libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

Update provider to create documentation entries for its properties

Browse source 
Closes #17565
This commit is contained in:
Alexander Schwartz 2023-03-10 11:09:00 +01:00 committed by Pedro Igor
parent 1a19bdb90c
commit ccec3639ff
1 changed files with 29 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
services/src/main/java/org/keycloak/userprofile/AbstractUserProfileProvider.java
View file

@ -44,6 +44,8 @@ import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory; import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.RealmModel; import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel; import org.keycloak.models.UserModel;
import org.keycloak.provider.ProviderConfigProperty;
import org.keycloak.provider.ProviderConfigurationBuilder;
import org.keycloak.services.messages.Messages; import org.keycloak.services.messages.Messages;
import org.keycloak.userprofile.validator.BlankAttributeValidator; import org.keycloak.userprofile.validator.BlankAttributeValidator;
import org.keycloak.userprofile.validator.BrokeringFederatedUsernameHasValueValidator; import org.keycloak.userprofile.validator.BrokeringFederatedUsernameHasValueValidator;
@ -55,7 +57,6 @@ import org.keycloak.userprofile.validator.RegistrationEmailAsUsernameEmailValueV
import org.keycloak.userprofile.validator.RegistrationEmailAsUsernameUsernameValueValidator; import org.keycloak.userprofile.validator.RegistrationEmailAsUsernameUsernameValueValidator;
import org.keycloak.userprofile.validator.RegistrationUsernameExistsValidator; import org.keycloak.userprofile.validator.RegistrationUsernameExistsValidator;
import org.keycloak.userprofile.validator.UsernameHasValueValidator; import org.keycloak.userprofile.validator.UsernameHasValueValidator;
import org.keycloak.userprofile.validator.UsernameIDNHomographValidator;
import org.keycloak.userprofile.validator.UsernameMutationValidator; import org.keycloak.userprofile.validator.UsernameMutationValidator;
import org.keycloak.validate.ValidatorConfig; import org.keycloak.validate.ValidatorConfig;
import org.keycloak.validate.validators.EmailValidator; import org.keycloak.validate.validators.EmailValidator;
@ -67,6 +68,9 @@ import org.keycloak.validate.validators.EmailValidator;
*/ */
public abstract class AbstractUserProfileProvider<U extends UserProfileProvider> implements UserProfileProvider, UserProfileProviderFactory<U> { public abstract class AbstractUserProfileProvider<U extends UserProfileProvider> implements UserProfileProvider, UserProfileProviderFactory<U> {
public static final String CONFIG_ADMIN_READ_ONLY_ATTRIBUTES = "admin-read-only-attributes";
public static final String CONFIG_READ_ONLY_ATTRIBUTES = "read-only-attributes";
private static boolean editUsernameCondition(AttributeContext c) { private static boolean editUsernameCondition(AttributeContext c) {
KeycloakSession session = c.getSession(); KeycloakSession session = c.getSession();
KeycloakContext context = session.getContext(); KeycloakContext context = session.getContext();
@ -148,10 +152,10 @@ public abstract class AbstractUserProfileProvider<U extends UserProfileProvider>
* There are the declarations for creating the built-in validations for read-only attributes. Regardless of the context where * There are the declarations for creating the built-in validations for read-only attributes. Regardless of the context where
* user profiles are used. They are related to internal attributes with hard conditions on them in terms of management. * user profiles are used. They are related to internal attributes with hard conditions on them in terms of management.
