Package org.keycloak.authentication.authenticators.browser

Class ScriptBasedAuthenticator

  • All Implemented Interfaces:
    Authenticator, Provider
    public class ScriptBasedAuthenticator
extends Object
implements Authenticator
    An Authenticator that can execute a configured script during authentication flow.

    Scripts must at least provide one of the following functions:

    1. authenticate(..) which is called from Authenticator.authenticate(AuthenticationFlowContext)
    2. action(..) which is called from Authenticator.action(AuthenticationFlowContext)

    Custom Authenticator's should at least provide the authenticate(..) function. The following script Bindings are available for convenient use within script code.

    1. script the ScriptModel to access script metadata
    2. realm the RealmModel
    3. user the current UserModel
    4. session the active KeycloakSession
    5. authenticationSession the current AuthenticationSessionModel
    6. httpRequest the current HttpRequest
    7. LOG a Logger scoped to ScriptBasedAuthenticator

    Note that the user variable is only defined when the user was identified by a preceeding authentication step, e.g. by the UsernamePasswordForm authenticator.

    Additional context information can be extracted from the context argument passed to the authenticate(context) or action(context) function.

    An example ScriptBasedAuthenticator definition could look as follows: 

     

   AuthenticationFlowError = Java.type("org.keycloak.authentication.AuthenticationFlowError");

   function authenticate(context) {

     var username = user ? user.username : "anonymous";
     LOG.info(script.name + " --> trace auth for: " + username);

     if (   username === "tester"
         && user.getAttribute("someAttribute")
         && user.getAttribute("someAttribute").contains("someValue")) {

         context.failure(AuthenticationFlowError.INVALID_USER);
         return;
     }

     context.success();
   }
    Author:
    Thomas Darimont

    • Constructor Detail

      • ScriptBasedAuthenticator

        public ScriptBasedAuthenticator()

    • Method Detail

      • authenticate

        public void authenticate​(AuthenticationFlowContext context)
        Description copied from interface: Authenticator
        Initial call for the authenticator. This method should check the current HTTP request to determine if the request satifies the Authenticator's requirements. If it doesn't, it should send back a challenge response by calling the AuthenticationFlowContext.challenge(Response). If this challenge is a authentication, the action URL of the form must point to /realms/{realm}/login-actions/authenticate?code={session-code}&execution={executionId} or /realms/{realm}/login-actions/registration?code={session-code}&execution={executionId} {session-code} pertains to the code generated from AuthenticationFlowContext.generateAccessCode(). The {executionId} pertains to the AuthenticationExecutionModel.getId() value obtained from AuthenticationFlowContext.getExecution(). The action URL will invoke the action() method described below.
        Specified by:
        authenticate in interface Authenticator

      • requiresUser

        public boolean requiresUser()
        Description copied from interface: Authenticator
        Does this authenticator require that the user has already been identified? That AuthenticatorContext.getUser() is not null?
        Specified by:
        requiresUser in interface Authenticator
        Returns:

      • close

        public void close()
        Specified by:
        close in interface Provider