KEYCLOAK-1116 KEYCLOAK-1117 JSON migration and removal of ClientModel.claimsMask

model/api/src/main/java/org/keycloak/migration/MigrationProvider.java

@@ -0,0 +1,20 @@
+package org.keycloak.migration;
+
+import java.util.List;
+import org.keycloak.provider.Provider;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+
+/**
+ * Various common utils needed for migration from older version to newer
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface MigrationProvider extends Provider {
+
+    /**
+     * @param claimMask mask used on ClientModel in 1.1.0
+     * @return set of 1.2.0.Beta1 protocol mappers corresponding to given claimMask
+     */
+    List<ProtocolMapperRepresentation> getMappersForClaimMask(Long claimMask);
+
+}

model/api/src/main/java/org/keycloak/migration/MigrationProviderFactory.java

@@ -0,0 +1,9 @@
+package org.keycloak.migration;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface MigrationProviderFactory extends ProviderFactory<MigrationProvider> {
+}

model/api/src/main/java/org/keycloak/migration/MigrationSpi.java

@@ -0,0 +1,26 @@
+package org.keycloak.migration;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class MigrationSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "migration";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return MigrationProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return MigrationProviderFactory.class;
+    }
+}

model/api/src/main/java/org/keycloak/models/ClientModel.java

@@ -30,10 +30,6 @@ public interface ClientModel {
      */
     String getClientId();
 
-    long getAllowedClaimsMask();
-
-    void setAllowedClaimsMask(long mask);
-
     Set<String> getWebOrigins();
 
     void setWebOrigins(Set<String> webOrigins);

model/api/src/main/java/org/keycloak/models/entities/ClientEntity.java

@@ -56,14 +56,6 @@ public class ClientEntity extends AbstractIdentifiableEntity {
         this.secret = secret;
     }
 
-    public long getAllowedClaimsMask() {
-        return allowedClaimsMask;
-    }
-
-    public void setAllowedClaimsMask(long allowedClaimsMask) {
-        this.allowedClaimsMask = allowedClaimsMask;
-    }
-
     public int getNotBefore() {
         return notBefore;
     }

model/api/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java

@@ -178,7 +178,6 @@ public final class KeycloakModelUtils {
         ApplicationModel app = realm.addApplication(name);
         generateSecret(app);
         app.setFullScopeAllowed(true);
-        app.setAllowedClaimsMask(ClaimMask.ALL);
 
         return app;
     }

model/api/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java

@@ -192,21 +192,6 @@ public class ModelToRepresentation {
         return rep;
     }
 
-    public static ClaimRepresentation toRepresentation(ClientModel model) {
-        ClaimRepresentation rep = new ClaimRepresentation();
-        rep.setAddress(ClaimMask.hasAddress(model.getAllowedClaimsMask()));
-        rep.setEmail(ClaimMask.hasEmail(model.getAllowedClaimsMask()));
-        rep.setGender(ClaimMask.hasGender(model.getAllowedClaimsMask()));
-        rep.setLocale(ClaimMask.hasLocale(model.getAllowedClaimsMask()));
-        rep.setName(ClaimMask.hasName(model.getAllowedClaimsMask()));
-        rep.setPhone(ClaimMask.hasPhone(model.getAllowedClaimsMask()));
-        rep.setPicture(ClaimMask.hasPicture(model.getAllowedClaimsMask()));
-        rep.setProfile(ClaimMask.hasProfile(model.getAllowedClaimsMask()));
-        rep.setWebsite(ClaimMask.hasWebsite(model.getAllowedClaimsMask()));
-        rep.setUsername(ClaimMask.hasUsername(model.getAllowedClaimsMask()));
-        return rep;
-    }
-
     public static FederatedIdentityRepresentation toRepresentation(FederatedIdentityModel socialLink) {
         FederatedIdentityRepresentation rep = new FederatedIdentityRepresentation();
         rep.setUserName(socialLink.getUserName());

model/api/src/main/java/org/keycloak/models/utils/RepresentationToModel.java

@@ -3,6 +3,7 @@ package org.keycloak.models.utils;
 import net.iharder.Base64;
 import org.jboss.logging.Logger;
 import org.keycloak.enums.SslRequired;
+import org.keycloak.migration.MigrationProvider;
 import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.BrowserSecurityHeaders;
 import org.keycloak.models.ClaimMask;
@@ -129,7 +130,7 @@ public class RepresentationToModel {
         importIdentityProviders(rep, newRealm);
 
         if (rep.getApplications() != null) {
-            Map<String, ApplicationModel> appMap = createApplications(rep, newRealm);
+            Map<String, ApplicationModel> appMap = createApplications(session, rep, newRealm);
         }
 
         if (rep.getRoles() != null) {
@@ -189,7 +190,7 @@ public class RepresentationToModel {
         }
 
         if (rep.getOauthClients() != null) {
-            createOAuthClients(rep, newRealm);
+            createOAuthClients(session, rep, newRealm);
         }
 
 
@@ -302,6 +303,7 @@ public class RepresentationToModel {
                 federatedIdentity.setIdentityProvider(social.getSocialProvider());
                 federatedIdentity.setUserId(social.getSocialUserId());
                 federatedIdentity.setUserName(social.getSocialUsername());
+                federatedIdentities.add(federatedIdentity);
             }
             user.setFederatedIdentities(federatedIdentities);
         }
@@ -309,6 +311,16 @@ public class RepresentationToModel {
         user.setSocialLinks(null);
     }
 
