org.keycloak.models

Interface UserCredentialManager

All Superinterfaces:

Provider, UserCredentialStore

public interface UserCredentialManager
extends UserCredentialStore

Version:

$Revision: 1 $

Author:

Bill Burke

Method Summary

Modifier and Type	Method and Description
CredentialValidationOutput	authenticate(KeycloakSession session, RealmModel realm, CredentialInput input) Given a CredentialInput, authenticate the user.
void	disableCredentialType(RealmModel realm, UserModel user, String credentialType) Calls disableCredential on UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.
Set<String>	getDisableableCredentialTypes(RealmModel realm, UserModel user) Returns a set of credential types that can be disabled by disableCredentialType() method
boolean	isConfiguredFor(RealmModel realm, UserModel user, String type) Checks to see if user has credential type configured.
boolean	isConfiguredLocally(RealmModel realm, UserModel user, String type) Only loops through each CredentialProvider to see if credential type is configured for the user.
boolean	isValid(RealmModel realm, UserModel user, CredentialInput... inputs) Validates list of credentials.
boolean	isValid(RealmModel realm, UserModel user, List<CredentialInput> inputs) Validates list of credentials.
void	updateCredential(RealmModel realm, UserModel user, CredentialInput input) Updates a credential.

Methods inherited from interface org.keycloak.credential.UserCredentialStore

createCredential, getStoredCredentialById, getStoredCredentialByNameAndType, getStoredCredentials, getStoredCredentialsByType, removeStoredCredential, updateCredential

Methods inherited from interface org.keycloak.provider.Provider

close

Method Detail

isValid

boolean isValid(RealmModel realm,
                UserModel user,
                List<CredentialInput> inputs)

Validates list of credentials. Will call UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.

Parameters:

realm -

user -

inputs -

Returns:

isValid

boolean isValid(RealmModel realm,
                UserModel user,
                CredentialInput... inputs)

Validates list of credentials. Will call UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.

Parameters:

realm -

user -

inputs -

Returns:

updateCredential

void updateCredential(RealmModel realm,
                      UserModel user,
                      CredentialInput input)

Updates a credential. Will call UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider. Update is finished whenever any one provider returns true.

Parameters:

realm -

user -

disableCredentialType

void disableCredentialType(RealmModel realm,
                           UserModel user,
                           String credentialType)

Calls disableCredential on UserStorageProvider and UserFederationProviders first, then loop through each CredentialProvider.

Parameters:

realm -

user -

credentialType -

getDisableableCredentialTypes

Set<String> getDisableableCredentialTypes(RealmModel realm,
                                          UserModel user)

Returns a set of credential types that can be disabled by disableCredentialType() method

Parameters:

realm -

user -

Returns:

isConfiguredFor

boolean isConfiguredFor(RealmModel realm,
                        UserModel user,
                        String type)

Checks to see if user has credential type configured. Looks in UserStorageProvider or UserFederationProvider first, then loops through each CredentialProvider.

Parameters:

realm -

user -

type -

Returns:

isConfiguredLocally

boolean isConfiguredLocally(RealmModel realm,
                            UserModel user,
                            String type)

Only loops through each CredentialProvider to see if credential type is configured for the user. This allows UserStorageProvider and UserFederationProvider isValid() implementations to punt to local storage when validating a credential that has been overriden in Keycloak storage.

Parameters:

realm -

user -

type -

Returns:

authenticate

CredentialValidationOutput authenticate(KeycloakSession session,
                                        RealmModel realm,
                                        CredentialInput input)

Given a CredentialInput, authenticate the user. This is used in the case where the credential must be processed to determine and find the user. An example is Kerberos where the kerberos token might be validated and processed by a variety of different storage providers.

Parameters:

session -

realm -

input -

Returns: