org.keycloak.models

Interface UserFederationProvider

All Superinterfaces:

Provider

public interface UserFederationProvider
extends Provider

SPI for plugging in federation storage. This class is instantiated once per session/request and is closed after the session/request is finished.

Version:

$Revision: 1 $

Author:

Bill Burke

Nested Class Summary

Nested Classes

Modifier and Type	Interface and Description
static class	UserFederationProvider.EditMode Optional type that can be by implementations to describe edit mode of federation storage

Field Summary

Fields

Modifier and Type	Field and Description
static String	EMAIL
static String	FIRST_NAME
static String	LAST_NAME
static String	USERNAME

Method Summary

Methods

Modifier and Type	Method and Description
void	close() This method is called at the end of requests.
Set<String>	getSupportedCredentialTypes() What UserCredentialModel types should be handled by this provider? This is called in scenarios when we don't know user, who is going to authenticate (For example Kerberos authentication).
Set<String>	getSupportedCredentialTypes(UserModel user) What UserCredentialModel types should be handled by this provider for this user? Keycloak will only call validCredentials() with the credential types specified in this method.
UserModel	getUserByEmail(RealmModel realm, String email) Keycloak will search for user in local storage first.
UserModel	getUserByUsername(RealmModel realm, String username) Keycloak will search for user in local storage first.
boolean	isValid(RealmModel realm, UserModel local) Is the Keycloak UserModel still valid and/or existing in federated storage? Keycloak may call this method in various user operations.
void	preRemove(RealmModel realm) called whenever a Realm is removed
void	preRemove(RealmModel realm, RoleModel role) called before a role is removed.
UserModel	register(RealmModel realm, UserModel user) Called if this federation provider has priority and supports synchronized registrations.
boolean	removeUser(RealmModel realm, UserModel user)
List<UserModel>	searchByAttributes(Map<String,String> attributes, RealmModel realm, int maxResults) Keycloak does not search in local storage first before calling this method.
boolean	synchronizeRegistrations() Should user registrations be synchronized with this provider? FYI, only one provider will be chosen (by priority) to have this synchronization
UserModel	validateAndProxy(RealmModel realm, UserModel local) Gives the provider an option to validate if user still exists in federation backend and then proxy UserModel loaded from local storage.
CredentialValidationOutput	validCredentials(RealmModel realm, UserCredentialModel credential) Validate credentials of unknown user.
boolean	validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input) Validate credentials for this user.
boolean	validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input)

Field Detail

USERNAME

static final String USERNAME

See Also:

Constant Field Values

EMAIL

static final String EMAIL

See Also:

Constant Field Values

FIRST_NAME

static final String FIRST_NAME

See Also:

Constant Field Values

LAST_NAME

static final String LAST_NAME

See Also:

Constant Field Values

Method Detail

validateAndProxy

UserModel validateAndProxy(RealmModel realm,
                         UserModel local)

Gives the provider an option to validate if user still exists in federation backend and then proxy UserModel loaded from local storage. This method is called whenever a UserModel is pulled from Keycloak local storage. For example, the LDAP provider proxies the UserModel and does on-demand synchronization with LDAP whenever UserModel update methods are invoked. It also overrides UserModel.updateCredential for the credential types it supports

Parameters:

realm -

local -

Returns:

null if user is no longer valid or proxy object otherwise

synchronizeRegistrations

boolean synchronizeRegistrations()

Should user registrations be synchronized with this provider? FYI, only one provider will be chosen (by priority) to have this synchronization

Returns:

register

UserModel register(RealmModel realm,
                 UserModel user)

Called if this federation provider has priority and supports synchronized registrations.

Parameters:

realm -

user -

Returns:

removeUser

boolean removeUser(RealmModel realm,
                 UserModel user)

getUserByUsername

UserModel getUserByUsername(RealmModel realm,
                          String username)

Keycloak will search for user in local storage first. If it can't find the UserModel is local storage, it will call this method. You are required to import the returned UserModel into local storage.

Parameters:

realm -

username -

Returns:

getUserByEmail

UserModel getUserByEmail(RealmModel realm,
                       String email)

Keycloak will search for user in local storage first. If it can't find the UserModel is local storage, it will call this method. You are required to import the returned UserModel into local storage.

Parameters:

realm -

email -

Returns:

searchByAttributes

List<UserModel> searchByAttributes(Map<String,String> attributes,
                                 RealmModel realm,
                                 int maxResults)

Keycloak does not search in local storage first before calling this method. The implementation must check to see if user is already in local storage (KeycloakSession.userStorage()) before doing an import. Currently only attributes USERNAME, EMAIL, FIRST_NAME and LAST_NAME will be used.

Parameters:

attributes -

realm -

Returns:

preRemove

void preRemove(RealmModel realm)

called whenever a Realm is removed

Parameters:

realm -

preRemove

void preRemove(RealmModel realm,
             RoleModel role)

called before a role is removed.

Parameters:

realm -

role -

isValid

boolean isValid(RealmModel realm,
              UserModel local)

Is the Keycloak UserModel still valid and/or existing in federated storage? Keycloak may call this method in various user operations. The local storage may be deleted if this method returns false.

Parameters:

realm -

local -

Returns:

getSupportedCredentialTypes

Set<String> getSupportedCredentialTypes(UserModel user)

What UserCredentialModel types should be handled by this provider for this user? Keycloak will only call validCredentials() with the credential types specified in this method.

Returns:

getSupportedCredentialTypes

Set<String> getSupportedCredentialTypes()

What UserCredentialModel types should be handled by this provider? This is called in scenarios when we don't know user, who is going to authenticate (For example Kerberos authentication).

Returns:

validCredentials

boolean validCredentials(RealmModel realm,
                       UserModel user,
                       List<UserCredentialModel> input)

Validate credentials for this user. This method will only be called with credential parameters supported by this provider

Parameters:

realm -

user -

input -

Returns:

validCredentials

boolean validCredentials(RealmModel realm,
                       UserModel user,
                       UserCredentialModel... input)

validCredentials

CredentialValidationOutput validCredentials(RealmModel realm,
                                          UserCredentialModel credential)

Validate credentials of unknown user. The authenticated user is recognized based on provided credentials and returned back in CredentialValidationOutput

Parameters:

realm -

credential -

Returns:

close

void close()

This method is called at the end of requests.

Specified by:

close in interface Provider