Examples with GroupModel org.keycloak.models.GroupModel used on opensource projects

Example 21 with GroupModel

use of org.keycloak.models.GroupModel in project keycloak by keycloak.

the class GroupSynchronizer method synchronize.

@Override
public void synchronize(GroupModel.GroupRemovedEvent event, KeycloakSessionFactory factory) {
    ProviderFactory<AuthorizationProvider> providerFactory = factory.getProviderFactory(AuthorizationProvider.class);
    AuthorizationProvider authorizationProvider = providerFactory.create(event.getKeycloakSession());
    StoreFactory storeFactory = authorizationProvider.getStoreFactory();
    PolicyStore policyStore = storeFactory.getPolicyStore();
    GroupModel group = event.getGroup();
    Map<Policy.FilterOption, String[]> attributes = new EnumMap<>(Policy.FilterOption.class);
    attributes.put(Policy.FilterOption.TYPE, new String[] { "group" });
    attributes.put(Policy.FilterOption.CONFIG, new String[] { "groups", group.getId() });
    attributes.put(Policy.FilterOption.ANY_OWNER, Policy.FilterOption.EMPTY_FILTER);
    List<Policy> search = policyStore.findByResourceServer(attributes, null, -1, -1);
    for (Policy policy : search) {
        PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType());
        GroupPolicyRepresentation representation = GroupPolicyRepresentation.class.cast(policyFactory.toRepresentation(policy, authorizationProvider));
        Set<GroupPolicyRepresentation.GroupDefinition> groups = representation.getGroups();
        groups.removeIf(groupDefinition -> groupDefinition.getId().equals(group.getId()));
        if (groups.isEmpty()) {
            policyFactory.onRemove(policy, authorizationProvider);
            policyStore.delete(policy.getId());
        } else {
            policyFactory.onUpdate(policy, representation, authorizationProvider);
        }
    }
}

Example 22 with GroupModel

use of org.keycloak.models.GroupModel in project keycloak by keycloak.

the class AbstractClaimToGroupMapper method updateBrokeredUser.

@Override
public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
    GroupModel group = this.getGroup(realm, mapperModel);
    String groupId = mapperModel.getConfig().get(ConfigConstants.GROUP);
    if (!context.hasMapperAssignedGroup(groupId)) {
        if (applies(mapperModel, context)) {
            context.addMapperAssignedGroup(groupId);
            user.joinGroup(group);
        } else {
            user.leaveGroup(group);
        }
    }
}

Example 23 with GroupModel

use of org.keycloak.models.GroupModel in project keycloak by keycloak.

the class GroupAdapter method getSubGroupsStream.

@Override
public Stream<GroupModel> getSubGroupsStream() {
    if (isUpdated())
        return updated.getSubGroupsStream();
    Set<GroupModel> subGroups = new HashSet<>();
    for (String id : cached.getSubGroups(modelSupplier)) {
        GroupModel subGroup = keycloakSession.groups().getGroupById(realm, id);
        if (subGroup == null) {
            // chance that role was removed, so just delegate to persistence and get user invalidated
            getDelegateForUpdate();
            return updated.getSubGroupsStream();
        }
        subGroups.add(subGroup);
    }
    return subGroups.stream();
}

Example 24 with GroupModel

use of org.keycloak.models.GroupModel in project keycloak by keycloak.

the class LDAPSpecialCharsTest method test03_specialCharUserJoiningSpecialCharGroup.

@Test
public void test03_specialCharUserJoiningSpecialCharGroup() {
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "groupsMapper");
        LDAPTestUtils.updateGroupMapperConfigOptions(mapperModel, GroupMapperConfig.MODE, LDAPGroupMapperMode.LDAP_ONLY.toString());
        appRealm.updateComponent(mapperModel);
        UserModel specialUser = session.users().getUserByUsername(appRealm, "jamees,key*cložak)ppp");
        Assert.assertNotNull(specialUser);
        // 1 - Grant some groups in LDAP
        // This group should already exists as it was imported from LDAP
        GroupModel specialGroup = KeycloakModelUtils.findGroupByPath(appRealm, "/group-spec,ia*l_characžter)s");
        Assert.assertNotNull(specialGroup);
        specialUser.joinGroup(specialGroup);
        GroupModel groupWithSlashes = KeycloakModelUtils.findGroupByPath(appRealm, "/group/with/three/slashes");
        Assert.assertNotNull(groupWithSlashes);
        specialUser.joinGroup(groupWithSlashes);
        // 2 - Check that group mappings are in LDAP and hence available through federation
        Set<GroupModel> userGroups = specialUser.getGroupsStream().collect(Collectors.toSet());
        Assert.assertEquals(2, userGroups.size());
        Assert.assertTrue(userGroups.contains(specialGroup));
        // 3 - Check through userProvider
        List<UserModel> groupMembers = session.users().getGroupMembersStream(appRealm, specialGroup, 0, 10).collect(Collectors.toList());
        Assert.assertEquals(1, groupMembers.size());
        Assert.assertEquals("jamees,key*cložak)ppp", groupMembers.get(0).getUsername());
        groupMembers = session.users().getGroupMembersStream(appRealm, groupWithSlashes, 0, 10).collect(Collectors.toList());
        Assert.assertEquals(1, groupMembers.size());
        Assert.assertEquals("jamees,key*cložak)ppp", groupMembers.get(0).getUsername());
        // 4 - Delete some group mappings and check they are deleted
        specialUser.leaveGroup(specialGroup);
        specialUser.leaveGroup(groupWithSlashes);
        Assert.assertEquals(0, specialUser.getGroupsStream().count());
    });
}

