org.keycloak.models

## Interface UserFederationProvider

- All Superinterfaces:
    Provider
  All Known Implementing Classes:
    KerberosFederationProvider, LDAPFederationProvider

      public interface UserFederationProvider
      extends Provider

  SPI for plugging in federation storage. This class is instantiated once per session/request and is closed after the session/request is finished.
  Version:
    $Revision: 1 $
  Author:
    Bill Burke

- - ### Nested Class Summary

    Nested Classes
    Modifier and Type | Interface and Description
    --- | ---
    `static class` | `UserFederationProvider.EditMode` Optional type that can be by implementations to describe edit mode of federation storage

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static String` | `EMAIL`
    `static String` | `FIRST_NAME`
    `static String` | `LAST_NAME`
    `static String` | `USERNAME`

  - ### Method Summary

    All Methods Instance Methods Abstract Methods
    Modifier and Type | Method and Description
    --- | ---
    `void` | `close()` This method is called at the end of requests.
    `List<UserModel>` | `getGroupMembers(RealmModel realm, GroupModel group, int firstResult, int maxResults)` Return group members from federation storage.
    `Set<String>` | `getSupportedCredentialTypes()` What UserCredentialModel types should be handled by this provider? This is called in scenarios when we don't know user, who is going to authenticate (For example Kerberos authentication).
    `Set<String>` | `getSupportedCredentialTypes(UserModel user)` What UserCredentialModel types should be handled by this provider for this user? Keycloak will only call validCredentials() with the credential types specified in this method.
    `UserModel` | `getUserByEmail(RealmModel realm, String email)` Keycloak will search for user in local storage first.
    `UserModel` | `getUserByUsername(RealmModel realm, String username)` Keycloak will search for user in local storage first.
    `boolean` | `isValid(RealmModel realm, UserModel local)` Is the Keycloak UserModel still valid and/or existing in federated storage? Keycloak may call this method in various user operations.
    `void` | `preRemove(RealmModel realm)` called whenever a Realm is removed
    `void` | `preRemove(RealmModel realm, GroupModel group)` called before a role is removed.
    `void` | `preRemove(RealmModel realm, RoleModel role)` called before a role is removed.
    `UserModel` | `register(RealmModel realm, UserModel user)` Called if this federation provider has priority and supports synchronized registrations.
    `boolean` | `removeUser(RealmModel realm, UserModel user)`
    `List<UserModel>` | `searchByAttributes(Map<String,String> attributes, RealmModel realm, int maxResults)` Keycloak does not search in local storage first before calling this method.
    `boolean` | `synchronizeRegistrations()` Should user registrations be synchronized with this provider? FYI, only one provider will be chosen (by priority) to have this synchronization
    `UserModel` | `validateAndProxy(RealmModel realm, UserModel local)` Gives the provider an option to validate if user still exists in federation backend and then proxy UserModel loaded from local storage.
    `CredentialValidationOutput` | `validCredentials(RealmModel realm, UserCredentialModel credential)` Validate credentials of unknown user.
    `boolean` | `validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input)` Validate credentials for this user.
    `boolean` | `validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input)`

- - ### Field Detail

    - #### USERNAME

          static final String USERNAME

      See Also:
        Constant Field Values

    - #### EMAIL

          static final String EMAIL

      See Also:
        Constant Field Values

    - #### FIRST_NAME

          static final String FIRST_NAME

      See Also:
        Constant Field Values

    - #### LAST_NAME

          static final String LAST_NAME

      See Also:
        Constant Field Values

  - ### Method Detail

    - #### validateAndProxy

          UserModel validateAndProxy(RealmModel realm,
                                     UserModel local)

      Gives the provider an option to validate if user still exists in federation backend and then proxy UserModel loaded from local storage. This method is called whenever a UserModel is pulled from Keycloak local storage. For example, the LDAP provider proxies the UserModel and does on-demand synchronization with LDAP whenever UserModel update methods are invoked. It also overrides UserModel.updateCredential for the credential types it supports
      Parameters:
        `realm` -
        `local` -
      Returns:
        null if user is no longer valid or proxy object otherwise

