OAuth2Constants.SUBJECT_TOKEN); + setFederatedIdToken(userSession, subjectToken); } userSession.setNote(OIDCIdentityProvider.EXCHANGE_PROVIDER, getConfig().getAlias()); } diff --git a/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java b/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java index 01d6c8ee3f30..cd1b142f9cab 100755 --- a/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java +++ b/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java @@ -152,7 +152,7 @@ public boolean isType(KeycloakSession session, IdentityProviderType type) { * @return */ public String refreshTokenForLogout(KeycloakSession session, UserSessionModel userSession) { - String refreshToken = userSession.getNote(FEDERATED_REFRESH_TOKEN); + String refreshToken = getFederatedRefreshToken(userSession); try (VaultStringSecret vaultStringSecret = session.vault().getStringSecret(getConfig().getClientSecret())) { return getRefreshTokenRequest(session, refreshToken, getConfig().getClientId(), vaultStringSecret.get().orElse(getConfig().getClientSecret())).asString(); } catch (IOException e) { @@ -164,7 +164,7 @@ public String refreshTokenForLogout(KeycloakSession session, UserSessionModel us public void backchannelLogout(KeycloakSession session, UserSessionModel userSession, UriInfo uriInfo, RealmModel realm) { if (getConfig().getLogoutUrl() == null || getConfig().getLogoutUrl().trim().equals("") || !getConfig().isBackchannelSupported()) return; - String idToken = userSession.getNote(FEDERATED_ID_TOKEN); + String idToken = getFederatedIdToken(userSession); if (idToken == null) return; backchannelLogout(userSession, idToken); } @@ -195,7 +195,7 @@ protected void backchannelLogout(UserSessionModel userSession, String idToken) { @Override public Response keycloakInitiatedBrowserLogout(KeycloakSession session, UserSessionModel userSession, UriInfo uriInfo, RealmModel realm) { if (getConfig().getLogoutUrl() == null || getConfig().getLogoutUrl().trim().equals("")) return null; - String idToken = userSession.getNote(FEDERATED_ID_TOKEN); + String idToken = getFederatedIdToken(userSession); if (getConfig().isBackchannelSupported()) { backchannelLogout(userSession, idToken); return null; @@ -257,7 +257,7 @@ protected Response exchangeStoredToken(UriInfo uriInfo, EventBuilder event, Clie updateStoredTokenModel(realm, tokenSubject, model, currentTime, newResponse, tokenResponse); if (tokenUserSession != null) { - String oldToken = tokenUserSession.getNote(FEDERATED_ACCESS_TOKEN); + String oldToken = getFederatedAccessToken(tokenUserSession); if (oldToken != null && oldToken.equals(tokenResponse.getToken())) { updateUserSessionFromRefresh(tokenUserSession, newResponse, currentTime); } @@ -277,8 +277,8 @@ protected Response exchangeStoredToken(UriInfo uriInfo, EventBuilder event, Clie @Override protected Response exchangeSessionToken(UriInfo uriInfo, EventBuilder event, ClientModel authorizedClient, UserSessionModel tokenUserSession, UserModel tokenSubject) { RealmModel realm = authorizedClient != null ? authorizedClient.getRealm() : session.getContext().getRealm(); - String refreshToken = tokenUserSession.getNote(FEDERATED_REFRESH_TOKEN); - String accessToken = tokenUserSession.getNote(FEDERATED_ACCESS_TOKEN); + String refreshToken = getFederatedRefreshToken(tokenUserSession); + String accessToken = getFederatedAccessToken(tokenUserSession); if (accessToken == null) { if (event != null) { @@ -289,7 +289,8 @@ protected Response exchangeSessionToken(UriInfo uriInfo, EventBuilder event, Cli } try { - long expiration = Long.parseLong(tokenUserSession.getNote(FEDERATED_TOKEN_EXPIRATION)); + String expirationNote = getFederatedTokenExpiration(tokenUserSession); + long expiration = Long.parseLong(expirationNote); final int currentTime = Time.currentTime(); if (expiration == 0 || expiration > currentTime + getConfig().getMinValidityToken()) { @@ -360,12 +361,13 @@ private void updateUserSessionFromRefresh(UserSessionModel tokenUserSession, Acc final boolean isStoreTokenInSession = getConfig().isStoreTokenInSession(); if (isStoreTokenInSession) { long accessTokenExpiration = newResponse.getExpiresIn() > 0 ? currentTime + newResponse.getExpiresIn() : 