5:09 p.m.
Hi,
I've pushed support for bulk sync of users from external store (like
LDAP) to local store. Some summary of changes:
- Added 2 new methods to UserFederationProviderFactory. Method
syncAllUsers (For sync all users from external store to local store) and
syncChangedUsers (sync just users, which were changed. Needs that
external store has support for changelogs)
- Implementation for LDAP which allows both "full" and "changed" sync.
It's possible to track users, which were created or updated on LDAP
server since some specified time. Unfortunately not easily possible to
track removed LDAP users
- Support for periodic sync. You can specify period for each
FederationProvider how often it should do syncAllUsers and how often
syncChangedUsers. It's possible to specify different period for each
UserFederationProviderModel so for example realm1 can sync from Active
Directory once per day where realm2 can sync from OpenDS LDAP just one
per week etc. Also if you update or delete UserFederationProviderModel,
sync task will be updated/cancelled as well (I've added to BasicTimer
support for cancelling of previously scheduled tasks)
Remaining work:
* Support in admin console. I plan to add buttons, which will allow
admin to trigger either syncAllUsers or syncChangedUsers from admin
console. Also new options to specify periods for fullSync and
"changedSync" . For LDAP, I will need to add option for batch size
(Number of LDAP users to be downloaded per each batch (page). Each batch
is processed in separate transaction) .
* For now, I've added just sync from external store to Keycloak. Do we
need 2 ways sync? For example if people have WRITABLE mode for their
Federation Provider, then changes to particular user done by Keycloak
are immediatelly written to 3rd party store anyway?
* As I mentioned the syncChangedUsers for LDAP is able to track created
and updated LDAP users but not removed. I wonder if it's good idea that
during full sync, Keycloak will check if all local users with LDAP links
are still valid and delete those, which are not? Or is it ok to just
rely on FederationProvider to handle this?
* Sync/Federation of roles? Right now both FederationProvider and Sync
is doing just syncing of users, but not roles or role mappings. I wonder
that maybe people probably also want to sync their LDAP roles into
Keycloak and also role mappings too. This might be quite tricky though
as Federation just deals with UserProvider, but syncing roles from LDAP
will require some updates to RealmProvider too. Probably not doable for
1.0.Final though...
Marek