mirror/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2025-12-29 19:09:56 -06:00
Code Issues Packages Projects Releases Wiki Activity

KEYCLOAK-10977 Allow disabling Kerberos athentication with LDAP federation provider (#6422)

Browse Source
This commit is contained in:
Ramon Spahr
2019-11-18 14:12:26 +01:00
committed by Marek Posolda
parent 76aa199fee
commit 0f00e23f96
2 changed files with 36 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProviderFactory.java
View File

@@ -410,13 +410,24 @@ public class LDAPStorageProviderFactory implements UserStorageProviderFactory<LD
mapperModel = KeycloakModelUtils.createComponentModel("MSAD account controls", model.getId(), MSADUserAccountControlStorageMapperFactory.PROVIDER_ID,LDAPStorageMapper.class.getName());
realm.addComponentModel(mapperModel);
}
checkKerberosCredential(session, realm, model);
String allowKerberosCfg = model.getConfig().getFirst(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION);
if (Boolean.valueOf(allowKerberosCfg)) {
CredentialHelper.setOrReplaceAuthenticationRequirement(session, realm, CredentialRepresentation.KERBEROS,
AuthenticationExecutionModel.Requirement.ALTERNATIVE, AuthenticationExecutionModel.Requirement.DISABLED);
}
}
@Override
public void onUpdate(KeycloakSession session, RealmModel realm, ComponentModel oldModel, ComponentModel newModel) {
checkKerberosCredential(session, realm, newModel);
boolean allowKerberosCfgOld = Boolean.valueOf(oldModel.getConfig().getFirst(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION));
boolean allowKerberosCfgNew = Boolean.valueOf(newModel.getConfig().getFirst(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION));
if (!allowKerberosCfgOld && allowKerberosCfgNew) {
CredentialHelper.setOrReplaceAuthenticationRequirement(session, realm, CredentialRepresentation.KERBEROS,
AuthenticationExecutionModel.Requirement.ALTERNATIVE, AuthenticationExecutionModel.Requirement.DISABLED);
} else if(allowKerberosCfgOld && !allowKerberosCfgNew) {
CredentialHelper.setOrReplaceAuthenticationRequirement(session, realm, CredentialRepresentation.KERBEROS,
AuthenticationExecutionModel.Requirement.DISABLED, AuthenticationExecutionModel.Requirement.ALTERNATIVE);
} // else: keep current settings
}
@Override
@@ -651,14 +662,4 @@ public class LDAPStorageProviderFactory implements UserStorageProviderFactory<LD
return new KerberosUsernamePasswordAuthenticator(kerberosConfig);
}
public static boolean checkKerberosCredential(KeycloakSession session, RealmModel realm, ComponentModel model) {
String allowKerberosCfg = model.getConfig().getFirst(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION);
if (Boolean.valueOf(allowKerberosCfg)) {
CredentialHelper.setOrReplaceAuthenticationRequirement(session, realm, CredentialRepresentation.KERBEROS,
AuthenticationExecutionModel.Requirement.ALTERNATIVE, AuthenticationExecutionModel.Requirement.DISABLED);
return true;
}
return false;
}
}

24
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UserStorageRestTest.java
View File

@@ -99,12 +99,32 @@ public class UserStorageRestTest extends AbstractAdminTest {
realm.flows().updateExecutions("browser", kerberosExecution);
assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
// update LDAP provider with kerberos
// update LDAP provider with kerberos (without changing kerberos switch)
ldapRep = realm.components().component(id).toRepresentation();
realm.components().component(id).update(ldapRep);
assertAdminEvents.clear();
// Assert kerberos authenticator ALTERNATIVE
// Assert kerberos authenticator is still DISABLED
kerberosExecution = findKerberosExecution();
Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
// update LDAP provider with kerberos (with changing kerberos switch to disabled)
ldapRep = realm.components().component(id).toRepresentation();
ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "false");
realm.components().component(id).update(ldapRep);
assertAdminEvents.clear();
// Assert kerberos authenticator is still DISABLED
kerberosExecution = findKerberosExecution();
Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
// update LDAP provider with kerberos (with changing kerberos switch to enabled)
ldapRep = realm.components().component(id).toRepresentation();
ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
realm.components().component(id).update(ldapRep);
assertAdminEvents.clear();
// Assert kerberos authenticator is still ALTERNATIVE
kerberosExecution = findKerberosExecution();
Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());