0; - tokenUserSession.setNote(FEDERATED_TOKEN_EXPIRATION, Long.toString(accessTokenExpiration)); - tokenUserSession.setNote(FEDERATED_REFRESH_TOKEN, newResponse.getRefreshToken()); - tokenUserSession.setNote(FEDERATED_ACCESS_TOKEN, newResponse.getToken()); + String expirationStr = Long.toString(accessTokenExpiration); + setFederatedTokenExpiration(tokenUserSession, expirationStr); + setFederatedRefreshToken(tokenUserSession, newResponse.getRefreshToken()); + setFederatedAccessToken(tokenUserSession, newResponse.getToken()); } if (newResponse.getIdToken() != null && (isStoreTokenInSession || getConfig().isSendIdTokenOnLogout())) { - tokenUserSession.setNote(FEDERATED_ID_TOKEN, newResponse.getIdToken()); + setFederatedIdToken(tokenUserSession, newResponse.getIdToken()); } } @@ -843,12 +845,13 @@ public void authenticationFinished(AuthenticationSessionModel authSession, Broke if (isStoreTokenInSession) { int currentTime = Time.currentTime(); long expiration = tokenResponse.getExpiresIn() > 0 ? tokenResponse.getExpiresIn() + currentTime : 0; - authSession.setUserSessionNote(FEDERATED_TOKEN_EXPIRATION, Long.toString(expiration)); - authSession.setUserSessionNote(FEDERATED_REFRESH_TOKEN, tokenResponse.getRefreshToken()); - authSession.setUserSessionNote(FEDERATED_ACCESS_TOKEN, tokenResponse.getToken()); + String expirationStr = Long.toString(expiration); + setFederatedTokenExpiration(authSession, expirationStr); + setFederatedRefreshToken(authSession, tokenResponse.getRefreshToken()); + setFederatedAccessToken(authSession, tokenResponse.getToken()); } if (isStoreTokenInSession || getConfig().isSendIdTokenOnLogout()) { - authSession.setUserSessionNote(FEDERATED_ID_TOKEN, tokenResponse.getIdToken()); + setFederatedIdToken(authSession, tokenResponse.getIdToken()); } } diff --git a/services/src/main/java/org/keycloak/broker/saml/SAMLIdentityProvider.java b/services/src/main/java/org/keycloak/broker/saml/SAMLIdentityProvider.java index de4d2b8d0c0e..4618a89ced10 100755 --- a/services/src/main/java/org/keycloak/broker/saml/SAMLIdentityProvider.java +++ b/services/src/main/java/org/keycloak/broker/saml/SAMLIdentityProvider.java @@ -273,7 +273,8 @@ public void authenticationFinished(AuthenticationSessionModel authSession, Broke } if (context.getContextData().containsKey(FEDERATED_ACCESS_TOKEN)) { - authSession.setUserSessionNote(FEDERATED_ACCESS_TOKEN, (String) context.getContextData().get(FEDERATED_ACCESS_TOKEN)); + String token = (String) context.getContextData().get(FEDERATED_ACCESS_TOKEN); + setFederatedAccessToken(authSession, token); } } diff --git a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java index 1b52f9b9056f..69f8ac4ebd99 100644 --- a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java +++ b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java @@ -305,8 +305,9 @@ protected Response exchangeExternalToken(String subjectIssuer, String subjectTok externalExchangeContext.provider().exchangeExternalComplete(userSession, context, formParams); // this must exist so that we can obtain access token from user session if idp's store tokens is off - userSession.setNote(UserAuthenticationIdentityProvider.EXTERNAL_IDENTITY_PROVIDER, externalExchangeContext.idpModel().getAlias()); - userSession.setNote(UserAuthenticationIdentityProvider.FEDERATED_ACCESS_TOKEN, subjectToken); + String idpAlias = externalExchangeContext.idpModel().getAlias(); + userSession.setNote(UserAuthenticationIdentityProvider.EXTERNAL_IDENTITY_PROVIDER, idpAlias); + setFederatedAccessTokenNotes(userSession, idpAlias, subjectToken); context.addSessionNotesToUserSession(userSession); @@ -433,6 +434,10 @@ protected UserModel importUserFromExternalIdentity(BrokeredIdentityContext conte return user; } + private void setFederatedAccessTokenNotes(UserSessionModel userSession, String idpAlias, String token) { + userSession.setNote(UserAuthenticationIdentityProvider.FEDERATED_ACCESS_TOKEN + ":" + idpAlias, token); + } + // TODO: move to utility class protected void updateUserSessionFromClientAuth(UserSessionModel userSession) { for (Map.Entry attr : clientAuthAttributes.entrySet()) { diff --git a/services/src/main/java/org/keycloak/social/twitter/TwitterIdentityProvider.java b/services/src/main/java/org/keycloak/social/twitter/TwitterIdentityProvider.java