Examples with SynchronizationResult org.keycloak.storage.user.SynchronizationResult used on opensource projects

Example 11 with SynchronizationResult

use of org.keycloak.storage.user.SynchronizationResult in project keycloak by keycloak.

the class SyncFederationTest method test01PeriodicSyncOnCreate.

/**
 * Test that period sync is triggered when creating a synchronized User Storage Provider
 */
@Test
public void test01PeriodicSyncOnCreate() {
    final Map<String, Integer> state = testingClient.server().fetch(session -> {
        KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
        DummyUserFederationProviderFactory dummyFedFactory = (DummyUserFederationProviderFactory) sessionFactory.getProviderFactory(UserStorageProvider.class, DummyUserFederationProviderFactory.PROVIDER_NAME);
        int full = dummyFedFactory.getFullSyncCounter();
        int changed = dummyFedFactory.getChangedSyncCounter();
        Map<String, Integer> state1 = new HashMap<>();
        state1.put("full", full);
        state1.put("changed", changed);
        return state1;
    }, Map.class);
    // Enable timer for SyncDummyUserFederationProvider
    testingClient.server().run(session -> {
        RealmModel appRealm = session.realms().getRealmByName(AuthRealm.TEST);
        UserStorageProviderModel model = new UserStorageProviderModel();
        model.setProviderId(DummyUserFederationProviderFactory.PROVIDER_NAME);
        model.setPriority(1);
        model.setName("test-sync-dummy");
        model.setFullSyncPeriod(-1);
        model.setChangedSyncPeriod(1);
        model.setLastSync(0);
        ComponentModel dummyModel = new UserStorageProviderModel(appRealm.addComponentModel(model));
    });
    testingClient.server().run(session -> {
        RealmModel appRealm = session.realms().getRealmByName(AuthRealm.TEST);
        UserStorageProviderModel dummyModel = findDummyProviderModel(appRealm);
        KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
        DummyUserFederationProviderFactory dummyFedFactory = (DummyUserFederationProviderFactory) sessionFactory.getProviderFactory(UserStorageProvider.class, DummyUserFederationProviderFactory.PROVIDER_NAME);
        // Assert that after some period was DummyUserFederationProvider triggered
        UserStorageSyncManager usersSyncManager = new UserStorageSyncManager();
        sleep(1800);
        // Cancel timer
        usersSyncManager.notifyToRefreshPeriodicSync(session, appRealm, dummyModel, true);
        log.infof("Notified sync manager about cancel periodic sync");
        // This sync is here just to ensure that we have lock (doublecheck that periodic sync, which was possibly triggered before canceling timer is finished too)
        while (true) {
            SynchronizationResult result = usersSyncManager.syncChangedUsers(session.getKeycloakSessionFactory(), appRealm.getId(), dummyModel);
            if (result.isIgnored()) {
                log.infof("Still waiting for lock before periodic sync is finished", result.toString());
                sleep(1000);
            } else {
                break;
            }
        }
        int full = state.get("full");
        int changed = state.get("changed");
        // Assert that DummyUserFederationProviderFactory.syncChangedUsers was invoked at least 2 times (once periodically and once for us)
        int newChanged = dummyFedFactory.getChangedSyncCounter();
        Assert.assertEquals(full, dummyFedFactory.getFullSyncCounter());
        Assert.assertTrue("Assertion failed. newChanged=" + newChanged + ", changed=" + changed, newChanged > (changed + 1));
        // Assert that dummy provider won't be invoked anymore
        sleep(1800);
        Assert.assertEquals(full, dummyFedFactory.getFullSyncCounter());
        int newestChanged = dummyFedFactory.getChangedSyncCounter();
        Assert.assertEquals("Assertion failed. newChanged=" + newChanged + ", newestChanged=" + newestChanged, newChanged, newestChanged);
    });
    // remove dummyProvider
    testingClient.server().run(session -> {
        RealmModel appRealm = session.realms().getRealmByName(AuthRealm.TEST);
        UserStorageProviderModel dummyModel = findDummyProviderModel(appRealm);
        appRealm.removeComponent(dummyModel);
    });
}

Example 12 with SynchronizationResult

use of org.keycloak.storage.user.SynchronizationResult in project keycloak by keycloak.

the class SyncFederationTest method test02PeriodicSyncOnUpdate.

