Merge remote-tracking branch 'upstream/master'

model/api/src/main/java/org/keycloak/mappers/UserFederationMapper.java

@@ -1,5 +1,10 @@
 package org.keycloak.mappers;
 
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserFederationMapperModel;
+import org.keycloak.models.UserFederationProvider;
+import org.keycloak.models.UserFederationSyncResult;
 import org.keycloak.provider.Provider;
 
 /**
@@ -7,4 +12,28 @@ import org.keycloak.provider.Provider;
  */
 public interface UserFederationMapper extends Provider {
 
+    /**
+     * Sync data from federation storage to Keycloak. It's useful just if mapper needs some data preloaded from federation storage (For example
+     * load roles from federation provider and sync them to Keycloak database)
+     *
+     * Applicable just if sync is supported (see UserFederationMapperFactory.getSyncConfig() )
+     *
+     * @see UserFederationMapperFactory#getSyncConfig()
+     * @param mapperModel
+     * @param federationProvider
+     * @param session
+     * @param realm
+     */
+    UserFederationSyncResult syncDataFromFederationProviderToKeycloak(UserFederationMapperModel mapperModel, UserFederationProvider federationProvider, KeycloakSession session, RealmModel realm);
+
+    /**
+     * Sync data from Keycloak back to federation storage
+     *
+     * @see UserFederationMapperFactory#getSyncConfig()
+     * @param mapperModel
+     * @param federationProvider
+     * @param session
+     * @param realm
+     */
+    UserFederationSyncResult syncDataFromKeycloakToFederationProvider(UserFederationMapperModel mapperModel, UserFederationProvider federationProvider, KeycloakSession session, RealmModel realm);
 }

model/api/src/main/java/org/keycloak/mappers/UserFederationMapperFactory.java

@@ -1,12 +1,9 @@
 package org.keycloak.mappers;
 
-import java.util.List;
-
-import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserFederationMapperModel;
 import org.keycloak.provider.ConfiguredProvider;
-import org.keycloak.provider.ProviderConfigProperty;
 import org.keycloak.provider.ProviderFactory;
+import org.keycloak.representations.idm.UserFederationMapperSyncConfigRepresentation;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -23,6 +20,14 @@ public interface UserFederationMapperFactory extends ProviderFactory<UserFederat
     String getDisplayCategory();
     String getDisplayType();
 
+    /**
+     * Specifies if mapper supports sync data from federation storage to keycloak and viceversa.
+     * Also specifies messages to be displayed in admin console UI (For example "Sync roles from LDAP" etc)
+     *
+     * @return syncConfig representation
+     */
+    UserFederationMapperSyncConfigRepresentation getSyncConfig();
+
     /**
      * Called when instance of mapperModel is created for this factory through admin endpoint
      *

model/api/src/main/java/org/keycloak/models/LDAPConstants.java

@@ -87,6 +87,8 @@ public class LDAPConstants {
     public static final String CREATE_TIMESTAMP = "createTimestamp";
     public static final String MODIFY_TIMESTAMP = "modifyTimestamp";
 
+    public static final String LDAP_MATCHING_RULE_IN_CHAIN = ":1.2.840.113556.1.4.1941:";
+
     public static String getUuidAttributeName(String vendor) {
         if (vendor != null) {
             switch (vendor) {

model/api/src/main/java/org/keycloak/models/RealmModel.java

@@ -29,12 +29,6 @@ public interface RealmModel extends RoleContainerModel {
         RealmModel getRealm();
     }
 
-    interface UserFederationMapperEvent extends ProviderEvent {
-        UserFederationMapperModel getFederationMapper();
-        RealmModel getRealm();
-        KeycloakSession getSession();
-    }
-
     String getId();
 
     String getName();

model/api/src/main/java/org/keycloak/models/UserFederationMapperEventImpl.java

@@ -1,33 +0,0 @@
-package org.keycloak.models;
-
-/**
- * Called during creation or update of UserFederationMapperModel
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class UserFederationMapperEventImpl implements RealmModel.UserFederationMapperEvent {
-
-    private final UserFederationMapperModel mapperModel;
-    private final RealmModel realm;
-    private final KeycloakSession session;
-
-    public UserFederationMapperEventImpl(UserFederationMapperModel mapperModel, RealmModel realm, KeycloakSession session) {
-        this.mapperModel = mapperModel;
-        this.realm = realm;
-        this.session = session;
-    }
-
-    @Override
-    public UserFederationMapperModel getFederationMapper() {
-        return mapperModel;
-    }
-
-    @Override
-    public RealmModel getRealm() {
-        return realm;
-    }
-
-    public KeycloakSession getSession() {
-        return session;
-    }
-}

model/api/src/main/java/org/keycloak/models/utils/DefaultAuthenticationFlows.java

