Package org.keycloak.federation.kerberos

Class KerberosFederationProvider

java.lang.Object

org.keycloak.federation.kerberos.KerberosFederationProvider

All Implemented Interfaces:

CredentialAuthentication, CredentialInputUpdater, CredentialInputValidator, Provider, ImportedUserValidation, UserLookupProvider, UserRegistrationProvider, UserStorageProvider, UserProfileDecorator

public class KerberosFederationProvider
extends Object
implements UserStorageProvider, UserLookupProvider, CredentialInputValidator, CredentialInputUpdater, CredentialAuthentication, ImportedUserValidation, UserProfileDecorator, UserRegistrationProvider

Author:

Marek Posolda

Nested Class Summary

Nested classes/interfaces inherited from interface org.keycloak.storage.UserStorageProvider

UserStorageProvider.EditMode

Field Summary

Fields

Modifier and Type	Field	Description
protected KerberosFederationProviderFactory	factory
static final String	KERBEROS_PRINCIPAL
protected KerberosConfig	kerberosConfig
protected UserStorageProviderModel	model
protected KeycloakSession	session

Constructor Summary

Constructors

Constructor	Description
KerberosFederationProvider(KeycloakSession session, UserStorageProviderModel model, KerberosFederationProviderFactory factory)

Method Summary

Modifier and Type	Method	Description
UserModel	addUser(RealmModel realm, String username)	All storage providers that implement this interface will be looped through.
CredentialValidationOutput	authenticate(RealmModel realm, CredentialInput input)
void	close()
List<AttributeMetadata>	decorateUserProfile(String providerId, UserProfileMetadata metadata)	Decorates user profile with additional metadata.
void	disableCredentialType(RealmModel realm, UserModel user, String credentialType)
protected UserModel	findOrCreateAuthenticatedUser(RealmModel realm, KerberosPrincipal kerberosPrincipal)	Called after successful authentication
Stream<String>	getDisableableCredentialTypesStream(RealmModel realm, UserModel user)	Obtains the set of credential types that can be disabled via disableCredentialType.
UserModel	getUserByEmail(RealmModel realm, String email)	Returns a user with the given email belonging to the realm
UserModel	getUserById(RealmModel realm, String id)	Returns a user with the given id belonging to the realm
UserModel	getUserByUsername(RealmModel realm, String username)	Exact search for a user by its username.
protected UserModel	importUserToKeycloak(RealmModel realm, KerberosPrincipal kerberosPrincipal)
boolean	isConfiguredFor(RealmModel realm, UserModel user, String credentialType)
boolean	isValid(RealmModel realm, UserModel user, CredentialInput input)	Tests whether a credential is valid
void	preRemove(RealmModel realm)	Callback when a realm is removed.
void	preRemove(RealmModel realm, GroupModel group)	Callback when a group is removed.
void	preRemove(RealmModel realm, RoleModel role)	Callback when a role is removed.
boolean	removeUser(RealmModel realm, UserModel user)	Called if user originated from this provider.
boolean	supportsCredentialAuthenticationFor(String type)
boolean	supportsCredentialType(String credentialType)
String	toString()
boolean	updateCredential(RealmModel realm, UserModel user, CredentialInput input)
UserModel	validate(RealmModel realm, UserModel user)	If this method returns null, then the user in local storage will be removed
protected boolean	validPassword(String kerberosPrincipal, String password)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface org.keycloak.storage.user.UserLookupProvider

getUserByCredential

Field Details

KERBEROS_PRINCIPAL

public static final String KERBEROS_PRINCIPAL

See Also:

• Constant Field Values

session

protected KeycloakSession session

model

protected UserStorageProviderModel model

kerberosConfig

protected KerberosConfig kerberosConfig

factory

protected KerberosFederationProviderFactory factory

Constructor Details

KerberosFederationProvider

public KerberosFederationProvider(KeycloakSession session,
 UserStorageProviderModel model,
 KerberosFederationProviderFactory factory)

Method Details

validate

public UserModel validate(RealmModel realm,
 UserModel user)

Description copied from interface: ImportedUserValidation

If this method returns null, then the user in local storage will be removed

Specified by:

validate in interface ImportedUserValidation

Returns:

null if user no longer valid

getUserByUsername

public UserModel getUserByUsername(RealmModel realm,
 String username)

Description copied from interface: UserLookupProvider

Exact search for a user by its username. Returns a user with the given username belonging to the realm

Specified by:

getUserByUsername in interface UserLookupProvider

Parameters:

realm - the realm model

username - (case-sensitivity is controlled by storage)

Returns:

found user model, or null if no such user exists

getUserByEmail

public UserModel getUserByEmail(RealmModel realm,
 String email)

Description copied from interface: UserLookupProvider

Returns a user with the given email belonging to the realm

Specified by:

getUserByEmail in interface UserLookupProvider

Parameters:

realm - the realm model

email - email address

Returns:

found user model, or null if no such user exists

getUserById

public UserModel getUserById(RealmModel realm,
 String id)

Description copied from interface: UserLookupProvider

Returns a user with the given id belonging to the realm

Specified by:

getUserById in interface UserLookupProvider

Parameters:

realm - the realm model

id - id of the user

Returns:

found user model, or null if no such user exists

preRemove

public void preRemove(RealmModel realm)

