libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Merge pull request #2 from patriot1burke/master

Browse source 
more
This commit is contained in:
Bill Burke 2013-07-05 11:24:07 -07:00
commit a4e75a6c7d
32 changed files with 562 additions and 1149 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
core/src/main/java/org/keycloak/RSATokenVerifier.java
View file

@ -18,7 +18,11 @@ public class RSATokenVerifier
{
PublicKey realmKey = metadata.getRealmKey();
String realm = metadata.getRealm();
String resource = metadata.getResourceName();
return verifyToken(tokenString, realmKey, realm);
}
public static SkeletonKeyToken verifyToken(String tokenString, PublicKey realmKey, String realm) throws VerificationException
{
JWSInput input = new JWSInput(tokenString);
boolean verified = false;
try

13
core/src/main/java/org/keycloak/representations/idm/PublishedRealmRepresentation.java
View file

@ -30,6 +30,9 @@ public class PublishedRealmRepresentation
@JsonProperty("grants")
protected String grantUrl;
@JsonProperty("identity-grants")
protected String identityGrantUrl;
@JsonIgnore
protected volatile transient PublicKey publicKey;
@ -133,4 +136,14 @@ public class PublishedRealmRepresentation
{
this.grantUrl = grantUrl;
}
public String getIdentityGrantUrl()
{
return identityGrantUrl;
}
public void setIdentityGrantUrl(String identityGrantUrl)
{
this.identityGrantUrl = identityGrantUrl;
}
}

12
core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java
View file

@ -2,6 +2,7 @@ package org.keycloak.representations.idm;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@ -16,6 +17,7 @@ public class RealmRepresentation
protected boolean enabled;
protected boolean sslNotRequired;
protected boolean cookieLoginAllowed;
protected Set<String> roles;
protected List<RequiredCredentialRepresentation> requiredCredentials;
protected List<UserRepresentation> users;
protected List<RoleMappingRepresentation> roleMappings;
@ -168,4 +170,14 @@ public class RealmRepresentation
{
this.accessCodeLifespan = accessCodeLifespan;
}
public Set<String> getRoles()
{
return roles;
}
public void setRoles(Set<String> roles)
{
this.roles = roles;
}
}

19
core/src/main/java/org/keycloak/representations/idm/RoleMappingRepresentation.java
View file

@ -14,7 +14,6 @@ public class RoleMappingRepresentation
protected String self; // link
protected String username;
protected Set<String> roles;
protected Set<String> surrogates;
public String getSelf()
{
@ -41,24 +40,6 @@ public class RoleMappingRepresentation
return roles;
}
public Set<String> getSurrogates()
{
return surrogates;
}
public void setSurrogates(Set<String> surrogates)
{
this.surrogates = surrogates;
}
public RoleMappingRepresentation surrogate(String surrogate)
{
if (this.surrogates == null) this.surrogates = new HashSet<String>();
this.surrogates.add(surrogate);
return this;
}
public void setRoles(Set<String> roles)
{
this.roles = roles;

84
services/src/main/java/org/keycloak/services/IdentityManagerAdapter.java
View file

@ -1,84 +0,0 @@
package org.keycloak.services;
import org.keycloak.services.model.data.RealmModel;
import org.keycloak.services.model.data.RequiredCredentialModel;
import org.keycloak.services.model.data.ResourceModel;
import org.keycloak.services.model.data.RoleMappingModel;
import org.keycloak.services.model.data.RoleModel;
import org.keycloak.services.model.data.ScopeMappingModel;
import org.keycloak.services.model.data.UserAttributeModel;
import org.keycloak.services.model.data.UserCredentialModel;
import org.keycloak.services.model.data.UserModel;
import java.util.List;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Deprecated
public interface IdentityManagerAdapter
{
RealmModel getRealm(String id);
RealmModel create(RealmModel realm);
void update(RealmModel realm);
void delete(RealmModel realm);
List<RequiredCredentialModel> getRequiredCredentials(RealmModel realm);
RequiredCredentialModel getRealmCredential(String id);
RequiredCredentialModel create(RealmModel realm, RequiredCredentialModel cred);
void update(RequiredCredentialModel cred);
void delete(RequiredCredentialModel cred);
UserModel getUser(RealmModel realm, String username);
UserModel create(RealmModel realm, UserModel user);
void update(RealmModel realm, UserModel user);
void delete(RealmModel realm,UserModel user);
List<UserCredentialModel> getCredentials(UserModel user);
UserCredentialModel getCredential(String id);
UserCredentialModel create(UserModel user, UserCredentialModel cred);
void update(UserCredentialModel cred);
void delete(UserCredentialModel cred);
UserAttributeModel getUserAttribute(String id);
UserAttributeModel create(UserModel user, UserAttributeModel attribute);
void update(UserAttributeModel attribute);
void delete(UserAttributeModel attribute);
ResourceModel getResource(String resourceid);
List<ResourceModel> getResources(RealmModel realm);
ResourceModel create(RealmModel realm, ResourceModel resource);
void update(ResourceModel resource);
void delete(ResourceModel resource);
RoleModel getRoleByName(RealmModel realm, String roleName);
RoleModel getRoleByName(ResourceModel resource, String roleName);
List<RoleModel> getRoles(RealmModel realm, ResourceModel resource);
List<RoleModel> getRoles(RealmModel realm);
RoleModel getRole(String id);
RoleModel create(RealmModel realm, ResourceModel resource, String role);
RoleModel create(RealmModel realm, String role);
void delete(RoleModel role);
List<RoleMappingModel> getRoleMappings(RealmModel realm);
List<RoleMappingModel> getRoleMappings(RealmModel realm, ResourceModel resource);
RoleMappingModel getRoleMapping(RealmModel realm, UserModel user);
RoleMappingModel getRoleMapping(RealmModel realm, ResourceModel resource, UserModel user);
RoleMappingModel getRoleMapping(String id);
RoleMappingModel create(RealmModel realm, UserModel user, RoleMappingModel mapping);
RoleMappingModel create(RealmModel realm, ResourceModel resource, UserModel user, RoleMappingModel mapping);
void delete(RoleMappingModel role);
List<ScopeMappingModel> getScopeMappings(RealmModel realm);
List<ScopeMappingModel> getScopeMappings(RealmModel realm, ResourceModel resource);
ScopeMappingModel getScopeMapping(RealmModel realm, UserModel user);
ScopeMappingModel getScopeMapping(RealmModel realm, ResourceModel resource, UserModel user);
ScopeMappingModel getScopeMapping(String id);
ScopeMappingModel create(RealmModel realm, UserModel user, ScopeMappingModel mapping);
ScopeMappingModel create(RealmModel realm, ResourceModel resource, UserModel user, ScopeMappingModel mapping);
void delete(ScopeMappingModel scope);
List<RealmModel> getRealmsByName(String name);
}

53
services/src/main/java/org/keycloak/services/service/AuthenticationManager.java → services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java
View file

@ -1,16 +1,21 @@
package org.keycloak.services.service;
package org.keycloak.services.managers;
import org.jboss.resteasy.logging.Logger;
import org.keycloak.RSATokenVerifier;
import org.keycloak.VerificationException;
import org.keycloak.representations.SkeletonKeyToken;
import org.keycloak.representations.idm.RequiredCredentialRepresentation;
import org.keycloak.services.model.RealmManager;
import org.keycloak.services.model.RealmModel;
import org.keycloak.services.model.RequiredCredentialModel;
import org.keycloak.services.models.RealmManager;
import org.keycloak.services.models.RealmModel;
import org.keycloak.services.models.RequiredCredentialModel;
import org.picketlink.idm.credential.Credentials;
import org.picketlink.idm.credential.Password;
import org.picketlink.idm.credential.TOTPCredentials;
import org.picketlink.idm.credential.UsernamePasswordCredentials;
import org.picketlink.idm.model.User;
import javax.ws.rs.NotAuthorizedException;
import javax.ws.rs.core.HttpHeaders;
import javax.ws.rs.core.MultivaluedMap;
import java.util.HashSet;
import java.util.Set;
@ -30,7 +35,45 @@ public class AuthenticationManager
this.adapter = adapter;
}
public boolean authenticate(RealmModel realm, User user, MultivaluedMap<String, String> formData)
public User authenticateToken(RealmModel realm, HttpHeaders headers)
{
String tokenString = null;
String authHeader = headers.getHeaderString(HttpHeaders.AUTHORIZATION);
if (authHeader == null)
{
throw new NotAuthorizedException("Bearer");
}
else
{
String[] split = authHeader.trim().split("\\s+");
if (split == null || split.length != 2) throw new NotAuthorizedException("Bearer");
if (!split[0].equalsIgnoreCase("Bearer")) throw new NotAuthorizedException("Bearer");
tokenString = split[1];
}
try
{
SkeletonKeyToken token = RSATokenVerifier.verifyToken(tokenString, realm.getPublicKey(), realm.getId());
if (!token.isActive())
{
throw new NotAuthorizedException("token_expired");
}
User user = realm.getIdm().getUser(token.getPrincipal());
if (user == null || !user.isEnabled())
{
throw new NotAuthorizedException("invalid_user");
}
return user;
}
catch (VerificationException e)
{
logger.error("Failed to verify token", e);
throw new NotAuthorizedException("invalid_token");
}
}
public boolean authenticateForm(RealmModel realm, User user, MultivaluedMap<String, String> formData)
{
String username = user.getLoginName();
Set<String> types = new HashSet<String>();

8
services/src/main/java/org/keycloak/services/service/TokenManager.java → services/src/main/java/org/keycloak/services/managers/TokenManager.java
View file

@ -1,13 +1,13 @@
package org.keycloak.services.service;
package org.keycloak.services.managers;
import org.jboss.resteasy.jose.Base64Url;
import org.jboss.resteasy.jose.jws.JWSBuilder;
import org.jboss.resteasy.jwt.JsonSerialization;
import org.keycloak.representations.SkeletonKeyScope;
import org.keycloak.representations.SkeletonKeyToken;
import org.keycloak.services.model.RealmManager;
import org.keycloak.services.model.RealmModel;
import org.keycloak.services.model.ResourceModel;
import org.keycloak.services.models.RealmManager;
import org.keycloak.services.models.RealmModel;
import org.keycloak.services.models.ResourceModel;
import org.picketlink.idm.model.User;
import javax.ws.rs.ForbiddenException;

194
services/src/main/java/org/keycloak/services/model/data/RealmModel.java
View file

@ -1,194 +0,0 @@
package org.keycloak.services.model.data;
import org.bouncycastle.openssl.PEMWriter;
import org.jboss.resteasy.security.PemUtils;
import java.io.IOException;
import java.io.Serializable;
import java.io.StringWriter;
import java.security.PrivateKey;
import java.security.PublicKey;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Deprecated
public class RealmModel implements Serializable
{
private static final long serialVersionUID = 1L;
protected String id;
protected String name;
protected long tokenLifespan = 3600 * 24; // one day
protected long accessCodeLifespan = 300; // 5 minutes
protected boolean enabled;
protected boolean sslNotRequired;
protected boolean cookieLoginAllowed;
protected String publicKeyPem;
protected String privateKeyPem;
protected volatile transient PublicKey publicKey;
protected volatile transient PrivateKey privateKey;
public String getId()
{
return id;
}
public void setId(String id)
{
this.id = id;
}
public String getName()
{
return name;
}
public void setName(String name)
{
this.name = name;
}
public boolean isEnabled()
{
return enabled;
}
public void setEnabled(boolean enabled)
{
this.enabled = enabled;
}
public boolean isSslNotRequired()
{
return sslNotRequired;
}
public void setSslNotRequired(boolean sslNotRequired)
{
this.sslNotRequired = sslNotRequired;
}
public boolean isCookieLoginAllowed()
{
return cookieLoginAllowed;
}
public void setCookieLoginAllowed(boolean cookieLoginAllowed)
{
this.cookieLoginAllowed = cookieLoginAllowed;
}
public long getTokenLifespan()
{
return tokenLifespan;
}
public void setTokenLifespan(long tokenLifespan)
{
this.tokenLifespan = tokenLifespan;
}
public long getAccessCodeLifespan()
{
return accessCodeLifespan;
}
public void setAccessCodeLifespan(long accessCodeLifespan)
{
this.accessCodeLifespan = accessCodeLifespan;
}
public String getPublicKeyPem()
{
return publicKeyPem;
}
public void setPublicKeyPem(String publicKeyPem)
{
this.publicKeyPem = publicKeyPem;
this.publicKey = null;
}
public String getPrivateKeyPem()
{
return privateKeyPem;
}
public void setPrivateKeyPem(String privateKeyPem)
{
this.privateKeyPem = privateKeyPem;
this.privateKey = null;
}
public PublicKey getPublicKey()
{
if (publicKey != null) return publicKey;
if (publicKeyPem != null)
{
try
{
publicKey = PemUtils.decodePublicKey(publicKeyPem);
}
catch (Exception e)
{
throw new RuntimeException(e);
}
}
return publicKey;
}
public void setPublicKey(PublicKey publicKey)
{
this.publicKey = publicKey;
StringWriter writer = new StringWriter();
PEMWriter pemWriter = new PEMWriter(writer);
try
{
pemWriter.writeObject(publicKey);
pemWriter.flush();
}
catch (IOException e)
{
throw new RuntimeException(e);
}
String s = writer.toString();
this.publicKeyPem = PemUtils.removeBeginEnd(s);
}
public PrivateKey getPrivateKey()
{
if (privateKey != null) return privateKey;
if (privateKeyPem != null)
{
try
{
privateKey = PemUtils.decodePrivateKey(privateKeyPem);
}
catch (Exception e)
{
throw new RuntimeException(e);
}
}
return privateKey;
}
public void setPrivateKey(PrivateKey privateKey)
{
this.privateKey = privateKey;
StringWriter writer = new StringWriter();
PEMWriter pemWriter = new PEMWriter(writer);
try
{
pemWriter.writeObject(privateKey);
pemWriter.flush();
}
catch (IOException e)
{
throw new RuntimeException(e);
}
String s = writer.toString();
this.privateKeyPem = PemUtils.removeBeginEnd(s);
}
}

