First share of beta version
Mauro Mugnaini
4 years ago
commit
8f72f814e8
@ -0,0 +1,38 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<classpath>
|
||||
<classpathentry excluding="**" kind="src" output="target/classes" path="src/main/resources">
|
||||
<attributes>
|
||||
<attribute name="maven.pomderived" value="true"/>
|
||||
</attributes>
|
||||
</classpathentry>
|
||||
<classpathentry excluding="**" kind="src" output="target/test-classes" path="src/test/resources">
|
||||
<attributes>
|
||||
<attribute name="maven.pomderived" value="true"/>
|
||||
<attribute name="test" value="true"/>
|
||||
</attributes>
|
||||
</classpathentry>
|
||||
<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.8">
|
||||
<attributes>
|
||||
<attribute name="maven.pomderived" value="true"/>
|
||||
</attributes>
|
||||
</classpathentry>
|
||||
<classpathentry kind="con" path="org.eclipse.m2e.MAVEN2_CLASSPATH_CONTAINER">
|
||||
<attributes>
|
||||
<attribute name="maven.pomderived" value="true"/>
|
||||
</attributes>
|
||||
</classpathentry>
|
||||
<classpathentry kind="src" output="target/classes" path="src/main/java">
|
||||
<attributes>
|
||||
<attribute name="optional" value="true"/>
|
||||
<attribute name="maven.pomderived" value="true"/>
|
||||
</attributes>
|
||||
</classpathentry>
|
||||
<classpathentry kind="src" output="target/test-classes" path="src/test/java">
|
||||
<attributes>
|
||||
<attribute name="optional" value="true"/>
|
||||
<attribute name="maven.pomderived" value="true"/>
|
||||
<attribute name="test" value="true"/>
|
||||
</attributes>
|
||||
</classpathentry>
|
||||
<classpathentry kind="output" path="target/classes"/>
|
||||
</classpath>
|
||||
@ -0,0 +1 @@
|
||||
target
|
||||
@ -0,0 +1,23 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<projectDescription>
|
||||
<name>keycloak-d4science-spi</name>
|
||||
<comment></comment>
|
||||
<projects>
|
||||
</projects>
|
||||
<buildSpec>
|
||||
<buildCommand>
|
||||
<name>org.eclipse.jdt.core.javabuilder</name>
|
||||
<arguments>
|
||||
</arguments>
|
||||
</buildCommand>
|
||||
<buildCommand>
|
||||
<name>org.eclipse.m2e.core.maven2Builder</name>
|
||||
<arguments>
|
||||
</arguments>
|
||||
</buildCommand>
|
||||
</buildSpec>
|
||||
<natures>
|
||||
<nature>org.eclipse.jdt.core.javanature</nature>
|
||||
<nature>org.eclipse.m2e.core.maven2Nature</nature>
|
||||
</natures>
|
||||
</projectDescription>
|
||||
@ -0,0 +1,6 @@
|
||||
eclipse.preferences.version=1
|
||||
encoding//src/main/java=UTF-8
|
||||
encoding//src/main/resources=UTF-8
|
||||
encoding//src/test/java=UTF-8
|
||||
encoding//src/test/resources=UTF-8
|
||||
encoding/<project>=UTF-8
|
||||
@ -0,0 +1,8 @@
|
||||
eclipse.preferences.version=1
|
||||
org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.8
|
||||
org.eclipse.jdt.core.compiler.compliance=1.8
|
||||
org.eclipse.jdt.core.compiler.problem.enablePreviewFeatures=disabled
|
||||
org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
|
||||
org.eclipse.jdt.core.compiler.problem.reportPreviewFeatures=ignore
|
||||
org.eclipse.jdt.core.compiler.release=disabled
|
||||
org.eclipse.jdt.core.compiler.source=1.8
|
||||
@ -0,0 +1,4 @@
|
||||
activeProfiles=
|
||||
eclipse.preferences.version=1
|
||||
resolveWorkspaceProjects=true
|
||||
version=1
|
||||
@ -0,0 +1,7 @@
|
||||
# Changelog for "keycloak-extension-spi"
|
||||
|
||||
## [Unreleased]
|
||||
- First release (#TBA)
|
||||
|
||||
|
||||
This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||||
@ -0,0 +1,48 @@
|
||||
# Event Publisher Portal
|
||||
|
||||
**Keycloak D4Science SPI** is a suite classes to extend the [Keycloak](https://www.keycloak.org)'s functionalities via its provided SPI. It contains specific IdP mapper to extract the username from the email address and an LDAP mapper to map user's home attribute. It also contains an event publisher to push JSON events to an orchestrator endpoint.
|
||||
|
||||
## Structure of the project
|
||||
|
||||
The source code is present in `src` folder.
|
||||
|
||||
## Built With
|
||||
|
||||
* [OpenJDK](https://openjdk.java.net/) - The JDK used
|
||||
* [Maven](https://maven.apache.org/) - Dependency Management
|
||||
|
||||
## Documentation
|
||||
|
||||
To build the fat JAR file it is sufficient to type
|
||||
|
||||
mvn clean package
|
||||
|
||||
## Change log
|
||||
|
||||
See [Releases](https://code-repo.d4science.org/gCubeSystem/authorization-client/releases).
|
||||
|
||||
## Authors
|
||||
|
||||
* **Marco Lettere** ([Nubisware S.r.l.](http://www.nubisware.com))
|
||||
* **Mauro Mugnaini** ([Nubisware S.r.l.](http://www.nubisware.com))
|
||||
|
||||
## License
|
||||
|
||||
This project is licensed under the EUPL V.1.1 License - see the [LICENSE.md](LICENSE.md) file for details.
|
||||
|
||||
|
||||
## About the gCube Framework
|
||||
This software is part of the [gCubeFramework](https://www.gcube-system.org/ "gCubeFramework"): an
|
||||
open-source software toolkit used for building and operating Hybrid Data
|
||||
Infrastructures enabling the dynamic deployment of Virtual Research Environments
|
||||
by favouring the realisation of reuse oriented policies.
