Keycloak用户存储SPI身份验证流

Question

我已经实现了keycloak用户存储SPI流。它针对外部源进行身份验证。Keycloak是用外部存储属性更新的，如果它在getUserByUsername方法中更新，它就可以工作。

我正在isValid方法中验证userValidation，并更新UserModel和LocalHashMap中的userAttributes。

从日志中，我看到UserStoreProviderFactory创建了两个实例来验证一个事务/登录

为什么在第一次userStorageProvider调用时多次调用getUserByUserName（）方法

            UserStorageProviderFactory
                 -> Creates instance of UserStorageProvider
                    -> UserStorage provider calls getUserById method
                    -> UserStorage provider calls getUserByUserName method
                    -> UserStorage provider calls isValid method
                                 on true, keycloak 
            UserStorageProviderFactory
                 -> Creates instance of UserStorageProvider
                    -> UserStorage provider calls getUserById method
                    -> UserStorage provider calls getUserByUserName method
                           returns UserModel


 @Override
public UserModel getUserById(String id, RealmModel realm) {
    logger.debug("__ ########## getUserById  ID:" + "ID: " + id + ":REALM:" + realm);
    StorageId storageId = new StorageId(id);
    /**
     * StorageId.getExternalId() method is invoked to obtain 
     * the username embeded in the id parameter
     */
    String username = storageId.getExternalId();
    System.out.println("Name:" + username);
    return getUserByUsername(username, realm);
}

/***
 * From UserLookupProvider
 * This method is invoked by the Keycloak login page when a user logs in
 */
@Override
public UserModel getUserByUsername(String username, RealmModel realm) {
    logger.debug("__ %%%%%%%%%% getUserByUsername ID:" + username + ":REALM:" + realm);
    logger.debug("Provider Num:" + this.randomNum);
    UserModel userModel = loadedUsers.get(username);

    UserModel local = session.userLocalStorage().getUserByUsername(username, realm);
    logger.debug("*#@#$ local session:" + local);

    if (userModel == null) {
        logger.debug("In NULLLLLLLLLLLLLLLLLLL ");
        userModel = createUserModel(realm, username);
        // set for demo...
        userModel.setSingleAttribute("externalId", Integer.toString(10));
    } else {
        logger.debug("__ ELSEEEEEEEEEEEEEE getUserByUsername sku:" +  userModel.getFirstAttribute("sku"));
        userModel.setSingleAttribute("externalId", Integer.toString(12));
    }

    return userModel;
}

public boolean isValid(RealmModel realm, UserModel user, CredentialInput input) {
    logger.debug("__ , 1111111111 isValid:input type:" +  input.getType() + ":userName:" + user.getUsername());

    UserCredentialModel cred = (UserCredentialModel)input;

    if (!supportsCredentialType(input.getType()) 
            || !(input instanceof UserCredentialModel)) {
        logger.warn("__, credentialType: " + input.getType() + ": NOT supported");
        return false;
    }

    UserDTO model = new UserDTO();
    model.setEmailId(user.getUsername());
    model.setPassword(cred.getValue());

    try {
        ResteasyClient client = new ResteasyClientBuilder().build();
        ResteasyWebTarget target = client.target(properties.getProperty("userUrl"));
        Response response = target.request().post(
                Entity.entity(model, "application/json"));

        ResponseDTO<UserResponseDTO> responseDto = response.readEntity(new GenericType<ResponseDTO<UserResponseDTO>>() {});
        logger.debug("__ , !!!!!!!!!!! json response:" +  responseDto);
        logger.debug("!!!! Provider Num:" + this.randomNum);
        if (responseDto.getCode() == 200) {
            UserResponseDTO userResponseDto = responseDto.getData();
            UserDetailsDTO userDetailsDto = userResponseDto.getDetails();
            user.setEmail(userDetailsDto.getEmailId());
            user.setFirstName(userDetailsDto.getFirstName());

            logger.debug("!!!!@@@@@@@@ Provider Num:" + this.randomNum);
            logger.debug("__ , returning success from isValid:" + user.getUsername() +":::"); 
            loadedUsers.put(user.getUsername(), user);
            return true;
        }
        response.close();

    } catch(Exception ex) {
        logger.error("Exception Occured accessing:", ex);
    }

    return false;

}

日志（为了显示调用getUserById（）和getUserByUserName（）方法的次数，UserStorageFactory实例化了两次UserStorageProvider实例）

2019-08-30 08:49:26,273调试[org.test.keycloak.userstore.factory.TestUserStoreProviderFactory]（默认任务-2）用户URL:http://localhost:8280/login

