[keycloak-user] Groups as array of objects (Script Mapper ? )

[Dmitry Telegin]

Hi Daniel,

On Mon, 2018-07-23 at 18:31 +0200, Daniel Teixeira wrote:
> Thank you Dmitry, 
> I was trying to see if there was an option without writing a java module. What you are suggesting is to create a module, correct?

Yep you're right, from my experience it's easier to create a Java extension rather then dive deep into the guts of ScriptMapper trying to make it return what you want :)

> I gave a try to my first "module" but couldn't find very much info or examples about how to write custom protocol mappers.
> Are they configured the same was as Authentication Providers? 
> 
> I tried to configure it, but I get a ModuleNotFoundException, here is what I did: 
> https://github.com/ddtxra/sib-group-membership-mapper

You did everything right. The only missing piece is deployment descriptor. If you're hot deploying (via standalone/deployments directory), put this into your META-INF/jboss-deployment-structure.xml:

<?xml version="1.0" encoding="UTF-8"?>
<jboss-deployment-structure>
  <deployment>
    <dependencies>
        <module name="org.keycloak.keycloak-services"/>
    </dependencies>
  </deployment>
</jboss-deployment-structure>

...then recompile and redeploy. Or, if you'd like to deploy it as a Wildfly/JBoss module, do the following in jboss-cli:

module add --name=sib-group-membership-mapper --resources=/path/to/sib-group-membership-mapper.jar --dependencies=org.keycloak.keycloak-services

...so that it creates the descriptor (yet a different one) for you.

Good luck!
Dmitry

> 
> Can someone spot the problem?
> Thanks very much for your help!
> 
> 
> > On Mon, Jul 23, 2018 at 4:04 AM, Dmitry Telegin <dt at acutus.pro> wrote:
> > Hi Daniel,
> > 
> > Not sure if Script Mapper allows for that, but you could definitely
> > solve this with a custom ProtocolMapper. Use the "Group Membership"
> > mapper as a reference, but return an array of objects instead of an
> > array of strings.
> > 
> > Cheers,
> > Dmitry Telegin
> > CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> > 
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> > 
> > On Fri, 2018-07-20 at 14:26 +0200, Daniel Teixeira wrote:
> > > Hello,
> > > I am trying to configure my userinfo token to get the groups, as an
> > > array
> > > of objects.
> > > Currently if I add the "Group Membership" mapper in my client, an
> > > array of
> > > Strings with the groups is returns.
> > > 
> > > {
> > >   "name": "Dummy User",
> > >   "groups": ["group1", "group2", "group3"]
> > >    ...
> > > }
> > > 
> > > But what I need for a SSO Confluence plugin to work is the following
> > > format:
> > > (The name of the attributes don't matter, but I need an array of
> > > objects
> > > for the groups)
> > > 
> > > {
> > >   "name": "Dummy User",
> > >   "groups": [ {"group_name": "group1"},
> > >                    {"group_name": "group2"},
> > >                    {"group_name": "group3"}  ]
> > >  ...
> > > }
> > > 
> > > So I have tried to created Script Mapper as follows:
> > > 
> > > *var groups = [];*
> > > *user.getGroups().forEach(function(groupModel) {*
> > > *    var groupName = groupModel.getName();*
> > > *    groups.push({"group_name": groupName});*
> > > *})*
> > > 
> > > *token.setOtherClaims("groups", groups);*
> > > 
> > > 
> > > But this script produces a token as following:
> > > 
> > > {
> > >   "name": "Dummy User",
> > >   "groups": {
> > >     "0": {
> > >       "group_name": "group1"
> > >     },
> > >     "1": {
> > >       "group_name": "group2"
> > >     },
> > >     "2": {
> > >       "group_name": "group3"
> > >     }
> > >   },
> > >   ....
> > > }
> > > 
> > > Which is not an array of object, but a map of objects.
> > > I have tried to toggle the option multivalued but it didn't change
> > > anything.
> > > 
> > > Is there a way to have an array?
> > > Could someone help me with that?
> > > Thanks in advance!
> > > 
> > > Cheers,
> > > Daniel Teixeira
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > 
> 
> 
> 
> -- 
> Daniel Teixeira