|
||||
|
||||
The projects leading to this software have received funding from a series of European Union programmes including:
|
||||
|
||||
- the Sixth Framework Programme for Research and Technological Development
|
||||
- DILIGENT (grant no. 004260);
|
||||
- the Seventh Framework Programme for research, technological development and demonstration
|
||||
- D4Science (grant no. 212488), D4Science-II (grant no.239019), ENVRI (grant no. 283465), EUBrazilOpenBio (grant no. 288754), iMarine(grant no. 283644);
|
||||
- the H2020 research and innovation programme
|
||||
- BlueBRIDGE (grant no. 675680), EGIEngage (grant no. 654142), ENVRIplus (grant no. 654182), Parthenos (grant no. 654119), SoBigData (grant no. 654024),DESIRA (grant no. 818194), ARIADNEplus (grant no. 823914), RISIS2 (grant no. 824091), PerformFish (grant no. 727610), AGINFRAplus (grant no. 731001);
|
||||
|
||||
@ -0,0 +1,32 @@
|
||||
<assembly
|
||||
xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0 http://maven.apache.org/xsd/assembly-1.1.0.xsd">
|
||||
|
||||
<id>servicearchive</id>
|
||||
<formats>
|
||||
<format>tar.gz</format>
|
||||
</formats>
|
||||
<baseDirectory>/</baseDirectory>
|
||||
<fileSets>
|
||||
<fileSet>
|
||||
<directory>.</directory>
|
||||
<outputDirectory>${file.separator}</outputDirectory>
|
||||
<useDefaultExcludes>true</useDefaultExcludes>
|
||||
<includes>
|
||||
<include>README.md</include>
|
||||
<include>LICENSE.md</include>
|
||||
<include>CHANGELOG.md</include>
|
||||
<include>profile.xml</include>
|
||||
</includes>
|
||||
<fileMode>755</fileMode>
|
||||
<filtered>true</filtered>
|
||||
</fileSet>
|
||||
</fileSets>
|
||||
<files>
|
||||
<file>
|
||||
<source>target${file.separator}${build.finalName}.${project.packaging}</source>
|
||||
<outputDirectory>${file.separator}${artifactId}</outputDirectory>
|
||||
</file>
|
||||
</files>
|
||||
</assembly>
|
||||
@ -0,0 +1,136 @@
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<parent>
|
||||
<artifactId>maven-parent</artifactId>
|
||||
<groupId>org.gcube.tools</groupId>
|
||||
<version>1.1.0</version>
|
||||
<relativePath />
|
||||
</parent>
|
||||
|
||||
<groupId>org.gcube</groupId>
|
||||
<artifactId>keycloak-d4science-spi</artifactId>
|
||||
<version>0.0.1-SNAPSHOT</version>
|
||||
<packaging>jar</packaging>
|
||||
|
||||
<properties>
|
||||
<keycloak-version>10.0.2</keycloak-version>
|
||||
<jboss.logging.version>3.4.1.Final</jboss.logging.version>
|
||||
</properties>
|
||||
|
||||
<dependencyManagement>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.gcube.distribution</groupId>
|
||||
<artifactId>maven-portal-bom</artifactId>
|
||||
<version>3.6.0</version>
|
||||
<type>pom</type>
|
||||
<scope>import</scope>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
</dependencyManagement>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.gcube.common</groupId>
|
||||
<artifactId>event-publisher-library</artifactId>
|
||||
<version>[1.0.0-SNAPSHOT, 2.0.0-SNAPSHOT)</version>
|
||||
<scope>compile</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.googlecode.json-simple</groupId>
|
||||
<artifactId>json-simple</artifactId>
|
||||
<scope>compile</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.slf4j</groupId>
|
||||
<artifactId>slf4j-api</artifactId>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<!-- <dependency> -->
|
||||
<!-- <groupId>org.jboss.slf4j</groupId> -->
|
||||
<!-- <artifactId>slf4j-jboss-logging</artifactId> -->
|
||||
<!-- <version>1.2.0.Final</version> -->
|
||||
<!-- <scope>runtime</scope> -->
|
||||
<!-- </dependency> -->
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-core</artifactId>
|
||||
<version>${keycloak-version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-server-spi</artifactId>
|
||||
<version>${keycloak-version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-server-spi-private</artifactId>
|
||||
<version>${keycloak-version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-services</artifactId>
|
||||
<version>${keycloak-version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-ldap-federation</artifactId>
|
||||
<version>${keycloak-version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.logging</groupId>
|
||||
<artifactId>jboss-logging</artifactId>
|
||||
<version>${jboss.logging.version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-compiler-plugin</artifactId>
|
||||
<configuration>
|
||||
<source>${maven.compiler.source}</source>
|
||||
<target>${maven.compiler.target}</target>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-assembly-plugin</artifactId>
|
||||
|
||||
<configuration>
|
||||
<descriptorRefs>
|
||||
<descriptorRef>jar-with-dependencies</descriptorRef>
|
||||
</descriptorRefs>
|
||||
</configuration>
|
||||
|
||||
<executions>
|
||||
<execution>
|
||||
<id>make-assembly</id>
|
||||
<phase>package</phase>
|
||||
<goals>
|
||||
<goal>single</goal>
|
||||
</goals>
|
||||
</execution>
|
||||
</executions>
|
||||
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</project>
|
||||
@ -0,0 +1,25 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<Resource xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
||||
<ID></ID>
|
||||
<Type>Portlet</Type>
|
||||
<Profile>
|
||||
<Description>${project.description}</Description>
|
||||
<Class>PortletUser</Class>
|
||||
<Name>${project.artifactId}</Name>
|
||||
<Version>1.0.0</Version>
|
||||
<Packages>
|
||||
<Software>
|
||||
<Name>${project.artifactId}</Name>
|
||||
<Description>${project.description}</Description>
|
||||
<MavenCoordinates>
|
||||
<groupId>${project.groupId}</groupId>
|
||||
<artifactId>${project.artifactId}</artifactId>
|
||||
<version>${project.version}</version>
|
||||
</MavenCoordinates>
|
||||
<Files>
|
||||
<File>${project.build.finalName}.${project.packaging}</File>
|
||||
</Files>
|
||||
</Software>
|
||||
</Packages>
|
||||
</Profile>
|
||||
</Resource>
|
||||
@ -0,0 +1,18 @@
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-assembly-plugin</artifactId>