    - #### synchronizeRegistrations

          boolean synchronizeRegistrations()

      Should user registrations be synchronized with this provider? FYI, only one provider will be chosen (by priority) to have this synchronization
      Returns:

    - #### register

          UserModel register(RealmModel realm,
                             UserModel user)

      Called if this federation provider has priority and supports synchronized registrations.
      Parameters:
        `realm` -
        `user` -
      Returns:

    - #### removeUser

          boolean removeUser(RealmModel realm,
                             UserModel user)

    - #### getUserByUsername

          UserModel getUserByUsername(RealmModel realm,
                                      String username)

      Keycloak will search for user in local storage first. If it can't find the UserModel is local storage, it will call this method. You are required to import the returned UserModel into local storage.
      Parameters:
        `realm` -
        `username` -
      Returns:

    - #### getUserByEmail

          UserModel getUserByEmail(RealmModel realm,
                                   String email)

      Keycloak will search for user in local storage first. If it can't find the UserModel is local storage, it will call this method. You are required to import the returned UserModel into local storage.
      Parameters:
        `realm` -
        `email` -
      Returns:

    - #### searchByAttributes

          List<UserModel> searchByAttributes(Map<String,String> attributes,
                                             RealmModel realm,
                                             int maxResults)

      Keycloak does not search in local storage first before calling this method. The implementation must check to see if user is already in local storage (KeycloakSession.userStorage()) before doing an import. Currently only attributes USERNAME, EMAIL, FIRST_NAME and LAST_NAME will be used.
      Parameters:
        `attributes` -
        `realm` -
      Returns:

    - #### getGroupMembers

          List<UserModel> getGroupMembers(RealmModel realm,
                                          GroupModel group,
                                          int firstResult,
                                          int maxResults)

      Return group members from federation storage. Useful if info about group memberships is stored in the federation storage. Return empty list if your federation provider doesn't support storing user-group memberships
      Parameters:
        `realm` -
        `group` -
        `firstResult` -
        `maxResults` -
      Returns:

    - #### preRemove

          void preRemove(RealmModel realm)

      called whenever a Realm is removed
      Parameters:
        `realm` -

    - #### preRemove

          void preRemove(RealmModel realm,
                         RoleModel role)

      called before a role is removed.
      Parameters:
        `realm` -
        `role` -

    - #### preRemove

          void preRemove(RealmModel realm,
                         GroupModel group)

      called before a role is removed.
      Parameters:
        `realm` -
        `group` -

    - #### isValid

          boolean isValid(RealmModel realm,
                          UserModel local)

      Is the Keycloak UserModel still valid and/or existing in federated storage? Keycloak may call this method in various user operations. The local storage may be deleted if this method returns false.
      Parameters:
        `realm` -
        `local` -
      Returns:

    - #### getSupportedCredentialTypes

          Set<String> getSupportedCredentialTypes(UserModel user)

      What UserCredentialModel types should be handled by this provider for this user? Keycloak will only call validCredentials() with the credential types specified in this method.
      Returns:

    - #### getSupportedCredentialTypes

          Set<String> getSupportedCredentialTypes()

      What UserCredentialModel types should be handled by this provider? This is called in scenarios when we don't know user, who is going to authenticate (For example Kerberos authentication).
      Returns:

    - #### validCredentials

          boolean validCredentials(RealmModel realm,
                                   UserModel user,
                                   List<UserCredentialModel> input)

      Validate credentials for this user. This method will only be called with credential parameters supported by this provider
      Parameters:
        `realm` -
        `user` -
        `input` -
      Returns:

    - #### validCredentials

          boolean validCredentials(RealmModel realm,
                                   UserModel user,
                                   UserCredentialModel... input)

    - #### validCredentials

          CredentialValidationOutput validCredentials(RealmModel realm,
                                                      UserCredentialModel credential)

      Validate credentials of unknown user. The authenticated user is recognized based on provided credentials and returned back in CredentialValidationOutput
      Parameters:
        `realm` -
        `credential` -
      Returns:

    - #### close

          void close()

      This method is called at the end of requests.
      Specified by:
        `close` in interface `Provider`

Copyright © 2016 JBoss by Red Hat. All rights reserved.