Package org.keycloak.storage.ldap

Class LDAPStorageProvider

java.lang.Object

org.keycloak.storage.ldap.LDAPStorageProvider

All Implemented Interfaces:

CredentialAuthentication, CredentialInputUpdater, CredentialInputValidator, Provider, ImportedUserValidation, UserLookupProvider, UserQueryMethodsProvider, UserRegistrationProvider, UserStorageProvider

public class LDAPStorageProvider
extends Object
implements UserStorageProvider, CredentialInputValidator, CredentialInputUpdater, CredentialAuthentication, UserLookupProvider, UserRegistrationProvider, UserQueryMethodsProvider, ImportedUserValidation

Version:

$Revision: 1 $

Author:

Marek Posolda, Bill Burke

Nested Class Summary

Nested classes/interfaces inherited from interface org.keycloak.storage.UserStorageProvider

UserStorageProvider.EditMode

Field Summary

Fields

Modifier and Type	Field	Description
protected UserStorageProvider.EditMode	editMode
protected LDAPStorageProviderFactory	factory
protected LDAPProviderKerberosConfig	kerberosConfig
protected LDAPIdentityStore	ldapIdentityStore
protected LDAPStorageMapperManager	mapperManager
protected UserStorageProviderModel	model
protected KeycloakSession	session
protected final Set<String>	supportedCredentialTypes
protected PasswordUpdateCallback	updater
protected LDAPStorageUserManager	userManager

Constructor Summary

Constructors

Constructor	Description
LDAPStorageProvider(LDAPStorageProviderFactory factory, KeycloakSession session, ComponentModel model, LDAPIdentityStore ldapIdentityStore)

Method Summary

Modifier and Type	Method	Description
UserModel	addUser(RealmModel realm, String username)
CredentialValidationOutput	authenticate(RealmModel realm, CredentialInput cred)
void	close()
void	disableCredentialType(RealmModel realm, UserModel user, String credentialType)
protected UserModel	findOrCreateAuthenticatedUser(RealmModel realm, String username)	Called after successful kerberos authentication
Stream<String>	getDisableableCredentialTypesStream(RealmModel realm, UserModel user)
UserStorageProvider.EditMode	getEditMode()
Stream<UserModel>	getGroupMembersStream(RealmModel realm, GroupModel group, Integer firstResult, Integer maxResults)
LDAPIdentityStore	getLdapIdentityStore()
LDAPStorageMapperManager	getMapperManager()
UserStorageProviderModel	getModel()
Stream<UserModel>	getRoleMembersStream(RealmModel realm, RoleModel role, Integer firstResult, Integer maxResults)
KeycloakSession	getSession()
Set<String>	getSupportedCredentialTypes()
UserModel	getUserByEmail(RealmModel realm, String email)
UserModel	getUserById(RealmModel realm, String id)
UserModel	getUserByUsername(RealmModel realm, String username)
LDAPStorageUserManager	getUserManager()
protected UserModel	importUserFromLDAP(KeycloakSession session, RealmModel realm, LDAPObject ldapUser)
boolean	isConfiguredFor(RealmModel realm, UserModel user, String credentialType)
boolean	isValid(RealmModel realm, UserModel user, CredentialInput input)
protected LDAPObject	loadAndValidateUser(RealmModel realm, UserModel local)
LDAPObject	loadLDAPUserByUsername(RealmModel realm, String username)
LDAPObject	loadLDAPUserByUuid(RealmModel realm, String uuid)
List<UserModel>	loadUsersByUsernames(List<String> usernames, RealmModel realm)
void	preRemove(RealmModel realm)
void	preRemove(RealmModel realm, GroupModel group)
void	preRemove(RealmModel realm, RoleModel role)
protected UserModel	proxy(RealmModel realm, UserModel local, LDAPObject ldapObject, boolean newUser)
protected LDAPObject	queryByEmail(RealmModel realm, String email)
boolean	removeUser(RealmModel realm, UserModel user)
Stream<UserModel>	searchForUserByUserAttributeStream(RealmModel realm, String attrName, String attrValue)
Stream<UserModel>	searchForUserStream(RealmModel realm, Map<String,String> params, Integer firstResult, Integer maxResults)	It supports UserModel.FIRST_NAME UserModel.LAST_NAME UserModel.EMAIL UserModel.USERNAME Other fields are not supported.
void	setUpdater(PasswordUpdateCallback updater)
boolean	supportsCredentialAuthenticationFor(String type)
boolean	supportsCredentialType(String credentialType)
boolean	synchronizeRegistrations()
boolean	updateCredential(RealmModel realm, UserModel user, CredentialInput input)
UserModel	validate(RealmModel realm, UserModel local)
boolean	validPassword(RealmModel realm, UserModel user, String password)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.storage.user.UserLookupProvider