|
||||
<configuration>
|
||||
<descriptors>
|
||||
<descriptor>descriptor.xml</descriptor>
|
||||
</descriptors>
|
||||
</configuration>
|
||||
<executions>
|
||||
<execution>
|
||||
<id>servicearchive</id>
|
||||
<phase>install</phase>
|
||||
<goals>
|
||||
<goal>single</goal>
|
||||
</goals>
|
||||
</execution>
|
||||
</executions>
|
||||
</plugin>
|
||||
@ -0,0 +1,218 @@
|
||||
package org.gcube.keycloak.broker.oidc.mappers;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Collections;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
import org.jboss.logging.Logger;
|
||||
import org.keycloak.broker.oidc.KeycloakOIDCIdentityProviderFactory;
|
||||
import org.keycloak.broker.oidc.OIDCIdentityProviderFactory;
|
||||
import org.keycloak.broker.oidc.mappers.AbstractClaimMapper;
|
||||
import org.keycloak.broker.provider.BrokeredIdentityContext;
|
||||
import org.keycloak.models.IdentityProviderMapperModel;
|
||||
import org.keycloak.models.IdentityProviderSyncMode;
|
||||
import org.keycloak.models.KeycloakSession;
|
||||
import org.keycloak.models.RealmModel;
|
||||
import org.keycloak.models.UserModel;
|
||||
import org.keycloak.models.utils.KeycloakModelUtils;
|
||||
import org.keycloak.provider.ProviderConfigProperty;
|
||||
import org.keycloak.provider.ProviderConfigurationBuilder;
|
||||
import org.keycloak.social.bitbucket.BitbucketIdentityProviderFactory;
|
||||
import org.keycloak.social.facebook.FacebookIdentityProviderFactory;
|
||||
import org.keycloak.social.github.GitHubIdentityProviderFactory;
|
||||
import org.keycloak.social.gitlab.GitLabIdentityProviderFactory;
|
||||
import org.keycloak.social.google.GoogleIdentityProviderFactory;
|
||||
import org.keycloak.social.instagram.InstagramIdentityProviderFactory;
|
||||
import org.keycloak.social.linkedin.LinkedInIdentityProviderFactory;
|
||||
import org.keycloak.social.microsoft.MicrosoftIdentityProviderFactory;
|
||||
import org.keycloak.social.openshift.OpenshiftV3IdentityProviderFactory;
|
||||
import org.keycloak.social.openshift.OpenshiftV4IdentityProviderFactory;
|
||||
import org.keycloak.social.paypal.PayPalIdentityProviderFactory;
|
||||
import org.keycloak.social.stackoverflow.StackoverflowIdentityProviderFactory;
|
||||
import org.keycloak.social.twitter.TwitterIdentityProviderFactory;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:mauro.mugnaini@nubisware.com">Mauro Mugnaini</a>
|
||||
*/
|
||||
public class UsernameFromMailMapper extends AbstractClaimMapper {
|
||||
|
||||
private static final Logger logger = Logger.getLogger(UsernameFromMailMapper.class);
|
||||
|
||||
private static final Character PERIOD = '.';
|
||||
private static final Character DASH = '-';
|
||||
private static final String CYRUS = "cyrus";
|
||||
private static final String POSTFIX = "postfix";
|
||||
private static final String COMMA = ",";
|
||||
|
||||
public static final String[] COMPATIBLE_PROVIDERS = {
|
||||
KeycloakOIDCIdentityProviderFactory.PROVIDER_ID,
|
||||
OIDCIdentityProviderFactory.PROVIDER_ID,
|
||||
BitbucketIdentityProviderFactory.PROVIDER_ID,
|
||||
FacebookIdentityProviderFactory.PROVIDER_ID,
|
||||
GitHubIdentityProviderFactory.PROVIDER_ID,
|
||||
GitLabIdentityProviderFactory.PROVIDER_ID,
|
||||
GoogleIdentityProviderFactory.PROVIDER_ID,
|
||||
InstagramIdentityProviderFactory.PROVIDER_ID,
|
||||
LinkedInIdentityProviderFactory.PROVIDER_ID,
|
||||
MicrosoftIdentityProviderFactory.PROVIDER_ID,
|
||||
OpenshiftV3IdentityProviderFactory.PROVIDER_ID,
|
||||
OpenshiftV4IdentityProviderFactory.PROVIDER_ID,
|
||||
PayPalIdentityProviderFactory.PROVIDER_ID,
|
||||
StackoverflowIdentityProviderFactory.PROVIDER_ID,
|
||||
TwitterIdentityProviderFactory.PROVIDER_ID
|
||||
};
|
||||
|
||||
private static final List<ProviderConfigProperty> configProperties;
|
||||
private static final Set<IdentityProviderSyncMode> IDENTITY_PROVIDER_SYNC_MODES = new HashSet<>(
|
||||
Arrays.asList(IdentityProviderSyncMode.values()));
|
||||
|
||||
public static final String RESERVED_USERNAMES = "reserved-usernames";
|
||||
public static final String AUTO_RESOLVE_CONFLICT = "auto-resolve";
|
||||
|
||||
static {
|
||||
configProperties = ProviderConfigurationBuilder.create().property().name(RESERVED_USERNAMES)
|
||||
.label("Reserved Usernames")
|
||||
.helpText("List of reserved usernames (comma separated) that cannot be accepted. "
|
||||
+ "If found a progressive suffix number will we added.")
|
||||
.type(ProviderConfigProperty.STRING_TYPE).defaultValue(CYRUS + COMMA + POSTFIX)
|
||||
.add().property().name(AUTO_RESOLVE_CONFLICT).label("Auto resolve conflicts")
|
||||
.helpText("Automatically add a numeric suffix to avoid already existing username conflict.")
|
||||
.type(ProviderConfigProperty.BOOLEAN_TYPE).add().build();
|
||||
}
|
||||
|
||||
public static final String PROVIDER_ID = "username-from-idp-email-mapper";
|
||||
|
||||
@Override
|
||||
public boolean supportsSyncMode(IdentityProviderSyncMode syncMode) {
|
||||
return IDENTITY_PROVIDER_SYNC_MODES.contains(syncMode);
|
||||
}
|
||||
|
||||
@Override
|
||||
public List<ProviderConfigProperty> getConfigProperties() {
|
||||
return configProperties;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getId() {
|
||||
return PROVIDER_ID;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String[] getCompatibleProviders() {
|
||||
return COMPATIBLE_PROVIDERS;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getDisplayCategory() {
|
||||
return "Preprocessor";
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getDisplayType() {
|
||||
return "Username from email importer";
|
||||
}
|
||||
|
||||
@Override
|
||||
public void updateBrokeredUserLegacy(KeycloakSession session, RealmModel realm, UserModel user,
|
||||
IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user,
|
||||
IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
|
||||
|
||||
// preprocessFederatedIdentity gets called anyways, so we only need to set the username if necessary.
