Keycloak 用户存储 SPI 认证流程
Keycloak User Storage SPI Authentication Flow
从登录的前端应用程序，用户被重定向到 Keycloak 页面。用户已针对外部服务进行身份验证
我已经实现了 keycloak 用户存储 SPI 流程。它针对外部来源进行身份验证。 Keycloak 使用外部存储属性更新，如果它在 getUserByUsername 方法中更新，它就可以工作。
我正在验证 isValid 方法中的 userValidation 并更新 UserModel 和 LocalHashMap 中的 userAttributes。
从日志中，我看到 UserStoreProviderFactory 创建了两个实例来验证一个 transaction/login
我的问题是，Keycloak 是否为一个身份验证流程创建了两个 UserStorageProvider 实例。由于是多次调用，在isValid方法上创建的UserModel必须缓存起来，第二次再取回，是否可以避免？
为什么在第一次调用 userStorageProvider 时多次调用 getUserByUserName() 方法
UserStorageProviderFactory
-> Creates instance of UserStorageProvider
-> UserStorage provider calls getUserById method
-> UserStorage provider calls getUserByUserName method
-> UserStorage provider calls isValid method
on true, keycloak
UserStorageProviderFactory
-> Creates instance of UserStorageProvider
-> UserStorage provider calls getUserById method
-> UserStorage provider calls getUserByUserName method
returns UserModel
@Override
public UserModel getUserById(String id, RealmModel realm) {
logger.debug("__ ########## getUserById ID:" + "ID: " + id + ":REALM:" + realm);
StorageId storageId = new StorageId(id);
/**
* StorageId.getExternalId() method is invoked to obtain
* the username embeded in the id parameter
*/
String username = storageId.getExternalId();
System.out.println("Name:" + username);
return getUserByUsername(username, realm);
}
/***
* From UserLookupProvider
* This method is invoked by the Keycloak login page when a user logs in
*/
@Override
public UserModel getUserByUsername(String username, RealmModel realm) {
logger.debug("__ %%%%%%%%%% getUserByUsername ID:" + username + ":REALM:" + realm);
logger.debug("Provider Num:" + this.randomNum);
UserModel userModel = loadedUsers.get(username);
UserModel local = session.userLocalStorage().getUserByUsername(username, realm);
logger.debug("*#@#$ local session:" + local);
if (userModel == null) {
logger.debug("In NULLLLLLLLLLLLLLLLLLL ");
userModel = createUserModel(realm, username);
// set for demo...
userModel.setSingleAttribute("externalId", Integer.toString(10));
} else {
logger.debug("__ ELSEEEEEEEEEEEEEE getUserByUsername sku:" + userModel.getFirstAttribute("sku"));
userModel.setSingleAttribute("externalId", Integer.toString(12));
}
return userModel;
}
public boolean isValid(RealmModel realm, UserModel user, CredentialInput input) {
logger.debug("__ , 1111111111 isValid:input type:" + input.getType() + ":userName:" + user.getUsername());
UserCredentialModel cred = (UserCredentialModel)input;
if (!supportsCredentialType(input.getType())
|| !(input instanceof UserCredentialModel)) {
logger.warn("__, credentialType: " + input.getType() + ": NOT supported");
return false;
}
UserDTO model = new UserDTO();
model.setEmailId(user.getUsername());
model.setPassword(cred.getValue());
try {
ResteasyClient client = new ResteasyClientBuilder().build();
ResteasyWebTarget target = client.target(properties.getProperty("userUrl"));
Response response = target.request().post(
Entity.entity(model, "application/json"));
ResponseDTO<UserResponseDTO> responseDto = response.readEntity(new GenericType<ResponseDTO<UserResponseDTO>>() {});
logger.debug("__ , !!!!!!!!!!! json response:" + responseDto);
logger.debug("!!!! Provider Num:" + this.randomNum);
if (responseDto.getCode() == 200) {
UserResponseDTO userResponseDto = responseDto.getData();
UserDetailsDTO userDetailsDto = userResponseDto.getDetails();
user.setEmail(userDetailsDto.getEmailId());
user.setFirstName(userDetailsDto.getFirstName());
logger.debug("!!!!@@@@@@@@ Provider Num:" + this.randomNum);
logger.debug("__ , returning success from isValid:" + user.getUsername() +":::");
loadedUsers.put(user.getUsername(), user);
return true;
}
response.close();
} catch(Exception ex) {
logger.error("Exception Occured accessing:", ex);
}
return false;
}
Logs（显示getUserById()和getUserByUserName()方法被调用了多少次，UserStorageFactory实例化了两次UserStorageProvider实例）
2019-08-30 08:49:26,273 DEBUG [org.test.keycloak.userstore.factory.TestUserStoreProviderFactory] (default task-2) userURL:http://localhost:8280/login
2019-08-30 08:49:26,283 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:26,291 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:26,319 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) In NULLLLLLLLLLLLLLLLLLL
2019-08-30 08:49:26,951 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ , !!!!!!!!!!! json response:Message:Logged in :status:Success
2019-08-30 08:49:26,952 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:26,953 INFO [stdout] (default task-2) Name:test@gmail.com
2019-08-30 08:49:26,960 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:26,962 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) LOADEDUSERS, keysize:0
2019-08-30 08:49:26,962 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) In NULLLLLLLLLLLLLLLLLLL
2019-08-30 08:49:26,965 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ , returning success from isValid:test@gmail.com:::
2019-08-30 08:49:26,966 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:26,986 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:27,022 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ELSEEEEEEEEEEEEEE getUserByUsername sku:1
2019-08-30 08:49:27,056 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:27,059 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:27,059 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) LOADEDUSERS, keysize:1
2019-08-30 08:49:27,059 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ELSEEEEEEEEEEEEEE getUserByUsername sku:1
2019-08-30 08:49:27,061 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:27,071 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:27,073 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:27,073 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ELSEEEEEEEEEEEEEE getUserByUsername sku:1
2019-08-30 08:49:29,421 DEBUG [org.test.keycloak.userstore.factory.TestUserStoreProviderFactory] (default task-2) userURL:http://localhost:8280/login
2019-08-30 08:49:29,422 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:29,432 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:29,432 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) In NULLLLLLLLLLLLLLLLLLL
2019-08-30 08:49:29,581 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:29,581 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
任何suggestion/tips你可以帮助我 solve/understand 工作流程将不胜感激！
根据文档，它的状态
UserProvider - Remember that provider class instances are created once per transaction and are closed after the transaction completes.
