Examples with LDAPStorageProvider org.keycloak.storage.ldap.LDAPStorageProvider used on opensource projects

Example 16 with LDAPStorageProvider

use of org.keycloak.storage.ldap.LDAPStorageProvider in project keycloak by keycloak.

the class LDAPGroupMapperSyncTest method test03_syncWithDropNonExistingGroups.

@Test
public void test03_syncWithDropNonExistingGroups() throws Exception {
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel realm = ctx.getRealm();
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(realm, ctx.getLdapModel(), "groupsMapper");
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        // KEYCLOAK-11415 - This test requires the group mapper to be configured with preserve group inheritance
        // set to 'true' (the default setting). If preservation of group inheritance isn't configured, some of
        // the previous test(s) failed to cleanup properly. Check the requirement as part of running the test
        Assert.assertEquals(mapperModel.getConfig().getFirst("preserve.group.inheritance"), "true");
        // Sync groups with inheritance
        SynchronizationResult syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(realm);
        LDAPTestAsserts.assertSyncEquals(syncResult, 3, 0, 0, 0);
        // Assert groups are imported to keycloak including their inheritance from LDAP
        GroupModel kcGroup1 = KeycloakModelUtils.findGroupByPath(realm, "/group1");
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group11"));
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group12"));
        Assert.assertEquals(2, kcGroup1.getSubGroupsStream().count());
        // Create some new groups in keycloak
        GroupModel model1 = realm.createGroup("model1");
        GroupModel model2 = realm.createGroup("model2", kcGroup1);
        // Sync groups again from LDAP. Nothing deleted
        syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(realm);
        LDAPTestAsserts.assertSyncEquals(syncResult, 0, 3, 0, 0);
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group11"));
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group12"));
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/model1"));
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/model2"));
        // Update group mapper to drop non-existing groups during sync
        LDAPTestUtils.updateGroupMapperConfigOptions(mapperModel, GroupMapperConfig.DROP_NON_EXISTING_GROUPS_DURING_SYNC, "true");
        realm.updateComponent(mapperModel);
        // Sync groups again from LDAP. Assert LDAP non-existing groups deleted
        syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(realm);
        Assert.assertEquals(3, syncResult.getUpdated());
        Assert.assertTrue(syncResult.getRemoved() == 2);
        // Sync and assert groups updated
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group11"));
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group12"));
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/model1"));
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/model2"));
    });
}

Example 17 with LDAPStorageProvider

use of org.keycloak.storage.ldap.LDAPStorageProvider in project keycloak by keycloak.

the class LDAPGroupMapperSyncTest method test02_syncWithGroupInheritance.

@Test
public void test02_syncWithGroupInheritance() throws Exception {
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel realm = ctx.getRealm();
        String descriptionAttrName = LDAPTestUtils.getGroupDescriptionLDAPAttrName(ctx.getLdapProvider());
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(realm, ctx.getLdapModel(), "groupsMapper");
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        GroupLDAPStorageMapper groupMapper = LDAPTestUtils.getGroupMapper(mapperModel, ldapProvider, realm);
        // KEYCLOAK-11415 - This test requires the group mapper to be configured with preserve group inheritance
        // set to 'true' (the default setting). If preservation of group inheritance isn't configured, some of
        // the previous test(s) failed to cleanup properly. Check the requirement as part of running the test
        Assert.assertEquals(mapperModel.getConfig().getFirst("preserve.group.inheritance"), "true");
        // Sync groups with inheritance
        SynchronizationResult syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(realm);
        LDAPTestAsserts.assertSyncEquals(syncResult, 3, 0, 0, 0);
        // Assert groups are imported to keycloak including their inheritance from LDAP
        GroupModel kcGroup1 = KeycloakModelUtils.findGroupByPath(realm, "/group1");
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/group11"));
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/group12"));
        GroupModel kcGroup11 = KeycloakModelUtils.findGroupByPath(realm, "/group1/group11");
        GroupModel kcGroup12 = KeycloakModelUtils.findGroupByPath(realm, "/group1/group12");
        Assert.assertEquals(2, kcGroup1.getSubGroupsStream().count());
        Assert.assertEquals("group1 - description", kcGroup1.getFirstAttribute(descriptionAttrName));
        Assert.assertNull(kcGroup11.getFirstAttribute(descriptionAttrName));
        Assert.assertEquals("group12 - description", kcGroup12.getFirstAttribute(descriptionAttrName));
        // Update description attributes in LDAP
        LDAPObject group1 = groupMapper.loadLDAPGroupByName("group1");
        group1.setSingleAttribute(descriptionAttrName, "group1 - changed description");
        ldapProvider.getLdapIdentityStore().update(group1);
        LDAPObject group12 = groupMapper.loadLDAPGroupByName("group12");
        group12.setAttribute(descriptionAttrName, null);
        ldapProvider.getLdapIdentityStore().update(group12);
        // Sync and assert groups updated
        syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(realm);
        LDAPTestAsserts.assertSyncEquals(syncResult, 0, 3, 0, 0);
        // Assert attributes changed in keycloak
        kcGroup1 = KeycloakModelUtils.findGroupByPath(realm, "/group1");
        kcGroup12 = KeycloakModelUtils.findGroupByPath(realm, "/group1/group12");
        Assert.assertEquals("group1 - changed description", kcGroup1.getFirstAttribute(descriptionAttrName));
        Assert.assertNull(kcGroup12.getFirstAttribute(descriptionAttrName));
    });
}