|
||||
// However, we don't want to set the username when the email is used as username
|
||||
if (!realm.isRegistrationEmailAsUsername()) {
|
||||
user.setUsername(context.getModelUsername());
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void preprocessFederatedIdentity(KeycloakSession session, RealmModel realm,
|
||||
IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
|
||||
|
||||
Set<String> reservedUsernames = getConfigValuesOrEmptySetIfNullOrEmptyString(
|
||||
mapperModel.getConfig().get(RESERVED_USERNAMES));
|
||||
|
||||
logger.debugf("Reserved usernames are: %s", reservedUsernames);
|
||||
|
||||
boolean autoResolveConflicts = Boolean.valueOf(mapperModel.getConfig().get(AUTO_RESOLVE_CONFLICT));
|
||||
logger.debugf("Auto resolve conflict setting is: %b", autoResolveConflicts);
|
||||
|
||||
String email = context.getEmail();
|
||||
logger.debugf("Email address is: " + email);
|
||||
|
||||
String username = email.substring(0, email.indexOf('@')).toLowerCase();
|
||||
logger.debugf("Extracted raw username is: %s", username);
|
||||
|
||||
for (Character c : username.chars().mapToObj(e -> (char) e).collect(Collectors.toSet())) {
|
||||
if (!isChar(c) && !isDigit(c) && (c != DASH) && (c != PERIOD)) {
|
||||
logger.infof("Replacing unneded char (%c) with %c", c, PERIOD);
|
||||
username = username.replace(c, PERIOD);
|
||||
}
|
||||
}
|
||||
|
||||
boolean usernameAlreadyExists = usernameAlreadyExists(session, realm, username);
|
||||
if ((usernameAlreadyExists && autoResolveConflicts)
|
||||
|| reservedUsernames.contains(username)) {
|
||||
|
||||
if (usernameAlreadyExists) {
|
||||
logger.infof("Username already exists: %s", username);
|
||||
} else {
|
||||
logger.info("Username is one of the reserved usernames");
|
||||
}
|
||||
|
||||
for (int i = 1;; i++) {
|
||||
String tempUsername = username + PERIOD + i;
|
||||
logger.tracef("Trying with username: %s", tempUsername);
|
||||
if (usernameAlreadyExists(session, realm, tempUsername)) {
|
||||
logger.tracef("Username already exists: %s", tempUsername);
|
||||
} else {
|
||||
logger.tracef("Username is OK: %s", tempUsername);
|
||||
username = tempUsername;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
logger.infof("Final computed username is: %s", username);
|
||||
context.setModelUsername(username);
|
||||
}
|
||||
|
||||
private static boolean isChar(char c) {
|
||||
return (((c >= 'a') && (c <= 'z')) || ((c >= 'A') && (c <= 'Z')));
|
||||
}
|
||||
|
||||
private static boolean isDigit(char c) {
|
||||
return ((c >= '0') && (c <= '9'));
|
||||
}
|
||||
|
||||
private boolean usernameAlreadyExists(KeycloakSession session, RealmModel realm, String username) {
|
||||
return KeycloakModelUtils.findUserByNameOrEmail(session, realm, username) != null;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHelpText() {
|
||||
return "Extract the IdP username from the e-mail address (before the '@' char).";
|
||||
}
|
||||
|
||||
protected Set<String> getConfigValuesOrEmptySetIfNullOrEmptyString(String str) {
|
||||
if (str == null || "".equals(str)) {
|
||||
return Collections.emptySet();
|
||||
} else {
|
||||
String[] objClasses = str.split(COMMA);
|
||||
Set<String> trimmed = new HashSet<>();
|
||||
for (String objectClass : objClasses) {
|
||||
objectClass = objectClass.trim();
|
||||
if (objectClass.length() > 0) {
|
||||
trimmed.add(objectClass);
|
||||
}
|
||||
}
|
||||
return trimmed;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,110 @@
|
||||
package org.gcube.keycloak.event;
|
||||
|
||||
import java.time.Instant;
|
||||
import java.time.OffsetDateTime;
|
||||
import java.time.ZoneOffset;
|
||||
import java.util.Map;
|
||||
|
||||
import org.gcube.event.publisher.Event;
|
||||
import org.keycloak.events.admin.AdminEvent;
|
||||
|
||||
public class KeycloakEvent extends Event {
|
||||
|
||||
private static final long serialVersionUID = 4072256389444123291L;
|
||||
|
||||
public static final String TYPE = "keycloak";
|
||||
public static final String REALM = "realm";
|
||||
public static final String USER = "user";
|
||||
public static final String CLIENT = "client";
|
||||
public static final String RESOURCE = "resource";
|
||||
public static final String RESOURCE_TYPE = "resource-type";
|
||||
public static final String OPERATION = "operation";
|
||||
|
||||
public static final String ADMIN_NAME = "ADMIN";
|
||||
|
||||
public KeycloakEvent(String name, String sender, String realm) {
|
||||
this(name, sender, realm, null);
|
||||
}
|
||||
|
||||
public KeycloakEvent(String name, String sender, String realm, Map<String, String> data) {
|
||||
super(name, TYPE, sender, data);
|
||||
setRealm(realm);
|
||||
}
|
||||
|
||||
public static KeycloakEvent newKeycloakEvent(org.keycloak.events.Event event) {
|
||||
KeycloakEvent keycloakEvent = new KeycloakEvent(event.getType().name(), event.getIpAddress(),
|
||||
event.getRealmId(), event.getDetails());
|
||||
|
||||
// Overriding the timestamp setting it equal to the event time
|
||||
keycloakEvent.setTimestamp(convertEventDate(event.getTime()));
|
||||
|
||||
keycloakEvent.setClient(event.getClientId());
|
||||
keycloakEvent.setUser(event.getUserId());
|
||||
return keycloakEvent;
|
||||
}
|
||||
|
||||
public static KeycloakEvent newKeycloakAdminEvent(AdminEvent adminEvent) {
|
||||
KeycloakEvent keycloakEvent = new KeycloakEvent(ADMIN_NAME, adminEvent.getResourcePath(),
|
||||
adminEvent.getRealmId());
|
||||
|
||||
// Overriding the timestamp setting it equal to the event time
|
||||
keycloakEvent.setTimestamp(convertEventDate(adminEvent.getTime()));
|
||||
keycloakEvent.setResource(adminEvent.getResourcePath());
|
||||
keycloakEvent.setResourceType(adminEvent.getResourceTypeAsString());
|
||||
keycloakEvent.setOperation(adminEvent.getOperationType().name());
|
||||
return keycloakEvent;