getUserByCredential

Methods inherited from interface org.keycloak.storage.user.UserQueryMethodsProvider

getGroupMembersStream, getRoleMembersStream, searchForUserStream, searchForUserStream, searchForUserStream

Field Details

factory

protected LDAPStorageProviderFactory factory

session

protected KeycloakSession session

model

protected UserStorageProviderModel model

ldapIdentityStore

protected LDAPIdentityStore ldapIdentityStore

editMode

protected UserStorageProvider.EditMode editMode

kerberosConfig

protected LDAPProviderKerberosConfig kerberosConfig

updater

protected PasswordUpdateCallback updater

mapperManager

protected LDAPStorageMapperManager mapperManager

userManager

protected LDAPStorageUserManager userManager

supportedCredentialTypes

protected final Set<String> supportedCredentialTypes

Constructor Details

LDAPStorageProvider

public LDAPStorageProvider(LDAPStorageProviderFactory factory,
 KeycloakSession session,
 ComponentModel model,
 LDAPIdentityStore ldapIdentityStore)

Method Details

setUpdater

public void setUpdater(PasswordUpdateCallback updater)

getSession

public KeycloakSession getSession()

getLdapIdentityStore

public LDAPIdentityStore getLdapIdentityStore()

getEditMode

public UserStorageProvider.EditMode getEditMode()

getModel

public UserStorageProviderModel getModel()

getMapperManager

public LDAPStorageMapperManager getMapperManager()

getUserManager

public LDAPStorageUserManager getUserManager()

validate

public UserModel validate(RealmModel realm,
 UserModel local)

Specified by:

validate in interface ImportedUserValidation

proxy

protected UserModel proxy(RealmModel realm,
 UserModel local,
 LDAPObject ldapObject,
 boolean newUser)

supportsCredentialAuthenticationFor

public boolean supportsCredentialAuthenticationFor(String type)

Specified by:

supportsCredentialAuthenticationFor in interface CredentialAuthentication

searchForUserByUserAttributeStream

public Stream<UserModel> searchForUserByUserAttributeStream(RealmModel realm,
 String attrName,
 String attrValue)

Specified by:

searchForUserByUserAttributeStream in interface UserQueryMethodsProvider

synchronizeRegistrations

public boolean synchronizeRegistrations()

addUser

public UserModel addUser(RealmModel realm,
 String username)

Specified by:

addUser in interface UserRegistrationProvider

removeUser

public boolean removeUser(RealmModel realm,
 UserModel user)

Specified by:

removeUser in interface UserRegistrationProvider

getUserById

public UserModel getUserById(RealmModel realm,
 String id)

Specified by:

getUserById in interface UserLookupProvider

searchForUserStream

public Stream<UserModel> searchForUserStream(RealmModel realm,
 Map<String,String> params,
 Integer firstResult,
 Integer maxResults)

It supports

• UserModel.FIRST_NAME
• UserModel.LAST_NAME
• UserModel.EMAIL
• UserModel.USERNAME

Other fields are not supported. The search for LDAP REST endpoints is done in the context of fields which are stored in LDAP (above).

