org.keycloak.federation.ldap

## Class LDAPFederationProvider

- java.lang.Object
- - org.keycloak.federation.ldap.LDAPFederationProvider

- All Implemented Interfaces:
    UserFederationProvider, Provider

      public class LDAPFederationProvider
      extends Object
      implements UserFederationProvider

  Version:
    $Revision: 1 $
  Author:
    Marek Posolda, Bill Burke

- - ### Nested Class Summary

    - ### Nested classes/interfaces inherited from interface org.keycloak.models.UserFederationProvider

      `UserFederationProvider.EditMode`

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `protected UserFederationProvider.EditMode` | `editMode`
    `protected LDAPFederationProviderFactory` | `factory`
    `protected LDAPProviderKerberosConfig` | `kerberosConfig`
    `protected LDAPIdentityStore` | `ldapIdentityStore`
    `protected UserFederationProviderModel` | `model`
    `protected KeycloakSession` | `session`
    `protected Set<String>` | `supportedCredentialTypes`

    - ### Fields inherited from interface org.keycloak.models.UserFederationProvider

      `EMAIL, FIRST_NAME, LAST_NAME, USERNAME`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `LDAPFederationProvider(LDAPFederationProviderFactory factory, KeycloakSession session, UserFederationProviderModel model, LDAPIdentityStore ldapIdentityStore)`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `void` | `close()` This method is called at the end of requests.
    `protected UserModel` | `findOrCreateAuthenticatedUser(RealmModel realm, String username)` Called after successful kerberos authentication
    `UserFederationProvider.EditMode` | `getEditMode()`
    `List<UserModel>` | `getGroupMembers(RealmModel realm, GroupModel group, int firstResult, int maxResults)` Return group members from federation storage.
    `LDAPIdentityStore` | `getLdapIdentityStore()`
    `LDAPFederationMapper` | `getMapper(UserFederationMapperModel mapperModel)`
    `UserFederationProviderModel` | `getModel()`
    `KeycloakSession` | `getSession()`
    `Set<String>` | `getSupportedCredentialTypes()` What UserCredentialModel types should be handled by this provider? This is called in scenarios when we don't know user, who is going to authenticate (For example Kerberos authentication).
    `Set<String>` | `getSupportedCredentialTypes(UserModel local)` What UserCredentialModel types should be handled by this provider for this user? Keycloak will only call validCredentials() with the credential types specified in this method.
    `UserModel` | `getUserByEmail(RealmModel realm, String email)` Keycloak will search for user in local storage first.
    `UserModel` | `getUserByUsername(RealmModel realm, String username)` Keycloak will search for user in local storage first.
    `protected UserModel` | `importUserFromLDAP(KeycloakSession session, RealmModel realm, LDAPObject ldapUser)`
    `boolean` | `isValid(RealmModel realm, UserModel local)` Is the Keycloak UserModel still valid and/or existing in federated storage? Keycloak may call this method in various user operations.
    `protected LDAPObject` | `loadAndValidateUser(RealmModel realm, UserModel local)`
    `LDAPObject` | `loadLDAPUserByUsername(RealmModel realm, String username)`
    `List<UserModel>` | `loadUsersByUsernames(List<String> usernames, RealmModel realm)`
    `void` | `preRemove(RealmModel realm)` called whenever a Realm is removed
    `void` | `preRemove(RealmModel realm, GroupModel group)` called before a role is removed.
    `void` | `preRemove(RealmModel realm, RoleModel role)` called before a role is removed.
    `protected UserModel` | `proxy(RealmModel realm, UserModel local, LDAPObject ldapObject)`
    `protected LDAPObject` | `queryByEmail(RealmModel realm, String email)`
    `UserModel` | `register(RealmModel realm, UserModel user)` Called if this federation provider has priority and supports synchronized registrations.
    `boolean` | `removeUser(RealmModel realm, UserModel user)`
    `List<UserModel>` | `searchByAttributes(Map<String,String> attributes, RealmModel realm, int maxResults)` Keycloak does not search in local storage first before calling this method.
    `protected List<LDAPObject>` | `searchLDAP(RealmModel realm, Map<String,String> attributes, int maxResults)`
    `List<UserFederationMapperModel>` | `sortMappersAsc(Collection<UserFederationMapperModel> mappers)`
    `protected List<UserFederationMapperModel>` | `sortMappersDesc(Collection<UserFederationMapperModel> mappers)`
    `boolean` | `synchronizeRegistrations()` Should user registrations be synchronized with this provider? FYI, only one provider will be chosen (by priority) to have this synchronization
    `UserModel` | `validateAndProxy(RealmModel realm, UserModel local)` Gives the provider an option to validate if user still exists in federation backend and then proxy UserModel loaded from local storage.
    `CredentialValidationOutput` | `validCredentials(RealmModel realm, UserCredentialModel credential)` Validate credentials of unknown user.
    `boolean` | `validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input)` Validate credentials for this user.
    `boolean` | `validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input)`
    `boolean` | `validPassword(RealmModel realm, UserModel user, String password)`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### factory