Example 18 with LDAPStorageProvider

use of org.keycloak.storage.ldap.LDAPStorageProvider in project keycloak by keycloak.

the class LDAPGroupMapperSyncTest method test06_ldapGroupsSyncHasLinearTimeComplexity.

// KEYCLOAK-8253 - Test if synchronization of large number of LDAP groups takes linear time
@Ignore("This test is not suitable for regular CI testing due to higher time / performance demand")
@Test
public void test06_ldapGroupsSyncHasLinearTimeComplexity() throws Exception {
    // Count of LDAP groups to test the duration of the sync operation. Defaults to 30k unless overridden via system property
    final int GROUPS_COUNT = (System.getProperties().containsKey(TEST_LDAP_GROUPS_SYNC_LINEAR_TIME_GROUPS_COUNT)) ? Integer.valueOf(System.getProperty(TEST_LDAP_GROUPS_SYNC_LINEAR_TIME_GROUPS_COUNT)) : 30000;
    // Period on how often (per how many groups) to perform the LDAP groups sync test & report the results back.
    // Defaults to 1k unless overridden via system property
    final int TEST_PERIOD = (System.getProperties().containsKey(TEST_LDAP_GROUPS_SYNC_LINEAR_TIME_TEST_PERIOD)) ? Integer.valueOf(System.getProperty(TEST_LDAP_GROUPS_SYNC_LINEAR_TIME_TEST_PERIOD)) : 1000;
    // Reset 'batchSizeForSync' configuration option to the default value of 'LDAPConstants.BATCH_SIZE_FOR_SYNC'
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        ctx.getLdapModel().put(LDAPConstants.BATCH_SIZE_FOR_SYNC, Integer.toString(1000));
        ctx.getRealm().updateComponent(ctx.getLdapModel());
        // Set group mapper to skip preservation of inheritance to test group creation
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(ctx.getRealm(), ctx.getLdapModel(), "groupsMapper");
        LDAPTestUtils.updateGroupMapperConfigOptions(mapperModel, GroupMapperConfig.PRESERVE_GROUP_INHERITANCE, "false");
        ctx.getRealm().updateComponent(mapperModel);
    });
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "groupsMapper");
        String descriptionAttrName = getGroupDescriptionLDAPAttrName(ctx.getLdapProvider());
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        GroupLDAPStorageMapper groupMapper = LDAPTestUtils.getGroupMapper(mapperModel, ldapProvider, appRealm);
        // Remove all LDAP groups
        LDAPTestUtils.removeAllLDAPGroups(session, appRealm, ctx.getLdapModel(), "groupsMapper");
        /* The following for loop doesn't really test true time it took to synchronize N * TEST_PERIOD LDAP groups.
             * Instead of that, in this test only time of syncing last TEST_PERIOD groups is reported. The previously
             *  created groups, existing as the result of (N-1)-th iteration are "just" updated.
             *  Also see NOTE: and the subsequent for loop, commented out, below for details.
             */
        Long elapsedTime = new Long(0);
        for (int i = 1; i <= GROUPS_COUNT; i++) {
            LDAPTestUtils.createLDAPGroup(session, appRealm, ctx.getLdapModel(), String.format("group-%s", i), descriptionAttrName, String.format("Testing group-%s, created at: %s", i, new Date().toString()));
            if (i != 0 && i % TEST_PERIOD == 0) {
                // Start the timer
                elapsedTime = new Date().getTime();
                // Sync the LDAP groups
                groupMapper.syncDataFromFederationProviderToKeycloak(appRealm);
                elapsedTime = new Date().getTime() - elapsedTime;
                logger.debugf("Synced %s LDAP groups in %s ms", Long.valueOf(i), elapsedTime);
            }
        }
    /* NOTE: The nested for loop below would be better test to check duration of groups syncing,
             *       since it would delete the LDAP groups created in (N - 1)-th iteration, create count
             *       of LDAP required by N-th iteration, and report back the syncing time. But it is commented
             *       out, because in the current form Apache DS always returns HTTP 505 Internal Server error for
             *       upon reaching 3k groups - in 3-th iteration of the main for loop
             *
            long elapsedTime = new Long(0);
            for (int i = 1; i <= GROUPS_COUNT; i++) {
                int groupsPerIteration = i * TEST_PERIOD;
                logger.debugf("Creating %s LDAP groups", groupsPerIteration);
                for (int j = 1; j <= groupsPerIteration; j++) {
                    LDAPTestUtils.createLDAPGroup(session,
                                                  appRealm,
                                                  ctx.getLdapModel(),
                                                  String.format("group-%s", j),
                                                  descriptionAttrName,
                                                  String.format("Testing group-%s, created at: %s", j, new Date().toString())
                    );
                }
                logger.debugf("Done creating %s LDAP groups!", groupsPerIteration);
                elapsedTime = new Date().getTime();
                groupMapper.syncDataFromFederationProviderToKeycloak(appRealm);
                logger.debugf("Synced %s LDAP groups in %s ms", groupsPerIteration, new Date().getTime() - elapsedTime);
                if (appRealm.getTopLevelGroups().size() != 0) {
                    LDAPTestUtils.removeAllLDAPGroups(session, appRealm, ctx.getLdapModel(), "groupsMapper");
                }
            }*/
    });
}

