Common Concepts

curl --location --request GET 'https://<OMN_SERVER>/api/v1/search/omn-search-version' \
--header 'Authorization: Bearer <ACCESS_TOKEN>'

curl --location --request POST 'https://<OMN_SERVER>/auth/realms/OMN/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=omn-ui' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'username=YOUR_USER_NAME' \
--data-urlencode 'password=YOUR_USER_PASSWORD' \
--data-urlencode 'scope=openid offline_access'

curl --location --request POST 'https://<OMN_SERVER>/auth/realms/OMN/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=omn-ui' \
--data-urlencode 'grant_type=refresh_token' \
--data-urlencode 'refresh_token=OFFLINE_TOKEN' \
--data-urlencode 'scope=openid offline_access'

import org.apache.http.HttpEntity;
import org.apache.http.NameValuePair;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.message.BasicNameValuePair;
import org.keycloak.OAuth2Constants;
import org.keycloak.representations.AccessTokenResponse;
import org.keycloak.util.JsonSerialization;

import java.io.IOException;
import java.io.InputStream;
import java.util.ArrayList;
import java.util.Base64;
import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit;

/**
 * This class demonstrates how to use offline token to manage the Keycloak tokens.
 */
public class KeycloakTokenManager {
    public static final int TOKEN_EXPIRATION_BUFFER_MINUTES = 5;
    private String serverUrl;
    private String clientId;
    private String clientSecret;
    private String offlineToken;
    private String accessToken;

    private AccessTokenResponse tokenResponse;
    private ScheduledExecutorService scheduler;

    public static void main(String[] args) {
        KeycloakTokenManager tokenManager = new KeycloakTokenManager(
                "https://<OMN_SERVER>/auth", "omn-ui", null, "<INITIAL_OFFLINE_TOKEN>");

        // Example: rotate token in API calls
        tokenManager.rotateToken();
    }

    /**
     * @param serverUrl  OMN Auth server URL
     * @param clientId   Client ID e.g. "omn-ui"
     * @param clientSecret could be null if the client is not confidential
     * @param offlineToken the initial offline token from OMN User Settings
     */
    public KeycloakTokenManager(String serverUrl, String clientId, String clientSecret, String offlineToken) {
        this.serverUrl = serverUrl;
        this.clientId = clientId;
        this.clientSecret = clientSecret;
        this.offlineToken = offlineToken;
        this.scheduler = Executors.newSingleThreadScheduledExecutor();
    }

    public void rotateToken() {
        if (tokenResponse == null || isTokenExpired()) {
            refreshTokens();
        }
    }

    private synchronized void refreshTokens() {
        try (CloseableHttpClient client = HttpClients.createDefault()) {
            HttpPost post = new HttpPost(serverUrl + "/realms/OMN/protocol/openid-connect/token");

            List<NameValuePair> params = new ArrayList<>();
            params.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.REFRESH_TOKEN));
            params.add(new BasicNameValuePair(OAuth2Constants.REFRESH_TOKEN, offlineToken));
            params.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, clientId));
            params.add(new BasicNameValuePair(OAuth2Constants.CLIENT_SECRET, clientSecret));

            post.setEntity(new UrlEncodedFormEntity(params));

            try (CloseableHttpResponse response = client.execute(post)) {
                HttpEntity entity = response.getEntity();
                if (entity != null) {
                    try (InputStream is = entity.getContent()) {
                        tokenResponse = JsonSerialization.readValue(is, AccessTokenResponse.class);
                        // Update offline token
                        offlineToken = tokenResponse.getRefreshToken();
                        // Update access token
                        accessToken = tokenResponse.getToken();
                        // Print the exp of the access token
                        System.out.println("New assess token expired at: " + new Date(getTokenExpiredAt() * 1000));
                        scheduleTokenRefresh();
                    }
                }
            }
        } catch (IOException e) {
            throw new RuntimeException("Failed to refresh token", e);
        }
    }

    private boolean isTokenExpired() {
        if (tokenResponse == null) return true;

        // Get expiration time
        long expirationTime = getTokenExpiredAt() * 1000;
        long currentTime = System.currentTimeMillis();

        // Consider token expired with a buffered time e.g. 5 minutes before actual expiration
        return expirationTime - currentTime < TimeUnit.MINUTES.toMillis(TOKEN_EXPIRATION_BUFFER_MINUTES);
    }

    private Long getTokenExpiredAt() {
        if (tokenResponse == null) return null;

        // Parse the JWT without validation (we trust Keycloak)
        String token = tokenResponse.getToken();
        String[] parts = token.split("\\.");
        if (parts.length < 2) return null;

        try {
            // Decode the JWT payload (second part)
            String payload = new String(Base64.getUrlDecoder().decode(parts[1]));
            Map<String, Object> claims = JsonSerialization.readValue(payload, Map.class);

            // Convert seconds to milliseconds
            return ((Number) claims.get("exp")).longValue();
        } catch (Exception e) {
            throw new RuntimeException("Failed to parse JWT", e);
        }
    }

    private void scheduleTokenRefresh() {
        if (tokenResponse == null) return;

        // Calculate refresh time with buffer (e.g. 5 minutes before expiration)
        long refreshDelay = (tokenResponse.getExpiresIn() - TimeUnit.MINUTES.toSeconds(TOKEN_EXPIRATION_BUFFER_MINUTES)) * 1000;
        System.out.println("Next refresh in (ms): " + refreshDelay);
        scheduler.schedule(() -> {
            refreshTokens();
        }, refreshDelay, TimeUnit.MILLISECONDS);
    }

    public void shutdown() {
        scheduler.shutdown();
    }
}

<dependencies>
        <dependency>
            <groupId>org.keycloak</groupId>
            <artifactId>keycloak-admin-client</artifactId>
            <version>18.0.2</version> <!-- same version as keycloak server-->
        </dependency>
        <dependency>
            <groupId>org.keycloak</groupId>
            <artifactId>keycloak-admin-client</artifactId>
            <version>18.0.2</version> <!-- same version as keycloak server-->
        </dependency>
        <dependency>
            <groupId>org.keycloak</groupId>
            <artifactId>keycloak-core</artifactId>
            <version>18.0.2</version> <!-- same version as keycloak server-->
        </dependency>
        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpclient</artifactId>
            <version>4.5.13</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-core</artifactId>
            <version>2.13.2</version>
        </dependency>
</dependencies>