org.keycloak.credential

Class UserCredentialStoreManager

java.lang.Object

org.keycloak.credential.UserCredentialStoreManager

All Implemented Interfaces:

UserCredentialStore, OnUserCache, UserCredentialManager, Provider

public class UserCredentialStoreManager
extends Object
implements UserCredentialManager, OnUserCache

Version:

$Revision: 1 $

Author:

Bill Burke

Field Summary

Fields

Modifier and Type	Field and Description
protected KeycloakSession	session

Constructor Summary

Constructors

Constructor and Description
UserCredentialStoreManager(KeycloakSession session)

Method Summary

Modifier and Type	Method and Description
CredentialValidationOutput	authenticate(KeycloakSession session, RealmModel realm, CredentialInput input) Given a CredentialInput, authenticate the user.
void	close()
CredentialModel	createCredential(RealmModel realm, UserModel user, CredentialModel cred)
CredentialModel	createCredentialThroughProvider(RealmModel realm, UserModel user, CredentialModel model) Creates a credential from the credentialModel, by looping through the providers to find a match for the type
void	disableCredentialType(RealmModel realm, UserModel user, String credentialType) Calls disableCredential on UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.
List<String>	getConfiguredUserStorageCredentialTypes(RealmModel realm, UserModel user) Return credential types, which are provided by the user storage where user is stored.
static <T> List<T>	getCredentialProviders(KeycloakSession session, RealmModel realm, Class<T> type)
Set<String>	getDisableableCredentialTypes(RealmModel realm, UserModel user) Returns a set of credential types that can be disabled by disableCredentialType() method
CredentialModel	getStoredCredentialById(RealmModel realm, UserModel user, String id)
CredentialModel	getStoredCredentialByNameAndType(RealmModel realm, UserModel user, String name, String type)
List<CredentialModel>	getStoredCredentials(RealmModel realm, UserModel user)
List<CredentialModel>	getStoredCredentialsByType(RealmModel realm, UserModel user, String type)
protected UserCredentialStore	getStoreForUser(UserModel user)
boolean	isConfiguredFor(RealmModel realm, UserModel user, String type) Checks to see if user has credential type configured.
boolean	isConfiguredLocally(RealmModel realm, UserModel user, String type) Only loops through each CredentialProvider to see if credential type is configured for the user.
boolean	isValid(RealmModel realm, UserModel user, CredentialInput... inputs) Validates list of credentials.
boolean	isValid(RealmModel realm, UserModel user, List<CredentialInput> inputs) Validates list of credentials.
boolean	moveCredentialTo(RealmModel realm, UserModel user, String id, String newPreviousCredentialId)
void	onCache(RealmModel realm, CachedUserModel user, UserModel delegate)
boolean	removeStoredCredential(RealmModel realm, UserModel user, String id)
boolean	updateCredential(RealmModel realm, UserModel user, CredentialInput input) Updates a credential.
void	updateCredential(RealmModel realm, UserModel user, CredentialModel cred)
void	updateCredentialLabel(RealmModel realm, UserModel user, String credentialId, String userLabel) Updates the credential label and invalidates the cache for the user.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

session

protected KeycloakSession session

Constructor Detail

UserCredentialStoreManager

public UserCredentialStoreManager(KeycloakSession session)

Method Detail

getStoreForUser

protected UserCredentialStore getStoreForUser(UserModel user)

updateCredential

public void updateCredential(RealmModel realm,
                             UserModel user,
                             CredentialModel cred)

Specified by:

updateCredential in interface UserCredentialStore

createCredential

public CredentialModel createCredential(RealmModel realm,
                                        UserModel user,
                                        CredentialModel cred)

Specified by:

createCredential in interface UserCredentialStore

removeStoredCredential

public boolean removeStoredCredential(RealmModel realm,
                                      UserModel user,
                                      String id)

Specified by:

removeStoredCredential in interface UserCredentialStore

getStoredCredentialById

public CredentialModel getStoredCredentialById(RealmModel realm,
                                               UserModel user,
                                               String id)

Specified by:

getStoredCredentialById in interface UserCredentialStore

getStoredCredentials

public List<CredentialModel> getStoredCredentials(RealmModel realm,
                                                  UserModel user)

Specified by:

getStoredCredentials in interface UserCredentialStore

getStoredCredentialsByType

public List<CredentialModel> getStoredCredentialsByType(RealmModel realm,
                                                        UserModel user,
                                                        String type)

Specified by:

getStoredCredentialsByType in interface UserCredentialStore

getStoredCredentialByNameAndType

public CredentialModel getStoredCredentialByNameAndType(RealmModel realm,
                                                        UserModel user,
                                                        String name,
                                                        String type)

Specified by:

getStoredCredentialByNameAndType in interface UserCredentialStore

moveCredentialTo

public boolean moveCredentialTo(RealmModel realm,
                                UserModel user,
                                String id,
                                String newPreviousCredentialId)

Specified by:

moveCredentialTo in interface UserCredentialStore

isValid

public boolean isValid(RealmModel realm,
                       UserModel user,
                       CredentialInput... inputs)

Description copied from interface: UserCredentialManager

Validates list of credentials. Will call UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.

