[KEYCLOAK-992] - Token retrieval from brokered idps.

model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/ClientAdapter.java

@@ -8,6 +8,7 @@ import org.keycloak.models.cache.entities.CachedClient;
 
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
@@ -259,4 +260,22 @@ public abstract class ClientAdapter implements ClientModel {
         copy.putAll(cachedClient.getAttributes());
         return copy;
     }
+
+    @Override
+    public void updateAllowedIdentityProviders(List<String> identityProviders) {
+        getDelegateForUpdate();
+        updatedClient.updateAllowedIdentityProviders(identityProviders);
+    }
+
+    @Override
+    public List<String> getAllowedIdentityProviders() {
+        if (updatedClient != null) return updatedClient.getAllowedIdentityProviders();
+        return cachedClient.getAllowedIdentityProviders();
+    }
+
+    @Override
+    public boolean hasIdentityProvider(String providerId) {
+        if (updatedClient != null) return updatedClient.hasIdentityProvider(providerId);
+        return cachedClient.hasIdentityProvider(providerId);
+    }
 }

model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedClient.java

@@ -6,8 +6,10 @@ import org.keycloak.models.RealmProvider;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.cache.RealmCache;
 
+import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
@@ -32,6 +34,7 @@ public class CachedClient {
     protected int notBefore;
     protected Set<String> scope = new HashSet<String>();
     protected Set<String> webOrigins = new HashSet<String>();
+    private List<String> allowedIdentityProviders = new ArrayList<String>();
 
     public CachedClient(RealmCache cache, RealmProvider delegate, RealmModel realm, ClientModel model) {
         id = model.getId();
@@ -52,7 +55,7 @@ public class CachedClient {
         for (RoleModel role : model.getScopeMappings())  {
             scope.add(role.getId());
         }
-
+        this.allowedIdentityProviders = model.getAllowedIdentityProviders();
     }
 
     public String getId() {
@@ -122,4 +125,16 @@ public class CachedClient {
     public void setFrontchannelLogout(boolean frontchannelLogout) {
         this.frontchannelLogout = frontchannelLogout;
     }
+
+    public List<String> getAllowedIdentityProviders() {
+        return this.allowedIdentityProviders;
+    }
+
+    public boolean hasIdentityProvider(String providerId) {
+        if (this.allowedIdentityProviders.isEmpty()) {
+            return true;
+        }
+
+        return this.allowedIdentityProviders.contains(providerId);
+    }
 }