          protected LDAPFederationProviderFactory factory

    - #### session

          protected KeycloakSession session

    - #### model

          protected UserFederationProviderModel model

    - #### ldapIdentityStore

          protected LDAPIdentityStore ldapIdentityStore

    - #### editMode

          protected UserFederationProvider.EditMode editMode

    - #### kerberosConfig

          protected LDAPProviderKerberosConfig kerberosConfig

    - #### supportedCredentialTypes

          protected final Set<String> supportedCredentialTypes

  - ### Constructor Detail

    - #### LDAPFederationProvider

          public LDAPFederationProvider(LDAPFederationProviderFactory factory,
                                        KeycloakSession session,
                                        UserFederationProviderModel model,
                                        LDAPIdentityStore ldapIdentityStore)

  - ### Method Detail

    - #### getSession

          public KeycloakSession getSession()

    - #### getModel

          public UserFederationProviderModel getModel()

    - #### getLdapIdentityStore

          public LDAPIdentityStore getLdapIdentityStore()

    - #### getEditMode

          public UserFederationProvider.EditMode getEditMode()

    - #### validateAndProxy

          public UserModel validateAndProxy(RealmModel realm,
                                            UserModel local)

      Description copied from interface: `UserFederationProvider`
      Gives the provider an option to validate if user still exists in federation backend and then proxy UserModel loaded from local storage. This method is called whenever a UserModel is pulled from Keycloak local storage. For example, the LDAP provider proxies the UserModel and does on-demand synchronization with LDAP whenever UserModel update methods are invoked. It also overrides UserModel.updateCredential for the credential types it supports
      Specified by:
        `validateAndProxy` in interface `UserFederationProvider`
      Returns:
        null if user is no longer valid or proxy object otherwise

    - #### proxy

          protected UserModel proxy(RealmModel realm,
                                    UserModel local,
                                    LDAPObject ldapObject)

    - #### getSupportedCredentialTypes

          public Set<String> getSupportedCredentialTypes(UserModel local)

      Description copied from interface: `UserFederationProvider`
      What UserCredentialModel types should be handled by this provider for this user? Keycloak will only call validCredentials() with the credential types specified in this method.
      Specified by:
        `getSupportedCredentialTypes` in interface `UserFederationProvider`
      Returns:

    - #### getSupportedCredentialTypes

          public Set<String> getSupportedCredentialTypes()

      Description copied from interface: `UserFederationProvider`
      What UserCredentialModel types should be handled by this provider? This is called in scenarios when we don't know user, who is going to authenticate (For example Kerberos authentication).
      Specified by:
        `getSupportedCredentialTypes` in interface `UserFederationProvider`
      Returns:

    - #### synchronizeRegistrations

          public boolean synchronizeRegistrations()

      Description copied from interface: `UserFederationProvider`
      Should user registrations be synchronized with this provider? FYI, only one provider will be chosen (by priority) to have this synchronization
      Specified by:
        `synchronizeRegistrations` in interface `UserFederationProvider`
      Returns:

    - #### register

          public UserModel register(RealmModel realm,
                                    UserModel user)

      Description copied from interface: `UserFederationProvider`
      Called if this federation provider has priority and supports synchronized registrations.
      Specified by:
        `register` in interface `UserFederationProvider`
      Returns:

    - #### removeUser

          public boolean removeUser(RealmModel realm,
                                    UserModel user)

      Specified by:
        `removeUser` in interface `UserFederationProvider`

    - #### searchByAttributes

          public List<UserModel> searchByAttributes(Map<String,String> attributes,
                                                    RealmModel realm,
                                                    int maxResults)

      Description copied from interface: `UserFederationProvider`
      Keycloak does not search in local storage first before calling this method. The implementation must check to see if user is already in local storage (KeycloakSession.userStorage()) before doing an import. Currently only attributes USERNAME, EMAIL, FIRST_NAME and LAST_NAME will be used.
      Specified by:
        `searchByAttributes` in interface `UserFederationProvider`
      Returns:

    - #### getGroupMembers

          public List<UserModel> getGroupMembers(RealmModel realm,
                                                 GroupModel group,
                                                 int firstResult,
                                                 int maxResults)

      Description copied from interface: `UserFederationProvider`
      Return group members from federation storage. Useful if info about group memberships is stored in the federation storage. Return empty list if your federation provider doesn't support storing user-group memberships
      Specified by:
        `getGroupMembers` in interface `UserFederationProvider`
      Returns:

    - #### loadUsersByUsernames

          public List<UserModel> loadUsersByUsernames(List<String> usernames,
                                                      RealmModel realm)

