org.keycloak.storage.ldap

## Class LDAPStorageProvider

- java.lang.Object
- - org.keycloak.storage.ldap.LDAPStorageProvider

- All Implemented Interfaces:
    CredentialAuthentication, CredentialInputUpdater, CredentialInputUpdater.Streams, CredentialInputValidator, Provider, ImportedUserValidation, UserLookupProvider, UserQueryProvider, UserQueryProvider.Streams, UserRegistrationProvider, UserStorageProvider

      public class LDAPStorageProvider
      extends Object
      implements UserStorageProvider, CredentialInputValidator, CredentialInputUpdater.Streams, CredentialAuthentication, UserLookupProvider, UserRegistrationProvider, UserQueryProvider.Streams, ImportedUserValidation

  Version:
    $Revision: 1 $
  Author:
    Marek Posolda, Bill Burke

- - ### Nested Class Summary

    - ### Nested classes/interfaces inherited from interface org.keycloak.storage.UserStorageProvider

      `UserStorageProvider.EditMode`

    - ### Nested classes/interfaces inherited from interface org.keycloak.credential.CredentialInputUpdater

      `CredentialInputUpdater.Streams`

    - ### Nested classes/interfaces inherited from interface org.keycloak.storage.user.UserQueryProvider

      `UserQueryProvider.Streams`

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `protected UserStorageProvider.EditMode` | `editMode`
    `protected LDAPStorageProviderFactory` | `factory`
    `protected LDAPProviderKerberosConfig` | `kerberosConfig`
    `protected LDAPIdentityStore` | `ldapIdentityStore`
    `protected LDAPStorageMapperManager` | `mapperManager`
    `protected UserStorageProviderModel` | `model`
    `protected KeycloakSession` | `session`
    `protected Set<String>` | `supportedCredentialTypes`
    `protected PasswordUpdateCallback` | `updater`
    `protected LDAPStorageUserManager` | `userManager`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `LDAPStorageProvider(LDAPStorageProviderFactory factory, KeycloakSession session, ComponentModel model, LDAPIdentityStore ldapIdentityStore)`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `UserModel` | `addUser(RealmModel realm, String username)` All storage providers that implement this interface will be looped through.
    `CredentialValidationOutput` | `authenticate(RealmModel realm, CredentialInput cred)`
    `void` | `close()`
    `void` | `disableCredentialType(RealmModel realm, UserModel user, String credentialType)`
    `protected UserModel` | `findOrCreateAuthenticatedUser(RealmModel realm, String username)` Called after successful kerberos authentication
    `Stream<String>` | `getDisableableCredentialTypesStream(RealmModel realm, UserModel user)` Obtains the set of credential types that can be disabled via `disableCredentialType`.
    `UserStorageProvider.EditMode` | `getEditMode()`
    `Stream<UserModel>` | `getGroupMembersStream(RealmModel realm, GroupModel group)` Obtains users that belong to a specific group.
    `Stream<UserModel>` | `getGroupMembersStream(RealmModel realm, GroupModel group, Integer firstResult, Integer maxResults)` Obtains users that belong to a specific group.
    `LDAPIdentityStore` | `getLdapIdentityStore()`
    `LDAPStorageMapperManager` | `getMapperManager()`
    `UserStorageProviderModel` | `getModel()`
    `Stream<UserModel>` | `getRoleMembersStream(RealmModel realm, RoleModel role)` Obtains users that have the specified role.
    `Stream<UserModel>` | `getRoleMembersStream(RealmModel realm, RoleModel role, Integer firstResult, Integer maxResults)` Searches for users that have the specified role.
    `KeycloakSession` | `getSession()`
    `Set<String>` | `getSupportedCredentialTypes()`
    `UserModel` | `getUserByEmail(String email, RealmModel realm)`
    `UserModel` | `getUserById(String id, RealmModel realm)`
    `UserModel` | `getUserByUsername(String username, RealmModel realm)`
    `LDAPStorageUserManager` | `getUserManager()`
    `int` | `getUsersCount(RealmModel realm)` Returns the number of users, without consider any service account.
    `Stream<UserModel>` | `getUsersStream(RealmModel realm)` Searches all users in the realm.
    `Stream<UserModel>` | `getUsersStream(RealmModel realm, int firstResult, int maxResults)` Searches all users in the realm, starting from the `firstResult` and containing at most `maxResults`.
    `protected UserModel` | `importUserFromLDAP(KeycloakSession session, RealmModel realm, LDAPObject ldapUser)`
