REST API for disable cred type

services/src/main/java/org/keycloak/credential/OTPCredentialProvider.java

@@ -29,7 +29,9 @@ import org.keycloak.models.utils.HmacOTP;
 import org.keycloak.models.utils.TimeBasedOTP;
 
 import java.util.Collections;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -139,6 +141,19 @@ public class OTPCredentialProvider implements CredentialProvider, CredentialInpu
         }
     }
 
+    @Override
+    public Set<String> getDisableableCredentialTypes(RealmModel realm, UserModel user) {
+        if (!getCredentialStore().getStoredCredentialsByType(realm, user, CredentialModel.HOTP).isEmpty()
+        || !getCredentialStore().getStoredCredentialsByType(realm, user, CredentialModel.TOTP).isEmpty()) {
+            Set<String> set = new HashSet<>();
+            set.add(CredentialModel.OTP);
+            return set;
+        } else {
+            return Collections.EMPTY_SET;
+        }
+    }
+
+
     @Override
     public boolean supportsCredentialType(String credentialType) {
         return CredentialModel.OTP.equals(credentialType)

services/src/main/java/org/keycloak/credential/PasswordCredentialProvider.java

@@ -33,8 +33,10 @@ import org.keycloak.policy.PolicyError;
 
 import java.util.Collections;
 import java.util.Comparator;
+import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Set;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -150,6 +152,17 @@ public class PasswordCredentialProvider implements CredentialProvider, Credentia
         expirePassword(realm, user, policy);
     }
 
+    @Override
+    public Set<String> getDisableableCredentialTypes(RealmModel realm, UserModel user) {
+        if (!getCredentialStore().getStoredCredentialsByType(realm, user, CredentialModel.PASSWORD).isEmpty()) {
+            Set<String> set = new HashSet<>();
+            set.add(CredentialModel.PASSWORD);
+            return set;
+        } else {
+            return Collections.EMPTY_SET;
+        }
+    }
+
     @Override
     public boolean supportsCredentialType(String credentialType) {
         return credentialType.equals(CredentialModel.PASSWORD);

services/src/main/java/org/keycloak/credential/UserCredentialStoreManager.java

@@ -35,9 +35,11 @@ import org.keycloak.storage.UserStorageProvider;
 
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.HashSet;
 import java.util.Iterator;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Set;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -196,7 +198,7 @@ public class UserCredentialStoreManager implements UserCredentialManager, OnUser
         }
     }
     @Override
-    public void disableCredential(RealmModel realm, UserModel user, String credentialType) {
+    public void disableCredentialType(RealmModel realm, UserModel user, String credentialType) {
         if (!StorageId.isLocalStorage(user)) {
             String providerId = StorageId.resolveProviderId(user);
             UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, providerId);
@@ -229,6 +231,38 @@ public class UserCredentialStoreManager implements UserCredentialManager, OnUser
 
 
     }
+
+    @Override
+    public Set<String> getDisableableCredentialTypes(RealmModel realm, UserModel user) {
+        Set<String> types = new HashSet<>();
+        if (!StorageId.isLocalStorage(user)) {
+            String providerId = StorageId.resolveProviderId(user);
+            UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, providerId);
+            if (provider instanceof CredentialInputUpdater) {
+                CredentialInputUpdater updater = (CredentialInputUpdater)provider;
+                types.addAll(updater.getDisableableCredentialTypes(realm, user));
+            }
+        } else {
+            UserFederationProvider link = session.users().getFederationLink(realm, user);
+            if (link != null) {
+                types.addAll(link.getDisableableCredentialTypes(realm, user));
+            }
+            else if (user.getFederationLink() != null) {
+                UserStorageProvider provider = UserStorageManager.getStorageProvider(session, realm, user.getFederationLink());
+                if (provider != null && provider instanceof CredentialInputUpdater) {
+                    types.addAll(((CredentialInputUpdater)provider).getDisableableCredentialTypes(realm, user));
+                }
+            }
+
+        }
+
+        List<CredentialInputUpdater> credentialProviders = getCredentialProviders(realm, CredentialInputUpdater.class);
+        for (CredentialInputUpdater updater : credentialProviders) {
+            types.addAll(updater.getDisableableCredentialTypes(realm, user));
+        }
+        return types;
+    }
+
     @Override
     public boolean isConfiguredFor(RealmModel realm, UserModel user, String type) {
         if (!StorageId.isLocalStorage(user)) {

services/src/main/java/org/keycloak/services/resources/AccountService.java

@@ -440,7 +440,7 @@ public class AccountService extends AbstractSecuredLocalService {
         csrfCheck(stateChecker);
 
         UserModel user = auth.getUser();
-        session.userCredentialManager().disableCredential(realm, user, CredentialModel.OTP);
+        session.userCredentialManager().disableCredentialType(realm, user, CredentialModel.OTP);
 
         event.event(EventType.REMOVE_TOTP).client(auth.getClient()).user(auth.getUser()).success();
 

services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java

@@ -719,7 +719,48 @@ public class UsersResource {
 
     }
 
-     /**
+    /**
+     * Disable all credentials for a user of a specific type
+     *
+     * @param id
+     * @param credentialType
+     */
+    @Path("{id}/disable-credential-type/{type}")
+    @DELETE
+    public void disableCredentialType(@PathParam("id") String id, @PathParam("type") String credentialType) {
+        auth.requireManage();
+
+        UserModel user = session.users().getUserById(id, realm);
+        if (user == null) {
+            throw new NotFoundException("User not found");
+        }
+
+        session.userCredentialManager().disableCredentialType(realm, user, credentialType);
+
+    }
+
+    /**
+     * Credential types that are disablable for this user
+     *
+     * @param id
+     * @return
+     */
+    @Path("{id}/disableable-credential-types")
+    @GET
+    @NoCache
+    @Produces(MediaType.APPLICATION_JSON)
+    public Set<String> getCredentialTypes(@PathParam("id") String id) {
+        auth.requireManage();
+
+        UserModel user = session.users().getUserById(id, realm);
+        if (user == null) {
+            throw new NotFoundException("User not found");
+        }
+        return session.userCredentialManager().getDisableableCredentialTypes(realm, user);
+
+    }
+
+    /**
      * Set up a temporary password for the user
      *
      * User will have to reset the temporary password next time they log in.
@@ -777,7 +818,7 @@ public class UsersResource {
             throw new NotFoundException("User not found");
         }
 
-        session.userCredentialManager().disableCredential(realm, user, CredentialModel.OTP);
+        session.userCredentialManager().disableCredentialType(realm, user, CredentialModel.OTP);
         adminEvent.operation(OperationType.ACTION).resourcePath(uriInfo).success();
     }