第 8 課：客戶端範圍、代幣管理和 DPoP

# Request offline token
GET /auth?response_type=code&
  client_id=my-app&
  scope=openid offline_access&
  redirect_uri=...

# Token response — refresh_token là offline token
{
  "access_token": "...",
  "expires_in": 300,
  "refresh_expires_in": 0,          // 0 = offline token (không expire theo session)
  "refresh_token": "offline-token",
  "token_type": "Bearer",
  "scope": "openid offline_access"
}

# Sử dụng offline token để refresh
POST /token
grant_type=refresh_token&
refresh_token=offline-token&
client_id=my-app&
client_secret=CLIENT_SECRET

___HTMLTAG_728__HTMLTAG_729___管理控制台 → 會話 → 選項卡 離線會話：查看所有離線會話___HTMLTAG_7344_____ ___HTMLTAG_736__HTMLTAG_737___使用者帳號控制台→ 會話：使用者可以檢視並撤銷離線會話___HTMLTAG_740__HTMLTAG_741___ ___HTMLTAG_742__HTMLTAG_743___管理 REST API：以程式方式撤銷離線會話___HTMLTAG_744__HTMLTAG_745___

# Revoke offline session cho user cụ thể
DELETE /admin/realms/my-company/users/{user-id}/consents/{client-id}

# Revoke tất cả sessions (bao gồm offline) cho user
POST /admin/realms/my-company/users/{user-id}/logout

HTMLTAG_747__HTMLTAG_748___4。令牌撤銷___HTMLTAG_749__HTMLTAG_750

___HTMLTAG_751__HTMLTAG_752___4.1 令牌撤銷端點 (RFC 7009)HTMLTAG_753__HTMLTAG_754

Keycloak 支援令牌撤銷端點，允許客戶端撤銷存取權杖或刷新令牌：

# Revoke refresh token
POST /realms/my-company/protocol/openid-connect/revoke
Content-Type: application/x-www-form-urlencoded

token=REFRESH_TOKEN&
token_type_hint=refresh_token&
client_id=my-app&
client_secret=CLIENT_SECRET

# Revoke access token
POST /realms/my-company/protocol/openid-connect/revoke
Content-Type: application/x-www-form-urlencoded

token=ACCESS_TOKEN&
token_type_hint=access_token&
client_id=my-app&
client_secret=CLIENT_SECRET

___HTMLTAG_757__HTMLTAG_758___注意：HTMLTAG_759__HTMLTAG_760

___HTMLTAG_762__HTMLTAG_763___撤銷刷新令牌 → 使刷新令牌和關聯的 SSO 會話失效（取決於設定）___HTMLTAG_764__HTMLTAG_765___ ___HTMLTAG_766__HTMLTAG_767___撤銷存取權杖 → 基於 JWT 的令牌，只有當資源伺服器執行令牌內省或使用令牌撤銷事件時，撤銷才有效____HTMLTAG_768__HTMLTAG_769___

HTMLTAG_771__HTMLTAG_772___4.2 不早於政策___HTMLTAG_773__HTMLTAG_774

撤銷某個時間之前發出的所有代幣：

# Set not-before timestamp — tất cả tokens issued trước thời điểm này bị invalidate
PUT /admin/realms/my-company
{
  "notBefore": 1711800000   // Unix timestamp
}

# Hoặc qua Admin Console:
# Realm Settings → Sessions → "Set to now" → "Push"
# "Push" gửi not-before policy đến tất cả clients có Admin URL

___HTMLTAG_777__HTMLTAG_778___4.3 令牌自省 (RFC 7662)HTMLTAG_779__HTMLTAG_780

資源伺服器使用令牌自省來驗證令牌有效性並檢索聲明：

# Introspect token
POST /realms/my-company/protocol/openid-connect/token/introspect
Content-Type: application/x-www-form-urlencoded

token=ACCESS_TOKEN&
client_id=my-resource-server&
client_secret=RESOURCE_SERVER_SECRET

# Response — token hợp lệ
{
  "active": true,
  "sub": "user-uuid",
  "email": "[email protected]",
  "realm_access": { "roles": ["admin"] },
  "client_id": "my-app",
  "token_type": "Bearer",
  "exp": 1711800300,
  "iat": 1711800000,
  "scope": "openid profile email"
}