58
services/src/main/java/org/keycloak/services/model/data/RequiredCredentialModel.java
View file

@ -1,58 +0,0 @@
package org.keycloak.services.model.data;
import java.io.Serializable;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Deprecated
public class RequiredCredentialModel implements Serializable
{
private static final long serialVersionUID = 1L;
protected String id;
protected String type;
protected boolean input;
protected boolean secret;
public String getId()
{
return id;
}
public void setId(String id)
{
this.id = id;
}
public String getType()
{
return type;
}
public void setType(String type)
{
this.type = type;
}
public boolean isInput()
{
return input;
}
public void setInput(boolean input)
{
this.input = input;
}
public boolean isSecret()
{
return secret;
}
public void setSecret(boolean secret)
{
this.secret = secret;
}
}

46
services/src/main/java/org/keycloak/services/model/data/ResourceModel.java
View file

@ -1,46 +0,0 @@
package org.keycloak.services.model.data;
import java.io.Serializable;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Deprecated
public class ResourceModel implements Serializable
{
private static final long serialVersionUID = 1L;
protected String id;
protected String name;
protected boolean surrogateAuthRequired;
public String getId()
{
return id;
}
public void setId(String id)
{
this.id = id;
}
public String getName()
{
return name;
}
public void setName(String name)
{
this.name = name;
}
public boolean isSurrogateAuthRequired()
{
return surrogateAuthRequired;
}
public void setSurrogateAuthRequired(boolean surrogateAuthRequired)
{
this.surrogateAuthRequired = surrogateAuthRequired;
}
}

59
services/src/main/java/org/keycloak/services/model/data/RoleMappingModel.java
View file

@ -1,59 +0,0 @@
package org.keycloak.services.model.data;
import java.io.Serializable;
import java.util.HashSet;
import java.util.Set;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Deprecated
public class RoleMappingModel implements Serializable
{
private static final long serialVersionUID = 1L;
protected String id;
protected String userid;
protected Set<String> roles = new HashSet<String>();
protected Set<String> surrogateIds = new HashSet<String>();
public String getId()
{
return id;
}
public void setId(String id)
{
this.id = id;
}
public String getUserid()
{
return userid;
}
public void setUserid(String userid)
{
this.userid = userid;
}
public Set<String> getRoles()
{
return roles;
}
public void setRoles(Set<String> roles)
{
this.roles = roles;
}
public Set<String> getSurrogateIds()
{
return surrogateIds;
}
public void setSurrogateIds(Set<String> surrogateIds)
{
this.surrogateIds = surrogateIds;
}
}

35
services/src/main/java/org/keycloak/services/model/data/RoleModel.java
View file

@ -1,35 +0,0 @@
package org.keycloak.services.model.data;
import java.io.Serializable;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Deprecated
public class RoleModel implements Serializable
{
private static final long serialVersionUID = 1L;
protected String id;
protected String name;
public String getId()
{
return id;
}
public void setId(String id)
{
this.id = id;
}
public String getName()
{
return name;
}
public void setName(String name)
{
this.name = name;
}
}

49
services/src/main/java/org/keycloak/services/model/data/ScopeMappingModel.java
View file

@ -1,49 +0,0 @@
package org.keycloak.services.model.data;
import java.io.Serializable;
import java.util.HashSet;
import java.util.Set;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Deprecated
public class ScopeMappingModel implements Serializable
{
private static final long serialVersionUID = 1L;
protected String id;
protected String userid;
protected Set<String> roles = new HashSet<String>();
public String getId()
{
return id;
}
public void setId(String id)
{
this.id = id;
}
public String getUserid()
{
return userid;
}
public void setUserid(String userid)
{
this.userid = userid;
}
public Set<String> getRoles()
{
return roles;
}
public void setRoles(Set<String> roles)
{
this.roles = roles;
}
}

46
services/src/main/java/org/keycloak/services/model/data/UserAttributeModel.java
View file

@ -1,46 +0,0 @@
package org.keycloak.services.model.data;
import java.io.Serializable;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Deprecated
public class UserAttributeModel implements Serializable
{
private static final long serialVersionUID = 1L;
protected String id;
protected String name;
protected String value;
public String getId()
{
return id;
}
public void setId(String id)
{
this.id = id;
}
public String getName()
{
return name;
}
public void setName(String name)
{
this.name = name;
}
public String getValue()
{
return value;
}
public void setValue(String value)
{
this.value = value;
}
}

58
services/src/main/java/org/keycloak/services/model/data/UserCredentialModel.java
View file

@ -1,58 +0,0 @@
package org.keycloak.services.model.data;
import java.io.Serializable;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Deprecated
public class UserCredentialModel implements Serializable
{
private static final long serialVersionUID = 1L;
protected String id;
protected String type;
protected String value;
protected boolean hashed;
public String getId()
{
return id;
}
public void setId(String id)
{
this.id = id;
}
public String getType()
{
return type;
}
public void setType(String type)
{
this.type = type;
}
public String getValue()
{
return value;
}
public void setValue(String value)
{
this.value = value;
}
public boolean isHashed()
{
return hashed;
}
public void setHashed(boolean hashed)
{
this.hashed = hashed;
}
}

46
services/src/main/java/org/keycloak/services/model/data/UserModel.java
View file

@ -1,46 +0,0 @@
package org.keycloak.services.model.data;
import java.io.Serializable;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Deprecated
public class UserModel implements Serializable
{
private static final long serialVersionUID = 1L;
protected String id;
protected String username;
protected boolean enabled;
public String getId()
{
return id;
}
public void setId(String id)
{
this.id = id;
}
public String getUsername()
{
return username;
}
public void setUsername(String username)
{
this.username = username;
}
public boolean isEnabled()
{
return enabled;
}
public void setEnabled(boolean enabled)
{
this.enabled = enabled;
}
}

2
services/src/main/java/org/keycloak/services/model/RealmManager.java → services/src/main/java/org/keycloak/services/models/RealmManager.java
View file

@ -1,4 +1,4 @@
package org.keycloak.services.model;
package org.keycloak.services.models;
import org.picketlink.idm.IdentityManager;
import org.picketlink.idm.internal.IdentityManagerFactory;

25
services/src/main/java/org/keycloak/services/model/RealmModel.java → services/src/main/java/org/keycloak/services/models/RealmModel.java
View file

