Hi Daniel,
On Mon, 2018-07-23 at 18:31 +0200, Daniel Teixeira wrote:
Thank you Dmitry,
I was trying to see if there was an option without writing a java module. What you are
suggesting is to create a module, correct?
Yep you're right, from my experience it's easier to create a Java extension rather
then dive deep into the guts of ScriptMapper trying to make it return what you want :)
I gave a try to my first "module" but couldn't find
very much info or examples about how to write custom protocol mappers.
Are they configured the same was as Authentication Providers?
I tried to configure it, but I get a ModuleNotFoundException, here is what I did:
https://github.com/ddtxra/sib-group-membership-mapper
You did everything right. The only missing piece is deployment descriptor. If
you're hot deploying (via standalone/deployments directory), put this into your
META-INF/jboss-deployment-structure.xml:
<?xml version="1.0" encoding="UTF-8"?>
<jboss-deployment-structure>
<deployment>
<dependencies>
<module name="org.keycloak.keycloak-services"/>
</dependencies>
</deployment>
</jboss-deployment-structure>
...then recompile and redeploy. Or, if you'd like to deploy it as a Wildfly/JBoss
module, do the following in jboss-cli:
module add --name=sib-group-membership-mapper
--resources=/path/to/sib-group-membership-mapper.jar
--dependencies=org.keycloak.keycloak-services
...so that it creates the descriptor (yet a different one) for you.
Good luck!
Dmitry
Can someone spot the problem?
Thanks very much for your help!
> On Mon, Jul 23, 2018 at 4:04 AM, Dmitry Telegin <dt(a)acutus.pro> wrote:
> Hi Daniel,
>
> Not sure if Script Mapper allows for that, but you could definitely
> solve this with a custom ProtocolMapper. Use the "Group Membership"
> mapper as a reference, but return an array of objects instead of an
> array of strings.
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info(a)acutus.pro
>
> On Fri, 2018-07-20 at 14:26 +0200, Daniel Teixeira wrote:
> > Hello,
> > I am trying to configure my userinfo token to get the groups, as an
> > array
> > of objects.
> > Currently if I add the "Group Membership" mapper in my client, an
> > array of
> > Strings with the groups is returns.
> >
> > {
> > "name": "Dummy User",
> > "groups": ["group1", "group2",
"group3"]
> > ...
> > }
> >
> > But what I need for a SSO Confluence plugin to work is the following
> > format:
> > (The name of the attributes don't matter, but I need an array of
> > objects
> > for the groups)
> >
> > {
> > "name": "Dummy User",
> > "groups": [ {"group_name": "group1"},
> > {"group_name": "group2"},
> > {"group_name": "group3"} ]
> > ...
> > }
> >
> > So I have tried to created Script Mapper as follows:
> >
> > *var groups = [];*
> > *user.getGroups().forEach(function(groupModel) {*
> > * var groupName = groupModel.getName();*
> > * groups.push({"group_name": groupName});*
> > *})*
> >
> > *token.setOtherClaims("groups", groups);*
> >
> >
> > But this script produces a token as following:
> >
> > {
> > "name": "Dummy User",
> > "groups": {
> > "0": {
> > "group_name": "group1"
> > },
> > "1": {
> > "group_name": "group2"
> > },
> > "2": {
> > "group_name": "group3"
> > }
> > },
> > ....
> > }
> >
> > Which is not an array of object, but a map of objects.
> > I have tried to toggle the option multivalued but it didn't change
> > anything.
> >
> > Is there a way to have an array?
> > Could someone help me with that?
> > Thanks in advance!
> >
> > Cheers,
> > Daniel Teixeira
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user(a)lists.jboss.org
> >
https://lists.jboss.org/mailman/listinfo/keycloak-user
>
--
Daniel Teixeira