+    private static List<ProtocolMapperRepresentation> convertDeprecatedClaimsMask(KeycloakSession session, ClaimRepresentation claimRep) {
+        if (claimRep == null) {
+            return null;
+        }
+
+        long mask = getClaimsMask(claimRep);
+        MigrationProvider migrationProvider = session.getProvider(MigrationProvider.class);
+        return migrationProvider.getMappersForClaimMask(mask);
+    }
+
     public static void updateRealm(RealmRepresentation rep, RealmModel realm) {
         if (rep.getRealm() != null) {
             realm.setName(rep.getRealm());
@@ -435,10 +447,10 @@ public class RepresentationToModel {
 
     // APPLICATIONS
 
-    private static Map<String, ApplicationModel> createApplications(RealmRepresentation rep, RealmModel realm) {
+    private static Map<String, ApplicationModel> createApplications(KeycloakSession session, RealmRepresentation rep, RealmModel realm) {
         Map<String, ApplicationModel> appMap = new HashMap<String, ApplicationModel>();
         for (ApplicationRepresentation resourceRep : rep.getApplications()) {
-            ApplicationModel app = createApplication(realm, resourceRep, false);
+            ApplicationModel app = createApplication(session, realm, resourceRep, false);
             appMap.put(app.getName(), app);
         }
         return appMap;
@@ -451,8 +463,16 @@ public class RepresentationToModel {
      * @param resourceRep
      * @return
      */
-    public static ApplicationModel createApplication(RealmModel realm, ApplicationRepresentation resourceRep, boolean addDefaultRoles) {
+    public static ApplicationModel createApplication(KeycloakSession session, RealmModel realm, ApplicationRepresentation resourceRep, boolean addDefaultRoles) {
         logger.debug("************ CREATE APPLICATION: {0}" + resourceRep.getName());
+
+        if (resourceRep.getProtocolMappers() == null) {
+            List<ProtocolMapperRepresentation> convertedProtocolMappers = convertDeprecatedClaimsMask(session, resourceRep.getClaims());
+            if (convertedProtocolMappers != null) {
+                resourceRep.setProtocolMappers(convertedProtocolMappers);
+            }
+        }
+
         ApplicationModel applicationModel = resourceRep.getId()!=null ? realm.addApplication(resourceRep.getId(), resourceRep.getName()) : realm.addApplication(resourceRep.getName());
         if (resourceRep.isEnabled() != null) applicationModel.setEnabled(resourceRep.isEnabled());
         applicationModel.setManagementUrl(resourceRep.getAdminUrl());
@@ -595,8 +615,9 @@ public class RepresentationToModel {
         updateClientIdentityProviders(rep.getIdentityProviders(), resource);
     }
 
-    public static void setClaims(ClientModel model, ClaimRepresentation rep) {
-        long mask = model.getAllowedClaimsMask();
+    public static long getClaimsMask(ClaimRepresentation rep) {
+        long mask = ClaimMask.ALL;
+
         if (rep.getAddress()) {
             mask |= ClaimMask.ADDRESS;
         } else {
@@ -647,14 +668,14 @@ public class RepresentationToModel {
         } else {
             mask &= ~ClaimMask.WEBSITE;
         }
-        model.setAllowedClaimsMask(mask);
+        return mask;
     }
 
     // OAuth clients
 
-    private static void createOAuthClients(RealmRepresentation realmRep, RealmModel realm) {
+    private static void createOAuthClients(KeycloakSession session, RealmRepresentation realmRep, RealmModel realm) {
         for (OAuthClientRepresentation rep : realmRep.getOauthClients()) {
-            createOAuthClient(rep, realm);
+            createOAuthClient(session, rep, realm);
         }
     }
 
@@ -664,25 +685,29 @@ public class RepresentationToModel {
         return model;
     }
 
-    public static OAuthClientModel createOAuthClient(OAuthClientRepresentation rep, RealmModel realm) {
+    public static OAuthClientModel createOAuthClient(KeycloakSession session, OAuthClientRepresentation rep, RealmModel realm) {
         OAuthClientModel model = createOAuthClient(rep.getId(), rep.getName(), realm);
 
         model.updateIdentityProviders(toModel(rep.getIdentityProviders(), realm));
 
-        updateOAuthClient(rep, model);
+        updateOAuthClient(session, rep, model);
         return model;
     }
 
-    public static void updateOAuthClient(OAuthClientRepresentation rep, OAuthClientModel model) {
+    public static void updateOAuthClient(KeycloakSession session, OAuthClientRepresentation rep, OAuthClientModel model) {
+        if (rep.getProtocolMappers() == null) {
+            List<ProtocolMapperRepresentation> convertedProtocolMappers = convertDeprecatedClaimsMask(session, rep.getClaims());
+            if (convertedProtocolMappers != null) {
+                rep.setProtocolMappers(convertedProtocolMappers);
+            }
+        }
+
         if (rep.getName() != null) model.setClientId(rep.getName());
         if (rep.isEnabled() != null) model.setEnabled(rep.isEnabled());
         if (rep.isPublicClient() != null) model.setPublicClient(rep.isPublicClient());
         if (rep.isFrontchannelLogout() != null) model.setFrontchannelLogout(rep.isFrontchannelLogout());
         if (rep.isFullScopeAllowed() != null) model.setFullScopeAllowed(rep.isFullScopeAllowed());
         if (rep.isDirectGrantsOnly() != null) model.setDirectGrantsOnly(rep.isDirectGrantsOnly());
-        if (rep.getClaims() != null) {
-            setClaims(model, rep.getClaims());
-        }
         if (rep.getNotBefore() != null) {
             model.setNotBefore(rep.getNotBefore());
         }

model/api/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -1,4 +1,5 @@
 org.keycloak.models.UserFederationSpi
 org.keycloak.models.RealmSpi
 org.keycloak.models.UserSessionSpi
-org.keycloak.models.UserSpi
+org.keycloak.models.UserSpi
+org.keycloak.migration.MigrationSpi