Package org.keycloak.federation.sssd
Class SSSDFederationProvider
java.lang.Object
org.keycloak.federation.sssd.SSSDFederationProvider
- All Implemented Interfaces:
CredentialInputUpdater
,CredentialInputValidator
,Provider
,ImportedUserValidation
,UserLookupProvider
,UserStorageProvider
,UserProfileDecorator
public class SSSDFederationProvider
extends Object
implements UserStorageProvider, UserLookupProvider, CredentialInputUpdater, CredentialInputValidator, ImportedUserValidation, UserProfileDecorator
SPI provider implementation to retrieve data from SSSD and authenticate
against PAM
- Version:
- $Revision: 1 $
- Author:
- Bruno Oliveira
-
Nested Class Summary
Nested classes/interfaces inherited from interface org.keycloak.storage.UserStorageProvider
UserStorageProvider.EditMode
-
Field Summary
-
Constructor Summary
ConstructorDescriptionSSSDFederationProvider
(KeycloakSession session, UserStorageProviderModel model, SSSDFederationProviderFactory sssdFederationProviderFactory) -
Method Summary
Modifier and TypeMethodDescriptionvoid
close()
void
decorateUserProfile
(RealmModel realm, UserProfileMetadata metadata) Decorates user profile with additional metadata.void
disableCredentialType
(RealmModel realm, UserModel user, String credentialType) protected UserModel
findOrCreateAuthenticatedUser
(RealmModel realm, String username) Called after successful authenticationgetDisableableCredentialTypesStream
(RealmModel realm, UserModel user) Obtains the set of credential types that can be disabled viadisableCredentialType
.getUserByEmail
(RealmModel realm, String email) Returns a user with the given email belonging to the realmgetUserById
(RealmModel realm, String id) Returns a user with the given id belonging to the realmgetUserByUsername
(RealmModel realm, String username) Exact search for a user by its username.protected UserModel
importUserToKeycloak
(RealmModel realm, String username) boolean
isConfiguredFor
(RealmModel realm, UserModel user, String credentialType) boolean
isValid
(RealmModel realm, UserModel local) boolean
isValid
(RealmModel realm, UserModel user, CredentialInput input) Tests whether a credential is validvoid
preRemove
(RealmModel realm) Callback when a realm is removed.void
preRemove
(RealmModel realm, GroupModel group) Callback when a group is removed.void
preRemove
(RealmModel realm, RoleModel role) Callback when a role is removed.boolean
supportsCredentialType
(String credentialType) boolean
updateCredential
(RealmModel realm, UserModel user, CredentialInput input) validate
(RealmModel realm, UserModel user) If this method returns null, then the user in local storage will be removedvalidateAndProxy
(RealmModel realm, UserModel local) Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
Methods inherited from interface org.keycloak.storage.user.UserLookupProvider
getUserByCredential
-
Field Details
-
supportedCredentialTypes
-
session
-
model
-
-
Constructor Details
-
SSSDFederationProvider
public SSSDFederationProvider(KeycloakSession session, UserStorageProviderModel model, SSSDFederationProviderFactory sssdFederationProviderFactory)
-
-
Method Details
-
getUserByUsername
Description copied from interface:UserLookupProvider
Exact search for a user by its username. Returns a user with the given username belonging to the realm- Specified by:
getUserByUsername
in interfaceUserLookupProvider
- Parameters:
realm
- the realm modelusername
- (case-sensitivity is controlled by storage)- Returns:
- found user model, or
null
if no such user exists
-
validate
Description copied from interface:ImportedUserValidation
If this method returns null, then the user in local storage will be removed- Specified by:
validate
in interfaceImportedUserValidation
- Returns:
- null if user no longer valid
-
findOrCreateAuthenticatedUser
Called after successful authentication- Parameters:
realm
- realmusername
- username without realm prefix- Returns:
- user if found or successfully created. Null if user with same username already exists, but is not linked to this provider
-
importUserToKeycloak
-
getUserById
Description copied from interface:UserLookupProvider
Returns a user with the given id belonging to the realm- Specified by:
getUserById
in interfaceUserLookupProvider
- Parameters:
realm
- the realm modelid
- id of the user- Returns:
- found user model, or
null
if no such user exists
-
getUserByEmail
Description copied from interface:UserLookupProvider
Returns a user with the given email belonging to the realm- Specified by:
getUserByEmail
in interfaceUserLookupProvider
- Parameters:
realm
- the realm modelemail
- email address- Returns:
- found user model, or
null
if no such user exists
-
preRemove
Description copied from interface:UserStorageProvider
Callback when a realm is removed. Implement this if, for example, you want to do some cleanup in your user storage when a realm is removed- Specified by:
preRemove
in interfaceUserStorageProvider
-
preRemove
Description copied from interface:UserStorageProvider
Callback when a role is removed. Allows you to do things like remove a user role mapping in your external store if appropriate- Specified by:
preRemove
in interfaceUserStorageProvider
-
preRemove
Description copied from interface:UserStorageProvider
Callback when a group is removed. Allows you to do things like remove a user group mapping in your external store if appropriate- Specified by:
preRemove
in interfaceUserStorageProvider
-
isValid
-
supportsCredentialType
- Specified by:
supportsCredentialType
in interfaceCredentialInputUpdater
- Specified by:
supportsCredentialType
in interfaceCredentialInputValidator
-
isConfiguredFor
- Specified by:
isConfiguredFor
in interfaceCredentialInputValidator
-
isValid
Description copied from interface:CredentialInputValidator
Tests whether a credential is valid- Specified by:
isValid
in interfaceCredentialInputValidator
- Parameters:
realm
- The realm in which to which the credential belongs touser
- The user for which to test the credentialinput
- the credential details to verify- Returns:
- true if the passed secret is correct
-
validateAndProxy
-
close
public void close() -
updateCredential
- Specified by:
updateCredential
in interfaceCredentialInputUpdater
-
disableCredentialType
- Specified by:
disableCredentialType
in interfaceCredentialInputUpdater
-
getDisableableCredentialTypesStream
Description copied from interface:CredentialInputUpdater
Obtains the set of credential types that can be disabled viadisableCredentialType
.- Specified by:
getDisableableCredentialTypesStream
in interfaceCredentialInputUpdater
- Parameters:
realm
- a reference to the realm.user
- the user whose credentials are being searched.- Returns:
- a non-null
Stream
of credential types.
-
decorateUserProfile
Description copied from interface:UserProfileDecorator
Decorates user profile with additional metadata. For instance, metadata attributes, which are available just for your user-storage provider can be added there, so they are available just for the users coming from your provider- Specified by:
decorateUserProfile
in interfaceUserProfileDecorator
metadata
- to decorate
-