*/ */
private static String[] DEFAULT_READ_ONLY_ATTRIBUTES = { "KERBEROS_PRINCIPAL", "LDAP_ID", "LDAP_ENTRY_DN", "CREATED_TIMESTAMP", "createTimestamp", "modifyTimestamp", "userCertificate", "saml.persistent.name.id.for.*", "ENABLED", "EMAIL_VERIFIED", "disabledReason" }; private static final String[] DEFAULT_READ_ONLY_ATTRIBUTES = { "KERBEROS_PRINCIPAL", "LDAP_ID", "LDAP_ENTRY_DN", "CREATED_TIMESTAMP", "createTimestamp", "modifyTimestamp", "userCertificate", "saml.persistent.name.id.for.*", "ENABLED", "EMAIL_VERIFIED", "disabledReason" };
private static String[] DEFAULT_ADMIN_READ_ONLY_ATTRIBUTES = { "KERBEROS_PRINCIPAL", "LDAP_ID", "LDAP_ENTRY_DN", "CREATED_TIMESTAMP", "createTimestamp", "modifyTimestamp" }; private static final String[] DEFAULT_ADMIN_READ_ONLY_ATTRIBUTES = { "KERBEROS_PRINCIPAL", "LDAP_ID", "LDAP_ENTRY_DN", "CREATED_TIMESTAMP", "createTimestamp", "modifyTimestamp" };
private static Pattern readOnlyAttributesPattern = getRegexPatternString(DEFAULT_READ_ONLY_ATTRIBUTES); private static final Pattern readOnlyAttributesPattern = getRegexPatternString(DEFAULT_READ_ONLY_ATTRIBUTES);
private static Pattern adminReadOnlyAttributesPattern = getRegexPatternString(DEFAULT_ADMIN_READ_ONLY_ATTRIBUTES); private static final Pattern adminReadOnlyAttributesPattern = getRegexPatternString(DEFAULT_ADMIN_READ_ONLY_ATTRIBUTES);
protected final Map<UserProfileContext, UserProfileMetadata> contextualMetadataRegistry; protected final Map<UserProfileContext, UserProfileMetadata> contextualMetadataRegistry;
protected final KeycloakSession session; protected final KeycloakSession session;
@ -190,7 +194,7 @@ public abstract class AbstractUserProfileProvider<U extends UserProfileProvider>
public void init(Config.Scope config) { public void init(Config.Scope config) {
// make sure registry is clear in case of re-deploy // make sure registry is clear in case of re-deploy
contextualMetadataRegistry.clear(); contextualMetadataRegistry.clear();
Pattern pattern = getRegexPatternString(config.getArray("read-only-attributes")); Pattern pattern = getRegexPatternString(config.getArray(CONFIG_READ_ONLY_ATTRIBUTES));
AttributeValidatorMetadata readOnlyValidator = null; AttributeValidatorMetadata readOnlyValidator = null;
if (pattern != null) { if (pattern != null) {
@ -377,7 +381,7 @@ public abstract class AbstractUserProfileProvider<U extends UserProfileProvider>
} }
private UserProfileMetadata createUserResourceValidation(Config.Scope config) { private UserProfileMetadata createUserResourceValidation(Config.Scope config) {
Pattern p = getRegexPatternString(config.getArray("admin-read-only-attributes")); Pattern p = getRegexPatternString(config.getArray(CONFIG_ADMIN_READ_ONLY_ATTRIBUTES));
UserProfileMetadata metadata = new UserProfileMetadata(USER_API); UserProfileMetadata metadata = new UserProfileMetadata(USER_API);
@ -396,4 +400,22 @@ public abstract class AbstractUserProfileProvider<U extends UserProfileProvider>
return metadata; return metadata;
} }
@Override
public List<ProviderConfigProperty> getConfigMetadata() {
return ProviderConfigurationBuilder.create()
.property()
.name(CONFIG_READ_ONLY_ATTRIBUTES)
.type(ProviderConfigProperty.MULTIVALUED_STRING_TYPE)
.helpText("Array of regular expressions to identify fields that should be treated read-only so users can't change them.")
.add()
.property()
.name(CONFIG_ADMIN_READ_ONLY_ATTRIBUTES)
.type(ProviderConfigProperty.MULTIVALUED_STRING_TYPE)
.helpText("Array of regular expressions to identify fields that should be treated read-only so administrators can't change them.")
.add()
.build();
}
} }