Package org.keycloak.storage.ldap
Class LDAPStorageProvider
java.lang.Object
org.keycloak.storage.ldap.LDAPStorageProvider
- All Implemented Interfaces:
CredentialAuthentication
,CredentialInputUpdater
,CredentialInputValidator
,Provider
,ImportedUserValidation
,UserLookupProvider
,UserQueryMethodsProvider
,UserRegistrationProvider
,UserStorageProvider
,UserProfileDecorator
public class LDAPStorageProvider
extends Object
implements UserStorageProvider, CredentialInputValidator, CredentialInputUpdater, CredentialAuthentication, UserLookupProvider, UserRegistrationProvider, UserQueryMethodsProvider, ImportedUserValidation, UserProfileDecorator
- Version:
- $Revision: 1 $
- Author:
- Marek Posolda, Bill Burke
-
Nested Class Summary
Nested classes/interfaces inherited from interface org.keycloak.storage.UserStorageProvider
UserStorageProvider.EditMode
-
Field Summary
Modifier and TypeFieldDescriptionprotected UserStorageProvider.EditMode
protected LDAPStorageProviderFactory
protected LDAPProviderKerberosConfig
protected LDAPIdentityStore
protected LDAPStorageMapperManager
protected UserStorageProviderModel
protected KeycloakSession
protected PasswordUpdateCallback
protected LDAPStorageUserManager
-
Constructor Summary
ConstructorDescriptionLDAPStorageProvider
(LDAPStorageProviderFactory factory, KeycloakSession session, ComponentModel model, LDAPIdentityStore ldapIdentityStore) -
Method Summary
Modifier and TypeMethodDescriptionaddUser
(RealmModel realm, String username) All storage providers that implement this interface will be looped through.authenticate
(RealmModel realm, CredentialInput cred) void
close()
void
decorateUserProfile
(RealmModel realm, UserProfileMetadata metadata) Decorates user profile with additional metadata.void
disableCredentialType
(RealmModel realm, UserModel user, String credentialType) protected UserModel
findOrCreateAuthenticatedUser
(RealmModel realm, KerberosPrincipal kerberosPrincipal) Called after successful kerberos authenticationgetDisableableCredentialTypesStream
(RealmModel realm, UserModel user) Obtains the set of credential types that can be disabled viadisableCredentialType
.getGroupMembersStream
(RealmModel realm, GroupModel group, Integer firstResult, Integer maxResults) Obtains users that belong to a specific group.getModel()
getRoleMembersStream
(RealmModel realm, RoleModel role, Integer firstResult, Integer maxResults) Searches for users that have the specified role.getUserByEmail
(RealmModel realm, String email) Returns a user with the given email belonging to the realmgetUserById
(RealmModel realm, String id) Returns a user with the given id belonging to the realmgetUserByUsername
(RealmModel realm, String username) Exact search for a user by its username.protected UserModel
importUserFromLDAP
(KeycloakSession session, RealmModel realm, LDAPObject ldapUser) protected UserModel
importUserFromLDAP
(KeycloakSession session, RealmModel realm, LDAPObject ldapUser, boolean duplicates) boolean
isConfiguredFor
(RealmModel realm, UserModel user, String credentialType) boolean
isValid
(RealmModel realm, UserModel user, CredentialInput input) Tests whether a credential is validprotected LDAPObject
loadAndValidateUser
(RealmModel realm, UserModel local) loadLDAPUserByDN
(RealmModel realm, LDAPDn dn) loadLDAPUserByUsername
(RealmModel realm, String username) loadLDAPUserByUuid
(RealmModel realm, String uuid) loadUsersByDNs
(RealmModel realm, Collection<LDAPDn> dns, int firstResult, int maxResults) loadUsersByUniqueAttribute
(RealmModel realm, String uidName, Collection<String> uids, int firstResult, int maxResults) loadUsersByUsernames
(List<String> usernames, RealmModel realm) void
preRemove
(RealmModel realm) Callback when a realm is removed.void
preRemove
(RealmModel realm, GroupModel group) Callback when a group is removed.void
preRemove
(RealmModel realm, RoleModel role) Callback when a role is removed.protected UserModel
proxy
(RealmModel realm, UserModel local, LDAPObject ldapObject, boolean newUser) protected LDAPObject
queryByEmail
(RealmModel realm, String email) boolean
removeUser
(RealmModel realm, UserModel user) Called if user originated from this provider.searchForUserByUserAttributeStream
(RealmModel realm, String attrName, String attrValue) Searches for users that have a specific attribute with a specific value.searchForUserStream
(RealmModel realm, Map<String, String> params, Integer firstResult, Integer maxResults) LDAP search supportsUserModel.SEARCH
,UserModel.EXACT
and all the other user attributes that are managed by a mapper (method getUserAttributes).void
setUpdater
(PasswordUpdateCallback updater) boolean
boolean
supportsCredentialType
(String credentialType) boolean
toString()
boolean
updateCredential
(RealmModel realm, UserModel user, CredentialInput input) validate
(RealmModel realm, UserModel local) If this method returns null, then the user in local storage will be removedboolean
validPassword