    `boolean` | `isConfiguredFor(RealmModel realm, UserModel user, String credentialType)`
    `boolean` | `isValid(RealmModel realm, UserModel user, CredentialInput input)` Tests whether a credential is valid
    `protected LDAPObject` | `loadAndValidateUser(RealmModel realm, UserModel local)`
    `LDAPObject` | `loadLDAPUserByUsername(RealmModel realm, String username)`
    `List<UserModel>` | `loadUsersByUsernames(List<String> usernames, RealmModel realm)`
    `void` | `preRemove(RealmModel realm)` Callback when a realm is removed.
    `void` | `preRemove(RealmModel realm, GroupModel group)` Callback when a group is removed.
    `void` | `preRemove(RealmModel realm, RoleModel role)` Callback when a role is removed.
    `protected UserModel` | `proxy(RealmModel realm, UserModel local, LDAPObject ldapObject, boolean newUser)`
    `protected LDAPObject` | `queryByEmail(RealmModel realm, String email)`
    `boolean` | `removeUser(RealmModel realm, UserModel user)` Called if user originated from this provider.
    `Stream<UserModel>` | `searchForUserByUserAttributeStream(String attrName, String attrValue, RealmModel realm)` Searches for users that have a specific attribute with a specific value.
    `Stream<UserModel>` | `searchForUserStream(Map<String,String> params, RealmModel realm)` Searches for user by parameter.
    `Stream<UserModel>` | `searchForUserStream(Map<String,String> params, RealmModel realm, Integer firstResult, Integer maxResults)` Searches for user by parameter.
    `Stream<UserModel>` | `searchForUserStream(String search, RealmModel realm)` Searches for users with username, email or first + last name that is like search string.
    `Stream<UserModel>` | `searchForUserStream(String search, RealmModel realm, Integer firstResult, Integer maxResults)` Searches for users with username, email or first + last name that is like search string.
    `protected List<LDAPObject>` | `searchLDAP(RealmModel realm, Map<String,String> attributes)`
    `void` | `setUpdater(PasswordUpdateCallback updater)`
    `boolean` | `supportsCredentialAuthenticationFor(String type)`
    `boolean` | `supportsCredentialType(String credentialType)`
    `boolean` | `synchronizeRegistrations()`
    `boolean` | `updateCredential(RealmModel realm, UserModel user, CredentialInput input)`
    `UserModel` | `validate(RealmModel realm, UserModel local)` If this method returns null, then the user in local storage will be removed
    `boolean` | `validPassword(RealmModel realm, UserModel user, String password)`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

    - ### Methods inherited from interface org.keycloak.credential.CredentialInputUpdater.Streams

      `getDisableableCredentialTypes`

    - ### Methods inherited from interface org.keycloak.storage.user.UserQueryProvider.Streams

      `getGroupMembers, getGroupMembers, getUsers, getUsers, searchForUser, searchForUser, searchForUser, searchForUser, searchForUserByUserAttribute`

    - ### Methods inherited from interface org.keycloak.storage.user.UserQueryProvider

      `countUsersInGroups, getRoleMembers, getRoleMembers, getUsersCount, getUsersCount, getUsersCount, getUsersCount, getUsersCount, getUsersCount`

- - ### Field Detail

    - #### factory

          protected LDAPStorageProviderFactory factory

    - #### session

          protected KeycloakSession session

    - #### model

          protected UserStorageProviderModel model

    - #### ldapIdentityStore

          protected LDAPIdentityStore ldapIdentityStore

    - #### editMode

          protected UserStorageProvider.EditMode editMode

    - #### kerberosConfig

          protected LDAPProviderKerberosConfig kerberosConfig

    - #### updater

          protected PasswordUpdateCallback updater

    - #### mapperManager

          protected LDAPStorageMapperManager mapperManager

    - #### userManager

          protected LDAPStorageUserManager userManager

    - #### supportedCredentialTypes

          protected final Set<String> supportedCredentialTypes

  - ### Constructor Detail

    - #### LDAPStorageProvider

          public LDAPStorageProvider(LDAPStorageProviderFactory factory,
                                     KeycloakSession session,
                                     ComponentModel model,
                                     LDAPIdentityStore ldapIdentityStore)

