Refactoring of AuthenticationProvider SPI

model/tests/src/test/java/org/keycloak/model/test/AuthProvidersExternalModelTest.java

@@ -95,10 +95,10 @@ public class AuthProvidersExternalModelTest extends AbstractModelTest {
             Assert.assertEquals("john@email.org", john2.getEmail());
 
             // Verify link exists
-            Set<AuthenticationLinkModel> authLinks = realm2.getAuthenticationLinks(john2);
-            Assert.assertEquals(1, authLinks.size());
-            AuthenticationLinkModel authLink = authLinks.iterator().next();
+            AuthenticationLinkModel authLink = realm2.getAuthenticationLink(john2);
+            Assert.assertNotNull(authLink);
             Assert.assertEquals(authLink.getAuthProvider(), AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL);
+            Assert.assertEquals(authLink.getAuthUserId(), realm1.getUser("john").getId());
         } finally {
             ResteasyProviderFactory.clearContextData();
         }
@@ -110,14 +110,19 @@ public class AuthProvidersExternalModelTest extends AbstractModelTest {
         // Add externalModel authenticationProvider into realm2 and point to realm1
         setupAuthenticationProviders();
 
+        // Add john to realm2 and set authentication link
+        UserModel john = realm2.addUser("john");
+        john.setEnabled(true);
+        realm2.setAuthenticationLink(john, new AuthenticationLinkModel(AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL, realm1.getUser("john").getId()));
+
         try {
             // this is needed for externalModel provider
             ResteasyProviderFactory.pushContext(KeycloakSession.class, identitySession);
 
-            // Change credential via realm2 and validate that they are changed in both realms
+            // Change credential via realm2 and validate that they are changed also in realm1
             AuthenticationProviderManager authProviderManager = AuthenticationProviderManager.getManager(realm2);
             try {
-                authProviderManager.updatePassword("john", "password-updated");
+                Assert.assertTrue(authProviderManager.updatePassword(john, "password-updated"));
             } catch (AuthenticationProviderException ape) {
                 ape.printStackTrace();
                 Assert.fail("Error not expected");
@@ -132,14 +137,14 @@ public class AuthProvidersExternalModelTest extends AbstractModelTest {
 
             // Change credential and validate that password is updated just for realm2
             try {
-                authProviderManager.updatePassword("john", "password-updated2");
+                Assert.assertFalse(authProviderManager.updatePassword(john, "password-updated2"));
             } catch (AuthenticationProviderException ape) {
                 ape.printStackTrace();
                 Assert.fail("Error not expected");
             }
             formData = createFormData("john", "password-updated2");
             Assert.assertEquals(AuthenticationManager.AuthenticationStatus.INVALID_CREDENTIALS, am.authenticateForm(realm1, formData));
-            Assert.assertEquals(AuthenticationManager.AuthenticationStatus.SUCCESS, am.authenticateForm(realm2, formData));
+            Assert.assertEquals(AuthenticationManager.AuthenticationStatus.INVALID_CREDENTIALS, am.authenticateForm(realm2, formData));
 
 
             // Allow passwordUpdate propagation again
@@ -148,7 +153,7 @@ public class AuthProvidersExternalModelTest extends AbstractModelTest {
             // Set passwordPolicy for realm1 and verify that password update fail
             realm1.setPasswordPolicy(new PasswordPolicy("length(8)"));
             try {
-                authProviderManager.updatePassword("john", "passw");
+                authProviderManager.updatePassword(john, "passw");
                 Assert.fail("Update not expected to pass");
             } catch (AuthenticationProviderException ape) {
 

model/tests/src/test/java/org/keycloak/model/test/AuthProvidersLDAPTest.java

@@ -95,9 +95,8 @@ public class AuthProvidersLDAPTest extends AbstractModelTest {
             Assert.assertEquals("john@email.org", john.getEmail());
 
             // Verify link exists
-            Set<AuthenticationLinkModel> authLinks = realm.getAuthenticationLinks(john);
-            Assert.assertEquals(1, authLinks.size());
-            AuthenticationLinkModel authLink = authLinks.iterator().next();
+            AuthenticationLinkModel authLink = realm.getAuthenticationLink(john);
+            Assert.assertNotNull(authLink);
             Assert.assertEquals(authLink.getAuthProvider(), AuthProviderConstants.PROVIDER_NAME_PICKETLINK);
         } finally {
             ResteasyProviderFactory.clearContextData();
@@ -114,6 +113,7 @@ public class AuthProvidersLDAPTest extends AbstractModelTest {
 
             // Add some user and password to realm
             UserModel realmUser = realm.addUser("realmUser");
+            realmUser.setEnabled(true);
             UserCredentialModel credential = new UserCredentialModel();
             credential.setType(CredentialRepresentation.PASSWORD);
             credential.setValue("pass");
@@ -135,6 +135,11 @@ public class AuthProvidersLDAPTest extends AbstractModelTest {
             realmUser.setEnabled(false);
             formData = AuthProvidersExternalModelTest.createFormData("realmUser", "pass");
             Assert.assertEquals(AuthenticationManager.AuthenticationStatus.ACCOUNT_DISABLED, am.authenticateForm(realm, formData));
+
+            // Successful authentication
+            realmUser.setEnabled(true);
+            formData = AuthProvidersExternalModelTest.createFormData("realmUser", "pass");
+            Assert.assertEquals(AuthenticationManager.AuthenticationStatus.SUCCESS, am.authenticateForm(realm, formData));
         } finally {
             ResteasyProviderFactory.clearContextData();
         }
@@ -149,26 +154,34 @@ public class AuthProvidersLDAPTest extends AbstractModelTest {
             // this is needed for ldap provider
             ResteasyProviderFactory.pushContext(KeycloakRegistry.class, new KeycloakRegistry());
 