@ -1,8 +1,12 @@
package org.keycloak.services.model;
package org.keycloak.services.models;
import org.bouncycastle.openssl.PEMWriter;
import org.jboss.resteasy.security.PemUtils;
import org.keycloak.representations.idm.RequiredCredentialRepresentation;
import org.keycloak.services.models.relationships.RealmAdminRelationship;
import org.keycloak.services.models.relationships.RealmResourceRelationship;
import org.keycloak.services.models.relationships.RequiredCredentialRelationship;
import org.keycloak.services.models.relationships.ScopeRelationship;
import org.picketlink.idm.IdentityManager;
import org.picketlink.idm.credential.Password;
import org.picketlink.idm.credential.TOTPCredential;
@ -386,4 +390,23 @@ public class RealmModel
}
return set;
}
public boolean isRealmAdmin(Agent agent)
{
IdentityManager idm = getIdm();
RelationshipQuery<RealmAdminRelationship> query = idm.createRelationshipQuery(RealmAdminRelationship.class);
query.setParameter(RealmAdminRelationship.REALM, realm);
query.setParameter(RealmAdminRelationship.ADMIN, agent);
List<RealmAdminRelationship> results = query.getResultList();
return results.size() > 0;
}
public void addRealmAdmin(Agent agent)
{
IdentityManager idm = getIdm();
RealmAdminRelationship relationship = new RealmAdminRelationship();
relationship.setAdmin(agent);
relationship.setRealm(realm);
idm.add(relationship);
}
}

2
services/src/main/java/org/keycloak/services/model/RequiredCredentialModel.java → services/src/main/java/org/keycloak/services/models/RequiredCredentialModel.java
View file

@ -1,4 +1,4 @@
package org.keycloak.services.model;
package org.keycloak.services.models;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

7
services/src/main/java/org/keycloak/services/model/ResourceModel.java → services/src/main/java/org/keycloak/services/models/ResourceModel.java
View file

@ -1,5 +1,6 @@
package org.keycloak.services.model;
package org.keycloak.services.models;
import org.keycloak.services.models.relationships.ScopeRelationship;
import org.picketlink.idm.IdentityManager;
import org.picketlink.idm.internal.IdentityManagerFactory;
import org.picketlink.idm.model.Agent;
@ -115,7 +116,6 @@ public class ResourceModel
}
public Set<String> getScope(Agent agent)
{
RelationshipQuery<ScopeRelationship> query = getIdm().createRelationshipQuery(ScopeRelationship.class);
@ -128,7 +128,4 @@ public class ResourceModel
}
return set;
}
}

2
services/src/main/java/org/keycloak/services/model/UserCredentialModel.java → services/src/main/java/org/keycloak/services/models/UserCredentialModel.java
View file

@ -1,4 +1,4 @@
package org.keycloak.services.model;
package org.keycloak.services.models;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

58
services/src/main/java/org/keycloak/services/models/relationships/RealmAdminRelationship.java Executable file
View file

@ -0,0 +1,58 @@
package org.keycloak.services.models.relationships;
import org.picketlink.idm.model.AbstractAttributedType;
import org.picketlink.idm.model.Agent;
import org.picketlink.idm.model.Realm;
import org.picketlink.idm.model.Relationship;
import org.picketlink.idm.model.annotation.IdentityProperty;
import org.picketlink.idm.query.RelationshipQueryParameter;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
public class RealmAdminRelationship extends AbstractAttributedType implements Relationship
{
private static final long serialVersionUID = 1L;
public static final RelationshipQueryParameter REALM = new RelationshipQueryParameter() {
@Override
public String getName() {
return "realm";
}
};
public static final RelationshipQueryParameter ADMIN = new RelationshipQueryParameter() {
@Override
public String getName() {
return "admin";
}
};
protected Realm realm;
protected Agent admin;
@IdentityProperty
public Realm getRealm()
{
return realm;
}
public void setRealm(Realm realm)
{
this.realm = realm;
}
@IdentityProperty
public Agent getAdmin()
{
return admin;
}
public void setAdmin(Agent admin)
{
this.admin = admin;
}
}

2
services/src/main/java/org/keycloak/services/model/RealmResourceRelationship.java → services/src/main/java/org/keycloak/services/models/relationships/RealmResourceRelationship.java
View file

@ -1,4 +1,4 @@
package org.keycloak.services.model;
package org.keycloak.services.models.relationships;
import org.picketlink.idm.model.AbstractAttributedType;
import org.picketlink.idm.model.Agent;

2
services/src/main/java/org/keycloak/services/model/RequiredCredentialRelationship.java → services/src/main/java/org/keycloak/services/models/relationships/RequiredCredentialRelationship.java
View file

@ -1,4 +1,4 @@
package org.keycloak.services.model;
package org.keycloak.services.models.relationships;
import org.picketlink.idm.model.AbstractAttributedType;
import org.picketlink.idm.model.Agent;

2
services/src/main/java/org/keycloak/services/model/ScopeRelationship.java → services/src/main/java/org/keycloak/services/models/relationships/ScopeRelationship.java
View file

@ -1,4 +1,4 @@
package org.keycloak.services.model;
package org.keycloak.services.models.relationships;
import org.picketlink.idm.model.AbstractAttributedType;
import org.picketlink.idm.model.Agent;

343
services/src/main/java/org/keycloak/services/resources/RealmFactory.java Executable file
View file