  - ### Method Detail

    - #### setUpdater

          public void setUpdater(PasswordUpdateCallback updater)

    - #### getSession

          public KeycloakSession getSession()

    - #### getLdapIdentityStore

          public LDAPIdentityStore getLdapIdentityStore()

    - #### getEditMode

          public UserStorageProvider.EditMode getEditMode()

    - #### getModel

          public UserStorageProviderModel getModel()

    - #### getMapperManager

          public LDAPStorageMapperManager getMapperManager()

    - #### getUserManager

          public LDAPStorageUserManager getUserManager()

    - #### validate

          public UserModel validate(RealmModel realm,
                                    UserModel local)

      Description copied from interface: `ImportedUserValidation`
      If this method returns null, then the user in local storage will be removed
      Specified by:
        `validate` in interface `ImportedUserValidation`
      Returns:
        null if user no longer valid

    - #### proxy

          protected UserModel proxy(RealmModel realm,
                                    UserModel local,
                                    LDAPObject ldapObject,
                                    boolean newUser)

    - #### supportsCredentialAuthenticationFor

          public boolean supportsCredentialAuthenticationFor(String type)

      Specified by:
        `supportsCredentialAuthenticationFor` in interface `CredentialAuthentication`

    - #### searchForUserByUserAttributeStream

          public Stream<UserModel> searchForUserByUserAttributeStream(String attrName,
                                                                      String attrValue,
                                                                      RealmModel realm)

      Description copied from interface: `UserQueryProvider`
      Searches for users that have a specific attribute with a specific value. Implementations do not have to search in `UserFederatedStorageProvider` as this is done automatically.
      Specified by:
        `searchForUserByUserAttributeStream` in interface `UserQueryProvider`
      Specified by:
        `searchForUserByUserAttributeStream` in interface `UserQueryProvider.Streams`
      Parameters:
        `attrName` - the attribute name.
        `attrValue` - the attribute value.
        `realm` - a reference to the realm.
      Returns:
        a non-null `Stream` of users that match the search criteria.
      See Also:
        `UserFederatedStorageProvider`

    - #### synchronizeRegistrations

          public boolean synchronizeRegistrations()

    - #### addUser

          public UserModel addUser(RealmModel realm,
                                   String username)

      Description copied from interface: `UserRegistrationProvider`
      All storage providers that implement this interface will be looped through. If this method returns null, then the next storage provider's addUser() method will be called. If no storage providers handle the add, then the user will be created in local storage. Returning null is useful when you want optional support for adding users. For example, our LDAP provider can enable and disable the ability to add users.
      Specified by:
        `addUser` in interface `UserRegistrationProvider`
      Returns:

    - #### removeUser

          public boolean removeUser(RealmModel realm,
                                    UserModel user)

      Description copied from interface: `UserRegistrationProvider`
      Called if user originated from this provider. If a local user is linked to this provider, this method will be called before local storage's removeUser() method is invoked. If you are using an import strategy, and this is a local user linked to this provider, this method will be called before local storage's removeUser() method is invoked. Also, you DO NOT need to remove the imported user. The runtime will handle this for you.
      Specified by:
        `removeUser` in interface `UserRegistrationProvider`
      Returns:

    - #### getUserById

          public UserModel getUserById(String id,
                                       RealmModel realm)

      Specified by:
        `getUserById` in interface `UserLookupProvider`

    - #### getUsersCount

          public int getUsersCount(RealmModel realm)

      Description copied from interface: `UserQueryProvider`
      Returns the number of users, without consider any service account.
      Specified by:
        `getUsersCount` in interface `UserQueryProvider`
      Parameters:
        `realm` - the realm
      Returns:
        the number of users

    - #### getUsersStream

          public Stream<UserModel> getUsersStream(RealmModel realm)

      Description copied from interface: `UserQueryProvider`
      Searches all users in the realm.
      Specified by:
        `getUsersStream` in interface `UserQueryProvider`
      Specified by:
        `getUsersStream` in interface `UserQueryProvider.Streams`
      Parameters:
        `realm` - a reference to the realm.
      Returns:
        a non-null `Stream` of users.