Specified by:

searchForUserStream in interface UserQueryMethodsProvider

getGroupMembersStream

public Stream<UserModel> getGroupMembersStream(RealmModel realm,
 GroupModel group,
 Integer firstResult,
 Integer maxResults)

Specified by:

getGroupMembersStream in interface UserQueryMethodsProvider

getRoleMembersStream

public Stream<UserModel> getRoleMembersStream(RealmModel realm,
 RoleModel role,
 Integer firstResult,
 Integer maxResults)

Specified by:

getRoleMembersStream in interface UserQueryMethodsProvider

loadUsersByUsernames

public List<UserModel> loadUsersByUsernames(List<String> usernames,
 RealmModel realm)

loadAndValidateUser

protected LDAPObject loadAndValidateUser(RealmModel realm,
 UserModel local)

Parameters:

local -

Returns:

ldapUser corresponding to local user or null if user is no longer in LDAP

getUserByUsername

public UserModel getUserByUsername(RealmModel realm,
 String username)

Specified by:

getUserByUsername in interface UserLookupProvider

importUserFromLDAP

protected UserModel importUserFromLDAP(KeycloakSession session,
 RealmModel realm,
 LDAPObject ldapUser)

queryByEmail

protected LDAPObject queryByEmail(RealmModel realm,
 String email)

getUserByEmail

public UserModel getUserByEmail(RealmModel realm,
 String email)

Specified by:

getUserByEmail in interface UserLookupProvider

preRemove

public void preRemove(RealmModel realm)

Specified by:

preRemove in interface UserStorageProvider

preRemove

public void preRemove(RealmModel realm,
 RoleModel role)

Specified by:

preRemove in interface UserStorageProvider

preRemove

public void preRemove(RealmModel realm,
 GroupModel group)

Specified by:

preRemove in interface UserStorageProvider

validPassword

public boolean validPassword(RealmModel realm,
 UserModel user,
 String password)

updateCredential

public boolean updateCredential(RealmModel realm,
 UserModel user,
 CredentialInput input)

Specified by:

updateCredential in interface CredentialInputUpdater

disableCredentialType

public void disableCredentialType(RealmModel realm,
 UserModel user,
 String credentialType)

Specified by:

disableCredentialType in interface CredentialInputUpdater

getDisableableCredentialTypesStream

public Stream<String> getDisableableCredentialTypesStream(RealmModel realm,
 UserModel user)

Specified by:

getDisableableCredentialTypesStream in interface CredentialInputUpdater

getSupportedCredentialTypes

public Set<String> getSupportedCredentialTypes()

supportsCredentialType

public boolean supportsCredentialType(String credentialType)

Specified by:

supportsCredentialType in interface CredentialInputUpdater

Specified by:

supportsCredentialType in interface CredentialInputValidator

isConfiguredFor

public boolean isConfiguredFor(RealmModel realm,
 UserModel user,
 String credentialType)

Specified by:

isConfiguredFor in interface CredentialInputValidator

isValid

public boolean isValid(RealmModel realm,
 UserModel user,
 CredentialInput input)

Specified by:

isValid in interface CredentialInputValidator

authenticate

public CredentialValidationOutput authenticate(RealmModel realm,
 CredentialInput cred)

Specified by:

authenticate in interface CredentialAuthentication

close

public void close()

Specified by:

close in interface Provider

findOrCreateAuthenticatedUser

protected UserModel findOrCreateAuthenticatedUser(RealmModel realm,
 String username)

Called after successful kerberos authentication

Parameters:

realm - realm

username - username without realm prefix

Returns:

finded or newly created user

loadLDAPUserByUsername

public LDAPObject loadLDAPUserByUsername(RealmModel realm,
 String username)

loadLDAPUserByUuid

public LDAPObject loadLDAPUserByUuid(RealmModel realm,
 String uuid)