JBoss.orgCommunity Documentation
The most important part of architecture is a split between the API and the SPI.
PicketLink IDM architecture
API part contains of following interfaces:
Realm - described later in this document. Groups configuration of several identity stores and exposes all of them with one consistent identity model.
IdentitySessionFactory - Main entry point in the API. Enables to create/get IdentitySession for a given Realm
IdentitySession - Session that groups all identity management operation. Contains transaction support and exposes four managers that handle all identity management operations.
PersistenceManager - Operates witin IdentitySession. Performs all operations on Identity and Group objects. Create/Remove/Find
RelationshipManager - Operates witin IdentitySession. Associate and deassociate Identity and Group objects. Find Idenity and Group objects depending on their relationships
RoleManager - Operates witin IdentitySession. Operations on Role objects. Optional feature.
AttributeManager - Operates witin IdentitySession. Manages Identity and Group (IdentityType objects) attributes. Each configured attribute is described with AttributeDescription interface
SearchCriteria - Enables to apply additional conditions to search operations. May be leveraged to receive results sorted, paginated or filtered with attributes.
SPI part contains of following interfaces
IdentityStoreSession - Session that groups all identity management operations within identity persistence stores.
IdentityStoreSessionFactory - Entry point in the SPI to initialize IdentityStoreSession inside IdentityStore or AttributeStore.
IdentityStoreInvocationContext - IdentityStoreSession aware context object that is passed during any invocation of AttributeStore or IdentityStore methods. Thanks to this actual store implementation doesn't need to be aware of current session state. Therefore one instance of AttributeStore or IdentityStore can be invoked by different realms at the same time.
AttributeStore - Exposes operations on identity store with attributes. This is a separate interface as in multi store configuration scenario, profile may need to be stored outside of actual data store for a given identity (LDAP + DB)
IdentityStore - Extends AttributeStore. Implementation of this interface performs operations on the real data store.
IdentityStoreRepository - Extends IdentityStore. Groups several IdentityStore objects and exposes operations on them within single interface for the API. The implementation is responsible for aggregate identity objects from many configured underlaying IdentityStore objects and map different IdentityObjectTypes between them. The place where the whole magic happens
IdentityObjectSearchControl - Enables to apply additional conditions to search operations. May be leveraged to receive results sorted, paginated or filtered withattributes.