KEYCLOAK-2178 KEYCLOAK-1744 Added MSADUserAccountControlMapper. Removing enableUserAccountControlAfterPasswordUpdate option

model/api/src/main/java/org/keycloak/migration/MigrationModel.java

@@ -1,7 +1,5 @@
 package org.keycloak.migration;
 
-import org.keycloak.provider.Provider;
-import org.keycloak.provider.ProviderFactory;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -11,7 +9,7 @@ public interface MigrationModel {
     /**
      * Must have the form of major.minor.micro as the version is parsed and numbers are compared
      */
-    public static final String LATEST_VERSION = "1.7.0";
+    String LATEST_VERSION = "1.8.0";
 
     String getStoredVersion();
     void setStoredVersion(String version);

model/api/src/main/java/org/keycloak/migration/MigrationModelManager.java

@@ -6,6 +6,7 @@ import org.keycloak.migration.migrators.MigrateTo1_4_0;
 import org.keycloak.migration.migrators.MigrateTo1_5_0;
 import org.keycloak.migration.migrators.MigrateTo1_6_0;
 import org.keycloak.migration.migrators.MigrateTo1_7_0;
+import org.keycloak.migration.migrators.MigrateTo1_8_0;
 import org.keycloak.migration.migrators.MigrationTo1_2_0_CR1;
 import org.keycloak.models.KeycloakSession;
 
@@ -61,6 +62,12 @@ public class MigrationModelManager {
             }
             new MigrateTo1_7_0().migrate(session);
         }
+        if (stored == null || stored.lessThan(MigrateTo1_8_0.VERSION)) {
+            if (stored != null) {
+                logger.debug("Migrating older model to 1.8.0 updates");
+            }
+            new MigrateTo1_8_0().migrate(session);
+        }
 
         model.setStoredVersion(MigrationModel.LATEST_VERSION);
     }

model/api/src/main/java/org/keycloak/migration/migrators/MigrateTo1_8_0.java

@@ -0,0 +1,48 @@
+package org.keycloak.migration.migrators;
+
+import java.util.List;
+import java.util.Map;
+import org.keycloak.migration.ModelVersion;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.LDAPConstants;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserFederationMapperModel;
+import org.keycloak.models.UserFederationProviderModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class MigrateTo1_8_0 {
+
+    public static final ModelVersion VERSION = new ModelVersion("1.8.0");
+
+    public void migrate(KeycloakSession session) {
+        List<RealmModel> realms = session.realms().getRealms();
+        for (RealmModel realm : realms) {
+
+            List<UserFederationProviderModel> federationProviders = realm.getUserFederationProviders();
+            for (UserFederationProviderModel fedProvider : federationProviders) {
+
+                if (fedProvider.getProviderName().equals(LDAPConstants.LDAP_PROVIDER)) {
+                    Map<String, String> config = fedProvider.getConfig();
+
+                    if (isActiveDirectory(config)) {
+
+                        // Create mapper for MSAD account controls
+                        if (realm.getUserFederationMapperByName(fedProvider.getId(), "MSAD account controls") == null) {
+                            UserFederationMapperModel mapperModel = KeycloakModelUtils.createUserFederationMapperModel("MSAD account controls", fedProvider.getId(), LDAPConstants.MSAD_USER_ACCOUNT_CONTROL_MAPPER);
+                            realm.addUserFederationMapper(mapperModel);
+                        }
+                    }
+                }
+            }
+
+        }
+    }
+
+    private boolean isActiveDirectory(Map<String, String> ldapConfig) {
+        String vendor = ldapConfig.get(LDAPConstants.VENDOR);
+        return vendor != null && vendor.equals(LDAPConstants.VENDOR_ACTIVE_DIRECTORY);
+    }
+}

model/api/src/main/java/org/keycloak/models/LDAPConstants.java

@@ -6,6 +6,7 @@ package org.keycloak.models;
 public class LDAPConstants {
 
     public static final String LDAP_PROVIDER = "ldap";
+    public static final String MSAD_USER_ACCOUNT_CONTROL_MAPPER = "msad-user-account-control-mapper";
 
     public static final String VENDOR = "vendor";
     public static final String VENDOR_RHDS = "rhds";
@@ -43,9 +44,6 @@ public class LDAPConstants {
     // Config option to specify if registrations will be synced or not
     public static final String SYNC_REGISTRATIONS = "syncRegistrations";
 
-    // Applicable just for active directory
-    public static final String USER_ACCOUNT_CONTROLS_AFTER_PASSWORD_UPDATE = "userAccountControlsAfterPasswordUpdate";
-
     // Custom user search filter
     public static final String CUSTOM_USER_SEARCH_FILTER = "customUserSearchFilter";
 
@@ -53,9 +51,6 @@ public class LDAPConstants {
     public static final String LDAP_ID = "LDAP_ID";
     public static final String LDAP_ENTRY_DN = "LDAP_ENTRY_DN";
 
-    // String used in config to divide more possible values (for example more userDns), which are saved in DB as single string
-    public static final String CONFIG_DIVIDER = ":::";
-
     // Those are forked from Picketlink
     public static final String GIVENNAME = "givenName";
     public static final String CN = "cn";
@@ -73,6 +68,8 @@ public class LDAPConstants {
     public static final String GROUP_OF_NAMES = "groupOfNames";
     public static final String GROUP_OF_ENTRIES = "groupOfEntries";
     public static final String GROUP_OF_UNIQUE_NAMES = "groupOfUniqueNames";
+    public static final String USER_ACCOUNT_CONTROL = "userAccountControl";
+    public static final String PWD_LAST_SET = "pwdLastSet";
 
     public static final String COMMA = ",";
     public static final String EQUAL = "=";