    - #### searchLDAP

          protected List<LDAPObject> searchLDAP(RealmModel realm,
                                                Map<String,String> attributes,
                                                int maxResults)

    - #### loadAndValidateUser

          protected LDAPObject loadAndValidateUser(RealmModel realm,
                                                   UserModel local)

      Parameters:
        `local` -
      Returns:
        ldapUser corresponding to local user or null if user is no longer in LDAP

    - #### isValid

          public boolean isValid(RealmModel realm,
                                 UserModel local)

      Description copied from interface: `UserFederationProvider`
      Is the Keycloak UserModel still valid and/or existing in federated storage? Keycloak may call this method in various user operations. The local storage may be deleted if this method returns false.
      Specified by:
        `isValid` in interface `UserFederationProvider`
      Returns:

    - #### getUserByUsername

          public UserModel getUserByUsername(RealmModel realm,
                                             String username)

      Description copied from interface: `UserFederationProvider`
      Keycloak will search for user in local storage first. If it can't find the UserModel is local storage, it will call this method. You are required to import the returned UserModel into local storage.
      Specified by:
        `getUserByUsername` in interface `UserFederationProvider`
      Returns:

    - #### importUserFromLDAP

          protected UserModel importUserFromLDAP(KeycloakSession session,
                                                 RealmModel realm,
                                                 LDAPObject ldapUser)

    - #### queryByEmail

          protected LDAPObject queryByEmail(RealmModel realm,
                                            String email)

    - #### getUserByEmail

          public UserModel getUserByEmail(RealmModel realm,
                                          String email)

      Description copied from interface: `UserFederationProvider`
      Keycloak will search for user in local storage first. If it can't find the UserModel is local storage, it will call this method. You are required to import the returned UserModel into local storage.
      Specified by:
        `getUserByEmail` in interface `UserFederationProvider`
      Returns:

    - #### preRemove

          public void preRemove(RealmModel realm)

      Description copied from interface: `UserFederationProvider`
      called whenever a Realm is removed
      Specified by:
        `preRemove` in interface `UserFederationProvider`

    - #### preRemove

          public void preRemove(RealmModel realm,
                                RoleModel role)

      Description copied from interface: `UserFederationProvider`
      called before a role is removed.
      Specified by:
        `preRemove` in interface `UserFederationProvider`

    - #### preRemove

          public void preRemove(RealmModel realm,
                                GroupModel group)

      Description copied from interface: `UserFederationProvider`
      called before a role is removed.
      Specified by:
        `preRemove` in interface `UserFederationProvider`

    - #### validPassword

          public boolean validPassword(RealmModel realm,
                                       UserModel user,
                                       String password)

    - #### validCredentials

          public boolean validCredentials(RealmModel realm,
                                          UserModel user,
                                          List<UserCredentialModel> input)

      Description copied from interface: `UserFederationProvider`
      Validate credentials for this user. This method will only be called with credential parameters supported by this provider
      Specified by:
        `validCredentials` in interface `UserFederationProvider`
      Returns:

    - #### validCredentials

          public boolean validCredentials(RealmModel realm,
                                          UserModel user,
                                          UserCredentialModel... input)

      Specified by:
        `validCredentials` in interface `UserFederationProvider`

    - #### validCredentials

          public CredentialValidationOutput validCredentials(RealmModel realm,
                                                             UserCredentialModel credential)

      Description copied from interface: `UserFederationProvider`
      Validate credentials of unknown user. The authenticated user is recognized based on provided credentials and returned back in CredentialValidationOutput
      Specified by:
        `validCredentials` in interface `UserFederationProvider`
      Returns:

    - #### close

          public void close()

      Description copied from interface: `UserFederationProvider`
      This method is called at the end of requests.
      Specified by:
        `close` in interface `UserFederationProvider`
      Specified by:
        `close` in interface `Provider`

    - #### findOrCreateAuthenticatedUser

          protected UserModel findOrCreateAuthenticatedUser(RealmModel realm,
                                                            String username)

      Called after successful kerberos authentication
      Parameters:
        `realm` - realm
        `username` - username without realm prefix
      Returns:
        finded or newly created user

    - #### loadLDAPUserByUsername

          public LDAPObject loadLDAPUserByUsername(RealmModel realm,
                                                   String username)

    - #### getMapper

          public LDAPFederationMapper getMapper(UserFederationMapperModel mapperModel)

    - #### sortMappersAsc

          public List<UserFederationMapperModel> sortMappersAsc(Collection<UserFederationMapperModel> mappers)

    - #### sortMappersDesc

          protected List<UserFederationMapperModel> sortMappersDesc(Collection<UserFederationMapperModel> mappers)

Copyright © 2016 JBoss by Red Hat. All rights reserved.