Example 19 with LDAPStorageProvider

use of org.keycloak.storage.ldap.LDAPStorageProvider in project keycloak by keycloak.

the class LDAPGroupMapperTest method test08_ldapOnlyGroupMappingsRanged.

@Test
public void test08_ldapOnlyGroupMappingsRanged() {
    testingClient.server().run(session -> {
        // try to do 3 pages (30+30+1)
        int membersToTest = 61;
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "groupsMapper");
        LDAPTestUtils.updateGroupMapperConfigOptions(mapperModel, GroupMapperConfig.MODE, LDAPGroupMapperMode.LDAP_ONLY.toString());
        appRealm.updateComponent(mapperModel);
        // Ignoring this test on ActiveDirectory and rhds as it's currently impossible to import more than 60 users without timeout
        LDAPConfig ldapConfig = ctx.getLdapProvider().getLdapIdentityStore().getConfig();
        if (ldapConfig.isActiveDirectory() || LDAPConstants.VENDOR_RHDS.equals(ldapConfig.getVendor())) {
            return;
        }
        // create big grups that use ranged search
        String descriptionAttrName = getGroupDescriptionLDAPAttrName(ctx.getLdapProvider());
        LDAPObject bigGroup = LDAPTestUtils.createLDAPGroup(session, appRealm, ctx.getLdapModel(), "biggroup", descriptionAttrName, "biggroup - description");
        // create the users to use range search and add them to the group
        for (int i = 0; i < membersToTest; i++) {
            String username = String.format("user%02d", i);
            LDAPObject user = LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), appRealm, username, username, username, username + "@email.org", null, "1234");
            LDAPUtils.addMember(ctx.getLdapProvider(), MembershipType.DN, LDAPConstants.MEMBER, "not-used", bigGroup, user);
        }
        // check if ranged intercetor is in place and working
        GroupMapperConfig config = new GroupMapperConfig(mapperModel);
        bigGroup = LDAPGroupMapperTest.searchObjectInBase(ctx.getLdapProvider(), bigGroup.getDn().toString(), config.getMembershipLdapAttribute());
        Assert.assertNotNull(bigGroup.getAttributes().get(config.getMembershipLdapAttribute()));
        Assert.assertFalse(bigGroup.isRangeComplete(config.getMembershipLdapAttribute()));
        Assert.assertTrue(membersToTest > bigGroup.getAttributeAsSet(config.getMembershipLdapAttribute()).size());
        Assert.assertEquals(bigGroup.getCurrentRange(config.getMembershipLdapAttribute()), bigGroup.getAttributeAsSet(config.getMembershipLdapAttribute()).size() - 1);
        // now check the population of ranged attributes is OK
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        GroupLDAPStorageMapper groupMapper = LDAPTestUtils.getGroupMapper(mapperModel, ldapProvider, appRealm);
        groupMapper.syncDataFromFederationProviderToKeycloak(appRealm);
        GroupModel kcBigGroup = KeycloakModelUtils.findGroupByPath(appRealm, "/biggroup");
        // check all the users have the group assigned
        for (int i = 0; i < membersToTest; i++) {
            UserModel kcUser = session.users().getUserByUsername(appRealm, String.format("user%02d", i));
            Assert.assertTrue("User contains biggroup " + i, kcUser.getGroupsStream().collect(Collectors.toSet()).contains(kcBigGroup));
        }
        // check the group contains all the users as member
        List<UserModel> groupMembers = session.users().getGroupMembersStream(appRealm, kcBigGroup, 0, membersToTest).collect(Collectors.toList());
        Assert.assertEquals(membersToTest, groupMembers.size());
        Set<String> usernames = groupMembers.stream().map(u -> u.getUsername()).collect(Collectors.toSet());
        for (int i = 0; i < membersToTest; i++) {
            Assert.assertTrue("Group contains user " + i, usernames.contains(String.format("user%02d", i)));
        }
    });
}

