keycloak · thomasdarimont · Jun 27, 2025
@@ -59,6 +59,9 @@ public class OAuthErrorException extends Exception {
     // DPoP
     public static final String INVALID_DPOP_PROOF = "invalid_dpop_proof";
 
+    // RFC 8707 Resource Indicators for OAuth 2.0
+    public static final String INVALID_TARGET = "invalid_target";
+
     // Others
     public static final String INVALID_CLIENT = "invalid_client";
     public static final String INVALID_GRANT = "invalid_grant";

@@ -70,6 +70,7 @@ public interface Details {
     String AUDIENCE = "audience";
     String PERMISSION = "permission";
     String SCOPE = "scope";
+    String RESOURCE = "resource";
     String REQUESTED_ISSUER = "requested_issuer";
     String REQUESTED_SUBJECT = "requested_subject";
     String REQUESTED_TOKEN_TYPE = "requested_token_type";

@@ -0,0 +1,79 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.protocol.oauth2.resourceindicators;
+
+import org.keycloak.models.AuthenticatedClientSessionModel;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * Represents the result of narrowing a set of requested resource indicators to supported resource indicators.
+ * 
+ * See {@link ResourceIndicatorsUtil#narrowResourceIndicators(KeycloakSession, ClientModel, AuthenticatedClientSessionModel, Set)}
+ */
+public class CheckedResourceIndicators {
+
+    /**
+     * Represents an empty result.
+     */
+    public static final CheckedResourceIndicators EMPTY = new CheckedResourceIndicators(Collections.emptySet(), Collections.emptySet());
+
+    private final Set<String> supportedResources;
+
+    private final Set<String> unsupportedResources;
+
+    private final Set<String> requestedResources;
+
+    /**
+     * Creates a new {@link CheckedResourceIndicators}.
+     * @param allowedResources the set of allowed resource indicators
+     * @param requestedResources the set of requested resource indicators.
+     */
+    public CheckedResourceIndicators(Set<String> allowedResources, Set<String> requestedResources) {
+        var supported = new HashSet<>(allowedResources);
+        supported.retainAll(requestedResources);
+        this.supportedResources = supported;
+        var unsupported = new HashSet<>(requestedResources);
+        unsupported.removeAll(allowedResources);
+        this.unsupportedResources = unsupported;
+        this.requestedResources = requestedResources;
+    }
+
+    public Set<String> getRequestedResources() {
+        return requestedResources;
+    }
+
+    public Set<String> getSupportedResources() {
+        return supportedResources;
+    }
+
+    public Set<String> getUnsupportedResources() {
+        return unsupportedResources;
+    }
+
+    public boolean hasSupportedResources() {
+        return supportedResources != null && !supportedResources.isEmpty();
+    }
+
+    public boolean hasUnsupportedResources() {
+        return unsupportedResources != null && !unsupportedResources.isEmpty();
+    }
+}
@@ -0,0 +1,141 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oauth2.resourceindicators;
+
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.authorization.store.StoreFactory;
+import org.keycloak.common.Profile;
+import org.keycloak.common.util.CollectionUtil;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+
+import java.net.URI;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Objects;
+import java.util.Set;
+
+public class DefaultOAuth2ResourceIndicatorResolver implements OAuth2ResourceIndicatorResolver {
+
+    /**
+     * A resource type to denote OAuth 2.0 Resource Indicator resource definitions.
+     */
+    public static final String KEYCLOAK_RESOURCE_INDICATOR_TYPE = "urn:keycloak:oauth2:resource-indicator";
+
+    protected final KeycloakSession session;
+
+    public DefaultOAuth2ResourceIndicatorResolver(KeycloakSession session) {
+        this.session = session;
+    }
+
+    @Override
+    public ClientModel findClientByResourceIndicator(String resourceIndicator) {
+        return null;
+    }
+
+    @Override
+    public Set<String> narrowResourceIndicators(ClientModel client, Set<String> resourceIndicatorCandidates) {
+
+        Set<String> allowedResources = findAllowedResourceIndicators(client);
+        if (allowedResources.isEmpty()) {
+            return Collections.emptySet();
+        }
+
+        // Only allow explicitly allowed resources on this client.
+        Set<String> checkedAllowedResources = new LinkedHashSet<>();
+        for (String allowedResource : allowedResources) {
+            URI allowedResourceUri = URI.create(allowedResource).normalize();
+
+            for (String candidate : resourceIndicatorCandidates) {
+                URI candidateUri = URI.create(candidate).normalize();
+
+                if (!Objects.equals(candidateUri.getScheme(), allowedResourceUri.getScheme())) {