(RealmModel realm, UserModel user, String password) Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait
Methods inherited from interface org.keycloak.storage.user.UserLookupProvider
getUserByCredential
Methods inherited from interface org.keycloak.storage.user.UserQueryMethodsProvider
getGroupMembersStream, getRoleMembersStream, searchForUserStream, searchForUserStream, searchForUserStream
-
Field Details
-
factory
-
session
-
model
-
ldapIdentityStore
-
editMode
-
kerberosConfig
-
updater
-
mapperManager
-
userManager
-
supportedCredentialTypes
-
-
Constructor Details
-
LDAPStorageProvider
public LDAPStorageProvider(LDAPStorageProviderFactory factory, KeycloakSession session, ComponentModel model, LDAPIdentityStore ldapIdentityStore)
-
-
Method Details
-
setUpdater
-
getSession
-
getLdapIdentityStore
-
getEditMode
-
getModel
-
getKerberosConfig
-
getMapperManager
-
getUserManager
-
validate
Description copied from interface:ImportedUserValidation
If this method returns null, then the user in local storage will be removed- Specified by:
validate
in interfaceImportedUserValidation
- Returns:
- null if user no longer valid
-
proxy
protected UserModel proxy(RealmModel realm, UserModel local, LDAPObject ldapObject, boolean newUser) -
supportsCredentialAuthenticationFor
- Specified by:
supportsCredentialAuthenticationFor
in interfaceCredentialAuthentication
-
searchForUserByUserAttributeStream
public Stream<UserModel> searchForUserByUserAttributeStream(RealmModel realm, String attrName, String attrValue) Description copied from interface:UserQueryMethodsProvider
Searches for users that have a specific attribute with a specific value.- Specified by:
searchForUserByUserAttributeStream
in interfaceUserQueryMethodsProvider
- Parameters:
realm
- a reference to the realm.attrName
- the attribute name.attrValue
- the attribute value.- Returns:
- a non-null
Stream
of users that match the search criteria.
-
synchronizeRegistrations
public boolean synchronizeRegistrations() -
addUser
Description copied from interface:UserRegistrationProvider
All storage providers that implement this interface will be looped through. If this method returns null, then the next storage provider's addUser() method will be called. If no storage providers handle the add, then the user will be created in local storage. Returning null is useful when you want optional support for adding users. For example, our LDAP provider can enable and disable the ability to add users.- Specified by:
addUser
in interfaceUserRegistrationProvider
- Parameters:
realm
- a reference to the realmusername
- a username the created user will be assigned- Returns:
- a model of created user
-
removeUser
Description copied from interface:UserRegistrationProvider
Called if user originated from this provider. If a local user is linked to this provider, this method will be called before local storage's removeUser() method is invoked. If you are using an import strategy, and this is a local user linked to this provider, this method will be called before local storage's removeUser() method is invoked. Also, you DO NOT need to remove the imported user. The runtime will handle this for you.- Specified by:
removeUser
in interfaceUserRegistrationProvider
- Parameters:
realm
- a reference to the realmuser
- a reference to the user that is removed- Returns:
- true if the user was removed, false otherwise
-
getUserById
Description copied from interface:UserLookupProvider
Returns a user with the given id belonging to the realm- Specified by:
getUserById
in interfaceUserLookupProvider
- Parameters:
realm
- the realm modelid
- id of the user- Returns:
- found user model, or
null
if no such user exists
-
searchForUserStream
public Stream<UserModel> searchForUserStream(RealmModel realm, Map<String, String> params, Integer firstResult, Integer maxResults) LDAP search supportsUserModel.SEARCH
,UserModel.EXACT
and all the other user attributes that are managed by a mapper (method getUserAttributes).- Specified by:
searchForUserStream
in interfaceUserQueryMethodsProvider
- Parameters:
realm
- a reference to the realm.params
- a map containing the search parameters.firstResult
- first result to return. Ignored if negative, zero, ornull
.maxResults
- maximum number of results to return. Ignored if negative ornull
.- Returns:
- a non-null
Stream
of users that match the search criteria.
-
getGroupMembersStream
public Stream<UserModel> getGroupMembersStream(RealmModel realm, GroupModel group, Integer firstResult, Integer maxResults) Description copied from interface:UserQueryMethodsProvider
Obtains users that belong to a specific group.- Specified by:
getGroupMembersStream
in interfaceUserQueryMethodsProvider
- Parameters:
realm
- a reference to the realm.group
- a reference to the group.firstResult
- first result to return. Ignored if negative, zero, ornull
.maxResults
- maximum number of results to return. Ignored if negative ornull
.- Returns:
- a non-null
Stream
of users that belong to the group.