@@ -24,6 +24,7 @@ public class DefaultAuthenticationFlows {
     public static final String DIRECT_GRANT_FLOW = "direct grant";
     public static final String RESET_CREDENTIALS_FLOW = "reset credentials";
     public static final String LOGIN_FORMS_FLOW = "forms";
+    public static final String SAML_ECP_FLOW = "saml ecp";
 
     public static final String CLIENT_AUTHENTICATION_FLOW = "clients";
     public static final String FIRST_BROKER_LOGIN_FLOW = "first broker login";
@@ -39,6 +40,7 @@ public class DefaultAuthenticationFlows {
         if (realm.getFlowByAlias(RESET_CREDENTIALS_FLOW) == null) resetCredentialsFlow(realm);
         if (realm.getFlowByAlias(CLIENT_AUTHENTICATION_FLOW) == null) clientAuthFlow(realm);
         if (realm.getFlowByAlias(FIRST_BROKER_LOGIN_FLOW) == null) firstBrokerLoginFlow(realm, false);
+        if (realm.getFlowByAlias(SAML_ECP_FLOW) == null) samlEcpProfile(realm);
     }
     public static void migrateFlows(RealmModel realm) {
         if (realm.getFlowByAlias(BROWSER_FLOW) == null) browserFlow(realm, true);
@@ -47,6 +49,7 @@ public class DefaultAuthenticationFlows {
         if (realm.getFlowByAlias(RESET_CREDENTIALS_FLOW) == null) resetCredentialsFlow(realm);
         if (realm.getFlowByAlias(CLIENT_AUTHENTICATION_FLOW) == null) clientAuthFlow(realm);
         if (realm.getFlowByAlias(FIRST_BROKER_LOGIN_FLOW) == null) firstBrokerLoginFlow(realm, true);
+        if (realm.getFlowByAlias(SAML_ECP_FLOW) == null) samlEcpProfile(realm);
     }
 
     public static void registrationFlow(RealmModel realm) {
@@ -447,4 +450,25 @@ public class DefaultAuthenticationFlows {
         execution.setAuthenticatorFlow(false);
         realm.addAuthenticatorExecution(execution);
     }
+
+    public static void samlEcpProfile(RealmModel realm) {
+        AuthenticationFlowModel ecpFlow = new AuthenticationFlowModel();
+
+        ecpFlow.setAlias(SAML_ECP_FLOW);
+        ecpFlow.setDescription("SAML ECP Profile Authentication Flow");
+        ecpFlow.setProviderId("basic-flow");
+        ecpFlow.setTopLevel(true);
+        ecpFlow.setBuiltIn(true);
+        ecpFlow = realm.addAuthenticationFlow(ecpFlow);
+
+        AuthenticationExecutionModel execution = new AuthenticationExecutionModel();
+
+        execution.setParentFlow(ecpFlow.getId());
+        execution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED);
+        execution.setAuthenticator("http-basic-authenticator");
+        execution.setPriority(10);
+        execution.setAuthenticatorFlow(false);
+
+        realm.addAuthenticatorExecution(execution);
+    }
 }

model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java

@@ -1,6 +1,5 @@
 package org.keycloak.models.jpa;
 
-import org.keycloak.Config;
 import org.keycloak.connections.jpa.util.JpaUtils;
 import org.keycloak.common.enums.SslRequired;
 import org.keycloak.models.AuthenticationExecutionModel;
@@ -19,7 +18,6 @@ import org.keycloak.models.RealmModel;
 import org.keycloak.models.RequiredActionProviderModel;
 import org.keycloak.models.RequiredCredentialModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserFederationMapperEventImpl;
 import org.keycloak.models.UserFederationMapperModel;
 import org.keycloak.models.UserFederationProviderCreationEventImpl;
 import org.keycloak.models.UserFederationProviderModel;
@@ -1542,8 +1540,6 @@ public class RealmAdapter implements RealmModel {
         this.realm.getUserFederationMappers().add(entity);
         UserFederationMapperModel mapperModel = entityToModel(entity);
 
-        session.getKeycloakSessionFactory().publish(new UserFederationMapperEventImpl(mapperModel, this, session));
-
         return mapperModel;
     }
 
@@ -1598,8 +1594,6 @@ public class RealmAdapter implements RealmModel {
             entity.getConfig().putAll(mapper.getConfig());
         }
         em.flush();
-
-        session.getKeycloakSessionFactory().publish(new UserFederationMapperEventImpl(mapper, this, session));
     }
 
     @Override

model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RealmAdapter.java

@@ -22,7 +22,6 @@ import org.keycloak.models.RealmProvider;
 import org.keycloak.models.RequiredActionProviderModel;
 import org.keycloak.models.RequiredCredentialModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserFederationMapperEventImpl;
 import org.keycloak.models.UserFederationMapperModel;
 import org.keycloak.models.UserFederationProviderCreationEventImpl;
 import org.keycloak.models.UserFederationProviderModel;
@@ -1930,8 +1929,6 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
         updateMongoEntity();
         UserFederationMapperModel mapperModel = entityToModel(entity);
 
-        session.getKeycloakSessionFactory().publish(new UserFederationMapperEventImpl(mapperModel, this, session));
-
         return mapperModel;
     }
 
@@ -1986,8 +1983,6 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
             entity.getConfig().putAll(mapper.getConfig());
         }
         updateMongoEntity();
-
-        session.getKeycloakSessionFactory().publish(new UserFederationMapperEventImpl(mapper, this, session));
     }
 
     @Override