Package org.keycloak.organization.utils

Class Organizations

java.lang.Object

org.keycloak.organization.utils.Organizations

public class Organizations
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
static final String	INVITATION_TOKEN_NOTE	Authentication session note holding the invitation token that started the flow, so the invitation survives the redirect to an identity provider and the flow reset that follows.

Constructor Summary

Constructors

Constructor	Description
Organizations()

Method Summary

Modifier and Type	Method	Description
static boolean	canManageOrganizationGroup(KeycloakSession session, GroupModel group)
static void	checkEnabled(OrganizationProvider provider, AdminPermissionEvaluator auth)
static void	checkGroupMapperOrgPermission(KeycloakSession session, IdentityProviderMapperModel mapper, AdminPermissionEvaluator auth)
static void	filterOrganizationLinks(IdentityProviderRepresentation rep, KeycloakSession session, AdminPermissionEvaluator auth)
static int	getDomainPartsSize(String domain)
static String	getEmailDomain(String email)
static String	getEmailDomain(UserModel user)
static OrganizationDomainModel	getMatchingDomain(String domain, OrganizationModel organization)	Returns the most specific matching organization domain for the given domain and organization.
static OrganizationProvider	getProvider(KeycloakSession session)
static boolean	isEnabled(KeycloakSession session)
static boolean	isEnabledAndOrganizationsPresent(KeycloakSession session)
static boolean	isEnabledAndOrganizationsPresent(OrganizationProvider orgProvider)
static boolean	isOrganizationGroup(GroupModel group)
static boolean	isReadOnlyOrganizationMember(KeycloakSession session, UserModel delegate)
static boolean	isRegistrationAllowed(KeycloakSession session, RealmModel realm)
static boolean	isSameDomain(String domain, String expectedDomain)
static boolean	isSameDomain(String domain, OrganizationDomainModel model)
static InviteOrgActionToken	parseInvitationToken(KeycloakSession session, String tokenString)
static InviteOrgActionToken	parseInvitationToken(KeycloakSession session, HttpRequest request)
static Consumer<GroupModel>	removeGroup(KeycloakSession session, RealmModel realm)
static OrganizationModel	resolveByDomain(List<OrganizationModel> organizations, String domain)
static List<IdentityProviderModel>	resolveHomeBroker(KeycloakSession session, UserModel user)
static OrganizationModel	resolveOrganization(KeycloakSession session)
static OrganizationModel	resolveOrganization(KeycloakSession session, UserModel user)
static OrganizationModel	resolveOrganization(KeycloakSession session, UserModel user, String domain)
static void	stripOrganizationId(IdentityProviderRepresentation representation)
static void	validateDomain(String rawDomain)
static void	validateGroupMapperOrganization(KeycloakSession session, IdentityProviderModel idp, IdentityProviderMapperModel mapper)	Validates the organization recorded on an identity provider group mapper.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

INVITATION_TOKEN_NOTE

public static final String INVITATION_TOKEN_NOTE

Authentication session note holding the invitation token that started the flow, so the invitation survives the redirect to an identity provider and the flow reset that follows.

See Also:

• Constant Field Values

Constructor Details

Organizations

public Organizations()

Method Details

isOrganizationGroup

public static boolean isOrganizationGroup(GroupModel group)

validateGroupMapperOrganization

public static void validateGroupMapperOrganization(KeycloakSession session,
 IdentityProviderModel idp,
 IdentityProviderMapperModel mapper)

Validates the organization recorded on an identity provider group mapper.

A mapper targeting organization groups applies to exactly one organization, which it must name through ConfigConstants.ORGANIZATION_ID. To map groups of several organizations of a shared identity provider, add one mapper per organization.

Parameters:

session - the Keycloak session

idp - the identity provider owning the mapper

mapper - the mapper to validate

checkGroupMapperOrgPermission

public static void checkGroupMapperOrgPermission(KeycloakSession session,
 IdentityProviderMapperModel mapper,
 AdminPermissionEvaluator auth)

canManageOrganizationGroup

public static boolean canManageOrganizationGroup(KeycloakSession session,
 GroupModel group)

resolveHomeBroker

public static List<IdentityProviderModel> resolveHomeBroker(KeycloakSession session,
 UserModel user)

stripOrganizationId

public static void stripOrganizationId(IdentityProviderRepresentation representation)

filterOrganizationLinks

public static void filterOrganizationLinks(IdentityProviderRepresentation rep,
 KeycloakSession session,
 AdminPermissionEvaluator auth)

removeGroup

public static Consumer<GroupModel> removeGroup(KeycloakSession session,
 RealmModel realm)

isEnabled

public static boolean isEnabled(KeycloakSession session)

isEnabledAndOrganizationsPresent

public static boolean isEnabledAndOrganizationsPresent(OrganizationProvider orgProvider)

isEnabledAndOrganizationsPresent

public static boolean isEnabledAndOrganizationsPresent(KeycloakSession session)

checkEnabled

public static void checkEnabled(OrganizationProvider provider,
 AdminPermissionEvaluator auth)

parseInvitationToken

public static InviteOrgActionToken parseInvitationToken(KeycloakSession session,
 HttpRequest request)
                                                 throws VerificationException

Throws:

VerificationException

parseInvitationToken

public static InviteOrgActionToken parseInvitationToken(KeycloakSession session,
 String tokenString)
                                                 throws VerificationException

Throws:

VerificationException

getDomainPartsSize

public static int getDomainPartsSize(String domain)

validateDomain

public static void validateDomain(String rawDomain)

getMatchingDomain

public static OrganizationDomainModel getMatchingDomain(String domain,
 OrganizationModel organization)

Returns the most specific matching organization domain for the given domain and organization. When several domains of the organization match (e.g. an exact domain and a parent wildcard, or nested wildcards), the one with the largest number of parts wins.

Parameters:

domain - the domain

organization - the organization

Returns:

the most specific matching organization domain, or null if no match is found

isSameDomain

public static boolean isSameDomain(String domain,
 OrganizationDomainModel model)

isSameDomain

public static boolean isSameDomain(String domain,
 String expectedDomain)

getEmailDomain

public static String getEmailDomain(String email)

getEmailDomain

public static String getEmailDomain(UserModel user)

resolveOrganization

public static OrganizationModel resolveOrganization(KeycloakSession session)

resolveOrganization

public static OrganizationModel resolveOrganization(KeycloakSession session,
 UserModel user)

resolveOrganization

public static OrganizationModel resolveOrganization(KeycloakSession session,
 UserModel user,
 String domain)

getProvider

public static OrganizationProvider getProvider(KeycloakSession session)

isRegistrationAllowed

public static boolean isRegistrationAllowed(KeycloakSession session,
 RealmModel realm)

isReadOnlyOrganizationMember

public static boolean isReadOnlyOrganizationMember(KeycloakSession session,
 UserModel delegate)

resolveByDomain

public static OrganizationModel resolveByDomain(List<OrganizationModel> organizations,
 String domain)