|
||||
}
|
||||
|
||||
private static OffsetDateTime convertEventDate(long millis) {
|
||||
OrchestratorEventPublisherProvider.logger.infof("Creating offset date time from millis: %l", millis);
|
||||
return Instant.ofEpochMilli(millis).atZone(ZoneOffset.systemDefault()).toOffsetDateTime();
|
||||
}
|
||||
|
||||
public void setRealm(String realm) {
|
||||
set(REALM, realm);
|
||||
}
|
||||
|
||||
public String getRealm() {
|
||||
return (String) get(REALM);
|
||||
}
|
||||
|
||||
public void setUser(String user) {
|
||||
set(USER, user);
|
||||
}
|
||||
|
||||
public String getUser() {
|
||||
return (String) get(USER);
|
||||
}
|
||||
|
||||
public void setClient(String client) {
|
||||
set(CLIENT, client);
|
||||
}
|
||||
|
||||
public String getClient() {
|
||||
return (String) get(CLIENT);
|
||||
}
|
||||
|
||||
public void setResource(String resource) {
|
||||
set(RESOURCE, resource);
|
||||
}
|
||||
|
||||
public String getResource() {
|
||||
return (String) get(RESOURCE);
|
||||
}
|
||||
|
||||
public void setResourceType(String resourceType) {
|
||||
set(RESOURCE_TYPE, resourceType);
|
||||
}
|
||||
|
||||
public String getResourceType() {
|
||||
return (String) get(RESOURCE_TYPE);
|
||||
}
|
||||
|
||||
public void setOperation(String operation) {
|
||||
set(OPERATION, operation);
|
||||
}
|
||||
|
||||
public String getOperation() {
|
||||
return (String) get(OPERATION);
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,59 @@
|
||||
package org.gcube.keycloak.event;
|
||||
|
||||
import java.util.EventListener;
|
||||
|
||||
import org.gcube.event.publisher.AbstractEventPublisher;
|
||||
import org.gcube.event.publisher.EventSender;
|
||||
import org.gcube.event.publisher.HTTPWithUMAAuthEventSender;
|
||||
import org.jboss.logging.Logger;
|
||||
import org.keycloak.events.Event;
|
||||
import org.keycloak.events.EventListenerProvider;
|
||||
import org.keycloak.events.admin.AdminEvent;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:marco.lettere@nubisware.com">Marco Lettere</a>
|
||||
* @author <a href="mailto:mauro.mugnaini@nubisware.com">Mauro Mugnaini</a>
|
||||
*/
|
||||
public class OrchestratorEventPublisherProvider extends AbstractEventPublisher
|
||||
implements EventListenerProvider, EventListener {
|
||||
|
||||
public static final Logger logger = Logger.getLogger(OrchestratorEventPublisherProvider.class);
|
||||
|
||||
public OrchestratorEventPublisherProvider() {
|
||||
super();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void close() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void onEvent(Event event) {
|
||||
if (event.getError() != null) {
|
||||
logger.debug("Skipping error event publish");
|
||||
return;
|
||||
}
|
||||
logger.debug("Publishing new event to orchestrator");
|
||||
publish(KeycloakEvent.newKeycloakEvent(event));
|
||||
}
|
||||
|
||||
@Override
|
||||
public void onEvent(AdminEvent event, boolean includeRepresentation) {
|
||||
if (event.getError() != null) {
|
||||
logger.debug("Skipping error admin event publish");
|
||||
return;
|
||||
}
|
||||
logger.debug("Publishing new admin event to orchestrator");
|
||||
publish(KeycloakEvent.newKeycloakAdminEvent(event));
|
||||
}
|
||||
|
||||
@Override
|
||||
protected EventSender createEventSender() {
|
||||
logger.infof("Creating the HTTP event sender with endpoint: %s",
|
||||
OrchestratorEventPublisherProviderFactory.endpoint);
|
||||
|
||||
return new HTTPWithUMAAuthEventSender(OrchestratorEventPublisherProviderFactory.endpoint, null, null, null,
|
||||
null);
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,70 @@
|
||||
package org.gcube.keycloak.event;
|
||||
|
||||
import java.net.MalformedURLException;
|
||||
import java.net.URL;
|
||||
|
||||
import org.jboss.logging.Logger;
|
||||
import org.keycloak.Config.Scope;
|
||||
import org.keycloak.events.EventListenerProvider;
|
||||
import org.keycloak.events.EventListenerProviderFactory;
|
||||
import org.keycloak.models.KeycloakSession;
|
||||
import org.keycloak.models.KeycloakSessionFactory;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:marco.lettere@nubisware.com">Marco Lettere</a>
|
||||
* @author <a href="mailto:mauro.mugnaini@nubisware.com">Mauro Mugnaini</a>
|
||||
*/
|
||||
public class OrchestratorEventPublisherProviderFactory implements EventListenerProviderFactory {
|
||||
|
||||
public static final String REALM_NAME = "d4science";
|
||||
public static final String ORCHESTRATOR_CLIENT_ID = "orchestrator";
|
||||
|
||||
private static final Logger logger = Logger.getLogger(OrchestratorEventPublisherProviderFactory.class);
|
||||
|
||||
public static URL endpoint;
|
||||
protected OrchestratorEventPublisherProvider oepp;
|
||||
|
||||
public OrchestratorEventPublisherProviderFactory() {
|
||||
logger.info("New OrchestratorEventPublisherProviderFactory has been created");
|
||||
}
|
||||
|
||||
@Override
|
||||
public void close() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public EventListenerProvider create(KeycloakSession keycloakSession) {
|
||||
logger.debugf("Getting configured endpoint address for client '%s' in realm '%s'", ORCHESTRATOR_CLIENT_ID,
|
||||
REALM_NAME);
|
||||
|
||||
String address = keycloakSession.realms().getRealmByName(REALM_NAME).getClientByClientId(ORCHESTRATOR_CLIENT_ID)
|
||||
.getBaseUrl();
|
||||
try {
|
||||
URL newEndpoint = new URL(address);
|
||||
if (oepp == null || !newEndpoint.equals(endpoint)) {
|
||||
logger.infof("Creating new orchestrator event publisher provider for endpoint: %s", address);
|
||||
OrchestratorEventPublisherProviderFactory.endpoint = newEndpoint;
|
||||
// Endpoint address will be read from 'address' static field in this class
|
||||
oepp = new OrchestratorEventPublisherProvider();
|
||||
}
|
||||
} catch (MalformedURLException e) {
|
||||
