<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 04/08/16 15:43, Josh Cain wrote:<br>
</div>
<blockquote
cite="mid:CA+z0A8A6kAPb+ACcXCcCry4O8h-QzHzsHvxS_fprm2wFKXBFdg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>More like if the provider is down/unavailable. Our lower
environments are subject to frequent refreshes/redeploys and
our Keycloak IDP being down can really block a good deal of
testing there.<br>
<br>
</div>
So more specifically, on the ValidateAndProxy function: <br>
<pre style="background-color:rgb(255,255,255);color:rgb(0,0,0);font-family:"Source Code Pro";font-size:10.5pt"><span style="color:rgb(0,0,128);font-weight:bold">protected </span>UserModel validateAndProxyUser(<wbr>RealmModel realm, UserModel user) {
UserModel managed = <span style="color:rgb(102,14,122);font-weight:bold">managedUsers</span>.get(user.getId())<wbr>;
<span style="color:rgb(0,0,128);font-weight:bold">if </span>(managed != <span style="color:rgb(0,0,128);font-weight:bold">null</span>) {
<span style="color:rgb(0,0,128);font-weight:bold">return </span>managed;
}
UserFederationProvider link = getFederationLink(realm, user);
<span style="color:rgb(0,0,128);font-weight:bold">if </span>(link != <span style="color:rgb(0,0,128);font-weight:bold">null</span>) {
UserModel validatedProxyUser = link.validateAndProxy(realm, user);
<span style="color:rgb(0,0,128);font-weight:bold">if </span>(validatedProxyUser != <span style="color:rgb(0,0,128);font-weight:bold">null</span>) {
<span style="color:rgb(102,14,122);font-weight:bold">managedUsers</span>.put(user.getId(), validatedProxyUser);
<span style="color:rgb(0,0,128);font-weight:bold">return </span>validatedProxyUser;
} <span style="color:rgb(0,0,128);font-weight:bold">else </span>{
<span style="background-color:rgb(234,153,153)"> deleteInvalidUser(realm, user);
<span style="color:rgb(0,0,128);font-weight:bold">return null</span>;</span>
}
}
<span style="color:rgb(0,0,128);font-weight:bold">return </span>user;
}
</pre><pre style="background-color:rgb(255,255,255);color:rgb(0,0,0);font-size:10.5pt"><span style="font-family:arial,helvetica,sans-serif">This deletion/null return overrides any user information that might have been retrieved from the KC database (I.E. in getById):
</span><span style="color:rgb(128,128,0)">@Override
</span><span style="color:rgb(0,0,128);font-weight:bold">public </span><span style="background-color:rgb(228,228,255)">UserModel</span> getUserById(String id, RealmModel realm) {
<span style="background-color:rgb(228,228,255)">UserModel</span> user = <span style="color:rgb(102,14,122);font-weight:bold">session</span>.userStorage().getUserById(id, realm);
<span style="color:rgb(0,0,128);font-weight:bold">if </span>(user != <span style="color:rgb(0,0,128);font-weight:bold">null</span>) {
user = validateAndProxyUser(realm, user); <span style="background-color:rgb(234,153,153)">// overrides valid user with 'null'</span>
}
<span style="color:rgb(0,0,128);font-weight:bold">return </span>user;
}
<span style="font-family:arial,helvetica,sans-serif">I'm just wanting a way to be able to say 'if <i>null</i> is returned here by the validateAndProxy method, just use the user from userStorage()'
</span></pre></div></blockquote>You can return from your validateAndProxy just the local user, which was given as argument then?
Marek
<blockquote cite="mid:CA+z0A8A6kAPb+ACcXCcCry4O8h-QzHzsHvxS_fprm2wFKXBFdg@mail.gmail.com" type="cite"><div class="gmail_extra">
<div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><span><div><div>Josh Cain | Software Applications Engineer
</div><i>Identity and Access Management</i>
</div><b>Red Hat</b>
+1 843-737-1735
</span></div></div></div>
<div class="gmail_quote">On Wed, Aug 3, 2016 at 8:36 PM, Bill Burke <span dir="ltr"><<a moz-do-not-send="true" href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>></span> wrote:
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<p>Not sure what you mean. If the provider is not deployed?
</p><div><div class="h5">
<div>On 8/3/16 9:00 PM, Josh Cain wrote:
</div>
</div></div><blockquote type="cite"><div><div class="h5">
<div dir="ltr">
<div>
<div>Hi all,
</div>
I'm using a Keycloak impementation in which the majority of
our users come from a UserFederationProvider. However, I'd
ideally like to be able to fall-back to the Keycloak database
when this provider is unavailable. Is it possible to do so?
</div>
I looked around at the codebase and UserFederationManager seems
to be where I'd like to change (namely the <a moz-do-not-send="true" href="https://github.com/keycloak/keycloak/blob/ec6b81e42dc8cb7abd9d06571a732cb3c40a5b03/server-spi/src/main/java/org/keycloak/models/UserFederationManager.java#L143" target="_blank">validateAndProxyUser</a>
method). Is there any way to extend this with our own
behavior? Looks like that particular implementation is
hard-coded into the KeycloakSession interface.
<div>
<div>
<div>
<div>
<div data-smartmail="gmail_signature">
<div dir="ltr"><span>
<div>
<div>Josh Cain | Software Applications Engineer
</div>
<i>Identity and Access Management</i>
</div>
<b>Red Hat</b>
<a moz-do-not-send="true" href="tel:%2B1%20843-737-1735" value="+18437371735" target="_blank">+1 843-737-1735</a>
</span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<fieldset></fieldset>
</div></div><pre>______________________________<wbr>_________________
keycloak-user mailing list
<a moz-do-not-send="true" href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a>
<a moz-do-not-send="true" href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/keycloak-user</a></pre>
</blockquote>
</div>
______________________________<wbr>_________________
keycloak-user mailing list
<a moz-do-not-send="true" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a moz-do-not-send="true" href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/keycloak-user</a>
</blockquote></div>
</div>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
</body></html>