index d09f0180d02b..10772b65809c 100755 --- a/services/src/main/java/org/keycloak/social/twitter/TwitterIdentityProvider.java +++ b/services/src/main/java/org/keycloak/social/twitter/TwitterIdentityProvider.java @@ -169,7 +169,7 @@ protected Response exchangeStoredToken(UriInfo uriInfo, ClientModel authorizedCl } protected Response exchangeSessionToken(UriInfo uriInfo, ClientModel authorizedClient, UserSessionModel tokenUserSession, UserModel tokenSubject) { - String accessToken = tokenUserSession.getNote(UserAuthenticationIdentityProvider.FEDERATED_ACCESS_TOKEN); + String accessToken = getFederatedAccessToken(tokenUserSession); if (accessToken == null) { return exchangeTokenExpired(uriInfo, authorizedClient, tokenUserSession, tokenSubject); } @@ -296,8 +296,8 @@ public Response retrieveToken(KeycloakSession session, FederatedIdentityModel id @Override public void authenticationFinished(AuthenticationSessionModel authSession, BrokeredIdentityContext context) { - authSession.setUserSessionNote(UserAuthenticationIdentityProvider.FEDERATED_ACCESS_TOKEN, (String) context.getContextData().get(UserAuthenticationIdentityProvider.FEDERATED_ACCESS_TOKEN)); - + String token = (String) context.getContextData().get(UserAuthenticationIdentityProvider.FEDERATED_ACCESS_TOKEN); + setFederatedAccessToken(authSession, token); } } diff --git a/tests/base/src/test/java/org/keycloak/tests/broker/InterfaceIdentityProviderStoreTokenV2Test.java b/tests/base/src/test/java/org/keycloak/tests/broker/InterfaceIdentityProviderStoreTokenV2Test.java index fed3fc7b63cc..e98276cc6d89 100644 --- a/tests/base/src/test/java/org/keycloak/tests/broker/InterfaceIdentityProviderStoreTokenV2Test.java +++ b/tests/base/src/test/java/org/keycloak/tests/broker/InterfaceIdentityProviderStoreTokenV2Test.java @@ -330,7 +330,12 @@ default String getTokenFromSession(String realmName, String sessionId) { return getRunOnServer().fetch(session -> { RealmModel r = session.realms().getRealmByName(realmName); UserSessionModel userSession = session.sessions().getUserSession(r, sessionId); - return userSession.getNote(UserAuthenticationIdentityProvider.FEDERATED_ACCESS_TOKEN); + // Try alias-namespaced key first, then fall back to legacy un-namespaced key + String token = userSession.getNote(UserAuthenticationIdentityProvider.FEDERATED_ACCESS_TOKEN + ":" + IDP_ALIAS); + if (token == null) { + token = userSession.getNote(UserAuthenticationIdentityProvider.FEDERATED_ACCESS_TOKEN); + } + return token; }, String.class); } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerNonceParameterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerNonceParameterTest.java index a33f16e58f9c..545126952cc5 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerNonceParameterTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerNonceParameterTest.java @@ -46,7 +46,7 @@ public List createConsumerClients() { consumerSessionNoteToClaimMapper.setName(OIDCIdentityProvider.FEDERATED_ID_TOKEN); consumerSessionNoteToClaimMapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL); consumerSessionNoteToClaimMapper.setProtocolMapper(UserSessionNoteMapper.PROVIDER_ID); - consumerSessionNoteToClaimMapper.setConfig(Map.of(ProtocolMapperUtils.USER_SESSION_NOTE, OIDCIdentityProvider.FEDERATED_ID_TOKEN, + consumerSessionNoteToClaimMapper.setConfig(Map.of(ProtocolMapperUtils.USER_SESSION_NOTE, OIDCIdentityProvider.FEDERATED_ID_TOKEN + ":" + BrokerTestConstants.IDP_OIDC_ALIAS, OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME, OIDCIdentityProvider.FEDERATED_ID_TOKEN, OIDCAttributeMapperHelper.INCLUDE_IN_ID_TOKEN, Boolean.TRUE.toString())); client.setProtocolMappers(Arrays.asList(consumerSessionNoteToClaimMapper)); From a6685b425cfb6842b70967e45c6c7e608e0e35c2 Mon Sep 17 00:00:00 2001 From: Giuseppe Graziano Date: Mon, 13 Jul 2026 11:36:20 +0200 Subject: [PATCH 2/2] Manage OIDC broker email verification Closes #50618 Signed-off-by: Giuseppe Graziano --- .../provider/AbstractIdentityProvider.java | 15 +++++++++------ .../oidc/AbstractOAuth2IdentityProvider.java | 18 +++--------------- .../AbstractTokenExchangeProvider.java | 4 ++-- 3 files changed, 14 insertions(+), 23 deletions(-) diff --git a/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java