Java Code Examples for org.keycloak.authentication.AuthenticationFlowContext#getSession()
The following examples show how to use
org.keycloak.authentication.AuthenticationFlowContext#getSession() .
You can vote up the ones you like or vote down the ones you don't like,
and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: UserIdentityToModelMapper.java From keycloak with Apache License 2.0 | 6 votes |
@Override public UserModel find(AuthenticationFlowContext context, Object userIdentity) throws Exception { KeycloakSession session = context.getSession(); List<String> userIdentityValues = Arrays.asList(Constants.CFG_DELIMITER_PATTERN.split(userIdentity.toString())); if (_customAttributes.isEmpty() || userIdentityValues.isEmpty() || (_customAttributes.size() != userIdentityValues.size())) { return null; } List<UserModel> users = session.users().searchForUserByUserAttribute(_customAttributes.get(0), userIdentityValues.get(0), context.getRealm()); for (int i = 1; i <_customAttributes.size(); ++i) { String customAttribute = _customAttributes.get(i); String userIdentityValue = userIdentityValues.get(i); users = users.stream().filter(user -> user.getFirstAttribute(customAttribute).equals(userIdentityValue)).collect(Collectors.toList()); } if (users != null && users.size() > 1) { throw new ModelDuplicateException(); } return users != null && users.size() == 1 ? users.get(0) : null; }
Example 2
Source File: WebAuthnAuthenticator.java From keycloak with Apache License 2.0 | 6 votes |
public void authenticate(AuthenticationFlowContext context) { LoginFormsProvider form = context.form(); Challenge challenge = new DefaultChallenge(); String challengeValue = Base64Url.encode(challenge.getValue()); context.getAuthenticationSession().setAuthNote(WebAuthnConstants.AUTH_CHALLENGE_NOTE, challengeValue); form.setAttribute(WebAuthnConstants.CHALLENGE, challengeValue); WebAuthnPolicy policy = getWebAuthnPolicy(context); String rpId = getRpID(context); form.setAttribute(WebAuthnConstants.RP_ID, rpId); UserModel user = context.getUser(); boolean isUserIdentified = false; if (user != null) { // in 2 Factor Scenario where the user has already been identified WebAuthnAuthenticatorsBean authenticators = new WebAuthnAuthenticatorsBean(context.getSession(), context.getRealm(), user, getCredentialType()); if (authenticators.getAuthenticators().isEmpty()) { // require the user to register webauthn authenticator return; } isUserIdentified = true; form.setAttribute(WebAuthnConstants.ALLOWED_AUTHENTICATORS, authenticators); } else { // in ID-less & Password-less Scenario // NOP } form.setAttribute(WebAuthnConstants.IS_USER_IDENTIFIED, Boolean.toString(isUserIdentified)); // read options from policy String userVerificationRequirement = policy.getUserVerificationRequirement(); form.setAttribute(WebAuthnConstants.USER_VERIFICATION, userVerificationRequirement); context.challenge(form.createLoginWebAuthn()); }
Example 3
Source File: WebAuthnAuthenticator.java From keycloak with Apache License 2.0 | 5 votes |
private Response createErrorResponse(AuthenticationFlowContext context, final String errorCase) { LoginFormsProvider provider = context.form().setError(errorCase); UserModel user = context.getUser(); if (user != null) { WebAuthnAuthenticatorsBean authenticators = new WebAuthnAuthenticatorsBean(context.getSession(), context.getRealm(), user, getCredentialType()); if (authenticators.getAuthenticators() != null) { provider.setAttribute(WebAuthnConstants.ALLOWED_AUTHENTICATORS, authenticators); } } return provider.createWebAuthnErrorPage(); }
Example 4
Source File: IdpAutoLinkAuthenticator.java From keycloak with Apache License 2.0 | 5 votes |
@Override protected void authenticateImpl(AuthenticationFlowContext context, SerializedBrokeredIdentityContext serializedCtx, BrokeredIdentityContext brokerContext) { KeycloakSession session = context.getSession(); RealmModel realm = context.getRealm(); AuthenticationSessionModel authSession = context.getAuthenticationSession(); UserModel existingUser = getExistingUser(session, realm, authSession); logger.debugf("User '%s' is set to authentication context when link with identity provider '%s' . Identity provider username is '%s' ", existingUser.getUsername(), brokerContext.getIdpConfig().getAlias(), brokerContext.getUsername()); context.setUser(existingUser); context.success(); }
Example 5
Source File: IdpCreateUserIfUniqueAuthenticator.java From keycloak with Apache License 2.0 | 4 votes |
@Override protected void authenticateImpl(AuthenticationFlowContext context, SerializedBrokeredIdentityContext serializedCtx, BrokeredIdentityContext brokerContext) { KeycloakSession session = context.getSession(); RealmModel realm = context.getRealm(); if (context.getAuthenticationSession().getAuthNote(EXISTING_USER_INFO) != null) { context.attempted(); return; } String username = getUsername(context, serializedCtx, brokerContext); if (username == null) { ServicesLogger.LOGGER.resetFlow(realm.isRegistrationEmailAsUsername() ? "Email" : "Username"); context.getAuthenticationSession().setAuthNote(ENFORCE_UPDATE_PROFILE, "true"); context.resetFlow(); return; } ExistingUserInfo duplication = checkExistingUser(context, username, serializedCtx, brokerContext); if (duplication == null) { logger.debugf("No duplication detected. Creating account for user '%s' and linking with identity provider '%s' .", username, brokerContext.getIdpConfig().getAlias()); UserModel federatedUser = session.users().addUser(realm, username); federatedUser.setEnabled(true); federatedUser.setEmail(brokerContext.getEmail()); federatedUser.setFirstName(brokerContext.getFirstName()); federatedUser.setLastName(brokerContext.getLastName()); for (Map.Entry<String, List<String>> attr : serializedCtx.getAttributes().entrySet()) { federatedUser.setAttribute(attr.getKey(), attr.getValue()); } AuthenticatorConfigModel config = context.getAuthenticatorConfig(); if (config != null && Boolean.parseBoolean(config.getConfig().get(IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION))) { logger.debugf("User '%s' required to update password", federatedUser.getUsername()); federatedUser.addRequiredAction(UserModel.RequiredAction.UPDATE_PASSWORD); } userRegisteredSuccess(context, federatedUser, serializedCtx, brokerContext); context.setUser(federatedUser); context.getAuthenticationSession().setAuthNote(BROKER_REGISTERED_NEW_USER, "true"); context.success(); } else { logger.debugf("Duplication detected. There is already existing user with %s '%s' .", duplication.getDuplicateAttributeName(), duplication.getDuplicateAttributeValue()); // Set duplicated user, so next authenticators can deal with it context.getAuthenticationSession().setAuthNote(EXISTING_USER_INFO, duplication.serialize()); //Only show error message if the authenticator was required if (context.getExecution().isRequired()) { Response challengeResponse = context.form() .setError(Messages.FEDERATED_IDENTITY_EXISTS, duplication.getDuplicateAttributeName(), duplication.getDuplicateAttributeValue()) .createErrorPage(Response.Status.CONFLICT); context.challenge(challengeResponse); context.getEvent() .user(duplication.getExistingUserId()) .detail("existing_" + duplication.getDuplicateAttributeName(), duplication.getDuplicateAttributeValue()) .removeDetail(Details.AUTH_METHOD) .removeDetail(Details.AUTH_TYPE) .error(Errors.FEDERATED_IDENTITY_EXISTS); } else { context.attempted(); } } }