/**
 * Test that period sync is triggered when updating a synchronized User Storage Provider to have a non-negative sync period
 */
@Test
public void test02PeriodicSyncOnUpdate() {
    final Map<String, Integer> state = testingClient.server().fetch(session -> {
        KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
        DummyUserFederationProviderFactory dummyFedFactory = (DummyUserFederationProviderFactory) sessionFactory.getProviderFactory(UserStorageProvider.class, DummyUserFederationProviderFactory.PROVIDER_NAME);
        int full = dummyFedFactory.getFullSyncCounter();
        int changed = dummyFedFactory.getChangedSyncCounter();
        Map<String, Integer> state1 = new HashMap<>();
        state1.put("full", full);
        state1.put("changed", changed);
        return state1;
    }, Map.class);
    // Configure sync without timer for SyncDummyUserFederationProvider
    testingClient.server().run(session -> {
        RealmModel appRealm = session.realms().getRealmByName(AuthRealm.TEST);
        UserStorageProviderModel model = new UserStorageProviderModel();
        model.setProviderId(DummyUserFederationProviderFactory.PROVIDER_NAME);
        model.setPriority(1);
        model.setName("test-sync-dummy");
        model.setFullSyncPeriod(-1);
        model.setChangedSyncPeriod(-1);
        model.setLastSync(0);
        ComponentModel dummyModel = new UserStorageProviderModel(appRealm.addComponentModel(model));
    });
    testingClient.server().run(session -> {
        KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
        DummyUserFederationProviderFactory dummyFedFactory = (DummyUserFederationProviderFactory) sessionFactory.getProviderFactory(UserStorageProvider.class, DummyUserFederationProviderFactory.PROVIDER_NAME);
        // Assert that after some period was DummyUserFederationProvider triggered
        UserStorageSyncManager usersSyncManager = new UserStorageSyncManager();
        // Assert that dummy provider wasn't invoked anymore
        sleep(1800);
        int full = state.get("full");
        int changed = state.get("changed");
        Assert.assertEquals(full, dummyFedFactory.getFullSyncCounter());
        int newChanged = dummyFedFactory.getChangedSyncCounter();
        Assert.assertEquals("Assertion failed. changed=" + changed + ", newChanged=" + newChanged, changed, newChanged);
    });
    // Re-enable periodic sync for changed users
    testingClient.server().run(session -> {
        RealmModel appRealm = session.realms().getRealmByName(AuthRealm.TEST);
        UserStorageProviderModel dummyModel = findDummyProviderModel(appRealm);
        dummyModel.setChangedSyncPeriod(1);
        appRealm.updateComponent(dummyModel);
    });
    testingClient.server().run(session -> {
        RealmModel appRealm = session.realms().getRealmByName(AuthRealm.TEST);
        UserStorageProviderModel dummyModel = findDummyProviderModel(appRealm);
        KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
        DummyUserFederationProviderFactory dummyFedFactory = (DummyUserFederationProviderFactory) sessionFactory.getProviderFactory(UserStorageProvider.class, DummyUserFederationProviderFactory.PROVIDER_NAME);
        // Assert that after some period was DummyUserFederationProvider triggered
        UserStorageSyncManager usersSyncManager = new UserStorageSyncManager();
        sleep(1800);
        // Cancel timer
        usersSyncManager.notifyToRefreshPeriodicSync(session, appRealm, dummyModel, true);
        log.infof("Notified sync manager about cancel periodic sync");
        // This sync is here just to ensure that we have lock (doublecheck that periodic sync, which was possibly triggered before canceling timer is finished too)
        while (true) {
            SynchronizationResult result = usersSyncManager.syncChangedUsers(session.getKeycloakSessionFactory(), appRealm.getId(), dummyModel);
            if (result.isIgnored()) {
                log.infof("Still waiting for lock before periodic sync is finished", result.toString());
                sleep(1000);
            } else {
                break;
            }
        }
        int full = state.get("full");
        int changed = state.get("changed");
        // Assert that DummyUserFederationProviderFactory.syncChangedUsers was invoked at least 1 time
        int newChanged = dummyFedFactory.getChangedSyncCounter();
        Assert.assertEquals(full, dummyFedFactory.getFullSyncCounter());
        log.info("Asserting. newChanged=" + newChanged + " > changed=" + changed);
        Assert.assertTrue("Assertion failed. newChanged=" + newChanged + ", changed=" + changed, newChanged > (changed + 1));
        // Assert that dummy provider won't be invoked anymore
        sleep(1800);
        Assert.assertEquals(full, dummyFedFactory.getFullSyncCounter());
        int newestChanged = dummyFedFactory.getChangedSyncCounter();
        Assert.assertEquals("Assertion failed. newChanged=" + newChanged + ", newestChanged=" + newestChanged, newChanged, newestChanged);
    });
    // remove dummyProvider
    testingClient.server().run(session -> {
        RealmModel appRealm = session.realms().getRealmByName(AuthRealm.TEST);
        UserStorageProviderModel dummyModel = findDummyProviderModel(appRealm);
        appRealm.removeComponent(dummyModel);
    });
}

Example 13 with SynchronizationResult

use of org.keycloak.storage.user.SynchronizationResult in project keycloak by keycloak.

the class LDAPRoleMappingsTest method test04_syncRoleMappings.