+            LdapTestUtils.setLdapPassword(realm, "john", "password");
+
+            // First authenticate successfully to sync john into realm
+            MultivaluedMap<String, String> formData = AuthProvidersExternalModelTest.createFormData("john", "password");
+            Assert.assertEquals(AuthenticationManager.AuthenticationStatus.SUCCESS, am.authenticateForm(realm, formData));
+
             // Change credential and validate that user can authenticate
             AuthenticationProviderManager authProviderManager = AuthenticationProviderManager.getManager(realm);
+
+            UserModel john = realm.getUser("john");
             try {
-                authProviderManager.updatePassword("john", "password-updated");
+                Assert.assertTrue(authProviderManager.updatePassword(john, "password-updated"));
             } catch (AuthenticationProviderException ape) {
                 ape.printStackTrace();
                 Assert.fail("Error not expected");
             }
-            MultivaluedMap<String, String> formData = AuthProvidersExternalModelTest.createFormData("john", "password-updated");
+            formData = AuthProvidersExternalModelTest.createFormData("john", "password-updated");
             Assert.assertEquals(AuthenticationManager.AuthenticationStatus.SUCCESS, am.authenticateForm(realm, formData));
 
             // Password updated just in LDAP, so validating directly in realm should fail
-            Assert.assertFalse(realm.validatePassword(realm.getUser("john"), "password-updated"));
+            Assert.assertFalse(realm.validatePassword(john, "password-updated"));
 
             // Switch to not allow updating passwords in ldap
             AuthProvidersExternalModelTest.setPasswordUpdateForProvider(false, AuthProviderConstants.PROVIDER_NAME_PICKETLINK, realm);
 
             // Change credential and validate that password is not updated
             try {
-                authProviderManager.updatePassword("john", "password-updated2");
+                Assert.assertFalse(authProviderManager.updatePassword(john, "password-updated2"));
             } catch (AuthenticationProviderException ape) {
                 ape.printStackTrace();
                 Assert.fail("Error not expected");

model/tests/src/test/java/org/keycloak/model/test/ImportTest.java

@@ -208,24 +208,9 @@ public class ImportTest extends AbstractModelTest {
         Assert.assertTrue(authProv3.isPasswordUpdateSupported());
 
         // Test authentication linking
-        Set<AuthenticationLinkModel> authLinks = realm.getAuthenticationLinks(socialUser);
-        Assert.assertEquals(2, authLinks.size());
-        boolean plFound = false;
-        boolean extFound = false;
-        for (AuthenticationLinkModel authLinkModel : authLinks) {
-            if (AuthProviderConstants.PROVIDER_NAME_PICKETLINK.equals(authLinkModel.getAuthProvider())) {
-                plFound = true;
-                Assert.assertEquals(authLinkModel.getAuthUserId(), "myUser1");
-            } else if (AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL.equals(authLinkModel.getAuthProvider())) {
-                extFound = true;
-                Assert.assertEquals(authLinkModel.getAuthUserId(), "myUser11");
-            }
-        }
-        Assert.assertTrue(plFound && extFound);
-
-        UserModel foundAuthUser = realm.getUserByAuthenticationLink(new AuthenticationLinkModel(AuthProviderConstants.PROVIDER_NAME_PICKETLINK, "myUser1"));
-        Assert.assertEquals(foundAuthUser.getLoginName(), socialUser.getLoginName());
-        Assert.assertNull(realm.getUserByAuthenticationLink(new AuthenticationLinkModel(AuthProviderConstants.PROVIDER_NAME_PICKETLINK, "not-existing")));
+        AuthenticationLinkModel authLink = realm.getAuthenticationLink(socialUser);
+        Assert.assertEquals(AuthProviderConstants.PROVIDER_NAME_PICKETLINK, authLink.getAuthProvider());
+        Assert.assertEquals("myUser1", authLink.getAuthUserId());
 
         commit();
 

model/tests/src/test/resources/testrealm.json

@@ -75,7 +75,11 @@
         },
         {
             "username": "mySocialUser",
-            "enabled": true
+            "enabled": true,
+            "authenticationLink": {
+                "authProvider": "picketlink",
+                "authUserId": "myUser1"
+            }
         }
     ],
     "socialMappings": [
@@ -100,21 +104,6 @@
             ]
         }
     ],
-    "authenticationMappings": [
-        {
-            "username": "mySocialUser",
-            "authenticationLinks": [
-                {
-                    "authProvider": "picketlink",
-                    "authUserId": "myUser1"
-                },
-                {
-                    "authProvider": "externalModel",
-                    "authUserId": "myUser11"
-                }
-            ]
-        }
-    ],
     "applications": [
         {
             "name": "Application",