+                    continue;
+                }
+
+                if (!Objects.equals(candidateUri.getHost(), allowedResourceUri.getHost())) {
+                    continue;
+                }
+
+                if (candidateUri.getPort() != allowedResourceUri.getPort()) {
+                    continue;
+                }
+
+                if (!Objects.equals(candidateUri.getAuthority(), allowedResourceUri.getAuthority())) {
+                    continue;
+                }
+
+                if (!Objects.equals(candidateUri.getPath(), allowedResourceUri.getPath())) {
+                    continue;
+                }
+
+                checkedAllowedResources.add(candidate);
+            }
+        }
+
+        return checkedAllowedResources;
+    }
+
+    /**
+     * Returns the set of allowed resource indicators for the given {@link ClientModel}.
+     *
+     * @param client
+     * @return
+     */
+    protected Set<String> findAllowedResourceIndicators(ClientModel client) {
+
+        if (!Profile.isFeatureEnabled(Profile.Feature.AUTHORIZATION)) {
+            return Collections.emptySet();
+        }
+
+        AuthorizationProvider authzProvider = session.getProvider(AuthorizationProvider.class);
+        StoreFactory storeFactory = authzProvider.getStoreFactory();
+
+        ResourceServer resourceServer = lookupResourceServer(client, storeFactory);
+        if (resourceServer == null) {
+            // no resource server definition found for the given client
+            return Collections.emptySet();
+        }
+
+        List<Resource> resources = getResources(storeFactory, resourceServer);
+        if (CollectionUtil.isEmpty(resources)) {
+            // no resource definitions found for the given client / resource server
+            return Collections.emptySet();
+        }
+
+        Set<String> allowedResources = new HashSet<>();
+        for (Resource resource : resources) {
+            allowedResources.addAll(resource.getUris());
+        }
+
+        return allowedResources;
+    }
+
+    protected List<Resource> getResources(StoreFactory storeFactory, ResourceServer resourceServer) {
+        return storeFactory.getResourceStore().findByType(resourceServer, KEYCLOAK_RESOURCE_INDICATOR_TYPE);
+    }
+
+    protected ResourceServer lookupResourceServer(ClientModel client, StoreFactory storeFactory) {
+        return storeFactory.getResourceServerStore().findByClient(client);
+    }
+
+}
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oauth2.resourceindicators;
+
+import org.keycloak.models.KeycloakSession;
+
+public class DefaultOAuth2ResourceIndicatorResolverFactory implements OAuth2ResourceIndicatorResolverFactory {
+
+    public static final String PROVIDER_ID = "default";
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public OAuth2ResourceIndicatorResolver create(KeycloakSession session) {
+        return new DefaultOAuth2ResourceIndicatorResolver(session);
+    }
+}
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.protocol.oauth2.resourceindicators;
+
+import org.keycloak.models.ClientModel;
+import org.keycloak.provider.Provider;
+
+import java.util.Set;
+
+/**
+ * Provider to customize OAuth2 Resource Indicators resolving.
+ *
+ * @link <a href="https://www.rfc-editor.org/rfc/rfc8707">RFC 8707 OAuth2 Resource Indicators</a>
+ */
+public interface OAuth2ResourceIndicatorResolver extends Provider {
+
+    /**
+     * Returns a client associated with the given {@code resourceIndicator} or {@literal null} if no client could be found.
+     * @param resourceIndicator
+     * @return client model
+     */
+    ClientModel findClientByResourceIndicator(String resourceIndicator);
+
+    /**
+     * Filters the given resource indicators to the supported resource indicators by the given {@link ClientModel client}.
+     *
+     * @param client client to find the resource indicators
+     * @param resourceIndicatorCandidates resource indicators to check
+     *
+     * @return Set of the resource indicators narrowed down to resource indicators that are supported by the given client.
+     */
+    Set<String> narrowResourceIndicators(ClientModel client, Set<String> resourceIndicatorCandidates);
+
+    @Override
+    default void close() {
+    }
+}
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.protocol.oauth2.resourceindicators;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * Factory for {@link OAuth2ResourceIndicatorResolver OAuth2ResourceIndicatorsProvider's}.
+ */
+public interface OAuth2ResourceIndicatorResolverFactory extends ProviderFactory<OAuth2ResourceIndicatorResolver> {
+
+    @Override
+    default void init(Config.Scope config) {
+    }
+
+    @Override
+    default void postInit(KeycloakSessionFactory factory) {
+    }
+
+    @Override
+    default void close() {
+    }
+}