    - #### getUsersStream

          public Stream<UserModel> getUsersStream(RealmModel realm,
                                                  int firstResult,
                                                  int maxResults)

      Description copied from interface: `UserQueryProvider`
      Searches all users in the realm, starting from the `firstResult` and containing at most `maxResults`.
      Specified by:
        `getUsersStream` in interface `UserQueryProvider`
      Specified by:
        `getUsersStream` in interface `UserQueryProvider.Streams`
      Parameters:
        `realm` - a reference to the realm.
        `firstResult` - first result to return. Ignored if negative.
        `maxResults` - maximum number of results to return. Ignored if negative.
      Returns:
        a non-null `Stream` of users.

    - #### searchForUserStream

          public Stream<UserModel> searchForUserStream(String search,
                                                       RealmModel realm)

      Description copied from interface: `UserQueryProvider`
      Searches for users with username, email or first + last name that is like search string. If possible, implementations should treat the parameter values as partial match patterns (i.e. in RDMBS terms use LIKE).

      This method is used by the admin console search box
      Specified by:
        `searchForUserStream` in interface `UserQueryProvider`
      Specified by:
        `searchForUserStream` in interface `UserQueryProvider.Streams`
      Parameters:
        `search` - case sensitive search string.
        `realm` - a reference to the realm.
      Returns:
        a non-null `Stream` of users that match the search string.

    - #### searchForUserStream

          public Stream<UserModel> searchForUserStream(String search,
                                                       RealmModel realm,
                                                       Integer firstResult,
                                                       Integer maxResults)

      Description copied from interface: `UserQueryProvider`
      Searches for users with username, email or first + last name that is like search string. If possible, implementations should treat the parameter values as partial match patterns (i.e. in RDMBS terms use LIKE).

      This method is used by the admin console search box
      Specified by:
        `searchForUserStream` in interface `UserQueryProvider`
      Specified by:
        `searchForUserStream` in interface `UserQueryProvider.Streams`
      Parameters:
        `search` - case sensitive search string.
        `realm` - a reference to the realm.
        `firstResult` - first result to return. Ignored if negative.
        `maxResults` - maximum number of results to return. Ignored if negative.
      Returns:
        a non-null `Stream` of users that match the search criteria.

    - #### searchForUserStream

          public Stream<UserModel> searchForUserStream(Map<String,String> params,
                                                       RealmModel realm)

      Description copied from interface: `UserQueryProvider`
      Searches for user by parameter. If possible, implementations should treat the parameter values as partial match patterns (i.e. in RDMBS terms use LIKE). Valid parameters are:
      - first - first name
      - last - last name
      - email - email
      - username - username
      - enabled - if user is enabled (true/false)
      This method is used by the REST API when querying users.
      Specified by:
        `searchForUserStream` in interface `UserQueryProvider`
      Specified by:
        `searchForUserStream` in interface `UserQueryProvider.Streams`
      Parameters:
        `params` - a map containing the search parameters.
        `realm` - a reference to the realm.
      Returns:
        a non-null `Stream` of users that match the search parameters.

    - #### searchForUserStream

          public Stream<UserModel> searchForUserStream(Map<String,String> params,
                                                       RealmModel realm,
                                                       Integer firstResult,
                                                       Integer maxResults)

      Description copied from interface: `UserQueryProvider`
      Searches for user by parameter. If possible, implementations should treat the parameter values as partial match patterns (i.e. in RDMBS terms use LIKE). Valid parameters are:
      - first - first name
      - last - last name
      - email - email
      - username - username
      - enabled - if user is enabled (true/false)
      This method is used by the REST API when querying users.
      Specified by:
        `searchForUserStream` in interface `UserQueryProvider`
      Specified by:
        `searchForUserStream` in interface `UserQueryProvider.Streams`
      Parameters:
        `params` - a map containing the search parameters.
        `realm` - a reference to the realm.
        `firstResult` - first result to return. Ignored if negative.
        `maxResults` - maximum number of results to return. Ignored if negative.
      Returns:
        a non-null `Stream` of users that match the search criteria.