-
getRoleMembersStream
public Stream<UserModel> getRoleMembersStream(RealmModel realm, RoleModel role, Integer firstResult, Integer maxResults) Description copied from interface:UserQueryMethodsProvider
Searches for users that have the specified role.- Specified by:
getRoleMembersStream
in interfaceUserQueryMethodsProvider
- Parameters:
realm
- a reference to the realm.role
- a reference to the role.firstResult
- first result to return. Ignored if negative ornull
.maxResults
- maximum number of results to return. Ignored if negative ornull
.- Returns:
- a non-null
Stream
of users that have the specified role.
-
loadUsersByUsernames
-
loadUsersByDNs
public Stream<UserModel> loadUsersByDNs(RealmModel realm, Collection<LDAPDn> dns, int firstResult, int maxResults) -
loadUsersByUniqueAttribute
public Stream<UserModel> loadUsersByUniqueAttribute(RealmModel realm, String uidName, Collection<String> uids, int firstResult, int maxResults) -
loadAndValidateUser
- Parameters:
local
-- Returns:
- ldapUser corresponding to local user or null if user is no longer in LDAP
-
getUserByUsername
Description copied from interface:UserLookupProvider
Exact search for a user by its username. Returns a user with the given username belonging to the realm- Specified by:
getUserByUsername
in interfaceUserLookupProvider
- Parameters:
realm
- the realm modelusername
- (case-sensitivity is controlled by storage)- Returns:
- found user model, or
null
if no such user exists
-
importUserFromLDAP
protected UserModel importUserFromLDAP(KeycloakSession session, RealmModel realm, LDAPObject ldapUser) -
importUserFromLDAP
protected UserModel importUserFromLDAP(KeycloakSession session, RealmModel realm, LDAPObject ldapUser, boolean duplicates) -
queryByEmail
-
getUserByEmail
Description copied from interface:UserLookupProvider
Returns a user with the given email belonging to the realm- Specified by:
getUserByEmail
in interfaceUserLookupProvider
- Parameters:
realm
- the realm modelemail
- email address- Returns:
- found user model, or
null
if no such user exists
-
preRemove
Description copied from interface:UserStorageProvider
Callback when a realm is removed. Implement this if, for example, you want to do some cleanup in your user storage when a realm is removed- Specified by:
preRemove
in interfaceUserStorageProvider
-
preRemove
Description copied from interface:UserStorageProvider
Callback when a role is removed. Allows you to do things like remove a user role mapping in your external store if appropriate- Specified by:
preRemove
in interfaceUserStorageProvider
-
preRemove
Description copied from interface:UserStorageProvider
Callback when a group is removed. Allows you to do things like remove a user group mapping in your external store if appropriate- Specified by:
preRemove
in interfaceUserStorageProvider
-
validPassword
-
updateCredential
- Specified by:
updateCredential
in interfaceCredentialInputUpdater
-
disableCredentialType
- Specified by:
disableCredentialType
in interfaceCredentialInputUpdater
-
getDisableableCredentialTypesStream
Description copied from interface:CredentialInputUpdater
Obtains the set of credential types that can be disabled viadisableCredentialType
.- Specified by:
getDisableableCredentialTypesStream
in interfaceCredentialInputUpdater
- Parameters:
realm
- a reference to the realm.user
- the user whose credentials are being searched.- Returns:
- a non-null
Stream
of credential types.
-
getSupportedCredentialTypes
-
supportsCredentialType
- Specified by:
supportsCredentialType
in interfaceCredentialInputUpdater
- Specified by:
supportsCredentialType
in interfaceCredentialInputValidator
-
isConfiguredFor
- Specified by:
isConfiguredFor
in interfaceCredentialInputValidator
-
isValid
Description copied from interface:CredentialInputValidator
Tests whether a credential is valid- Specified by:
isValid
in interfaceCredentialInputValidator
- Parameters:
realm
- The realm in which to which the credential belongs touser
- The user for which to test the credentialinput
- the credential details to verify- Returns:
- true if the passed secret is correct
-
authenticate
- Specified by:
authenticate
in interfaceCredentialAuthentication
-
close
public void close() -
findOrCreateAuthenticatedUser
protected UserModel findOrCreateAuthenticatedUser(RealmModel realm, KerberosPrincipal kerberosPrincipal) Called after successful kerberos authentication- Parameters:
realm
- realmkerberosPrincipal
- kerberos principal of the authenticated user- Returns:
- finded or newly created user
-
loadLDAPUserByUsername
-
loadLDAPUserByUuid
-
loadLDAPUserByDN
-
toString
-
decorateUserProfile
Description copied from interface:UserProfileDecorator
Decorates user profile with additional metadata. For instance, metadata attributes, which are available just for your user-storage provider can be added there, so they are available just for the users coming from your provider- Specified by:
decorateUserProfile
in interfaceUserProfileDecorator
metadata
- to decorate
-