org.keycloak.models

## Interface UserCredentialManager

- All Superinterfaces:
    Provider, UserCredentialStore
  All Known Subinterfaces:
    UserCredentialManager.Streams
  All Known Implementing Classes:
    UserCredentialStoreManager

      public interface UserCredentialManager
      extends UserCredentialStore

  Version:
    $Revision: 1 $
  Author:
    Bill Burke

- - ### Nested Class Summary

    Nested Classes
    Modifier and Type | Interface and Description
    --- | ---
    `static interface` | `UserCredentialManager.Streams` The `UserCredentialManager.Streams` interface makes all collection-based methods in `UserCredentialManager` default by providing implementations that delegate to the `Stream`-based variants instead of the other way around.

  - ### Method Summary

    All Methods Instance Methods Abstract Methods Default Methods Deprecated Methods
    Modifier and Type | Method and Description
    --- | ---
    `CredentialValidationOutput` | `authenticate(KeycloakSession session, RealmModel realm, CredentialInput input)` Given a CredentialInput, authenticate the user.
    `CredentialModel` | `createCredentialThroughProvider(RealmModel realm, UserModel user, CredentialModel model)` Creates a credential from the credentialModel, by looping through the providers to find a match for the type
    `void` | `disableCredentialType(RealmModel realm, UserModel user, String credentialType)` Calls disableCredential on UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.
    `List<String>` | `getConfiguredUserStorageCredentialTypes(RealmModel realm, UserModel user)` Deprecated. Use `getConfiguredUserStorageCredentialTypesStream` instead.
    `default Stream<String>` | `getConfiguredUserStorageCredentialTypesStream(RealmModel realm, UserModel user)` Obtains the credential types provided by the user storage where the specified user is stored.
    `Set<String>` | `getDisableableCredentialTypes(RealmModel realm, UserModel user)` Deprecated. Use `getDisableableCredentialTypesStream` instead.
    `default Stream<String>` | `getDisableableCredentialTypesStream(RealmModel realm, UserModel user)` Obtains the credential types that can be disabled by means of the `disableCredentialType(RealmModel, UserModel, String)` method.
    `boolean` | `isConfiguredFor(RealmModel realm, UserModel user, String type)` Checks to see if user has credential type configured.
    `boolean` | `isConfiguredLocally(RealmModel realm, UserModel user, String type)` Only loops through each CredentialProvider to see if credential type is configured for the user.
    `boolean` | `isValid(RealmModel realm, UserModel user, CredentialInput... inputs)` Validates list of credentials.
    `boolean` | `isValid(RealmModel realm, UserModel user, List<CredentialInput> inputs)` Validates list of credentials.
    `boolean` | `updateCredential(RealmModel realm, UserModel user, CredentialInput input)` Updates a credential.
    `void` | `updateCredentialLabel(RealmModel realm, UserModel user, String credentialId, String userLabel)` Updates the credential label and invalidates the cache for the user.

    - ### Methods inherited from interface org.keycloak.credential.UserCredentialStore

      `createCredential, getStoredCredentialById, getStoredCredentialByNameAndType, getStoredCredentials, getStoredCredentialsByType, getStoredCredentialsByTypeStream, getStoredCredentialsStream, moveCredentialTo, removeStoredCredential, updateCredential`

    - ### Methods inherited from interface org.keycloak.provider.Provider

      `close`

- - ### Method Detail

    - #### isValid

          boolean isValid(RealmModel realm,
                          UserModel user,
                          List<CredentialInput> inputs)

      Validates list of credentials. Will call UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.
      Parameters:
        `realm` -
        `user` -
        `inputs` -
      Returns:

    - #### isValid

          boolean isValid(RealmModel realm,
                          UserModel user,
                          CredentialInput... inputs)

      Validates list of credentials. Will call UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.
      Parameters:
        `realm` -
        `user` -
        `inputs` -
      Returns:

    - #### updateCredential

          boolean updateCredential(RealmModel realm,
                                   UserModel user,
                                   CredentialInput input)