@ -0,0 +1,343 @@
package org.keycloak.services.resources;
import org.jboss.resteasy.logging.Logger;
import org.keycloak.representations.idm.RequiredCredentialRepresentation;
import org.keycloak.representations.idm.ResourceRepresentation;
import org.keycloak.representations.idm.RoleMappingRepresentation;
import org.keycloak.representations.idm.ScopeMappingRepresentation;
import org.keycloak.representations.idm.UserRepresentation;
import org.keycloak.services.managers.AuthenticationManager;
import org.keycloak.services.models.RealmManager;
import org.keycloak.representations.idm.RealmRepresentation;
import org.keycloak.services.models.RealmModel;
import org.keycloak.services.models.RequiredCredentialModel;
import org.keycloak.services.models.ResourceModel;
import org.keycloak.services.models.UserCredentialModel;
import org.picketlink.idm.model.Attribute;
import org.picketlink.idm.model.Realm;
import org.picketlink.idm.model.Role;
import org.picketlink.idm.model.SimpleRole;
import org.picketlink.idm.model.SimpleUser;
import org.picketlink.idm.model.User;
import javax.ws.rs.Consumes;
import javax.ws.rs.NotAuthorizedException;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.WebApplicationException;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.HttpHeaders;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.UriBuilder;
import javax.ws.rs.core.UriInfo;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.util.HashMap;
import java.util.Map;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Path("/realmfactory")
public class RealmFactory
{
protected Logger logger = Logger.getLogger(RealmFactory.class);
protected RealmManager adapter;
protected AuthenticationManager authenticationManager;
protected RealmModel defaultRealm;
@Context
protected UriInfo uriInfo;
@Context
protected HttpHeaders headers;
public RealmFactory(RealmManager adapter)
{
this.adapter = adapter;
defaultRealm = adapter.getRealm(Realm.DEFAULT_REALM);
}
@POST
@Consumes("application/json")
public Response importDomain(RealmRepresentation rep)
{
RealmModel realm = createRealm(rep);
UriBuilder builder = uriInfo.getRequestUriBuilder().path(realm.getId());
return Response.created(builder.build())
.entity(RealmResource.realmRep(realm, uriInfo))
.type(MediaType.APPLICATION_JSON_TYPE).build();
}
protected RealmModel createRealm(RealmRepresentation rep)
{
User realmCreator = authenticationManager.authenticateToken(defaultRealm, headers);
Role creatorRole = defaultRealm.getIdm().getRole(RegistrationService.REALM_CREATOR_ROLE);
if (!defaultRealm.getIdm().hasRole(realmCreator, creatorRole))
{
logger.warn("not a realm creator");
throw new NotAuthorizedException("Bearer");
}
verifyRealmRepresentation(rep);
RealmModel realm = adapter.create(rep.getRealm());
realm.addRealmAdmin(realmCreator);
KeyPair keyPair = null;
try
{
keyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
}
catch (NoSuchAlgorithmException e)
{
throw new RuntimeException(e);
}
realm.setPrivateKey(keyPair.getPrivate());
realm.setPublicKey(keyPair.getPublic());
realm.setName(rep.getRealm());
realm.setEnabled(rep.isEnabled());
realm.setTokenLifespan(rep.getTokenLifespan());
realm.setAccessCodeLifespan(rep.getAccessCodeLifespan());
realm.setSslNotRequired(rep.isSslNotRequired());
realm.setCookieLoginAllowed(rep.isCookieLoginAllowed());
realm.updateRealm();
Map<String, User> userMap = new HashMap<String, User>();
for (RequiredCredentialRepresentation requiredCred : rep.getRequiredCredentials())
{
RequiredCredentialModel credential = new RequiredCredentialModel();
credential.setType(requiredCred.getType());
credential.setInput(requiredCred.isInput());
credential.setSecret(requiredCred.isSecret());
realm.addRequiredCredential(credential);
}
for (UserRepresentation userRep : rep.getUsers())
{
User user = new SimpleUser(userRep.getUsername());
user.setEnabled(userRep.isEnabled());
if (userRep.getAttributes() != null)
{
for (Map.Entry<String, String> entry : userRep.getAttributes().entrySet())
{
user.setAttribute(new Attribute<String>(entry.getKey(), entry.getValue()));
}
}
realm.getIdm().add(user);
if (userRep.getCredentials() != null)
{
for (UserRepresentation.Credential cred : userRep.getCredentials())
{
UserCredentialModel credential = new UserCredentialModel();
credential.setType(cred.getType());
credential.setValue(cred.getValue());
realm.updateCredential(user, credential);
}
}
userMap.put(user.getLoginName(), user);
}
Map<String, Role> roles = new HashMap<String, Role>();
if (rep.getRoles() != null)
{
for (String roleString : rep.getRoles())
{
SimpleRole role = new SimpleRole(roleString.trim());
realm.getIdm().add(role);
roles.put(role.getName(), role);
}
}
if (rep.getRoleMappings() != null)
{
for (RoleMappingRepresentation mapping : rep.getRoleMappings())
{
User user = userMap.get(mapping.getUsername());
for (String roleString : mapping.getRoles())
{
Role role = roles.get(roleString.trim());
if (role == null)
{
role = new SimpleRole(roleString.trim());
realm.getIdm().add(role);
roles.put(role.getName(), role);
}
realm.getIdm().grantRole(user, role);
}
}
}
if (rep.getScopeMappings() != null)
{
for (ScopeMappingRepresentation scope : rep.getScopeMappings())
{
for (String roleString : scope.getRoles())
{
Role role = roles.get(roleString.trim());
if (role == null)
{
role = new SimpleRole(roleString.trim());
realm.getIdm().add(role);
roles.put(role.getName(), role);
}
User user = userMap.get(scope.getUsername());
realm.addScope(user, role.getName());
}
}
}
if (!roles.containsKey("*"))
{
SimpleRole wildcard = new SimpleRole("*");
realm.getIdm().add(wildcard);
roles.put("*", wildcard);
}
if (rep.getResources() != null)
{
createResources(rep, realm, userMap);
}
return realm;
}
protected void createResources(RealmRepresentation rep, RealmModel realm, Map<String, User> userMap)
{
for (ResourceRepresentation resourceRep : rep.getResources())
{
ResourceModel resource = realm.addResource(resourceRep.getName());
resource.setSurrogateAuthRequired(resourceRep.isSurrogateAuthRequired());
resource.updateResource();
Map<String, Role> roles = new HashMap<String, Role>();
if (resourceRep.getRoles() != null)
{
for (String roleString : rep.getRoles())
{
SimpleRole role = new SimpleRole(roleString.trim());
resource.getIdm().add(role);
roles.put(role.getName(), role);
}
}
if (resourceRep.getRoleMappings() != null)
{
for (RoleMappingRepresentation mapping : resourceRep.getRoleMappings())
{
User user = userMap.get(mapping.getUsername());
for (String roleString : mapping.getRoles())
{
Role role = roles.get(roleString.trim());
if (role == null)
{
role = new SimpleRole(roleString.trim());
resource.getIdm().add(role);
roles.put(role.getName(), role);
}
resource.getIdm().grantRole(user, role);
}
}
}
if (resourceRep.getScopeMappings() != null)
{
for (ScopeMappingRepresentation mapping : resourceRep.getScopeMappings())
{
User user = userMap.get(mapping.getUsername());
for (String roleString : mapping.getRoles())
{
Role role = roles.get(roleString.trim());
if (role == null)
{
role = new SimpleRole(roleString.trim());
resource.getIdm().add(role);
roles.put(role.getName(), role);
}
resource.addScope(user, role.getName());
}
}
}
if (!roles.containsKey("*"))
{
SimpleRole wildcard = new SimpleRole("*");
resource.getIdm().add(wildcard);
roles.put("*", wildcard);
}
}
}
protected void verifyRealmRepresentation(RealmRepresentation rep)
{
if (rep.getRequiredCredentials() == null)
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("Realm credential requirements not defined").type("text/plain").build());
}
HashMap<String, UserRepresentation> userReps = new HashMap<String, UserRepresentation>();
for (UserRepresentation userRep : rep.getUsers()) userReps.put(userRep.getUsername(), userRep);
// override enabled to false if user does not have at least all of browser or client credentials
for (UserRepresentation userRep : rep.getUsers())
{
if (userRep.getCredentials() == null)
{
userRep.setEnabled(false);
}
else
{
boolean hasBrowserCredentials = true;
for (RequiredCredentialRepresentation credential : rep.getRequiredCredentials())
{
boolean hasCredential = false;
for (UserRepresentation.Credential cred : userRep.getCredentials())
{
if (cred.getType().equals(credential.getType()))
{
hasCredential = true;
break;
}
}
if (!hasCredential)
{
hasBrowserCredentials = false;
break;
}
}
if (!hasBrowserCredentials)
{
userRep.setEnabled(false);
}
}
}
if (rep.getResources() != null)
{
// check mappings
for (ResourceRepresentation resourceRep : rep.getResources())
{
if (resourceRep.getRoleMappings() != null)
{
for (RoleMappingRepresentation mapping : resourceRep.getRoleMappings())
{
if (!userReps.containsKey(mapping.getUsername()))
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("No users declared for role mapping").type("text/plain").build());
}
}
}
}
}
}
}