logger.error("Can't create new orchestrator event publisher provider with endpoint address: " + address, e);
|
||||
oepp = null;
|
||||
}
|
||||
return oepp;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getId() {
|
||||
return "orchestrator-event-publisher";
|
||||
}
|
||||
|
||||
@Override
|
||||
public void init(Scope scope) {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void postInit(KeycloakSessionFactory keycloakSessionFactory) {
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,262 @@
|
||||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.gcube.keycloak.storage.ldap.mappers;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.LinkedHashSet;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
import java.util.regex.Matcher;
|
||||
import java.util.regex.Pattern;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
import org.jboss.logging.Logger;
|
||||
import org.keycloak.component.ComponentModel;
|
||||
import org.keycloak.models.KeycloakSession;
|
||||
import org.keycloak.models.LDAPConstants;
|
||||
import org.keycloak.models.ModelDuplicateException;
|
||||
import org.keycloak.models.ModelException;
|
||||
import org.keycloak.models.RealmModel;
|
||||
import org.keycloak.models.UserModel;
|
||||
import org.keycloak.models.utils.KeycloakModelUtils;
|
||||
import org.keycloak.models.utils.reflection.Property;
|
||||
import org.keycloak.storage.ldap.LDAPStorageProvider;
|
||||
import org.keycloak.storage.ldap.LDAPUtils;
|
||||
import org.keycloak.storage.ldap.idm.model.LDAPObject;
|
||||
import org.keycloak.storage.ldap.idm.query.internal.LDAPQuery;
|
||||
import org.keycloak.storage.ldap.mappers.AbstractLDAPStorageMapper;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
|
||||
*/
|
||||
public class UserAttributeTemplatedLDAPStorageMapper extends AbstractLDAPStorageMapper {
|
||||
|
||||
private static final Logger logger = Logger.getLogger(UserAttributeTemplatedLDAPStorageMapper.class);
|
||||
|
||||
private static final Map<String, Property<Object>> userModelProperties = LDAPUtils.getUserModelProperties();
|
||||
|
||||
public static final String TEMPLATE_ATTRIBUTE = "template.string";
|
||||
public static final String USER_MODEL_ATTRIBUTE = "user.model.attribute";
|
||||
public static final String LDAP_ATTRIBUTE = "ldap.attribute";
|
||||
public static final String READ_ONLY = "read.only";
|
||||
public static final String ALWAYS_READ_VALUE_FROM_LDAP = "always.read.value.from.ldap";
|
||||
public static final String IS_MANDATORY_IN_LDAP = "is.mandatory.in.ldap";
|
||||
|
||||
public UserAttributeTemplatedLDAPStorageMapper(ComponentModel mapperModel, LDAPStorageProvider ldapProvider) {
|
||||
super(mapperModel, ldapProvider);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void onImportUserFromLDAP(LDAPObject ldapUser, UserModel user, RealmModel realm, boolean isCreate) {
|
||||
String userModelAttrName = getUserModelAttribute();
|
||||
String ldapAttrName = getLdapAttributeName();
|
||||
|
||||
Property<Object> userModelProperty = userModelProperties.get(userModelAttrName.toLowerCase());
|
||||
|
||||
if (userModelProperty != null) {
|
||||
|
||||
// we have java property on UserModel
|
||||
String ldapAttrValue = ldapUser.getAttributeAsString(ldapAttrName);
|
||||
|
||||
checkDuplicateEmail(userModelAttrName, ldapAttrValue, realm, ldapProvider.getSession(), user);
|
||||
|
||||
setPropertyOnUserModel(userModelProperty, user, ldapAttrValue);
|
||||
} else {
|
||||
|
||||
// we don't have java property. Let's set attribute
|
||||
Set<String> ldapAttrValue = ldapUser.getAttributeAsSet(ldapAttrName);
|
||||
if (ldapAttrValue != null) {
|
||||
user.setAttribute(userModelAttrName, new ArrayList<>(ldapAttrValue));
|
||||
} else {
|
||||
user.removeAttribute(userModelAttrName);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static final String VALUE = "VALUE";
|
||||
public static final String ATTRIBUTE_VALUE = "${" + VALUE + "}";
|
||||
|
||||
public static Pattern substitution = Pattern.compile("\\$\\{([^}]+)\\}");
|
||||
|
||||
protected String computeAttributeValue(String template, String value) {
|
||||
Matcher matcher = substitution.matcher(template);
|
||||
StringBuffer sb = new StringBuffer();
|
||||
|
||||
while (matcher.find()) {
|
||||
String token = matcher.group(1);
|
||||
if (token.equals(VALUE)) {
|
||||
matcher.appendReplacement(sb, value);
|
||||
} else {
|
||||
matcher.appendReplacement(sb, token);
|
||||
}
|
||||
}
|
||||
|
||||
matcher.appendTail(sb);
|
||||
|
||||
return sb.toString();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void onRegisterUserToLDAP(LDAPObject ldapUser, UserModel localUser, RealmModel realm) {
|
||||
String template = getTemplate();
|
||||
String userModelAttrName = getUserModelAttribute();
|
||||
String ldapAttrName = getLdapAttributeName();
|
||||
boolean isMandatoryInLdap = parseBooleanParameter(mapperModel, IS_MANDATORY_IN_LDAP);
|
||||
|
||||
Property<Object> userModelProperty = userModelProperties.get(userModelAttrName.toLowerCase());
|
||||
|
||||
if (userModelProperty != null) {
|
||||
|
||||
// we have java property on UserModel. Assuming we support just properties of simple types
|
||||
Object attrValue = userModelProperty.getValue(localUser);
|
||||
|
||||
if (attrValue == null) {
|
||||
if (isMandatoryInLdap) {
|
||||
ldapUser.setSingleAttribute(ldapAttrName, LDAPConstants.EMPTY_ATTRIBUTE_VALUE);
|
||||
} else {
|
||||
ldapUser.setAttribute(ldapAttrName, new LinkedHashSet<String>());
|
||||
}
|
||||
} else {
|
||||
ldapUser.setSingleAttribute(ldapAttrName, computeAttributeValue(template, attrValue.toString()));
|
||||
}
|
||||
} else {
|
||||
|
||||
// we don't have java property. Let's set attribute
|
||||
List<String> attrValues = localUser.getAttribute(userModelAttrName);
|
||||
|
||||
if (attrValues.size() == 0) {
|
||||
