5:04 p.m.
Ronald, sorry for late response,
You can use the following snippet:
function invalidGroup(context) {
return context.form()
.setError("Invalid group membership", []).createLogin();
}
function authenticate(context) {
...
if (authShouldFail) {
var challengeResponse = invalidGroup(context);
// context.failure(AuthenticationFlowError.INVALID_USER);
context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS,
challengeResponse);
return;
}
context.success();
}
Just FYI, I used the source code of Keycloak stock authenticators as a reference, like
this one [1].
[1]
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o...
Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training
Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info(a)acutus.pro
On Tue, 2018-10-30 at 14:47 +0000, Ronald Demneri wrote:
Almost forgot, If I set a static group name to compare against (which
is not our goal, but just for testing), it works correctly if the account is member of
that group. If the user is not a member, then it'll display an error like
"Invalid username or password". Is it possible to modify the response in such
cases, stating that the account is not a member of required groups, or at least have it
like "Invalid group membership".
Looking forward to hearing from you!
Regards,
Ronald
-----Original Message-----
> From: Dmitry Telegin <dt(a)acutus.pro>
Sent: 30.Oct.2018 4:07 AM
> To: Ronald Demneri <ronald.demneri(a)amdtia.com>; keycloak-user(a)lists.jboss.org
Subject: Re: [keycloak-user] group mapper per client
Hello Ronald,
If there is a literal correspondence between your AD group names and client names (like
e.g. if the client is named "foo", and the corresponding AD group is
"AD_group_foo"), you can do the following trick:
- make sure you have group-ldap-mapper configured in LDAP mappers, i.e. AD groups are
synced to Keycloak groups;
- create a Javascript authenticator that would check client name against user's
groups, and add it to your authentication flow. If the user tries to authenticate against
the client without being a member of the corresponding group, the authenticator should
deny login.
If there is no such correspondence (e.g. the client is named "foo", and the
group is "AD_group_bar"), you still have the following options:
- map AD groups to Keycloak roles using role-ldap-mapper, then use your adapter's
configuration to restrict access only to the users with this role (e.g.
<security-constraint> in web.xml);
- or map AD groups to Keycloak groups, enable authorization services and use group policy
(if your client adapter supports authorization, of course).
This, however, will need to be configured per each client, on the contrary to the first
approach (configured once per realm).
Let me know if you need further explanations, Dmitry Telegin CTO, Acutus s.r.o.
Keycloak Consulting and Training
Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info(a)acutus.pro
On Mon, 2018-10-29 at 15:35 +0000, Ronald Demneri wrote:
> Hello everyone,
>
> Please forgive me if this was already asked previously. After creating the LDAP
connection (read-only) and some LDAP mappers, I am trying to figure out a way how to allow
login to clients for users in respective groups in AD, for example for client app1 allow
login to users that are members of AD_group_app1; if account is not a member of the app1
group in AD, then he should not be allowed to login. Is it also possible to do it via role
mappings? Please note that we'd like to avoid modification of AD at all costs.
>
>
> Thanks in advance,
> Ronald
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user