78
services/src/main/java/org/keycloak/services/service/RealmResource.java → services/src/main/java/org/keycloak/services/resources/RealmResource.java
View file

@ -1,48 +1,42 @@
package org.keycloak.services.service;
package org.keycloak.services.resources;
import org.keycloak.services.IdentityManagerAdapter;
import org.keycloak.services.model.data.RealmModel;
import org.keycloak.services.models.RealmManager;
import org.jboss.resteasy.logging.Logger;
import org.keycloak.representations.idm.PublishedRealmRepresentation;
import org.keycloak.services.models.RealmModel;
import javax.ws.rs.GET;
import javax.ws.rs.NotFoundException;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.QueryParam;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.GenericEntity;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.UriBuilder;
import javax.ws.rs.core.UriInfo;
import java.util.ArrayList;
import java.util.List;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Path("/")
@Path("/realms")
public class RealmResource
{
protected Logger logger = Logger.getLogger(RealmResource.class);
protected IdentityManagerAdapter identityManager;
protected RealmManager adapter;
@Context
protected UriInfo uriInfo;
public RealmResource(IdentityManagerAdapter identityManager)
public RealmResource(RealmManager adapter)
{
this.identityManager = identityManager;
this.adapter = adapter;
}
@GET
@Path("realms/{realm}")
@Path("{realm}")
@Produces("application/json")
public PublishedRealmRepresentation getRealm(@PathParam("realm") String id)
{
RealmModel realm = identityManager.getRealm(id);
RealmModel realm = adapter.getRealm(id);
if (realm == null)
{
logger.debug("realm not found");
@ -52,11 +46,11 @@ public class RealmResource
}
@GET
@Path("realms/{realm}.html")
@Path("{realm}.html")
@Produces("text/html")
public String getRealmHtml(@PathParam("realm") String id)
{
RealmModel realm = identityManager.getRealm(id);
RealmModel realm = adapter.getRealm(id);
if (realm == null)
{
logger.debug("realm not found");
@ -82,10 +76,15 @@ public class RealmResource
grant.path(TokenService.class).path(TokenService.class, "accessTokenGrant");
String grantUrl = grant.build(realm.getId()).toString();
UriBuilder idGrant = uriInfo.getBaseUriBuilder();
grant.path(TokenService.class).path(TokenService.class, "identityTokenGrant");
String idGrantUrl = idGrant.build(realm.getId()).toString();
html.append("<html><body><h1>Realm: ").append(realm.getName()).append("</h1>");
html.append("<p>auth: ").append(authUri).append("</p>");
html.append("<p>code: ").append(codeUri).append("</p>");
html.append("<p>grant: ").append(grantUrl).append("</p>");
html.append("<p>identity grant: ").append(idGrantUrl).append("</p>");
html.append("<p>public key: ").append(realm.getPublicKeyPem()).append("</p>");
html.append("</body></html>");
@ -93,46 +92,6 @@ public class RealmResource
}
@GET
@Path("realms")
@Produces("application/json")
public Response getRealmsByName(@QueryParam("name") String name)
{
if (name == null) return Response.noContent().build();
List<RealmModel> realms = identityManager.getRealmsByName(name);
if (realms.size() == 0) return Response.noContent().build();
List<PublishedRealmRepresentation> list = new ArrayList<PublishedRealmRepresentation>();
for (RealmModel realm : realms)
{
list.add(realmRep(realm, uriInfo));
}
GenericEntity<List<PublishedRealmRepresentation>> entity = new GenericEntity<List<PublishedRealmRepresentation>>(list){};
return Response.ok(entity).type(MediaType.APPLICATION_JSON_TYPE).build();
}
@GET
@Path("realms.html")
@Produces("text/html")
public String getRealmsByNameHtml(@QueryParam("name") String name)
{
if (name == null) return "<html><body><h1>No realms with that name</h1></body></html>";
List<RealmModel> realms = identityManager.getRealmsByName(name);
if (realms.size() == 0) return "<html><body><h1>No realms with that name</h1></body></html>";
if (realms.size() == 1) return realmHtml(realms.get(0));
StringBuffer html = new StringBuffer();
html.append("<html><body><h1>Realms</h1>");
for (RealmModel realm : realms)
{
html.append("<p><a href=\"").append(uriInfo.getBaseUriBuilder().path("realms").path(realm.getId() + ".html"))
.append("\">").append(realm.getId()).append("</a></p>");
}
html.append("</body></html>");
return html.toString();
}
public static PublishedRealmRepresentation realmRep(RealmModel realm, UriInfo uriInfo)
{
PublishedRealmRepresentation rep = new PublishedRealmRepresentation();
@ -153,6 +112,11 @@ public class RealmResource
grant.path(TokenService.class).path(TokenService.class, "accessTokenGrant");
String grantUrl = grant.build(realm.getId()).toString();
rep.setGrantUrl(grantUrl);
UriBuilder idGrant = uriInfo.getBaseUriBuilder();
grant.path(TokenService.class).path(TokenService.class, "identityTokenGrant");
String idGrantUrl = idGrant.build(realm.getId()).toString();
rep.setIdentityGrantUrl(idGrantUrl);
return rep;
}
}

12
services/src/main/java/org/keycloak/services/service/RegistrationService.java → services/src/main/java/org/keycloak/services/resources/RegistrationService.java
View file

@ -1,10 +1,11 @@
package org.keycloak.services.service;
package org.keycloak.services.resources;
import org.keycloak.representations.idm.UserRepresentation;
import org.keycloak.services.model.RealmManager;
import org.keycloak.services.model.RealmModel;
import org.keycloak.services.model.UserCredentialModel;
import org.keycloak.services.models.RealmManager;
import org.keycloak.services.models.RealmModel;
import org.keycloak.services.models.UserCredentialModel;
import org.picketlink.idm.model.Realm;
import org.picketlink.idm.model.Role;
import org.picketlink.idm.model.SimpleUser;
import org.picketlink.idm.model.User;
@ -24,6 +25,7 @@ import java.net.URI;
@Path("/registrations")
public class RegistrationService
{
public static final String REALM_CREATOR_ROLE = "realm-creator";
protected RealmManager adapter;
protected RealmModel defaultRealm;
@ -57,6 +59,8 @@ public class RegistrationService
credModel.setValue(cred.getValue());
defaultRealm.updateCredential(user, credModel);
}
Role realmCreator = defaultRealm.getIdm().getRole(REALM_CREATOR_ROLE);
defaultRealm.getIdm().grantRole(user, realmCreator);
URI uri = uriInfo.getBaseUriBuilder().path(RealmFactory.class).path(user.getLoginName()).build();
return Response.created(uri).build();
}