Description copied from interface: UserStorageProvider

Callback when a realm is removed. Implement this if, for example, you want to do some cleanup in your user storage when a realm is removed

Specified by:

preRemove in interface UserStorageProvider

preRemove

public void preRemove(RealmModel realm,
 RoleModel role)

Description copied from interface: UserStorageProvider

Callback when a role is removed. Allows you to do things like remove a user role mapping in your external store if appropriate

Specified by:

preRemove in interface UserStorageProvider

preRemove

public void preRemove(RealmModel realm,
 GroupModel group)

Description copied from interface: UserStorageProvider

Callback when a group is removed. Allows you to do things like remove a user group mapping in your external store if appropriate

Specified by:

preRemove in interface UserStorageProvider

updateCredential

public boolean updateCredential(RealmModel realm,
 UserModel user,
 CredentialInput input)

Specified by:

updateCredential in interface CredentialInputUpdater

disableCredentialType

public void disableCredentialType(RealmModel realm,
 UserModel user,
 String credentialType)

Specified by:

disableCredentialType in interface CredentialInputUpdater

getDisableableCredentialTypesStream

public Stream<String> getDisableableCredentialTypesStream(RealmModel realm,
 UserModel user)

Description copied from interface: CredentialInputUpdater

Obtains the set of credential types that can be disabled via disableCredentialType.

Specified by:

getDisableableCredentialTypesStream in interface CredentialInputUpdater

Parameters:

realm - a reference to the realm.

user - the user whose credentials are being searched.

Returns:

a non-null Stream of credential types.

supportsCredentialType

public boolean supportsCredentialType(String credentialType)

Specified by:

supportsCredentialType in interface CredentialInputUpdater

Specified by:

supportsCredentialType in interface CredentialInputValidator

supportsCredentialAuthenticationFor

public boolean supportsCredentialAuthenticationFor(String type)

Specified by:

supportsCredentialAuthenticationFor in interface CredentialAuthentication

isConfiguredFor

public boolean isConfiguredFor(RealmModel realm,
 UserModel user,
 String credentialType)

Specified by:

isConfiguredFor in interface CredentialInputValidator

isValid

public boolean isValid(RealmModel realm,
 UserModel user,
 CredentialInput input)

Description copied from interface: CredentialInputValidator

Tests whether a credential is valid

Specified by:

isValid in interface CredentialInputValidator

Parameters:

realm - The realm in which to which the credential belongs to

user - The user for which to test the credential

input - the credential details to verify

Returns:

true if the passed secret is correct

validPassword

protected boolean validPassword(String kerberosPrincipal,
 String password)

authenticate

public CredentialValidationOutput authenticate(RealmModel realm,
 CredentialInput input)

Specified by:

authenticate in interface CredentialAuthentication

close

public void close()

Specified by:

close in interface Provider

findOrCreateAuthenticatedUser

protected UserModel findOrCreateAuthenticatedUser(RealmModel realm,
 KerberosPrincipal kerberosPrincipal)

Called after successful authentication

Parameters:

realm - realm

kerberosPrincipal -

Returns:

user if found or successfully created. Null if user with same username already exists, but is not linked to this provider

importUserToKeycloak

protected UserModel importUserToKeycloak(RealmModel realm,
 KerberosPrincipal kerberosPrincipal)

toString

public String toString()

Overrides:

toString in class Object

decorateUserProfile

public List<AttributeMetadata> decorateUserProfile(String providerId,
 UserProfileMetadata metadata)

Description copied from interface: UserProfileDecorator

Decorates user profile with additional metadata. For instance, metadata attributes, which are available just for your user-storage provider can be added there, so they are available just for the users coming from your provider.

This method is invoked every time a user is being managed through a user profile provider.

Specified by:

decorateUserProfile in interface UserProfileDecorator

Parameters:

providerId - the id of the user storage provider to which the user is associated with

metadata - the current UserProfileMetadata for the current realm

Returns:

a list of attribute metadata.The AttributeMetadata returned from this method overrides any other metadata already set in metadata for a given attribute.

removeUser

public boolean removeUser(RealmModel realm,
 UserModel user)

Description copied from interface: UserRegistrationProvider

Called if user originated from this provider. If a local user is linked to this provider, this method will be called before local storage's removeUser() method is invoked. If you are using an import strategy, and this is a local user linked to this provider, this method will be called before local storage's removeUser() method is invoked. Also, you DO NOT need to remove the imported user. The runtime will handle this for you.

Specified by:

removeUser in interface UserRegistrationProvider

Parameters:

realm - a reference to the realm

user - a reference to the user that is removed

Returns:

true if the user was removed, false otherwise

addUser

public UserModel addUser(RealmModel realm,
 String username)

Description copied from interface: UserRegistrationProvider

All storage providers that implement this interface will be looped through. If this method returns null, then the next storage provider's addUser() method will be called. If no storage providers handle the add, then the user will be created in local storage. Returning null is useful when you want optional support for adding users. For example, our LDAP provider can enable and disable the ability to add users.

Specified by:

addUser in interface UserRegistrationProvider

Parameters:

realm - a reference to the realm

username - a username the created user will be assigned

Returns:

a model of created user