11:41 p.m.
Thanks Bill for your help.
Date: Thu, 28 May 2015 08:51:41 -0400
From: Bill Burke <bburke(a)redhat.com>
Subject: Re: [keycloak-user] Some Help to Write a Federation Provider
To: keycloak-user(a)lists.jboss.org
Message-ID: <55670F5D.4010103(a)redhat.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
On 5/28/2015 7:30 AM, pubudu gunawardena wrote:
> Hi All,
>
> I am writing a federation provider which performs authentication
> against an RDBMS.
> I am using keycloak 1.2.0.Final. I have looked at the sample
> properties provider and would like to know a few things.
>
> In UserFederationProviderFactory
> 1. UserFederationProviderFactory#create returns null in the example.
> Do we not need to implement that?
No. This method is not called.
> 2. When is the UserFederationProviderFactory#close method called? Is
> it when the server is shut down?
Yes.
> 3. When is the init method called? Is it called once per object instance?
It Factory.init() is only called once when the server boots. The config
is pulled in from keycloak_server.json
> 4. Is it only one instance of a given type
> UserFederationProviderFactory that is created for the system?
>
Only one Factory instance is created for the server.
> UserFederationProvider
> 5. The javadoc for UserFederationProvider#getUserByUsername says
> "Required to import into local storage any user found." does it mean
> that I have to call keyCloakSession.userStorage().addUser(realm,
> userName)? Do I have to do that even if the user has been already
> previously imported into the system? Do I have to synchronize the user
> data in that method?
You do not have to test to see if the username exists in local storage.
Keycloak will do that before calling this method.
> 6. Same as question 5 for methods getUserByEmail and searchByAttributes.
getUserEmail does not require that you check to see if the user exists
in local storage. searchByAttribute, unfortunately does. The way you
should implement is:
1. do your query
2. Loop on results
3. if result is not in local storage, import to local storage
4. add result to returned List<UserModel>
> 7. When should I return false from method "isValid". What does
> returning false from that method prevent? Is it importing/prevent user
> from logging in/not show user in user list?
Keycloak may call this method to determine if a user is still exists or
is still enabled in federated storage.
> 8. In validCredentials(RealmModel realm, UserCredentialModel
> credential) the javadoc says "Validate credentials of unknown user.".
> When should I implement that method? How can an unknown user be
> validated?
This method is really only used for kerberos authentication against an
LDAP database.
> 9. When is the UserFederationProvider# close method called?
>
UserFederationProviders are created and closed once per request.
> Any help is highly appreciated. If possible please mention how those
> questions will relate to an RDBMS backed provider implementation.
>
Thanks, I'll add all this to the javadoc.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
--
Thanks,
Pubudu