/**
 * KEYCLOAK-5698
 */
@Test
public void test04_syncRoleMappings() {
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        LDAPObject john = LDAPTestUtils.addLDAPUser(ldapProvider, appRealm, "johnrolemapper", "John", "RoleMapper", "johnrolemapper@email.org", null, "1234");
        LDAPTestUtils.updateLDAPPassword(ldapProvider, john, "Password1");
        LDAPTestUtils.addOrUpdateRoleLDAPMappers(appRealm, ctx.getLdapModel(), LDAPGroupMapperMode.LDAP_ONLY);
        UserStorageSyncManager usersSyncManager = new UserStorageSyncManager();
        SynchronizationResult syncResult = usersSyncManager.syncChangedUsers(session.getKeycloakSessionFactory(), appRealm.getId(), new UserStorageProviderModel(ctx.getLdapModel()));
        syncResult.getAdded();
    });
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        // make sure user is cached.
        UserModel johnRoleMapper = session.users().getUserByUsername(appRealm, "johnrolemapper");
        Assert.assertNotNull(johnRoleMapper);
        Assert.assertEquals(0, johnRoleMapper.getRealmRoleMappingsStream().count());
    });
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        // Add some role mappings directly in LDAP
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        ComponentModel roleMapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "realmRolesMapper");
        RoleLDAPStorageMapper roleMapper = LDAPTestUtils.getRoleMapper(roleMapperModel, ldapProvider, appRealm);
        LDAPObject johnLdap = ldapProvider.loadLDAPUserByUsername(appRealm, "johnrolemapper");
        roleMapper.addRoleMappingInLDAP("realmRole1", johnLdap);
        roleMapper.addRoleMappingInLDAP("realmRole2", johnLdap);
        // Get user and check that he has requested roles from LDAP
        UserModel johnRoleMapper = session.users().getUserByUsername(appRealm, "johnrolemapper");
        RoleModel realmRole1 = appRealm.getRole("realmRole1");
        RoleModel realmRole2 = appRealm.getRole("realmRole2");
        Set<RoleModel> johnRoles = johnRoleMapper.getRealmRoleMappingsStream().collect(Collectors.toSet());
        Assert.assertFalse(johnRoles.contains(realmRole1));
        Assert.assertFalse(johnRoles.contains(realmRole2));
    });
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        // Add some role mappings directly in LDAP
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        ComponentModel roleMapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "realmRolesMapper");
        RoleLDAPStorageMapper roleMapper = LDAPTestUtils.getRoleMapper(roleMapperModel, ldapProvider, appRealm);
        LDAPObject johnLdap = ldapProvider.loadLDAPUserByUsername(appRealm, "johnrolemapper");
        // not sure why it is here for second time, but it is failing for Active directory - mapping already exists
        if (!ctx.getLdapProvider().getLdapIdentityStore().getConfig().isActiveDirectory()) {
            roleMapper.addRoleMappingInLDAP("realmRole1", johnLdap);
            roleMapper.addRoleMappingInLDAP("realmRole2", johnLdap);
        }
        UserStorageSyncManager usersSyncManager = new UserStorageSyncManager();
        SynchronizationResult syncResult = usersSyncManager.syncChangedUsers(session.getKeycloakSessionFactory(), appRealm.getId(), new UserStorageProviderModel(ctx.getLdapModel()));
    });
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel appRealm = ctx.getRealm();
        // Get user and check that he has requested roles from LDAP
        UserModel johnRoleMapper = session.users().getUserByUsername(appRealm, "johnrolemapper");
        RoleModel realmRole1 = appRealm.getRole("realmRole1");
        RoleModel realmRole2 = appRealm.getRole("realmRole2");
        Set<RoleModel> johnRoles = johnRoleMapper.getRealmRoleMappingsStream().collect(Collectors.toSet());
        Assert.assertTrue(johnRoles.contains(realmRole1));
        Assert.assertTrue(johnRoles.contains(realmRole2));
    });
}

Example 14 with SynchronizationResult

use of org.keycloak.storage.user.SynchronizationResult in project keycloak by keycloak.

the class LDAPGroupMapperSyncTest method test03_syncWithDropNonExistingGroups.

