8000 Set default Bearer token_type in broker token responses by atiqur-rahman-pro · Pull Request #53995 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Set default Bearer token_type in broker token responses #53995

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pedroigor merged 1 commit into from
Oct 15, 2026
Merged

Set default Bearer token_type in broker token responses #53995

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@
import org.keycloak.representations.AccessTokenResponse;
import org.keycloak.sessions.AuthenticationSessionModel;
import org.keycloak.util.Booleans;
import org.keycloak.util.TokenUtil;

import org.jboss.logging.Logger;

Expand Down Expand Up @@ -283,6 +284,10 @@ protected Response buildTokenResponse(UriInfo uriInfo, EventBuilder event, Clien
tokenResponse.setRefreshExpiresIn(0);
tokenResponse.getOtherClaims().clear();

if (tokenResponse.getTokenType() == null) {
tokenResponse.setTokenType(TokenUtil.TOKEN_TYPE_BEARER);
Comment thread
pedroigor marked this conversation as resolved.
Resolved
}

tokenResponse.getOtherClaims().put(OAuth2Constants.ISSUED_TOKEN_TYPE, issuedTokenType);

if (authorizedClient != null) {
Expand Down
20 changes: 20 additions & 0 deletions services/src/test/java/org/keycloak/test/broker/oidc/AbstractOAuth2IdentityProviderTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,17 @@
import java.util.HashMap;
import java.util.Map;

import jakarta.ws.rs.core.Response;

import org.keycloak.OAuth2Constants;
import org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider;
import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;
import org.keycloak.broker.provider.BrokeredIdentityContext;
import org.keycloak.broker.provider.IdentityBrokerException;
import org.keycloak.models.IdentityProviderModel;
import org.keycloak.representations.AccessTokenResponse;
import org.keycloak.util.JsonSerialization;
import org.keycloak.util.TokenUtil;

import com.fasterxml.jackson.databind.JsonNode;
import org.junit.Assert;
Expand Down Expand Up @@ -187,6 +192,17 @@ public void oAuthResponse_missingRefreshExpiresInField_shouldNotThrowException()
Assert.assertNull(response.getRefreshExpiresIn()); // Should return null, not throw NPE
}

@Test
public void buildTokenResponseDefaultsTokenTypeToBearer() {
AccessTokenResponse tokenResponse = new AccessTokenResponse();
tokenResponse.setToken("access-token");

try (Response response = getTested().buildTokenResponse(tokenResponse)) {
AccessTokenResponse result = (AccessTokenResponse) response.getEntity();
Assert.assertEquals(TokenUtil.TOKEN_TYPE_BEARER, result.getTokenType());
}
}

private OAuth2IdentityProviderConfig getConfig(final String autorizationUrl, final String defaultScope, final String clientId, final Boolean isLoginHint, final Boolean passMaxAge) {
IdentityProviderModel model = new IdentityProviderModel();
OAuth2IdentityProviderConfig config = new OAuth2IdentityProviderConfig(model);
Expand Down Expand Up @@ -214,6 +230,10 @@ protected BrokeredIdentityContext doGetFederatedIdentity(String accessToken) {
return new BrokeredIdentityContext(accessToken, getConfig());
};

private Response buildTokenResponse(AccessTokenResponse tokenResponse) {
return buildTokenResponse(null, null, null, null, tokenResponse, OAuth2Constants.ACCESS_TOKEN_TYPE);
}

};

}
2 changes: 2 additions & 0 deletions tests/base/src/test/java/org/keycloak/tests/broker/IdentityProviderStoreTokenV2Test.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
import org.keycloak.testsuite.util.oauth.AbstractHttpResponse;
import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
import org.keycloak.testsuite.util.oauth.UserInfoResponse;
import org.keycloak.util.TokenUtil;

import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
Expand Down Expand Up @@ -101,6 +102,7 @@ public void checkSuccessfulTokenResponse(AbstractHttpResponse response) {
Assertions.assertInstanceOf(AccessTokenResponse.class, response);
AccessTokenResponse externalTokens = (AccessTokenResponse) response;
Assertions.assertNotNull(externalTokens.getAccessToken());
Assertions.assertEquals(TokenUtil.TOKEN_TYPE_BEARER, externalTokens.getTokenType());
Assertions.assertNull(externalTokens.getRefreshToken());
Assertions.assertNull(externalTokens.getIdToken());
UserInfoResponse userInfoResponse = getOauthClientExternal().userInfoRequest(externalTokens.getAccessToken()).send();
Expand Down
2 changes: 2 additions & 0 deletions .../base/src/test/java/org/keycloak/tests/broker/OAuth2IdentityProviderStoreTokenV2Test.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@
import org.keycloak.testsuite.util.oauth.AbstractHttpResponse;
import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
import org.keycloak.testsuite.util.oauth.UserInfoResponse;
import org.keycloak.util.TokenUtil;

import com.sun.net.httpserver.HttpServer;
import org.junit.jupiter.api.Assertions;
Expand Down Expand Up @@ -130,6 +131,7 @@ public void checkSuccessfulTokenResponse(AbstractHttpResponse response) {
Assertions.assertInstanceOf(AccessTokenResponse.class, response);
AccessTokenResponse externalTokens = (AccessTokenResponse) response;
Assertions.assertNotNull(externalTokens.getAccessToken());
Assertions.assertEquals(TokenUtil.TOKEN_TYPE_BEARER, externalTokens.getTokenType());
Assertions.assertNull(externalTokens.getRefreshToken());
Assertions.assertNull(externalTokens.getIdToken());
UserInfoResponse userInfoResponse = oauthExternal.userInfoRequest(externalTokens.getAccessToken()).send();
Expand Down
3 changes: 3 additions & 0 deletions ...tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTokenExchangeTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@
import org.keycloak.testsuite.util.broker.OIDCIdentityProviderConfigRep;
import org.keycloak.testsuite.util.oauth.OAuthClient;
import org.keycloak.util.BasicAuthHelper;
import org.keycloak.util.TokenUtil;

import org.junit.Test;
import org.junit.jupiter.api.Assertions;
Expand Down Expand Up @@ -200,6 +201,7 @@ private void assertExternalToInternalExchange(String subjectIssuer, boolean idTo
))) {
assertThat(response.getStatus(), equalTo(200));
AccessTokenResponse internalToExternalTokenResponse = response.readEntity(AccessTokenResponse.class);
assertThat(internalToExternalTokenResponse.getTokenType(), equalTo(TokenUtil.TOKEN_TYPE_BEARER));
}
}
}
Expand Down Expand Up @@ -475,6 +477,7 @@ private void exchangeToIdP(ClientRepresentation brokerApp, String subjectToken,
AccessTokenResponse exchangeResponse = response.readEntity(AccessTokenResponse.class);
assertThat(exchangeResponse.getError(), nullValue());
assertThat(exchangeResponse.getToken(), notNullValue());
assertThat(exchangeResponse.getTokenType(), equalTo(TokenUtil.TOKEN_TYPE_BEARER));
assertThat(exchangeResponse.getExpiresIn(), greaterThan((long) IdentityProviderModel.DEFAULT_MIN_VALIDITY_TOKEN));
assertThat(exchangeResponse.getExpiresIn(), lessThanOrEqualTo(expires));
}
Expand Down
Loading
0