但是在应用程序中调用了多次，因为
首先，创建一个UserProvider实例来传递登录流程。在此流程上更新的 UserModel，除非它是 cached/stored
其次，使用以下端点创建一个 UserProvider 实例来创建令牌。 UserModel 对象从 getUserByUserName 方法 () 返回。
“http://localhost:8180/auth/realms/myapp/protocol/openid-connect/token”
要存储具有自定义属性的 UserModel，
this.session.userLocalStorage().addUser(realm, user.getUsername());
@Override
public UserModel addUser(RealmModel realm, String username) {
// userModel returned should be subclassed or instance of AbstractUserAdapterFederatedStorage
return this.myUserModel;
}
要更新存储在 localStorage 中的 UserModel，应删除和添加现有用户。
要删除用户，必须设置 FederationLink。
//ComponentModel ID of the provider. This sets a link between the provider and the imported user
user.setFederationLink(this.model.getId());
从登录的前端应用程序，用户被重定向到 Keycloak 页面。用户已针对外部服务进行身份验证
我已经实现了 keycloak 用户存储 SPI 流程。它针对外部来源进行身份验证。 Keycloak 使用外部存储属性更新，如果它在 getUserByUsername 方法中更新，它就可以工作。
我正在验证 isValid 方法中的 userValidation 并更新 UserModel 和 LocalHashMap 中的 userAttributes。
从日志中，我看到 UserStoreProviderFactory 创建了两个实例来验证一个 transaction/login
我的问题是，Keycloak 是否为一个身份验证流程创建了两个 UserStorageProvider 实例。由于是多次调用，在isValid方法上创建的UserModel必须缓存起来，第二次再取回，是否可以避免？
为什么在第一次调用 userStorageProvider 时多次调用 getUserByUserName() 方法
UserStorageProviderFactory
-> Creates instance of UserStorageProvider
-> UserStorage provider calls getUserById method
-> UserStorage provider calls getUserByUserName method
-> UserStorage provider calls isValid method
on true, keycloak
UserStorageProviderFactory
-> Creates instance of UserStorageProvider
-> UserStorage provider calls getUserById method
-> UserStorage provider calls getUserByUserName method
returns UserModel
@Override
public UserModel getUserById(String id, RealmModel realm) {
logger.debug("__ ########## getUserById ID:" + "ID: " + id + ":REALM:" + realm);
StorageId storageId = new StorageId(id);
/**
* StorageId.getExternalId() method is invoked to obtain
* the username embeded in the id parameter
*/
String username = storageId.getExternalId();
System.out.println("Name:" + username);
return getUserByUsername(username, realm);
}
/***
* From UserLookupProvider
* This method is invoked by the Keycloak login page when a user logs in
*/
@Override
public UserModel getUserByUsername(String username, RealmModel realm) {
logger.debug("__ %%%%%%%%%% getUserByUsername ID:" + username + ":REALM:" + realm);
logger.debug("Provider Num:" + this.randomNum);
UserModel userModel = loadedUsers.get(username);
UserModel local = session.userLocalStorage().getUserByUsername(username, realm);
logger.debug("*#@#$ local session:" + local);
if (userModel == null) {
logger.debug("In NULLLLLLLLLLLLLLLLLLL ");
userModel = createUserModel(realm, username);
// set for demo...