4
services/src/main/java/org/keycloak/services/service/SkeletonKeyApplication.java → services/src/main/java/org/keycloak/services/resources/SkeletonKeyApplication.java
View file

@ -1,10 +1,9 @@
package org.keycloak.services.service;
package org.keycloak.services.resources;
import org.infinispan.Cache;
import org.infinispan.manager.DefaultCacheManager;
import org.keycloak.SkeletonKeyContextResolver;
import javax.ws.rs.ApplicationPath;
import javax.ws.rs.core.Application;
import java.io.IOException;
import java.io.InputStream;
@ -15,7 +14,6 @@ import java.util.Set;
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@ApplicationPath("/")
public class SkeletonKeyApplication extends Application
{
protected Set<Object> singletons = new HashSet<Object>();

18
services/src/main/java/org/keycloak/services/service/TokenService.java → services/src/main/java/org/keycloak/services/resources/TokenService.java
View file

@ -1,4 +1,4 @@
package org.keycloak.services.service;
package org.keycloak.services.resources;
import org.jboss.resteasy.jose.Base64Url;
import org.jboss.resteasy.jose.jws.JWSBuilder;
@ -9,10 +9,12 @@ import org.jboss.resteasy.logging.Logger;
import org.keycloak.representations.AccessTokenResponse;
import org.keycloak.representations.SkeletonKeyScope;
import org.keycloak.representations.SkeletonKeyToken;
import org.keycloak.services.model.RealmManager;
import org.keycloak.services.model.RealmModel;
import org.keycloak.services.model.RequiredCredentialModel;
import org.keycloak.services.model.ResourceModel;
import org.keycloak.services.managers.AuthenticationManager;
import org.keycloak.services.managers.TokenManager;
import org.keycloak.services.models.RealmManager;
import org.keycloak.services.models.RealmModel;
import org.keycloak.services.models.RequiredCredentialModel;
import org.keycloak.services.models.ResourceModel;
import org.picketlink.idm.model.User;
import javax.ws.rs.Consumes;
@ -188,7 +190,7 @@ public class TokenService
{
throw new NotAuthorizedException("Disabled user.");
}
if (authManager.authenticate(realm, user, form))
if (authManager.authenticateForm(realm, user, form))
{
throw new NotAuthorizedException("Auth failed");
}
@ -239,7 +241,7 @@ public class TokenService
return Response.ok("Your account is not enabled").type("text/html").build();
}
boolean authenticated = authManager.authenticate(realm, user, formData);
boolean authenticated = authManager.authenticateForm(realm, user, formData);
if (!authenticated) return loginForm("Unable to authenticate, try again", redirect, clientId, scopeParam, state, realm, client);
SkeletonKeyToken token = null;
@ -322,7 +324,7 @@ public class TokenService
return Response.status(Response.Status.BAD_REQUEST).entity(error).type("application/json").build();
}
boolean authenticated = authManager.authenticate(realm, client, formData);
boolean authenticated = authManager.authenticateForm(realm, client, formData);
if (!authenticated)
{
Map<String, String> error = new HashMap<String, String>();

354
services/src/main/java/org/keycloak/services/service/RealmFactory.java
View file

