Examples with GroupMapperConfig org.keycloak.storage.ldap.mappers.membership.group.GroupMapperConfig used on opensource projects

Example 1 with GroupMapperConfig

use of org.keycloak.storage.ldap.mappers.membership.group.GroupMapperConfig in project keycloak by keycloak.

the class LDAPGroupMapperTest method test08_ldapOnlyGroupMappingsRanged.

@Test
public void test08_ldapOnlyGroupMappingsRanged() {
    testingClient.server().run(session -> {
        // try to do 3 pages (30+30+1)
        int membersToTest = 61;
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "groupsMapper");
        LDAPTestUtils.updateGroupMapperConfigOptions(mapperModel, GroupMapperConfig.MODE, LDAPGroupMapperMode.LDAP_ONLY.toString());
        appRealm.updateComponent(mapperModel);
        // Ignoring this test on ActiveDirectory and rhds as it's currently impossible to import more than 60 users without timeout
        LDAPConfig ldapConfig = ctx.getLdapProvider().getLdapIdentityStore().getConfig();
        if (ldapConfig.isActiveDirectory() || LDAPConstants.VENDOR_RHDS.equals(ldapConfig.getVendor())) {
            return;
        }
        // create big grups that use ranged search
        String descriptionAttrName = getGroupDescriptionLDAPAttrName(ctx.getLdapProvider());
        LDAPObject bigGroup = LDAPTestUtils.createLDAPGroup(session, appRealm, ctx.getLdapModel(), "biggroup", descriptionAttrName, "biggroup - description");
        // create the users to use range search and add them to the group
        for (int i = 0; i < membersToTest; i++) {
            String username = String.format("user%02d", i);
            LDAPObject user = LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), appRealm, username, username, username, username + "@email.org", null, "1234");
            LDAPUtils.addMember(ctx.getLdapProvider(), MembershipType.DN, LDAPConstants.MEMBER, "not-used", bigGroup, user);
        }
        // check if ranged intercetor is in place and working
        GroupMapperConfig config = new GroupMapperConfig(mapperModel);
        bigGroup = LDAPGroupMapperTest.searchObjectInBase(ctx.getLdapProvider(), bigGroup.getDn().toString(), config.getMembershipLdapAttribute());
        Assert.assertNotNull(bigGroup.getAttributes().get(config.getMembershipLdapAttribute()));
        Assert.assertFalse(bigGroup.isRangeComplete(config.getMembershipLdapAttribute()));
        Assert.assertTrue(membersToTest > bigGroup.getAttributeAsSet(config.getMembershipLdapAttribute()).size());
        Assert.assertEquals(bigGroup.getCurrentRange(config.getMembershipLdapAttribute()), bigGroup.getAttributeAsSet(config.getMembershipLdapAttribute()).size() - 1);
        // now check the population of ranged attributes is OK
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        GroupLDAPStorageMapper groupMapper = LDAPTestUtils.getGroupMapper(mapperModel, ldapProvider, appRealm);
        groupMapper.syncDataFromFederationProviderToKeycloak(appRealm);
        GroupModel kcBigGroup = KeycloakModelUtils.findGroupByPath(appRealm, "/biggroup");
        // check all the users have the group assigned
        for (int i = 0; i < membersToTest; i++) {
            UserModel kcUser = session.users().getUserByUsername(appRealm, String.format("user%02d", i));
            Assert.assertTrue("User contains biggroup " + i, kcUser.getGroupsStream().collect(Collectors.toSet()).contains(kcBigGroup));
        }
        // check the group contains all the users as member
        List<UserModel> groupMembers = session.users().getGroupMembersStream(appRealm, kcBigGroup, 0, membersToTest).collect(Collectors.toList());
        Assert.assertEquals(membersToTest, groupMembers.size());
        Set<String> usernames = groupMembers.stream().map(u -> u.getUsername()).collect(Collectors.toSet());
        for (int i = 0; i < membersToTest; i++) {
            Assert.assertTrue("Group contains user " + i, usernames.contains(String.format("user%02d", i)));
        }
    });
}

Example 2 with GroupMapperConfig

use of org.keycloak.storage.ldap.mappers.membership.group.GroupMapperConfig in project keycloak by keycloak.

the class LDAPGroupMapperSyncTest method test04_syncNoPreserveGroupInheritanceWithLazySync.

@Test
public void test04_syncNoPreserveGroupInheritanceWithLazySync() throws Exception {
    // Update group mapper to skip preserve inheritance
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(ctx.getRealm(), ctx.getLdapModel(), "groupsMapper");
        LDAPTestUtils.updateGroupMapperConfigOptions(mapperModel, GroupMapperConfig.PRESERVE_GROUP_INHERITANCE, "false");
        ctx.getRealm().updateComponent(mapperModel);
    });
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel realm = ctx.getRealm();
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(realm, ctx.getLdapModel(), "groupsMapper");
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        GroupLDAPStorageMapper groupMapper = LDAPTestUtils.getGroupMapper(mapperModel, ldapProvider, realm);
        // Add user to LDAP and put him as member of group11
        LDAPTestUtils.removeAllLDAPUsers(ldapProvider, realm);
        LDAPObject johnLdap = LDAPTestUtils.addLDAPUser(ldapProvider, realm, "johnkeycloak", "John", "Doe", "john@email.org", null, "1234");
        LDAPTestUtils.updateLDAPPassword(ldapProvider, johnLdap, "Password1");
        GroupMapperConfig groupMapperConfig = new GroupMapperConfig(mapperModel);
        LDAPObject ldapGroup = groupMapper.loadLDAPGroupByName("group11");
        LDAPUtils.addMember(ldapProvider, groupMapperConfig.getMembershipTypeLdapAttribute(), groupMapperConfig.getMembershipLdapAttribute(), groupMapperConfig.getMembershipUserLdapAttribute(ldapProvider.getLdapIdentityStore().getConfig()), ldapGroup, johnLdap);
        // Assert groups not yet imported to Keycloak DB
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/group1"));
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/group11"));
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/group12"));
        // Load user from LDAP to Keycloak DB
        UserModel john = session.users().getUserByUsername(realm, "johnkeycloak");
        Set<GroupModel> johnGroups = john.getGroupsStream().collect(Collectors.toSet());
        // Assert just those groups, which john was memberOf exists because they were lazily created
        GroupModel group1 = KeycloakModelUtils.findGroupByPath(realm, "/group1");
        GroupModel group11 = KeycloakModelUtils.findGroupByPath(realm, "/group11");
        GroupModel group12 = KeycloakModelUtils.findGroupByPath(realm, "/group12");
        Assert.assertNull(group1);
        Assert.assertNotNull(group11);
        Assert.assertNull(group12);
        Assert.assertEquals(1, johnGroups.size());
        Assert.assertTrue(johnGroups.contains(group11));
        // Delete group mapping
        john.leaveGroup(group11);
    });
    // Cleanup - revert (non-default) group mapper config
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(ctx.getRealm(), ctx.getLdapModel(), "groupsMapper");
        LDAPTestUtils.updateGroupMapperConfigOptions(mapperModel, GroupMapperConfig.PRESERVE_GROUP_INHERITANCE, "true");
        ctx.getRealm().updateComponent(mapperModel);
    });
}