userModel.setSingleAttribute("externalId", Integer.toString(10));
} else {
logger.debug("__ ELSEEEEEEEEEEEEEE getUserByUsername sku:" + userModel.getFirstAttribute("sku"));
userModel.setSingleAttribute("externalId", Integer.toString(12));
}
return userModel;
}
public boolean isValid(RealmModel realm, UserModel user, CredentialInput input) {
logger.debug("__ , 1111111111 isValid:input type:" + input.getType() + ":userName:" + user.getUsername());
UserCredentialModel cred = (UserCredentialModel)input;
if (!supportsCredentialType(input.getType())
|| !(input instanceof UserCredentialModel)) {
logger.warn("__, credentialType: " + input.getType() + ": NOT supported");
return false;
}
UserDTO model = new UserDTO();
model.setEmailId(user.getUsername());
model.setPassword(cred.getValue());
try {
ResteasyClient client = new ResteasyClientBuilder().build();
ResteasyWebTarget target = client.target(properties.getProperty("userUrl"));
Response response = target.request().post(
Entity.entity(model, "application/json"));
ResponseDTO<UserResponseDTO> responseDto = response.readEntity(new GenericType<ResponseDTO<UserResponseDTO>>() {});
logger.debug("__ , !!!!!!!!!!! json response:" + responseDto);
logger.debug("!!!! Provider Num:" + this.randomNum);
if (responseDto.getCode() == 200) {
UserResponseDTO userResponseDto = responseDto.getData();
UserDetailsDTO userDetailsDto = userResponseDto.getDetails();
user.setEmail(userDetailsDto.getEmailId());
user.setFirstName(userDetailsDto.getFirstName());
logger.debug("!!!!@@@@@@@@ Provider Num:" + this.randomNum);
logger.debug("__ , returning success from isValid:" + user.getUsername() +":::");
loadedUsers.put(user.getUsername(), user);
return true;
}
response.close();
} catch(Exception ex) {
logger.error("Exception Occured accessing:", ex);
}
return false;
}
Logs（显示getUserById()和getUserByUserName()方法被调用了多少次，UserStorageFactory实例化了两次UserStorageProvider实例）
2019-08-30 08:49:26,273 DEBUG [org.test.keycloak.userstore.factory.TestUserStoreProviderFactory] (default task-2) userURL:http://localhost:8280/login
2019-08-30 08:49:26,283 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:26,291 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:26,319 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) In NULLLLLLLLLLLLLLLLLLL 2019-08-30 08:49:26,951 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ , !!!!!!!!!!! json response:Message:Logged in :status:Success 2019-08-30 08:49:26,952 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:26,953 INFO [stdout] (default task-2) Name:test@gmail.com
2019-08-30 08:49:26,960 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:26,962 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) LOADEDUSERS, keysize:0 2019-08-30 08:49:26,962 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) In NULLLLLLLLLLLLLLLLLLL 2019-08-30 08:49:26,965 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ , returning success from isValid:test@gmail.com:::
2019-08-30 08:49:26,966 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:26,986 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:27,022 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ELSEEEEEEEEEEEEEE getUserByUsername sku:1
2019-08-30 08:49:27,056 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:27,059 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:27,059 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) LOADEDUSERS, keysize:1 2019-08-30 08:49:27,059 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ELSEEEEEEEEEEEEEE getUserByUsername sku:1 2019-08-30 08:49:27,061 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
2019-08-30 08:49:27,071 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:27,073 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:27,073 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ELSEEEEEEEEEEEEEE getUserByUsername sku:1
2019-08-30 08:49:29,421 DEBUG [org.test.keycloak.userstore.factory.TestUserStoreProviderFactory] (default task-2) userURL:http://localhost:8280/login 2019-08-30 08:49:29,422 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:29,432 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:29,432 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) In NULLLLLLLLLLLLLLLLLLL 2019-08-30 08:49:29,581 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ ########## getUserById ID:ID: f:4a65ac95-6b5d-4508-b7ec-348ae1da619d:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a 2019-08-30 08:49:29,581 DEBUG [org.test.keycloak.userstore.TestUserStoreProvider] (default task-2) __ %%%%%%%%%% getUserByUsername ID:test@gmail.com:REALM:org.keycloak.models.cache.infinispan.RealmAdapter@64ddda7a
任何suggestion/tips你可以帮助我 solve/understand 工作流程将不胜感激！
根据文档，它的状态
UserProvider - Remember that provider class instances are created once per transaction and are closed after the transaction completes.
但是在应用程序中调用了多次，因为
首先，创建一个UserProvider实例来传递登录流程。在此流程上更新的 UserModel，除非它是 cached/stored
，否则将无法在外部使用
其次，使用以下端点创建一个 UserProvider 实例来创建令牌。 UserModel 对象从 getUserByUserName 方法 () 返回。 “http://localhost:8180/auth/realms/myapp/protocol/openid-connect/token”
要存储具有自定义属性的 UserModel，
this.session.userLocalStorage().addUser(realm, user.getUsername());
@Override
public UserModel addUser(RealmModel realm, String username) {
// userModel returned should be subclassed or instance of AbstractUserAdapterFederatedStorage
return this.myUserModel;
}
要更新存储在 localStorage 中的 UserModel，应删除和添加现有用户。
要删除用户，必须设置 FederationLink。
//ComponentModel ID of the provider. This sets a link between the provider and the imported user
user.setFederationLink(this.model.getId());