Specified by:

isValid in interface UserCredentialManager

Returns:

createCredentialThroughProvider

public CredentialModel createCredentialThroughProvider(RealmModel realm,
                                                       UserModel user,
                                                       CredentialModel model)

Description copied from interface: UserCredentialManager

Creates a credential from the credentialModel, by looping through the providers to find a match for the type

Specified by:

createCredentialThroughProvider in interface UserCredentialManager

Returns:

updateCredentialLabel

public void updateCredentialLabel(RealmModel realm,
                                  UserModel user,
                                  String credentialId,
                                  String userLabel)

Description copied from interface: UserCredentialManager

Updates the credential label and invalidates the cache for the user.

Specified by:

updateCredentialLabel in interface UserCredentialManager

isValid

public boolean isValid(RealmModel realm,
                       UserModel user,
                       List<CredentialInput> inputs)

Description copied from interface: UserCredentialManager

Validates list of credentials. Will call UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.

Specified by:

isValid in interface UserCredentialManager

Returns:

getCredentialProviders

public static <T> List<T> getCredentialProviders(KeycloakSession session,
                                                 RealmModel realm,
                                                 Class<T> type)

updateCredential

public boolean updateCredential(RealmModel realm,
                                UserModel user,
                                CredentialInput input)

Description copied from interface: UserCredentialManager

Updates a credential. Will call UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider. Update is finished whenever any one provider returns true.

Specified by:

updateCredential in interface UserCredentialManager

Returns:

true if credential was successfully updated by UserStorage or any CredentialInputUpdater

disableCredentialType

public void disableCredentialType(RealmModel realm,
                                  UserModel user,
                                  String credentialType)

Description copied from interface: UserCredentialManager

Calls disableCredential on UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.

Specified by:

disableCredentialType in interface UserCredentialManager

getDisableableCredentialTypes

public Set<String> getDisableableCredentialTypes(RealmModel realm,
                                                 UserModel user)

Description copied from interface: UserCredentialManager

Returns a set of credential types that can be disabled by disableCredentialType() method

Specified by:

getDisableableCredentialTypes in interface UserCredentialManager

Returns:

isConfiguredFor

public boolean isConfiguredFor(RealmModel realm,
                               UserModel user,
                               String type)

Description copied from interface: UserCredentialManager

Checks to see if user has credential type configured. Looks in UserStorageProvider or UserFederationProvider first, then loops through each CredentialProvider.

Specified by:

isConfiguredFor in interface UserCredentialManager

Returns:

isConfiguredLocally

public boolean isConfiguredLocally(RealmModel realm,
                                   UserModel user,
                                   String type)

Description copied from interface: UserCredentialManager

Only loops through each CredentialProvider to see if credential type is configured for the user. This allows UserStorageProvider and UserFederationProvider isValid() implementations to punt to local storage when validating a credential that has been overriden in Keycloak storage.

Specified by:

isConfiguredLocally in interface UserCredentialManager

Returns:

authenticate

public CredentialValidationOutput authenticate(KeycloakSession session,
                                               RealmModel realm,
                                               CredentialInput input)

Description copied from interface: UserCredentialManager

Given a CredentialInput, authenticate the user. This is used in the case where the credential must be processed to determine and find the user. An example is Kerberos where the kerberos token might be validated and processed by a variety of different storage providers.

Specified by:

authenticate in interface UserCredentialManager

Returns:

onCache

public void onCache(RealmModel realm,
                    CachedUserModel user,
                    UserModel delegate)

Specified by:

onCache in interface OnUserCache

getConfiguredUserStorageCredentialTypes

public List<String> getConfiguredUserStorageCredentialTypes(RealmModel realm,
                                                            UserModel user)

Description copied from interface: UserCredentialManager

Return credential types, which are provided by the user storage where user is stored. Returned values can contain for example "password", "otp" etc. This will always return empty list for "local" users, which are not backed by any user storage

Specified by:

getConfiguredUserStorageCredentialTypes in interface UserCredentialManager

Returns:

close

public void close()

Specified by:

close in interface Provider