Example 25 with GroupModel

use of org.keycloak.models.GroupModel in project keycloak by keycloak.

the class LDAPGroupMapperTest method test02_readOnlyGroupMappings.

protected void test02_readOnlyGroupMappings(boolean importEnabled) {
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "groupsMapper");
        LDAPTestUtils.updateGroupMapperConfigOptions(mapperModel, GroupMapperConfig.MODE, LDAPGroupMapperMode.READ_ONLY.toString());
        appRealm.updateComponent(mapperModel);
        GroupModel group1 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1");
        GroupModel group11 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group11");
        // Add some group mappings directly into LDAP
        GroupLDAPStorageMapper groupMapper = LDAPTestUtils.getGroupMapper(mapperModel, ctx.getLdapProvider(), appRealm);
        LDAPObject maryLdap = ctx.getLdapProvider().loadLDAPUserByUsername(appRealm, "marykeycloak");
        groupMapper.addGroupMappingInLDAP(appRealm, group1, maryLdap);
        groupMapper.addGroupMappingInLDAP(appRealm, group11, maryLdap);
    });
    if (importEnabled) {
        testingClient.server().run(session -> {
            LDAPTestContext ctx = LDAPTestContext.init(session);
            RealmModel appRealm = ctx.getRealm();
            UserModel mary = session.users().getUserByUsername(appRealm, "marykeycloak");
            GroupModel group1 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1");
            GroupModel group11 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group11");
            GroupModel group12 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group12");
            // Add some group mapping to model
            mary.joinGroup(group12);
            // Assert that mary has both LDAP and DB mapped groups
            Set<GroupModel> maryGroups = mary.getGroupsStream().collect(Collectors.toSet());
            Assert.assertEquals(5, maryGroups.size());
            Assert.assertTrue(maryGroups.contains(group1));
            Assert.assertTrue(maryGroups.contains(group11));
            Assert.assertTrue(maryGroups.contains(group12));
            long groupCount = mary.getGroupsCount();
            Assert.assertEquals(5, groupCount);
            Assert.assertEquals(5, mary.getGroupsStream("gr", 0, 10).count());
            Assert.assertEquals(4, mary.getGroupsStream("gr", 1, 10).count());
            Assert.assertEquals(1, mary.getGroupsStream("gr", 0, 1).count());
            Assert.assertEquals(2, mary.getGroupsStream("12", 0, 10).count());
        });
    } else {
        testingClient.server().run(session -> {
            LDAPTestContext ctx = LDAPTestContext.init(session);
            RealmModel appRealm = ctx.getRealm();
            UserModel mary = session.users().getUserByUsername(appRealm, "marykeycloak");
            GroupModel group12 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group12");
            // as it is not allowed to update group mappings in LDAP nor in the DB
            try {
                mary.joinGroup(group12);
                Assert.fail("Not expected to successfully add group12 in no-import mode and READ_ONLY mode of the group mapper");
            } catch (ModelException me) {
            // Ignore
            }
        });
        testingClient.server().run(session -> {
            LDAPTestContext ctx = LDAPTestContext.init(session);
            RealmModel appRealm = ctx.getRealm();
            UserModel mary = session.users().getUserByUsername(appRealm, "marykeycloak");
            GroupModel group1 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1");
            GroupModel group11 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group11");
            GroupModel group12 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group12");
            // Assert that mary has both LDAP and DB mapped groups
            Set<GroupModel> maryGroups = mary.getGroupsStream().collect(Collectors.toSet());
            Assert.assertEquals(4, maryGroups.size());
            Assert.assertTrue(maryGroups.contains(group1));
            Assert.assertTrue(maryGroups.contains(group11));
            Assert.assertFalse(maryGroups.contains(group12));
            long groupCount = mary.getGroupsCount();
            Assert.assertEquals(4, groupCount);
            Assert.assertEquals(4, mary.getGroupsStream("gr", 0, 10).count());
            Assert.assertEquals(3, mary.getGroupsStream("gr", 1, 10).count());