if (isMandatoryInLdap) {
|
||||
ldapUser.setSingleAttribute(ldapAttrName, LDAPConstants.EMPTY_ATTRIBUTE_VALUE);
|
||||
} else {
|
||||
ldapUser.setAttribute(ldapAttrName, new LinkedHashSet<String>());
|
||||
}
|
||||
} else {
|
||||
UserAttributeTemplatedLDAPStorageMapper.logger
|
||||
.trace("Computing value from template for all the elements in the list");
|
||||
|
||||
List<String> newList = attrValues.stream().map(e -> computeAttributeValue(template, e))
|
||||
.collect(Collectors.toList());
|
||||
|
||||
ldapUser.setAttribute(ldapAttrName, new LinkedHashSet<>(newList));
|
||||
}
|
||||
}
|
||||
|
||||
if (isReadOnly()) {
|
||||
ldapUser.addReadOnlyAttributeName(ldapAttrName);
|
||||
}
|
||||
}
|
||||
|
||||
// throw ModelDuplicateException if there is different user in model with same email
|
||||
protected void checkDuplicateEmail(String userModelAttrName, String email, RealmModel realm,
|
||||
KeycloakSession session, UserModel user) {
|
||||
if (email == null || realm.isDuplicateEmailsAllowed())
|
||||
return;
|
||||
if (UserModel.EMAIL.equalsIgnoreCase(userModelAttrName)) {
|
||||
// lowercase before search
|
||||
email = KeycloakModelUtils.toLowerCaseSafe(email);
|
||||
|
||||
UserModel that = session.userLocalStorage().getUserByEmail(email, realm);
|
||||
if (that != null && !that.getId().equals(user.getId())) {
|
||||
session.getTransactionManager().setRollbackOnly();
|
||||
String exceptionMessage = String.format(
|
||||
"Can't import user '%s' from LDAP because email '%s' already exists in Keycloak. Existing user with this email is '%s'",
|
||||
user.getUsername(), email, that.getUsername());
|
||||
throw new ModelDuplicateException(exceptionMessage, UserModel.EMAIL);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
protected void checkDuplicateUsername(String userModelAttrName, String username, RealmModel realm,
|
||||
KeycloakSession session, UserModel user) {
|
||||
// only if working in USERNAME attribute
|
||||
if (UserModel.USERNAME.equalsIgnoreCase(userModelAttrName)) {
|
||||
if (username == null || username.isEmpty()) {
|
||||
throw new ModelException("Cannot set an empty username");
|
||||
}
|
||||
boolean usernameChanged = !username.equals(user.getUsername());
|
||||
if (realm.isEditUsernameAllowed() && usernameChanged) {
|
||||
UserModel that = session.users().getUserByUsername(username, realm);
|
||||
if (that != null && !that.getId().equals(user.getId())) {
|
||||
throw new ModelDuplicateException(
|
||||
String.format(
|
||||
"Cannot change the username to '%s' because the username already exists in keycloak",
|
||||
username),
|
||||
UserModel.USERNAME);
|
||||
}
|
||||
} else if (usernameChanged) {
|
||||
throw new ModelException(
|
||||
"Cannot change username if the realm is not configured to allow edit the usernames");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public UserModel proxy(final LDAPObject ldapUser, UserModel delegate, RealmModel realm) {
|
||||
// Don't update attribute in LDAP later. It's supposed to be written just at registration time
|
||||
String ldapAttrName = mapperModel.get(LDAP_ATTRIBUTE);
|
||||
ldapUser.addReadOnlyAttributeName(ldapAttrName);
|
||||
|
||||
return delegate;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void beforeLDAPQuery(LDAPQuery query) {
|
||||
String ldapAttrName = getLdapAttributeName();
|
||||
|
||||
// Add mapped attribute to returning ldap attributes
|
||||
query.addReturningLdapAttribute(ldapAttrName);
|
||||
if (isReadOnly()) {
|
||||
query.addReturningReadOnlyLdapAttribute(ldapAttrName);
|
||||
}
|
||||
}
|
||||
|
||||
private String getTemplate() {
|
||||
return mapperModel.getConfig().getFirst(TEMPLATE_ATTRIBUTE);
|
||||
}
|
||||
|
||||
private String getUserModelAttribute() {
|
||||
return mapperModel.getConfig().getFirst(USER_MODEL_ATTRIBUTE);
|
||||
}
|
||||
|
||||
String getLdapAttributeName() {
|
||||
return mapperModel.getConfig().getFirst(LDAP_ATTRIBUTE);
|
||||
}
|
||||
|
||||
private boolean isReadOnly() {
|
||||
return parseBooleanParameter(mapperModel, READ_ONLY);
|
||||
}
|
||||
|
||||
protected void setPropertyOnUserModel(Property<Object> userModelProperty, UserModel user, String ldapAttrValue) {
|
||||
if (ldapAttrValue == null) {
|
||||
userModelProperty.setValue(user, null);
|
||||
} else {
|
||||
Class<Object> clazz = userModelProperty.getJavaClass();
|
||||
|
||||
if (String.class.equals(clazz)) {
|
||||
userModelProperty.setValue(user, ldapAttrValue);
|
||||
} else if (Boolean.class.equals(clazz) || boolean.class.equals(clazz)) {
|
||||
Boolean boolVal = Boolean.valueOf(ldapAttrValue);
|
||||
userModelProperty.setValue(user, boolVal);
|
||||
} else {
|
||||
logger.warnf("Don't know how to set the property '%s' on user '%s' . Value of LDAP attribute is '%s' ",
|
||||
userModelProperty.getName(), user.getUsername(), ldapAttrValue.toString());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,142 @@
|
||||
/*
|
||||
* Copyright 2016 Red Hat, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.gcube.keycloak.storage.ldap.mappers;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
import org.keycloak.component.ComponentModel;
|
||||
import org.keycloak.component.ComponentValidationException;
|
||||
import org.keycloak.models.KeycloakSession;
|
||||
import org.keycloak.models.RealmModel;
|
||||
import org.keycloak.provider.ProviderConfigProperty;
|
||||
import org.keycloak.provider.ProviderConfigurationBuilder;
|
||||
import org.keycloak.storage.UserStorageProvider;
|
||||
import org.keycloak.storage.UserStorageProviderModel;
|
||||
import org.keycloak.storage.ldap.LDAPConfig;
|
||||
import org.keycloak.storage.ldap.LDAPStorageProvider;
|
||||
import org.keycloak.storage.ldap.mappers.AbstractLDAPStorageMapper;
|
||||
import org.keycloak.storage.ldap.mappers.AbstractLDAPStorageMapperFactory;
