Examples with LDAPQuery org.keycloak.storage.ldap.idm.query.internal.LDAPQuery used on opensource projects

Example 1 with LDAPQuery

use of org.keycloak.storage.ldap.idm.query.internal.LDAPQuery in project keycloak by keycloak.

the class RoleLDAPStorageMapper method syncDataFromKeycloakToFederationProvider.

// Sync roles from Keycloak back to LDAP
@Override
public SynchronizationResult syncDataFromKeycloakToFederationProvider(RealmModel realm) {
    SynchronizationResult syncResult = new SynchronizationResult() {

        @Override
        public String getStatus() {
            return String.format("%d roles imported to LDAP, %d roles already existed in LDAP", getAdded(), getUpdated());
        }
    };
    if (config.getMode() != LDAPGroupMapperMode.LDAP_ONLY) {
        logger.warnf("Ignored sync for federation mapper '%s' as it's mode is '%s'", mapperModel.getName(), config.getMode().toString());
        return syncResult;
    }
    logger.debugf("Syncing roles from Keycloak into LDAP. Mapper is [%s], LDAP provider is [%s]", mapperModel.getName(), ldapProvider.getModel().getName());
    // Send LDAP query to see which roles exists there
    try (LDAPQuery ldapQuery = createRoleQuery(false)) {
        List<LDAPObject> ldapRoles = LDAPUtils.loadAllLDAPObjects(ldapQuery, ldapProvider);
        Set<String> ldapRoleNames = new HashSet<>();
        String rolesRdnAttr = config.getRoleNameLdapAttribute();
        for (LDAPObject ldapRole : ldapRoles) {
            String roleName = ldapRole.getAttributeAsString(rolesRdnAttr);
            ldapRoleNames.add(roleName);
        }
        RoleContainerModel roleContainer = getTargetRoleContainer(realm);
        Stream<RoleModel> keycloakRoles = roleContainer.getRolesStream();
        Consumer<String> syncRoleFromKCToLDAP = roleName -> {
            if (ldapRoleNames.contains(roleName)) {
                syncResult.increaseUpdated();
            } else {
                logger.debugf("Syncing role [%s] from Keycloak to LDAP", roleName);
                createLDAPRole(roleName);
                syncResult.increaseAdded();
            }
        };
        keycloakRoles.map(RoleModel::getName).forEach(syncRoleFromKCToLDAP);
        return syncResult;
    }
}

Example 2 with LDAPQuery

use of org.keycloak.storage.ldap.idm.query.internal.LDAPQuery in project keycloak by keycloak.

the class RoleLDAPStorageMapper method loadRoleGroupByName.

public LDAPObject loadRoleGroupByName(String roleName) {
    try (LDAPQuery ldapQuery = createRoleQuery(true)) {
        Condition roleNameCondition = new LDAPQueryConditionsBuilder().equal(config.getRoleNameLdapAttribute(), roleName);
        ldapQuery.addWhereCondition(roleNameCondition);
        return ldapQuery.getFirstResult();
    }
}

Example 3 with LDAPQuery

use of org.keycloak.storage.ldap.idm.query.internal.LDAPQuery in project keycloak by keycloak.

the class RoleLDAPStorageMapper method syncDataFromFederationProviderToKeycloak.

// Sync roles from LDAP to Keycloak DB
@Override
public SynchronizationResult syncDataFromFederationProviderToKeycloak(RealmModel realm) {
    SynchronizationResult syncResult = new SynchronizationResult() {

        @Override
        public String getStatus() {
            return String.format("%d imported roles, %d roles already exists in Keycloak", getAdded(), getUpdated());
        }
    };
    logger.debugf("Syncing roles from LDAP into Keycloak DB. Mapper is [%s], LDAP provider is [%s]", mapperModel.getName(), ldapProvider.getModel().getName());
    // Send LDAP query to load all roles
    try (LDAPQuery ldapRoleQuery = createRoleQuery(false)) {
        List<LDAPObject> ldapRoles = LDAPUtils.loadAllLDAPObjects(ldapRoleQuery, ldapProvider);
        RoleContainerModel roleContainer = getTargetRoleContainer(realm);
        String rolesRdnAttr = config.getRoleNameLdapAttribute();
        for (LDAPObject ldapRole : ldapRoles) {
            String roleName = ldapRole.getAttributeAsString(rolesRdnAttr);
            if (roleContainer.getRole(roleName) == null) {
                logger.debugf("Syncing role [%s] from LDAP to keycloak DB", roleName);
                roleContainer.addRole(roleName);
                syncResult.increaseAdded();
            } else {
                syncResult.increaseUpdated();
            }
        }
        return syncResult;
    }
}

Example 4 with LDAPQuery

use of org.keycloak.storage.ldap.idm.query.internal.LDAPQuery in project keycloak by keycloak.

the class RoleLDAPStorageMapper method createRoleQuery.

// TODO: Possible to merge with GroupMapper and move to common class
public LDAPQuery createRoleQuery(boolean includeMemberAttribute) {
    LDAPQuery ldapQuery = new LDAPQuery(ldapProvider);
    // For now, use same search scope, which is configured "globally" and used for user's search.
    ldapQuery.setSearchScope(ldapProvider.getLdapIdentityStore().getConfig().getSearchScope());
    String rolesDn = config.getRolesDn();
    ldapQuery.setSearchDn(rolesDn);
    Collection<String> roleObjectClasses = config.getRoleObjectClasses(ldapProvider);
    ldapQuery.addObjectClasses(roleObjectClasses);
    String rolesRdnAttr = config.getRoleNameLdapAttribute();
    String customFilter = config.getCustomLdapFilter();
    if (customFilter != null && customFilter.trim().length() > 0) {
        Condition customFilterCondition = new LDAPQueryConditionsBuilder().addCustomLDAPFilter(customFilter);
        ldapQuery.addWhereCondition(customFilterCondition);
    }
    ldapQuery.addReturningLdapAttribute(rolesRdnAttr);
    // Performance improvement
    if (includeMemberAttribute) {
        String membershipAttr = config.getMembershipLdapAttribute();
        ldapQuery.addReturningLdapAttribute(membershipAttr);
    }
    return ldapQuery;
}

Example 5 with LDAPQuery

use of org.keycloak.storage.ldap.idm.query.internal.LDAPQuery in project keycloak by keycloak.

the class LDAPTestUtils method removeAllLDAPGroups.

public static void removeAllLDAPGroups(KeycloakSession session, RealmModel appRealm, ComponentModel ldapModel, String mapperName) {
    ComponentModel mapperModel = getSubcomponentByName(appRealm, ldapModel, mapperName);
    LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
    LDAPQuery query = null;
    if (GroupLDAPStorageMapperFactory.PROVIDER_ID.equals(mapperModel.getProviderId())) {
        query = getGroupMapper(mapperModel, ldapProvider, appRealm).createGroupQuery(false);
    } else {
        query = getRoleMapper(mapperModel, ldapProvider, appRealm).createRoleQuery(false);
    }
    try (LDAPQuery roleQuery = query) {
        List<LDAPObject> ldapRoles = roleQuery.getResultList();
        for (LDAPObject ldapRole : ldapRoles) {
            ldapProvider.getLdapIdentityStore().remove(ldapRole);
        }
    }
}