Overrider keycloak function authenticate to return the 403 reason #14206

georgeWUZF · 2022-09-06T02:29:20Z

georgeWUZF
Sep 6, 2022

I wanna return the 403 error with its reason because I wanna skip some one. So I override the function org.keycloak.adapters.OAuthRequestAuthenticator.challenge to return the reason/description. Code as below. But I can't check that which trigger point would call the function authenticate that I can't judge it's reason. Could help? Thanks!

@component
@slf4j
public class OAuthRequestAuthenticatorOverride
extends OAuthRequestAuthenticator
implements BeanPostProcessor {

@Autowired
AuthChallenge authChallenge;

public OAuthRequestAuthenticatorOverride(RequestAuthenticator requestAuthenticator, HttpFacade facade, KeycloakDeployment deployment, int sslRedirectPort, AdapterSessionStore tokenStore) {
    super(requestAuthenticator, facade, deployment, sslRedirectPort, tokenStore);
}

private void process(KeycloakAuthenticationProcessingFilter filter) {
    filter.setRequestAuthenticatorFactory(new SpringSecurityRequestAuthenticatorFactory() {
        @Override
        public RequestAuthenticator createRequestAuthenticator(HttpFacade facade, HttpServletRequest request, KeycloakDeployment deployment, AdapterTokenStore tokenStore, int sslRedirectPort) {
            return new SpringSecurityRequestAuthenticator(facade, request, deployment, tokenStore, sslRedirectPort) {
                @Override
                protected OAuthRequestAuthenticator createOAuthAuthenticator() {
                    return new OAuthRequestAuthenticator(this, facade, deployment, sslRedirectPort, tokenStore) {
                        @Override
                        public AuthOutcome authenticate() {
                            String code = this.getCode();
                            if (code == null) {
                                log.debug("there was no code");
                                String error = this.getError();
                                if (error != null) {
                                    log.warn("There was an error: " + error);
                                    this.challenge = this.challenge(400, OIDCAuthenticationError.Reason.OAUTH_ERROR, error);
                                    return AuthOutcome.FAILED;
                                } else {
                                    log.debug("redirecting to auth server");
                                    // Reason.NO_REDIRECT_URI
                                    this.challenge = this.loginRedirect();
                                    return AuthOutcome.NOT_ATTEMPTED;
                                }
                            } else {
                                log.debug("there was a code, resolving");
                                // Reason.SSL_REQUIRED
                                // Reason.CODE_TO_TOKEN_FAILURE
                                // Reason.CODE_TO_TOKEN_FAILURE
                                // Reason.INVALID_TOKEN
                                // Reason.STALE_TOKEN
                                authChallenge = (AuthChallenge) this.resolveCode(code);
                                if (authChallenge.getReason().contains(" ")) return null;
                                return this.challenge != null ? AuthOutcome.FAILED : AuthOutcome.AUTHENTICATED;
                            }
                        }
                    };
                }
            };
        }
    });
}

@Override
protected AuthChallenge challenge(final int code, final OIDCAuthenticationError.Reason reason, final String description) {
    return new AuthChallenge() {
        public int getResponseCode() {
            return code;
        }

        public String getReason() {return reason.toString();}

        public boolean challenge(HttpFacade exchange) {
            OIDCAuthenticationError error = new OIDCAuthenticationError(reason, description);
            exchange.getRequest().setError(error);
            exchange.getResponse().sendError(code);
            return true;
        }
    };
}

@Override
public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
    if (bean instanceof KeycloakAuthenticationProcessingFilter) {
        log.info("Injecting Custom handler...");
        process(((KeycloakAuthenticationProcessingFilter) bean));
    }
    return bean;
}

}

Navigation Menu

Repository navigation

Overrider keycloak function authenticate to return the 403 reason #14206

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Overrider keycloak function authenticate to return the 403 reason #14206

Uh oh!

georgeWUZF Sep 6, 2022

Replies: 0 comments

georgeWUZF
Sep 6, 2022