index d74e2a395b2d..4f0d38667b8a 100755 --- a/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java +++ b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java @@ -234,11 +234,10 @@ public IdentityProviderDataMarshaller getMarshaller() { return new DefaultDataMarshaller(); } - protected String getFederatedAccessToken(UserSessionModel userSession) { - // First try alias-namespaced key (supports multiple linked IdPs) - String token = userSession.getNote(getFederatedAccessTokenKey()); - if (token != null) { - return token; + protected String getFederatedTokenNote(UserSessionModel userSession, String namespacedKey, String legacyKey) { + String value = userSession.getNote(namespacedKey); + if (value != null) { + return value; } // Fallback to un-namespaced key for backward compatibility String brokerId = userSession.getNote(Details.IDENTITY_PROVIDER); @@ -246,11 +245,15 @@ protected String getFederatedAccessToken(UserSessionModel userSession) { brokerId = userSession.getNote(EXTERNAL_IDENTITY_PROVIDER); } if (getConfig().getAlias().equals(brokerId)) { - return userSession.getNote(FEDERATED_ACCESS_TOKEN); + return userSession.getNote(legacyKey); } return null; } + protected String getFederatedAccessToken(UserSessionModel userSession) { + return getFederatedTokenNote(userSession, getFederatedAccessTokenKey(), FEDERATED_ACCESS_TOKEN); + } + protected void setFederatedAccessToken(UserSessionModel userSession, String token) { userSession.setNote(getFederatedAccessTokenKey(), token); } diff --git a/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java b/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java index 344246487636..cb0432deb1c8 100755 --- a/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java +++ b/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java @@ -139,27 +139,15 @@ protected String getFederatedIdTokenKey() { } protected String getFederatedRefreshToken(UserSessionModel userSession) { - String token = userSession.getNote(getFederatedRefreshTokenKey()); - if (token != null) { - return token; - } - return userSession.getNote(FEDERATED_REFRESH_TOKEN); + return getFederatedTokenNote(userSession, getFederatedRefreshTokenKey(), FEDERATED_REFRESH_TOKEN); } protected String getFederatedTokenExpiration(UserSessionModel userSession) { - String value = userSession.getNote(getFederatedTokenExpirationKey()); - if (value != null) { - return value; - } - return userSession.getNote(FEDERATED_TOKEN_EXPIRATION); + return getFederatedTokenNote(userSession, getFederatedTokenExpirationKey(), FEDERATED_TOKEN_EXPIRATION); } protected String getFederatedIdToken(UserSessionModel userSession) { - String token = userSession.getNote(getFederatedIdTokenKey()); - if (token != null) { - return token; - } - return userSession.getNote(OIDCIdentityProvider.FEDERATED_ID_TOKEN); + return getFederatedTokenNote(userSession, getFederatedIdTokenKey(), OIDCIdentityProvider.FEDERATED_ID_TOKEN); } protected void setFederatedRefreshToken(UserSessionModel userSession, String token) { diff --git a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java index 69f8ac4ebd99..e95e9e37b0ed 100644 --- a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java +++ b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java @@ -307,7 +307,7 @@ protected Response exchangeExternalToken(String subjectIssuer, String subjectTok // this must exist so that we can obtain access token from user session if idp's store tokens is off String idpAlias = externalExchangeContext.idpModel().getAlias(); userSession.setNote(UserAuthenticationIdentityProvider.EXTERNAL_IDENTITY_PROVIDER, idpAlias); - setFederatedAccessTokenNotes(userSession, idpAlias, subjectToken); + setFederatedAccessTokenNote(userSession, idpAlias, subjectToken); context.addSessionNotesToUserSession(userSession); @@ -434,7 +434,7 @@ protected UserModel importUserFromExternalIdentity(BrokeredIdentityContext conte return user; } - private void setFederatedAccessTokenNotes(UserSessionModel userSession, String idpAlias, String token) { + private void setFederatedAccessTokenNote(UserSessionModel userSession, String idpAlias, String token) { userSession.setNote(UserAuthenticationIdentityProvider.FEDERATED_ACCESS_TOKEN + ":" + idpAlias, token); }