@Test
public void test03_syncWithDropNonExistingGroups() throws Exception {
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel realm = ctx.getRealm();
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(realm, ctx.getLdapModel(), "groupsMapper");
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        // KEYCLOAK-11415 - This test requires the group mapper to be configured with preserve group inheritance
        // set to 'true' (the default setting). If preservation of group inheritance isn't configured, some of
        // the previous test(s) failed to cleanup properly. Check the requirement as part of running the test
        Assert.assertEquals(mapperModel.getConfig().getFirst("preserve.group.inheritance"), "true");
        // Sync groups with inheritance
        SynchronizationResult syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(realm);
        LDAPTestAsserts.assertSyncEquals(syncResult, 3, 0, 0, 0);
        // Assert groups are imported to keycloak including their inheritance from LDAP
        GroupModel kcGroup1 = KeycloakModelUtils.findGroupByPath(realm, "/group1");
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group11"));
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group12"));
        Assert.assertEquals(2, kcGroup1.getSubGroupsStream().count());
        // Create some new groups in keycloak
        GroupModel model1 = realm.createGroup("model1");
        GroupModel model2 = realm.createGroup("model2", kcGroup1);
        // Sync groups again from LDAP. Nothing deleted
        syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(realm);
        LDAPTestAsserts.assertSyncEquals(syncResult, 0, 3, 0, 0);
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group11"));
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group12"));
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/model1"));
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/model2"));
        // Update group mapper to drop non-existing groups during sync
        LDAPTestUtils.updateGroupMapperConfigOptions(mapperModel, GroupMapperConfig.DROP_NON_EXISTING_GROUPS_DURING_SYNC, "true");
        realm.updateComponent(mapperModel);
        // Sync groups again from LDAP. Assert LDAP non-existing groups deleted
        syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(realm);
        Assert.assertEquals(3, syncResult.getUpdated());
        Assert.assertTrue(syncResult.getRemoved() == 2);
        // Sync and assert groups updated
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group11"));
        Assert.assertNotNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/group12"));
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/model1"));
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/group1/model2"));
    });
}

Example 15 with SynchronizationResult

use of org.keycloak.storage.user.SynchronizationResult in project keycloak by keycloak.

the class LDAPGroupMapperSyncTest method test02_syncWithGroupInheritance.

@Test
public void test02_syncWithGroupInheritance() throws Exception {
    testingClient.server().run(session -> {
        LDAPTestContext ctx = LDAPTestContext.init(session);
        RealmModel realm = ctx.getRealm();
        String descriptionAttrName = LDAPTestUtils.getGroupDescriptionLDAPAttrName(ctx.getLdapProvider());
        ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(realm, ctx.getLdapModel(), "groupsMapper");
        LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
        GroupLDAPStorageMapper groupMapper = LDAPTestUtils.getGroupMapper(mapperModel, ldapProvider, realm);
        // KEYCLOAK-11415 - This test requires the group mapper to be configured with preserve group inheritance
        // set to 'true' (the default setting). If preservation of group inheritance isn't configured, some of
        // the previous test(s) failed to cleanup properly. Check the requirement as part of running the test
        Assert.assertEquals(mapperModel.getConfig().getFirst("preserve.group.inheritance"), "true");
        // Sync groups with inheritance
        SynchronizationResult syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(realm);
        LDAPTestAsserts.assertSyncEquals(syncResult, 3, 0, 0, 0);
        // Assert groups are imported to keycloak including their inheritance from LDAP
        GroupModel kcGroup1 = KeycloakModelUtils.findGroupByPath(realm, "/group1");
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/group11"));
        Assert.assertNull(KeycloakModelUtils.findGroupByPath(realm, "/group12"));
        GroupModel kcGroup11 = KeycloakModelUtils.findGroupByPath(realm, "/group1/group11");
        GroupModel kcGroup12 = KeycloakModelUtils.findGroupByPath(realm, "/group1/group12");
        Assert.assertEquals(2, kcGroup1.getSubGroupsStream().count());
        Assert.assertEquals("group1 - description", kcGroup1.getFirstAttribute(descriptionAttrName));
        Assert.assertNull(kcGroup11.getFirstAttribute(descriptionAttrName));
        Assert.assertEquals("group12 - description", kcGroup12.getFirstAttribute(descriptionAttrName));
        // Update description attributes in LDAP
        LDAPObject group1 = groupMapper.loadLDAPGroupByName("group1");
        group1.setSingleAttribute(descriptionAttrName, "group1 - changed description");
        ldapProvider.getLdapIdentityStore().update(group1);
        LDAPObject group12 = groupMapper.loadLDAPGroupByName("group12");
        group12.setAttribute(descriptionAttrName, null);
        ldapProvider.getLdapIdentityStore().update(group12);
        // Sync and assert groups updated
        syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(realm);
        LDAPTestAsserts.assertSyncEquals(syncResult, 0, 3, 0, 0);
        // Assert attributes changed in keycloak
        kcGroup1 = KeycloakModelUtils.findGroupByPath(realm, "/group1");
        kcGroup12 = KeycloakModelUtils.findGroupByPath(realm, "/group1/group12");
        Assert.assertEquals("group1 - changed description", kcGroup1.getFirstAttribute(descriptionAttrName));
        Assert.assertNull(kcGroup12.getFirstAttribute(descriptionAttrName));
    });
}