    - #### getGroupMembersStream

          public Stream<UserModel> getGroupMembersStream(RealmModel realm,
                                                         GroupModel group)

      Description copied from interface: `UserQueryProvider`
      Obtains users that belong to a specific group. Implementations do not have to search in `UserFederatedStorageProvider` as this is done automatically.
      Specified by:
        `getGroupMembersStream` in interface `UserQueryProvider`
      Specified by:
        `getGroupMembersStream` in interface `UserQueryProvider.Streams`
      Parameters:
        `realm` - a reference to the realm.
        `group` - a reference to the group.
      Returns:
        a non-null `Stream` of users that belong to the group.
      See Also:
        `UserFederatedStorageProvider`

    - #### getGroupMembersStream

          public Stream<UserModel> getGroupMembersStream(RealmModel realm,
                                                         GroupModel group,
                                                         Integer firstResult,
                                                         Integer maxResults)

      Description copied from interface: `UserQueryProvider`
      Obtains users that belong to a specific group. Implementations do not have to search in `UserFederatedStorageProvider` as this is done automatically.
      Specified by:
        `getGroupMembersStream` in interface `UserQueryProvider`
      Specified by:
        `getGroupMembersStream` in interface `UserQueryProvider.Streams`
      Parameters:
        `realm` - a reference to the realm.
        `group` - a reference to the group.
        `firstResult` - first result to return. Ignored if negative.
        `maxResults` - maximum number of results to return. Ignored if negative.
      Returns:
        a non-null `Stream` of users that belong to the group.
      See Also:
        `UserFederatedStorageProvider`

    - #### getRoleMembersStream

          public Stream<UserModel> getRoleMembersStream(RealmModel realm,
                                                        RoleModel role)

      Description copied from interface: `UserQueryProvider`
      Obtains users that have the specified role.
      Specified by:
        `getRoleMembersStream` in interface `UserQueryProvider`
      Parameters:
        `realm` - a reference to the realm.
        `role` - a reference to the role.
      Returns:
        a non-null `Stream` of users that have the specified role.

    - #### getRoleMembersStream

          public Stream<UserModel> getRoleMembersStream(RealmModel realm,
                                                        RoleModel role,
                                                        Integer firstResult,
                                                        Integer maxResults)

      Description copied from interface: `UserQueryProvider`
      Searches for users that have the specified role.
      Specified by:
        `getRoleMembersStream` in interface `UserQueryProvider`
      Parameters:
        `realm` - a reference to the realm.
        `role` - a reference to the role.
        `firstResult` - first result to return. Ignored if negative.
        `maxResults` - maximum number of results to return. Ignored if negative.
      Returns:
        a non-null `Stream` of users that have the specified role.

    - #### loadUsersByUsernames

          public List<UserModel> loadUsersByUsernames(List<String> usernames,
                                                      RealmModel realm)

    - #### searchLDAP

          protected List<LDAPObject> searchLDAP(RealmModel realm,
                                                Map<String,String> attributes)

    - #### loadAndValidateUser

          protected LDAPObject loadAndValidateUser(RealmModel realm,
                                                   UserModel local)

      Parameters:
        `local` -
      Returns:
        ldapUser corresponding to local user or null if user is no longer in LDAP

    - #### getUserByUsername

          public UserModel getUserByUsername(String username,
                                             RealmModel realm)

      Specified by:
        `getUserByUsername` in interface `UserLookupProvider`

    - #### importUserFromLDAP

          protected UserModel importUserFromLDAP(KeycloakSession session,
                                                 RealmModel realm,
                                                 LDAPObject ldapUser)

    - #### queryByEmail

          protected LDAPObject queryByEmail(RealmModel realm,
                                            String email)