@ -1,354 +0,0 @@
package org.keycloak.services.service;
import org.keycloak.services.model.RealmManager;
import org.keycloak.representations.idm.RealmRepresentation;
import org.keycloak.services.model.RealmModel;
import org.picketlink.idm.model.User;
import javax.ws.rs.Consumes;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.UriBuilder;
import javax.ws.rs.core.UriInfo;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.util.HashMap;
import java.util.Map;
/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $
*/
@Path("/realmfactory")
public class RealmFactory
{
protected RealmManager adapter;
@Context
protected UriInfo uriInfo;
public RealmFactory(RealmManager adapter)
{
this.adapter = adapter;
}
@POST
@Consumes("application/json")
public Response importDomain(RealmRepresentation rep)
{
RealmModel realm = createRealm(rep);
UriBuilder builder = uriInfo.getRequestUriBuilder().path(realm.getId());
return Response.created(builder.build())
//.entity(RealmResource.realmRep(realm, uriInfo))
.type(MediaType.APPLICATION_JSON_TYPE).build();
}
protected RealmModel createRealm(RealmRepresentation rep)
{
//verifyRealmRepresentation(rep);
RealmModel realm = adapter.create(rep.getRealm());
KeyPair keyPair = null;
try
{
keyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
}
catch (NoSuchAlgorithmException e)
{
throw new RuntimeException(e);
}
realm.setPrivateKey(keyPair.getPrivate());
realm.setPublicKey(keyPair.getPublic());
realm.setName(rep.getRealm());
realm.setEnabled(rep.isEnabled());
realm.setTokenLifespan(rep.getTokenLifespan());
realm.setAccessCodeLifespan(rep.getAccessCodeLifespan());
realm.setSslNotRequired(rep.isSslNotRequired());
realm.updateRealm();
Map<String, User> userMap = new HashMap<String, User>();
return null;
}/*
RoleModel adminRole = identityManager.create(realm, "admin");
for (RequiredCredentialRepresentation requiredCred : rep.getRequiredCredentials())
{
RequiredCredentialModel credential = new RequiredCredentialModel();
credential.setType(requiredCred.getType());
credential.setInput(requiredCred.isInput());
credential.setSecret(requiredCred.isSecret());
identityManager.create(realm, credential);
}
for (UserRepresentation userRep : rep.getUsers())
{
UserModel user = new UserModel();
user.setUsername(userRep.getUsername());
user.setEnabled(userRep.isEnabled());
user = identityManager.create(realm, user);
userMap.put(user.getUsername(), user);
if (userRep.getCredentials() != null)
{
for (UserRepresentation.Credential cred : userRep.getCredentials())
{
UserCredentialModel credential = new UserCredentialModel();
credential.setType(cred.getType());
credential.setValue(cred.getValue());
credential.setHashed(cred.isHashed());
identityManager.create(user, credential);
}
}
if (userRep.getAttributes() != null)
{
for (Map.Entry<String, String> entry : userRep.getAttributes().entrySet())
{
UserAttributeModel attribute = new UserAttributeModel();
attribute.setName(entry.getKey());
attribute.setValue(entry.getValue());
identityManager.create(user, attribute);
}
}
}
for (RoleMappingRepresentation mapping : rep.getRoleMappings())
{
RoleMappingModel roleMapping = createRoleMapping(userMap, mapping);
UserModel user = userMap.get(mapping.getUsername());
identityManager.create(realm, user, roleMapping);
}
if (rep.getScopeMappings() != null)
{
for (ScopeMappingRepresentation scope : rep.getScopeMappings())
{
ScopeMappingModel scopeMapping = createScopeMapping(userMap, scope);
UserModel user = userMap.get(scope.getUsername());
identityManager.create(realm, user, scopeMapping);
}
}
if (rep.getResources() != null)
{
for (ResourceRepresentation resourceRep : rep.getResources())
{
ResourceModel resource = new ResourceModel();
resource.setName(resourceRep.getName());
resource.setSurrogateAuthRequired(resourceRep.isSurrogateAuthRequired());
resource = identityManager.create(realm, resource);
if (resourceRep.getRoles() != null)
{
for (String role : resourceRep.getRoles())
{
RoleModel r = identityManager.create(realm, resource, role);
}
}
if (resourceRep.getRoleMappings() != null)
{
for (RoleMappingRepresentation mapping : resourceRep.getRoleMappings())
{
RoleMappingModel roleMapping = createRoleMapping(userMap, mapping);
UserModel user = userMap.get(mapping.getUsername());
identityManager.create(realm, resource, user, roleMapping);
}
}
if (resourceRep.getScopeMappings() != null)
{
for (ScopeMappingRepresentation mapping : resourceRep.getScopeMappings())
{
ScopeMappingModel scopeMapping = createScopeMapping(userMap, mapping);
UserModel user = userMap.get(mapping.getUsername());
identityManager.create(realm, resource, user, scopeMapping);
}
}
}
}
return realm;
}
protected RoleMappingModel createRoleMapping(Map<String, UserModel> userMap, RoleMappingRepresentation mapping)
{
RoleMappingModel roleMapping = new RoleMappingModel();
UserModel user = userMap.get(mapping.getUsername());
roleMapping.setUserid(user.getId());
if (mapping.getSurrogates() != null)
{
for (String s : mapping.getSurrogates())
{
UserModel surrogate = userMap.get(s);
roleMapping.getSurrogateIds().add(surrogate.getId());
}
}
for (String role : mapping.getRoles())
{
roleMapping.getRoles().add(role);
}
return roleMapping;
}
protected ScopeMappingModel createScopeMapping(Map<String, UserModel> userMap, ScopeMappingRepresentation mapping)
{
ScopeMappingModel scopeMapping = new ScopeMappingModel();
UserModel user = userMap.get(mapping.getUsername());
scopeMapping.setUserid(user.getId());
for (String role : mapping.getRoles())
{
scopeMapping.getRoles().add(role);
}
return scopeMapping;
}
protected void verifyRealmRepresentation(RealmRepresentation rep)
{
if (rep.getUsers() == null)
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("No realm admin users defined for realm").type("text/plain").build());
}
if (rep.getRequiredCredentials() == null)
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("Realm credential requirements not defined").type("text/plain").build());
}
if (rep.getRoleMappings() == null)
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("No realm admin users defined for realm").type("text/plain").build());
}
HashMap<String, UserRepresentation> userReps = new HashMap<String, UserRepresentation>();
for (UserRepresentation userRep : rep.getUsers()) userReps.put(userRep.getUsername(), userRep);
// make sure there is a user that has admin privileges for the realm
Set<UserRepresentation> admins = new HashSet<UserRepresentation>();
for (RoleMappingRepresentation mapping : rep.getRoleMappings())
{
if (!userReps.containsKey(mapping.getUsername()))
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("No users declared for role mapping").type("text/plain").build());
}
for (String role : mapping.getRoles())
{
if (!role.equals("admin"))
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("There is only an 'admin' role for realms").type("text/plain").build());
}
else
{
admins.add(userReps.get(mapping.getUsername()));
}
}
}
if (admins.size() == 0)
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("No realm admin users defined for realm").type("text/plain").build());
}
// override enabled to false if user does not have at least all of browser or client credentials
for (UserRepresentation userRep : rep.getUsers())
{
if (!userRep.isEnabled())
{
admins.remove(userRep);
continue;
}
if (userRep.getCredentials() == null)
{
admins.remove(userRep);
userRep.setEnabled(false);
}
else
{
boolean hasBrowserCredentials = true;
for (RequiredCredentialRepresentation credential : rep.getRequiredCredentials())
{
boolean hasCredential = false;
for (UserRepresentation.Credential cred : userRep.getCredentials())
{
if (cred.getType().equals(credential.getType()))
{
hasCredential = true;
break;
}
}
if (!hasCredential)
{
hasBrowserCredentials = false;
break;
}
}
if (!hasBrowserCredentials)
{
userRep.setEnabled(false);
admins.remove(userRep);
}
}
}
if (admins.size() == 0)
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("No realm admin users are enabled or have appropriate credentials").type("text/plain").build());
}
if (rep.getResources() != null)
{
// check mappings
for (ResourceRepresentation resourceRep : rep.getResources())
{
if (resourceRep.getRoleMappings() != null)
{
for (RoleMappingRepresentation mapping : resourceRep.getRoleMappings())
{
if (!userReps.containsKey(mapping.getUsername()))
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("No users declared for role mapping").type("text/plain").build());
}
if (mapping.getSurrogates() != null)
{
for (String surrogate : mapping.getSurrogates())
{
if (!userReps.containsKey(surrogate))
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("No users declared for role mapping surrogate").type("text/plain").build());
}
}
}
for (String role : mapping.getRoles())
{
if (!resourceRep.getRoles().contains(role))
{
throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
.entity("No resource role for role mapping").type("text/plain").build());
}
}
}
}
}
}
}
*/
}

14
services/src/test/java/org/keycloak/test/AdapterTest.java
View file

@ -7,13 +7,13 @@ import org.junit.FixMethodOrder;
import org.junit.Test;
import org.junit.runners.MethodSorters;
import org.keycloak.representations.idm.RequiredCredentialRepresentation;
import org.keycloak.services.model.RealmManager;
import org.keycloak.services.model.RealmModel;
import org.keycloak.services.model.RealmResourceRelationship;
import org.keycloak.services.model.RequiredCredentialModel;
import org.keycloak.services.model.RequiredCredentialRelationship;
import org.keycloak.services.model.ScopeRelationship;
import org.keycloak.services.model.UserCredentialModel;
import org.keycloak.services.models.RealmManager;
import org.keycloak.services.models.RealmModel;
import org.keycloak.services.models.relationships.RealmResourceRelationship;
import org.keycloak.services.models.RequiredCredentialModel;
import org.keycloak.services.models.relationships.RequiredCredentialRelationship;
import org.keycloak.services.models.relationships.ScopeRelationship;
import org.keycloak.services.models.UserCredentialModel;
import org.picketlink.idm.IdentityManager;
import org.picketlink.idm.config.IdentityConfigurationBuilder;
import org.picketlink.idm.credential.Credentials;