# Response — token không hợp lệ
{
  "active": false
}

___HTMLTAG_783__HTMLTAG_784___何時使用令牌自省與 JWT 驗證：HTMLTAG_785__HTMLTAG_786

___HTMLTAG_817__HTMLTAG_818___5。 DPoP — 所有權證明示範 (RFC 9449)HTMLTAG_819__HTMLTAG_820

DPoP 解決了問題 承載令牌盜竊 — 如果存取權杖被盜，攻擊者可以在任何地方使用它，因為令牌和客戶端之間沒有綁定。

___HTMLTAG_825__HTMLTAG_826___5.1 DPoP 如何運作？ HTMLTAG_827__HTMLTAG_828

DPoP 將令牌綁定到客戶端擁有的特定 非對稱金鑰對 __HTMLTAG_831___。客戶端每次使用令牌時都必須證明私鑰的所有權。

┌──────────┐                     ┌──────────┐
│  Client  │                     │ Keycloak │
└────┬─────┘                     └────┬─────┘
     │                                │
     │  1. Generate key pair          │
     │     (public + private key)     │
     │                                │
     │  2. Token request +            │
     │     DPoP Proof (signed with    │
     │     private key)               │
     │───────────────────────────────>│
     │                                │
     │  3. DPoP-bound access token    │
     │     (contains cnf.jkt claim)   │
     │<──────────────────────────────│
     │                                │
     │                          ┌──────────┐
     │                          │ Resource │
     │                          │  Server  │
     │                          └────┬─────┘
     │  4. API request +             │
     │     DPoP-bound token +        │
     │     DPoP Proof (new, signed   │
     │     with same private key)    │
     │──────────────────────────────>│
     │                               │
     │  5. Verify: token.cnf.jkt     │
     │     matches DPoP proof's      │
     │     public key                │
     │  6. Response                  │
     │<─────────────────────────────│

// DPoP Proof Header
{
  "typ": "dpop+jwt",
  "alg": "ES256",
  "jwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "base64url-encoded-x",
    "y": "base64url-encoded-y"
  }
}

// DPoP Proof Payload
{
  "jti": "unique-proof-id",           // Unique ID, ngăn replay attacks
  "htm": "POST",                       // HTTP method
  "htu": "https://keycloak/token",     // HTTP URI (token endpoint)
  "iat": 1711800000,                   // Issued at
  "ath": "access-token-hash"           // Hash of access token (khi gọi resource server)
}

# Token request với DPoP
POST /realms/my-company/protocol/openid-connect/token
Content-Type: application/x-www-form-urlencoded
DPoP: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6Ik...

grant_type=authorization_code&
code=AUTH_CODE&
client_id=my-app&
redirect_uri=http://localhost:3000/callback

# Response — DPoP-bound token
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "DPoP",              // Token type = "DPoP" thay vì "Bearer"
  "expires_in": 300
}

# Access token chứa confirmation claim
{
  "cnf": {
    "jkt": "thumbprint-of-client-public-key"   // JWK Thumbprint
  }
}

# Gọi Resource Server với DPoP token
GET /api/resource
Authorization: DPoP eyJhbGciOiJSUzI1NiIs...
DPoP: eyJ0eXAiOiJkcG9wK2p3dCIs...          # DPoP proof mới (htm=GET, htu=API URL)

# Server response header khi DPoP nonce required
HTTP/1.1 401 Unauthorized
DPoP-Nonce: server-generated-nonce

# Client PHẢI include nonce trong DPoP proof tiếp theo
{
  "typ": "dpop+jwt",
  "alg": "ES256",
  "jwk": { ... }
}
{
  "jti": "new-unique-id",
  "htm": "POST",
  "htu": "https://keycloak/token",
  "iat": 1711800001,
  "nonce": "server-generated-nonce"    // Server-issued nonce
}

# Ví dụ: Policy enforce DPoP + PKCE + Secure Algorithm
Profile: high-security-profile
  Executors:
    - DPoP Proof Verification
    - PKCE Enforcer (S256 only)
    - Secure Signing Algorithm (RS256, ES256)
    - Reject Implicit Grant
    - Confidential Client Enforcer

Policy: high-security-policy
  Conditions:
    - Client Role: has role "high-security"
  Profiles:
    - high-security-profile