saml backchannel logout

core/src/main/java/org/keycloak/jose/jws/Algorithm.java

@@ -1,18 +1,32 @@
 package org.keycloak.jose.jws;
 
+import org.keycloak.jose.jws.crypto.RSAProvider;
+import org.keycloak.jose.jws.crypto.SignatureProvider;
+
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
 public enum Algorithm {
-    none,
-    HS256,
-    HS384,
-    HS512,
-    RS256,
-    RS384,
-    RS512,
-    ES256,
-    ES384,
-    ES512
+
+    none(null),
+    HS256(null),
+    HS384(null),
+    HS512(null),
+    RS256(new RSAProvider()),
+    RS384(new RSAProvider()),
+    RS512(new RSAProvider()),
+    ES256(null),
+    ES384(null),
+    ES512(null)
+    ;
+    private SignatureProvider provider;
+
+    Algorithm(SignatureProvider provider) {
+        this.provider = provider;
+    }
+
+    public SignatureProvider getProvider() {
+        return provider;
+    }
 }

core/src/main/java/org/keycloak/jose/jws/JWSInput.java

@@ -2,6 +2,7 @@ package org.keycloak.jose.jws;
 
 import org.keycloak.util.Base64Url;
 import org.keycloak.util.JsonSerialization;
+import static org.keycloak.jose.jws.Algorithm.*;
 
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
@@ -73,6 +74,13 @@ public class JWSInput {
         return signature;
     }
 
+    public boolean verify(String key) {
+        if (header.getAlgorithm().getProvider() == null) {
+            throw new RuntimeException("signing algorithm not supported");
+        }
+        return header.getAlgorithm().getProvider().verify(this, key);
+    }
+
     public <T> T readJsonContent(Class<T> type) throws IOException {
         return JsonSerialization.readValue(content, type);
     }

core/src/main/java/org/keycloak/jose/jws/crypto/HMACProvider.java

@@ -14,7 +14,7 @@ import java.security.NoSuchAlgorithmException;
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-public class HMACProvider {
+public class HMACProvider implements SignatureProvider {
     private static String getJavaAlgorithm(Algorithm alg) {
         switch (alg) {
             case HS256:
@@ -82,5 +82,8 @@ public class HMACProvider {
         }
     }
 
-
+    @Override
+    public boolean verify(JWSInput input, String key) {
+        return false;
+    }
 }

core/src/main/java/org/keycloak/jose/jws/crypto/RSAProvider.java

@@ -3,16 +3,18 @@ package org.keycloak.jose.jws.crypto;
 
 import org.keycloak.jose.jws.Algorithm;
 import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.util.PemUtils;
 
 import java.security.PrivateKey;
 import java.security.PublicKey;
 import java.security.Signature;
+import java.security.cert.X509Certificate;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-public class RSAProvider {
+public class RSAProvider implements SignatureProvider {
     public static String getJavaAlgorithm(Algorithm alg) {
         switch (alg) {
             case RS256:
@@ -45,6 +47,16 @@ public class RSAProvider {
         }
     }
 
+    public static boolean verifyViaCertificate(JWSInput input, String cert) {
+        X509Certificate certificate = null;
+        try {
+            certificate = PemUtils.decodeCertificate(cert);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+        return verify(input, certificate.getPublicKey());
+    }
+
     public static boolean verify(JWSInput input, PublicKey publicKey) {
         try {
             Signature verifier = getSignature(input.getHeader().getAlgorithm());
@@ -57,5 +69,10 @@ public class RSAProvider {
 
     }
 
+    @Override
+    public boolean verify(JWSInput input, String key) {
+        return verifyViaCertificate(input, key);
+    }
+
 
 }

core/src/main/java/org/keycloak/jose/jws/crypto/SignatureProvider.java

@@ -0,0 +1,11 @@
+package org.keycloak.jose.jws.crypto;
+
+import org.keycloak.jose.jws.JWSInput;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface SignatureProvider {
+    boolean verify(JWSInput input, String key);
+}

core/src/main/java/org/keycloak/representations/adapters/action/LogoutAction.java

@@ -10,14 +10,16 @@ public class LogoutAction extends AdminAction {
     public static final String LOGOUT = "LOGOUT";
     protected List<String> adapterSessionIds;
     protected int notBefore;
+    protected List<String> keycloakSessionIds;
 
     public LogoutAction() {
     }
 
-    public LogoutAction(String id, int expiration, String resource, List<String> adapterSessionIds, int notBefore) {
+    public LogoutAction(String id, int expiration, String resource, List<String> adapterSessionIds, int notBefore, List<String> keycloakSessionIds) {
         super(id, expiration, resource, LOGOUT);
         this.adapterSessionIds = adapterSessionIds;
         this.notBefore = notBefore;
+        this.keycloakSessionIds = keycloakSessionIds;
     }
 
 
@@ -33,6 +35,14 @@ public class LogoutAction extends AdminAction {
         return adapterSessionIds;
     }
 
+    public List<String> getKeycloakSessionIds() {
+        return keycloakSessionIds;
+    }
+
+    public void setKeycloakSessionIds(List<String> keycloakSessionIds) {
+        this.keycloakSessionIds = keycloakSessionIds;
+    }
+
     @Override
     public boolean validate() {
         return LOGOUT.equals(action);