Example 20 with LDAPStorageProvider

use of org.keycloak.storage.ldap.LDAPStorageProvider in project keycloak by keycloak.

the class LDAPProvidersIntegrationNoImportTest method testFullNameMapperWriteOnly.

@Test
public void testFullNameMapperWriteOnly() {
    ComponentRepresentation firstNameMapperRep = testingClient.server().fetch(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        // assert that user "fullnameUser" is not in local DB
        Assert.assertNull(session.users().getUserByUsername(appRealm, "fullname"));
        // Add the user with some fullName into LDAP directly. Ensure that fullName is saved into "cn" attribute in LDAP (currently mapped to model firstName)
        ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(appRealm);
        LDAPStorageProvider ldapFedProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
        LDAPTestUtils.addLDAPUser(ldapFedProvider, appRealm, "fullname", "James Dee", "Dee", "fullname@email.org", null, "4578");
        // add fullname mapper to the provider and remove "firstNameMapper". For this test, we will simply map full name to the LDAP attribute, which was before firstName ( "givenName" on active directory, "cn" on other LDAP servers)
        ComponentModel firstNameMapper = LDAPTestUtils.getSubcomponentByName(appRealm, ldapModel, "first name");
        String ldapFirstNameAttributeName = firstNameMapper.getConfig().getFirst(UserAttributeLDAPStorageMapper.LDAP_ATTRIBUTE);
        appRealm.removeComponent(firstNameMapper);
        ComponentRepresentation firstNameMapperRepp = ModelToRepresentation.toRepresentation(session, firstNameMapper, true);
        ComponentModel fullNameMapperModel = KeycloakModelUtils.createComponentModel("full name", ldapModel.getId(), FullNameLDAPStorageMapperFactory.PROVIDER_ID, LDAPStorageMapper.class.getName(), FullNameLDAPStorageMapper.LDAP_FULL_NAME_ATTRIBUTE, ldapFirstNameAttributeName, FullNameLDAPStorageMapper.READ_ONLY, "false");
        appRealm.addComponentModel(fullNameMapperModel);
        return firstNameMapperRepp;
    }, ComponentRepresentation.class);
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        // Assert user is successfully imported in Keycloak DB now with correct firstName and lastName
        LDAPTestAsserts.assertUserImported(session.users(), appRealm, "fullname", "James", "Dee", "fullname@email.org", "4578");
        // change mapper to writeOnly
        ComponentModel fullNameMapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "full name");
        fullNameMapperModel.getConfig().putSingle(FullNameLDAPStorageMapper.WRITE_ONLY, "true");
        appRealm.updateComponent(fullNameMapperModel);
    });
    // User will be changed in LDAP too
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        UserModel fullnameUser = session.users().getUserByUsername(appRealm, "fullname");
        fullnameUser.setFirstName("James2");
        fullnameUser.setLastName("Dee2");
    });
    // Assert changed user available in Keycloak, but his firstName is null (due the fullnameMapper is write-only and firstName mapper is removed)
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        // Assert user is successfully imported in Keycloak DB now with correct firstName and lastName
        LDAPTestAsserts.assertUserImported(session.users(), appRealm, "fullname", null, "Dee2", "fullname@email.org", "4578");
        // Remove "fullnameUser" to assert he is removed from LDAP. Revert mappers to previous state
        UserModel fullnameUser = session.users().getUserByUsername(appRealm, "fullname");
        session.users().removeUser(appRealm, fullnameUser);
        // Revert mappers
        ComponentModel fullNameMapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "full name");
        appRealm.removeComponent(fullNameMapperModel);
    });
    firstNameMapperRep.setId(null);
    Response response = testRealm().components().add(firstNameMapperRep);
    Assert.assertEquals(201, response.getStatus());
    response.close();
}