tessl/maven-org-keycloak--keycloak-adapter-core

Core functionality for Keycloak OIDC/OAuth2 client adapters enabling Java applications to integrate with Keycloak identity and access management services

—

Pending

Overview

Eval results

Files

Policy Enforcement

Name: tessl/maven-org-keycloak--keycloak-adapter-core
Author: tessl

Policy Enforcement Point (PEP) integration for authorization policy evaluation with Keycloak's authorization services. This module provides the foundation for fine-grained authorization policies and resource protection in applications.

Capabilities

HttpAuthzRequest

HTTP authorization request wrapper providing access to request information for policy evaluation.

/**
 * HTTP authorization request wrapper providing access to request information for policy evaluation
 */
public class HttpAuthzRequest implements AuthzRequest {
    /**
     * Constructor with OIDC HTTP facade
     * @param oidcFacade OIDC HTTP facade providing request access
     */
    public HttpAuthzRequest(OIDCHttpFacade oidcFacade);
    
    /**
     * Get the relative path of the request
     * @return Relative path string
     */
    public String getRelativePath();
    
    /**
     * Get the HTTP method of the request
     * @return HTTP method (GET, POST, PUT, DELETE, etc.)
     */
    public String getMethod();
    
    /**
     * Get the full URI of the request
     * @return Complete request URI
     */
    public String getURI();
    
    /**
     * Get all headers with the specified name
     * @param name Header name
     * @return List of header values
     */
    public List<String> getHeaders(String name);
    
    /**
     * Get the first parameter value with the specified name
     * @param name Parameter name
     * @return First parameter value or null
     */
    public String getFirstParam(String name);
    
    /**
     * Get cookie value by name
     * @param name Cookie name
     * @return Cookie value or null
     */
    public String getCookieValue(String name);
    
    /**
     * Get remote client address
     * @return Remote IP address
     */
    public String getRemoteAddr();
    
    /**
     * Check if the request is secure (HTTPS)
     * @return true if secure, false otherwise
     */
    public boolean isSecure();
    
    /**
     * Get single header value
     * @param name Header name
     * @return Header value or null
     */
    public String getHeader(String name);
    
    /**
     * Get request input stream
     * @param buffered Whether to buffer the stream
     * @return InputStream for request body
     */
    public InputStream getInputStream(boolean buffered);
    
    /**
     * Get the authenticated token principal
     * @return TokenPrincipal containing token information
     */
    public TokenPrincipal getPrincipal();
}

Usage Examples:

// Create authorization request from HTTP facade
HttpAuthzRequest authzRequest = new HttpAuthzRequest(oidcFacade);

// Extract request information for policy evaluation
String method = authzRequest.getMethod();
String path = authzRequest.getRelativePath();
String uri = authzRequest.getURI();
String clientIp = authzRequest.getRemoteAddr();
boolean isSecure = authzRequest.isSecure();

// Access headers and parameters
String contentType = authzRequest.getHeader("Content-Type");
List<String> acceptHeaders = authzRequest.getHeaders("Accept");
String actionParam = authzRequest.getFirstParam("action");

// Access authentication information
TokenPrincipal principal = authzRequest.getPrincipal();
if (principal != null) {
    AccessToken token = principal.getToken();
    String username = token.getPreferredUsername();
    Set<String> roles = token.getRealmAccess().getRoles();
}

// Read request body if needed
try (InputStream inputStream = authzRequest.getInputStream(true)) {
    // Process request body for policy evaluation
    String requestBody = IOUtils.toString(inputStream, StandardCharsets.UTF_8);
}

HttpAuthzResponse

HTTP authorization response wrapper for sending policy enforcement responses.

/**
 * HTTP authorization response wrapper for sending policy enforcement responses
 */
public class HttpAuthzResponse implements AuthzResponse {
    /**
     * Constructor with OIDC HTTP facade
     * @param oidcFacade OIDC HTTP facade providing response access
     */
    public HttpAuthzResponse(OIDCHttpFacade oidcFacade);
    
    /**
     * Send error response with status code only
     * @param statusCode HTTP status code
     */
    public void sendError(int statusCode);
    
    /**
     * Send error response with status code and reason
     * @param code HTTP status code
     * @param reason Error reason phrase
     */
    public void sendError(int code, String reason);
    
    /**
     * Set response header
     * @param name Header name
     * @param value Header value
     */
    public void setHeader(String name, String value);
}

Usage Examples:

// Create authorization response
HttpAuthzResponse authzResponse = new HttpAuthzResponse(oidcFacade);

// Send forbidden response for denied requests
authzResponse.sendError(403, "Access denied by policy");

// Send unauthorized response for unauthenticated requests
authzResponse.sendError(401, "Authentication required");

// Add custom headers to response
authzResponse.setHeader("X-Policy-Decision", "DENY");
authzResponse.setHeader("X-Required-Role", "admin");

// Send specific error for resource not found
authzResponse.sendError(404, "Protected resource not found");