|
||||
import org.keycloak.storage.ldap.mappers.LDAPConfigDecorator;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
|
||||
* @author <a href="mailto:mauro.mugnaini@nubisware.com">Mauro Mugnaini</a>
|
||||
*/
|
||||
public class UserAttributeTemplatedLDAPStorageMapperFactory extends AbstractLDAPStorageMapperFactory
|
||||
implements LDAPConfigDecorator {
|
||||
|
||||
public static final String PROVIDER_ID = "ua-templated-ldap-mapper";
|
||||
|
||||
protected static final List<ProviderConfigProperty> configProperties;
|
||||
|
||||
static {
|
||||
List<ProviderConfigProperty> props = getConfigProps(null);
|
||||
configProperties = props;
|
||||
}
|
||||
|
||||
static List<ProviderConfigProperty> getConfigProps(ComponentModel p) {
|
||||
String readOnly = "false";
|
||||
UserStorageProviderModel parent = new UserStorageProviderModel();
|
||||
if (p != null) {
|
||||
parent = new UserStorageProviderModel(p);
|
||||
LDAPConfig ldapConfig = new LDAPConfig(parent.getConfig());
|
||||
readOnly = ldapConfig.getEditMode() == UserStorageProvider.EditMode.WRITABLE ? "false" : "true";
|
||||
}
|
||||
ProviderConfigurationBuilder config = ProviderConfigurationBuilder.create()
|
||||
.property().name(UserAttributeTemplatedLDAPStorageMapper.TEMPLATE_ATTRIBUTE)
|
||||
.label("Template string")
|
||||
.helpText("Template to be used to compute final value to be set in LDAP. You can user the "
|
||||
+ UserAttributeTemplatedLDAPStorageMapper.ATTRIBUTE_VALUE
|
||||
+ " placeholder in the text and it will be replaced by the value read by the model property. "
|
||||
+ "(e.g. /home/" + UserAttributeTemplatedLDAPStorageMapper.ATTRIBUTE_VALUE)
|
||||
.type(ProviderConfigProperty.STRING_TYPE)
|
||||
.add()
|
||||
.property().name(UserAttributeTemplatedLDAPStorageMapper.USER_MODEL_ATTRIBUTE)
|
||||
.label("User Model Attribute")
|
||||
.helpText(
|
||||
"Name of the UserModel property or attribute you want to map the LDAP attribute into. For example 'firstName', 'lastName, 'email', 'street' etc.")
|
||||
.type(ProviderConfigProperty.STRING_TYPE)
|
||||
.add()
|
||||
.property().name(UserAttributeTemplatedLDAPStorageMapper.LDAP_ATTRIBUTE).label("LDAP Attribute")
|
||||
.helpText("Name of mapped attribute on LDAP object. For example 'cn', 'sn, 'mail', 'street' etc.")
|
||||
.type(ProviderConfigProperty.STRING_TYPE)
|
||||
.add()
|
||||
.property().name(UserAttributeTemplatedLDAPStorageMapper.READ_ONLY).label("Read Only")
|
||||
.helpText(
|
||||
"Read-only attribute is imported from LDAP to UserModel, but it's not saved back to LDAP when user is updated in Keycloak.")
|
||||
.type(ProviderConfigProperty.BOOLEAN_TYPE)
|
||||
.defaultValue(readOnly)
|
||||
.add();
|
||||
if (parent.isImportEnabled()) {
|
||||
config.property().name(UserAttributeTemplatedLDAPStorageMapper.ALWAYS_READ_VALUE_FROM_LDAP)
|
||||
.label("Always Read Value From LDAP")
|
||||
.helpText(
|
||||
"If on, then during reading of the LDAP attribute value will always used instead of the value from Keycloak DB")
|
||||
.type(ProviderConfigProperty.BOOLEAN_TYPE).defaultValue("false").add();
|
||||
}
|
||||
config.property().name(UserAttributeTemplatedLDAPStorageMapper.IS_MANDATORY_IN_LDAP)
|
||||
.label("Is Mandatory In LDAP")
|
||||
.helpText(
|
||||
"If true, attribute is mandatory in LDAP. Hence if there is no value in Keycloak DB, the empty value will be set to be propagated to LDAP")
|
||||
.type(ProviderConfigProperty.BOOLEAN_TYPE)
|
||||
.defaultValue("false").add();
|
||||
|
||||
return config.build();
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHelpText() {
|
||||
return "Used to map single attribute from LDAP user to attribute of UserModel in Keycloak DB";
|
||||
}
|
||||
|
||||
@Override
|
||||
public List<ProviderConfigProperty> getConfigProperties() {
|
||||
return configProperties;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getId() {
|
||||
return PROVIDER_ID;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void validateConfiguration(KeycloakSession session, RealmModel realm, ComponentModel config)
|
||||
throws ComponentValidationException {
|
||||
|
||||
checkMandatoryConfigAttribute(UserAttributeTemplatedLDAPStorageMapper.USER_MODEL_ATTRIBUTE,
|
||||
"User Model Attribute", config);
|
||||
|
||||
checkMandatoryConfigAttribute(UserAttributeTemplatedLDAPStorageMapper.LDAP_ATTRIBUTE, "LDAP Attribute",
|
||||
config);
|
||||
}
|
||||
|
||||
@Override
|
||||
protected AbstractLDAPStorageMapper createMapper(ComponentModel mapperModel,
|
||||
LDAPStorageProvider federationProvider) {
|
||||
return new UserAttributeTemplatedLDAPStorageMapper(mapperModel, federationProvider);
|
||||
}
|
||||
|
||||
@Override
|
||||
public List<ProviderConfigProperty> getConfigProperties(RealmModel realm, ComponentModel parent) {
|
||||
return getConfigProps(parent);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void updateLDAPConfig(LDAPConfig ldapConfig, ComponentModel mapperModel) {
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,12 @@
|
||||
<jboss-deployment-structure>
|
||||
<deployment>
|
||||
<dependencies>
|
||||
<module name="org.keycloak.keycloak-core"/>
|
||||
<module name="org.keycloak.keycloak-ldap-federation"/>
|
||||
<module name="org.keycloak.keycloak-server-spi"/>
|
||||
<module name="org.keycloak.keycloak-server-spi-private"/>
|
||||
<module name="org.keycloak.keycloak-services"/>
|
||||
<module name="org.jboss.logging"/>
|
||||
</dependencies>
|
||||
</deployment>
|
||||
</jboss-deployment-structure>
|
||||
@ -0,0 +1 @@
|
||||
org.gcube.keycloak.broker.oidc.mappers.UsernameFromMailMapper
|
||||
@ -0,0 +1 @@
|
||||
org.gcube.keycloak.event.OrchestratorEventPublisherProviderFactory
|
||||
@ -0,0 +1 @@
|
||||
org.gcube.keycloak.storage.ldap.mappers.UserAttributeTemplatedLDAPStorageMapperFactory
|
||||
Loading…
Reference in New Issue