            Assert.assertEquals(1, mary.getGroupsStream("gr", 0, 1).count());
            Assert.assertEquals(1, mary.getGroupsStream("12", 0, 10).count());
        });
    }
    // Assert that access through DB will have just DB mapped groups
    if (importEnabled) {
        testingClient.server().run(session -> {
            LDAPTestContext ctx = LDAPTestContext.init(session);
            RealmModel appRealm = ctx.getRealm();
            GroupModel group1 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1");
            GroupModel group11 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group11");
            GroupModel group12 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group12");
            UserModel maryDB = session.userLocalStorage().getUserByUsername(appRealm, "marykeycloak");
            Set<GroupModel> maryDBGroups = maryDB.getGroupsStream().collect(Collectors.toSet());
            Assert.assertFalse(maryDBGroups.contains(group1));
            Assert.assertFalse(maryDBGroups.contains(group11));
            Assert.assertTrue(maryDBGroups.contains(group12));
            Assert.assertEquals(3, maryDB.getGroupsStream("Gr", 0, 10).count());
            Assert.assertEquals(2, maryDB.getGroupsStream("Gr", 1, 10).count());
            Assert.assertEquals(1, maryDB.getGroupsStream("Gr", 0, 1).count());
            Assert.assertEquals(2, maryDB.getGroupsStream("12", 0, 10).count());
            long dbGroupCount = maryDB.getGroupsCount();
            Assert.assertEquals(3, dbGroupCount);
            // Test the group mapping available for group12
            List<UserModel> group12Members = session.users().getGroupMembersStream(appRealm, group12, 0, 10).collect(Collectors.toList());
            Assert.assertEquals(1, group12Members.size());
            Assert.assertEquals("marykeycloak", group12Members.get(0).getUsername());
            UserModel mary = session.users().getUserByUsername(appRealm, "marykeycloak");
            mary.leaveGroup(group12);
        });
    } else {
        testingClient.server().run(session -> {
            LDAPTestContext ctx = LDAPTestContext.init(session);
            RealmModel appRealm = ctx.getRealm();
            GroupModel group12 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group12");
            // Test the group mapping NOT available for group12
            Stream<UserModel> group12Members = session.users().getGroupMembersStream(appRealm, group12, 0, 10);
            Assert.assertEquals(0, group12Members.count());
        });
    }
    // Check through userProvider
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        GroupModel group1 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1");
        GroupModel group11 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group11");
        GroupModel group12 = KeycloakModelUtils.findGroupByPath(appRealm, "/group1/group12");
        UserModel john = session.users().getUserByUsername(appRealm, "johnkeycloak");
        UserModel mary = session.users().getUserByUsername(appRealm, "marykeycloak");
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "groupsMapper");
        GroupLDAPStorageMapper groupMapper = LDAPTestUtils.getGroupMapper(mapperModel, ctx.getLdapProvider(), appRealm);
        LDAPObject maryLdap = ctx.getLdapProvider().loadLDAPUserByUsername(appRealm, "marykeycloak");
        List<UserModel> group1Members = session.users().getGroupMembersStream(appRealm, group1, 0, 10).collect(Collectors.toList());
        List<UserModel> group11Members = session.users().getGroupMembersStream(appRealm, group11, 0, 10).collect(Collectors.toList());
        Assert.assertEquals(1, group1Members.size());
        Assert.assertEquals("marykeycloak", group1Members.get(0).getUsername());
        Assert.assertEquals(1, group11Members.size());
        Assert.assertEquals("marykeycloak", group11Members.get(0).getUsername());
        try {
            mary.leaveGroup(group1);
            Assert.fail("It wasn't expected to successfully delete LDAP group mappings in READ_ONLY mode");
        } catch (ModelException expected) {
        }
        // Delete group mappings directly in LDAP
        LDAPObject ldapGroup = groupMapper.loadLDAPGroupByName("group1");
        groupMapper.deleteGroupMappingInLDAP(maryLdap, ldapGroup);
        ldapGroup = groupMapper.loadLDAPGroupByName("group11");
        groupMapper.deleteGroupMappingInLDAP(maryLdap, ldapGroup);
    });
}