libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Retrieve UUID from LDAP in same context (#29470)

Browse source 
This should avoid out-of-sync problems in distributed LDAP environments.

Closes #29206

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
This commit is contained in:
Alexander Schwartz 2024-05-13 16:18:30 +02:00 committed by GitHub
parent 673e122443
commit 2d053312a0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 16 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPIdentityStore.java
View file

@ -49,7 +49,6 @@ import javax.naming.directory.SearchResult;
import java.io.IOException; import java.io.IOException;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection; import java.util.Collection;
import java.util.Collections; import java.util.Collections;
import java.util.LinkedHashSet; import java.util.LinkedHashSet;
@ -101,8 +100,7 @@ public class LDAPIdentityStore implements IdentityStore {
} }
BasicAttributes ldapAttributes = extractAttributesForSaving(ldapObject, true); BasicAttributes ldapAttributes = extractAttributesForSaving(ldapObject, true);
this.operationManager.createSubContext(ldapObject.getDn().getLdapName(), ldapAttributes); ldapObject.setUuid(operationManager.createSubContext(ldapObject.getDn().getLdapName(), ldapAttributes));
ldapObject.setUuid(getEntryIdentifier(ldapObject));
if (logger.isDebugEnabled()) { if (logger.isDebugEnabled()) {
logger.debugf("Type with identifier [%s] and dn [%s] successfully added to LDAP store.", ldapObject.getUuid(), ldapObject.getDn()); logger.debugf("Type with identifier [%s] and dn [%s] successfully added to LDAP store.", ldapObject.getUuid(), ldapObject.getDn());
@ -604,23 +602,4 @@ public class LDAPIdentityStore implements IdentityStore {
return attr; return attr;
} }
protected String getEntryIdentifier(final LDAPObject ldapObject) {
try {
// we need this to retrieve the entry's identifier from the ldap server
String uuidAttrName = getConfig().getUuidLDAPAttributeName();
List<SearchResult> search = this.operationManager.search(ldapObject.getDn().getLdapName(),
new LDAPQueryConditionsBuilder().present(LDAPConstants.OBJECT_CLASS),
Arrays.asList(uuidAttrName), SearchControls.OBJECT_SCOPE);
Attribute id = search.get(0).getAttributes().get(getConfig().getUuidLDAPAttributeName());
if (id == null) {
throw new ModelException("Could not retrieve identifier for entry [" + ldapObject.getDn().toString() + "].");
}
return this.operationManager.decodeEntryUUID(id.get());
} catch (NamingException ne) {
throw new ModelException("Could not retrieve identifier for entry [" + ldapObject.getDn().toString() + "].");
}
}
} }

22
federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java
View file

@ -600,7 +600,7 @@ public class LDAPOperationManager {
} }
} }
public void createSubContext(final LdapName name, final Attributes attributes) { public String createSubContext(final LdapName name, final Attributes attributes) {
try { try {
if (logger.isTraceEnabled()) { if (logger.isTraceEnabled()) {
logger.tracef("Creating entry [%s] with attributes: [", name); logger.tracef("Creating entry [%s] with attributes: [", name);
@ -622,14 +622,22 @@ public class LDAPOperationManager {
logger.tracef("]"); logger.tracef("]");
} }
execute(new LdapOperation<Void>() { return execute(new LdapOperation<>() {
@Override @Override
public Void execute(LdapContext context) throws NamingException { public String execute(LdapContext context) throws NamingException {
DirContext subcontext = context.createSubcontext(name, attributes); DirContext subcontext = context.createSubcontext(name, attributes);
try {
subcontext.close(); String uuidLDAPAttributeName = config.getUuidLDAPAttributeName();
Attribute id = subcontext.getAttributes("", new String[]{uuidLDAPAttributeName}).get(uuidLDAPAttributeName);
return null; if (id == null) {
throw new ModelException("Could not retrieve identifier for entry [" + name + "].");
}
return decodeEntryUUID(id.get());
} catch (NamingException ne) {
throw new ModelException("Could not retrieve identifier for entry [" + name + "].", ne);
} finally {
subcontext.close();
}
} }