2019-08-30 08:49:26,960 DEBUG[org.test.keycloak.userstore.testUserStoreProvider]（默认任务-2)__%%%%%%%%%%%getUserByUsername ID:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmAdapter@64DDDA7a 2019-08-30 08:49:26,962 DEBUG[org.test.keycloak.userstore.testUserStoreProvider]（默认任务-2）LOADEDUSERS,TestUserStoreProvider]（默认任务-2)在NulllLlLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL2019-08-30 08:49:26,965 DEBUG[org.test.keycloak.userstore.testUserStoreProvider]（默认任务-2)__中，从isvalid:[e-mail]:::

2019-08-30 08:49:26,966 DEBUG[org.test.keycloak.userstore.testUserStoreProvider]（默认任务-2)__################getUserById ID:ID:F:4A65AC95-6B5D-4508-B7EC-348AE1DA619D:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmadapter@64DDDA7A 2019-08-30 08:49:26,986 DEBUG%%%%getUserByUsername ID:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmAdapter@64DDDA7a 2019-08-30 08:49:27,022 DEBUG[org.test.keycloak.userstore.testUserstoreProvider]（默认任务

2019-08-30 08:49:27,056 DEBUG[org.test.keycloak.userstore.testUserStoreProvider]（默认任务-2)__###############getUserById ID:ID:F:4A65AC95-6B5D-4508-B7EC-348AE1DA619D:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmadapter@64DDDA7A 2019-08-30 08:49:27,059 DEBUG%%%%getUserByUsername ID:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmadapter@64DDDA7A 2019-08-30 08:49:27,059 DEBUG[org.test.keycloak.userstore.testUserStoreProvider]（默认任务-2）LOADEDUSERS,keysize：1 201 9-08-30 08:49:27,059 DEBUG[org.test.keycloak.userstore.testUserStoreProvider]（默认任务-2）test.keycloak.userstore.testUserStoreProvider]（默认任务-2)__%%%%%%%%%%%getUserByUsername id:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmAdapter@64DDDA7a

2019-08-30 08:49:27,071 DEBUG[org.test.keycloak.userstore.testUserStoreProvider]（默认任务-2)__###############getUserById ID:ID:F:4A65AC95-6B5D-4508-B7EC-348AE1DA619D:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmadapter@64DDDA7A 2019-08-30 08:49:27,073 DEBUG%%%%getUserByUsername ID:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmAdapter@64DDDA7A 2019-08-30 08:49:27,073 DEBUG[org.test.keycloak.userstore.testUserstoreProvider]（默认任务-2)__ELSEEEEEEEEEEEEEE getUserByUsername sku：1

2019-08-30 08:49:29,421调试[org.test.keycloak.userstore.factory.testuserstoreProviderFactory]（默认任务-2）用户URL:http://localhost:8280/login 2019-08-30 08:49:29,422调试[org.test.keycloak.userstore.testuserstoreProvider]（默认任务-2）.infinispan.realmadapter@64DDDA7A 2019-08-30 08:49:29,432 DEBUG[org.test.keycloak.userstore.testuserstoreProvider]（默认任务-2)__%%%%%%%%%%getUserByUsername id:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmadapter@64DDDA7A 2019-08-30 08:49:29,432 DEBUG[org.test.keycloak.userstore.testuserstoreProvider]（默认任务:29，581 DEBUG[org.test.keycloak.userstore.testUserStoreProvider]（默认任务-2)__############getUserById ID:ID:F:4A65AC95-6B5D-4508-B7EC-348AE1DA619D:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmAdapter@64DDDA7A 2019-08-3008:49:29,581 DEBUG[org.test.keycloak.userstore.testUserStoreProvider]（默认任务-2)__%%%%%%%%%%getUserByUsername id:[e-mail]:realm:org.keycloak.models.cache.infinispan.realmAdapter@64DDDA7a

任何建议/提示，你可以帮助我解决/理解工作流程将非常感谢！

Answer 1

>

首先，创建一个UserProvider实例来通过登录流。在此流上更新的UserModel在外部不可用，除非它被缓存/存储

其次，使用下面的endpoint创建一个UserProvider实例来创建令牌。UserModel对象从getUserByUserName方法（）返回。“http://localhost:8180/auth/realms/myapp/protocol/openid-connect/token”

若要存储具有自定义属性的UserModel，

this.session.userLocalStorage().addUser(realm, user.getUsername());

    @Override
public UserModel addUser(RealmModel realm, String username) {
    // userModel returned should be subclassed or instance of AbstractUserAdapterFederatedStorage
    return this.myUserModel;

}

//ComponentModel ID of the provider. This sets a link between the provider and the imported user
user.setFederationLink(this.model.getId());