      Updates a credential. Will call UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider. Update is finished whenever any one provider returns true.
      Parameters:
        `realm` -
        `user` -
      Returns:
        true if credential was successfully updated by UserStorage or any CredentialInputUpdater

    - #### createCredentialThroughProvider

          CredentialModel createCredentialThroughProvider(RealmModel realm,
                                                          UserModel user,
                                                          CredentialModel model)

      Creates a credential from the credentialModel, by looping through the providers to find a match for the type
      Parameters:
        `realm` -
        `user` -
        `model` -
      Returns:

    - #### updateCredentialLabel

          void updateCredentialLabel(RealmModel realm,
                                     UserModel user,
                                     String credentialId,
                                     String userLabel)

      Updates the credential label and invalidates the cache for the user.
      Parameters:
        `realm` -
        `user` -
        `credentialId` -
        `userLabel` -

    - #### disableCredentialType

          void disableCredentialType(RealmModel realm,
                                     UserModel user,
                                     String credentialType)

      Calls disableCredential on UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.
      Parameters:
        `realm` -
        `user` -
        `credentialType` -

    - #### getDisableableCredentialTypes

          @Deprecated
          Set<String> getDisableableCredentialTypes(RealmModel realm,
                                                                UserModel user)

      Deprecated. Use `getDisableableCredentialTypesStream` instead.
      Returns a set of credential types that can be disabled by disableCredentialType() method
      Parameters:
        `realm` -
        `user` -
      Returns:

    - #### getDisableableCredentialTypesStream

          default Stream<String> getDisableableCredentialTypesStream(RealmModel realm,
                                                                     UserModel user)

      Obtains the credential types that can be disabled by means of the `disableCredentialType(RealmModel, UserModel, String)` method.
      Parameters:
        `realm` - a reference to the realm.
        `user` - the user whose credentials are being searched.
      Returns:
        a non-null `Stream` of credential types.

    - #### isConfiguredFor

          boolean isConfiguredFor(RealmModel realm,
                                  UserModel user,
                                  String type)

      Checks to see if user has credential type configured. Looks in UserStorageProvider or UserFederationProvider first, then loops through each CredentialProvider.
      Parameters:
        `realm` -
        `user` -
        `type` -
      Returns:

    - #### isConfiguredLocally

          boolean isConfiguredLocally(RealmModel realm,
                                      UserModel user,
                                      String type)

      Only loops through each CredentialProvider to see if credential type is configured for the user. This allows UserStorageProvider and UserFederationProvider isValid() implementations to punt to local storage when validating a credential that has been overriden in Keycloak storage.
      Parameters:
        `realm` -
        `user` -
        `type` -
      Returns:

    - #### authenticate

          CredentialValidationOutput authenticate(KeycloakSession session,
                                                  RealmModel realm,
                                                  CredentialInput input)

      Given a CredentialInput, authenticate the user. This is used in the case where the credential must be processed to determine and find the user. An example is Kerberos where the kerberos token might be validated and processed by a variety of different storage providers.
      Parameters:
        `session` -
        `realm` -
        `input` -
      Returns:

    - #### getConfiguredUserStorageCredentialTypes

          @Deprecated
          List<String> getConfiguredUserStorageCredentialTypes(RealmModel realm,
                                                                           UserModel user)

      Deprecated. Use `getConfiguredUserStorageCredentialTypesStream` instead.
      Return credential types, which are provided by the user storage where user is stored. Returned values can contain for example "password", "otp" etc. This will always return empty list for "local" users, which are not backed by any user storage
      Returns:

    - #### getConfiguredUserStorageCredentialTypesStream

          default Stream<String> getConfiguredUserStorageCredentialTypesStream(RealmModel realm,
                                                                               UserModel user)

      Obtains the credential types provided by the user storage where the specified user is stored. Examples of returned values are "password", "otp", etc.

      This method will always return an empty stream for "local" users - i.e. users that are not backed by any user storage.
      Parameters:
        `realm` - a reference to the realm.
        `user` - a reference to the user.
      Returns:
        a non-null `Stream` of credential types.

Copyright © 2020 JBoss by Red Hat. All rights reserved.