    - #### getUserByEmail

          public UserModel getUserByEmail(String email,
                                          RealmModel realm)

      Specified by:
        `getUserByEmail` in interface `UserLookupProvider`
      Returns:

    - #### preRemove

          public void preRemove(RealmModel realm)

      Description copied from interface: `UserStorageProvider`
      Callback when a realm is removed. Implement this if, for example, you want to do some cleanup in your user storage when a realm is removed
      Specified by:
        `preRemove` in interface `UserStorageProvider`

    - #### preRemove

          public void preRemove(RealmModel realm,
                                RoleModel role)

      Description copied from interface: `UserStorageProvider`
      Callback when a role is removed. Allows you to do things like remove a user role mapping in your external store if appropriate
      Specified by:
        `preRemove` in interface `UserStorageProvider`

    - #### preRemove

          public void preRemove(RealmModel realm,
                                GroupModel group)

      Description copied from interface: `UserStorageProvider`
      Callback when a group is removed. Allows you to do things like remove a user group mapping in your external store if appropriate
      Specified by:
        `preRemove` in interface `UserStorageProvider`

    - #### validPassword

          public boolean validPassword(RealmModel realm,
                                       UserModel user,
                                       String password)

    - #### updateCredential

          public boolean updateCredential(RealmModel realm,
                                          UserModel user,
                                          CredentialInput input)

      Specified by:
        `updateCredential` in interface `CredentialInputUpdater`

    - #### disableCredentialType

          public void disableCredentialType(RealmModel realm,
                                            UserModel user,
                                            String credentialType)

      Specified by:
        `disableCredentialType` in interface `CredentialInputUpdater`

    - #### getDisableableCredentialTypesStream

          public Stream<String> getDisableableCredentialTypesStream(RealmModel realm,
                                                                    UserModel user)

      Description copied from interface: `CredentialInputUpdater`
      Obtains the set of credential types that can be disabled via `disableCredentialType`.
      Specified by:
        `getDisableableCredentialTypesStream` in interface `CredentialInputUpdater`
      Specified by:
        `getDisableableCredentialTypesStream` in interface `CredentialInputUpdater.Streams`
      Parameters:
        `realm` - a reference to the realm.
        `user` - the user whose credentials are being searched.
      Returns:
        a non-null `Stream` of credential types.

    - #### getSupportedCredentialTypes

          public Set<String> getSupportedCredentialTypes()

    - #### supportsCredentialType

          public boolean supportsCredentialType(String credentialType)

      Specified by:
        `supportsCredentialType` in interface `CredentialInputUpdater`
      Specified by:
        `supportsCredentialType` in interface `CredentialInputValidator`

    - #### isConfiguredFor

          public boolean isConfiguredFor(RealmModel realm,
                                         UserModel user,
                                         String credentialType)

      Specified by:
        `isConfiguredFor` in interface `CredentialInputValidator`

    - #### isValid

          public boolean isValid(RealmModel realm,
                                 UserModel user,
                                 CredentialInput input)

      Description copied from interface: `CredentialInputValidator`
      Tests whether a credential is valid
      Specified by:
        `isValid` in interface `CredentialInputValidator`
      Parameters:
        `realm` - The realm in which to which the credential belongs to
        `user` - The user for which to test the credential
        `input` - the credential details to verify
      Returns:
        true if the passed secret is correct

    - #### authenticate

          public CredentialValidationOutput authenticate(RealmModel realm,
                                                         CredentialInput cred)

      Specified by:
        `authenticate` in interface `CredentialAuthentication`

    - #### close

          public void close()

      Specified by:
        `close` in interface `Provider`

    - #### findOrCreateAuthenticatedUser

          protected UserModel findOrCreateAuthenticatedUser(RealmModel realm,
                                                            String username)

      Called after successful kerberos authentication
      Parameters:
        `realm` - realm
        `username` - username without realm prefix
      Returns:
        finded or newly created user

    - #### loadLDAPUserByUsername

          public LDAPObject loadLDAPUserByUsername(RealmModel realm,
                                                   String username)

Copyright © 2021 JBoss by Red Hat. All rights reserved.