keycloak-extension-playground深度解析用户存储(User Storage)扩展开发详解【免费下载链接】keycloak-extension-playgroundSimple project environment for creating custom Keycloak extensions项目地址: https://gitcode.com/gh_mirrors/ke/keycloak-extension-playgroundkeycloak-extension-playground是一个专注于Keycloak扩展开发的开源项目环境为开发者提供了丰富的用户存储扩展示例。本文将深入探讨如何利用该项目进行用户存储扩展开发帮助新手快速掌握Keycloak用户存储集成的核心技术。为什么需要用户存储扩展在企业级应用中用户数据往往存储在多样化的系统中如LDAP服务器、关系型数据库或其他身份管理系统。Keycloak的用户存储扩展功能允许将这些外部用户数据源无缝集成到Keycloak中实现统一身份认证和授权。keycloak-extension-playground提供了多种用户存储扩展实现包括LDAP用户存储扩展custom-ldap-user-storage-provider/src/main/java/com/github/thomasdarimont/keycloak/ldap/CustomLdapUserStorageProvider.java远程Keycloak联邦存储remote-keycloak-federation/src/main/java/com/github/thomasdarimont/keycloak/federation/RemoteKeycloakUserStorageProvider.java轻量级用户存储flyweight-user-storage-provider-extension/src/main/java/com/github/thomasdarimont/keycloak/userstorage/flyweight/FlyweightAcmeUserStorageProvider.java用户存储扩展核心接口Keycloak用户存储扩展开发主要涉及以下核心接口UserStorageProvider所有用户存储扩展的基础接口定义了生命周期方法public interface UserStorageProvider extends Provider { void close(); }UserLookupProvider用户查找接口实现用户的基本查询功能public interface UserLookupProvider { UserModel getUserById(String id, RealmModel realm); UserModel getUserByUsername(String username, RealmModel realm); UserModel getUserByEmail(String email, RealmModel realm); }CredentialInputValidator凭证验证接口用于验证用户密码等凭证public interface CredentialInputValidator { boolean supportsCredentialType(String credentialType); boolean isConfiguredFor(RealmModel realm, UserModel user, String credentialType); boolean isValid(RealmModel realm, UserModel user, CredentialInput input); }实战自定义LDAP用户存储扩展扩展LDAPStorageProviderkeycloak-extension-playground中的CustomLdapUserStorageProvider展示了如何扩展Keycloak的LDAP存储提供器public class CustomLdapUserStorageProvider extends LDAPStorageProvider { Override public boolean removeUser(RealmModel realm, UserModel user) { // 自定义删除逻辑禁用用户而非真正删除 user.setEnabled(false); return true; } // 工厂类实现 AutoService(UserStorageProviderFactory.class) public static class Factory extends LDAPStorageProviderFactory { Override public String getId() { return custom-ldap; } Override public String getHelpText() { return Custom LDAP User Store which disables users on remove.; } } }远程Keycloak用户联邦RemoteKeycloakUserStorageProvider实现了跨Keycloak实例的用户联邦允许从远程Keycloak服务器查询和验证用户public class RemoteKeycloakUserStorageProvider implements UserStorageProvider, UserLookupProvider, CredentialInputValidator { Override public UserModel getUserByUsername(String username, RealmModel realm) { // 先检查本地用户 UserModel localUser session.userLocalStorage().getUserByUsername(realm, username); if (localUser ! null) { return localUser; } // 从远程Keycloak查询用户 ListUserRepresentation users getRemoteKeycloak().getUserByUsername( componentModel.get(realm), username, false); if (users null || users.isEmpty()) { return null; } return toAdapter(realm, users.get(0)); } Override public boolean isValid(RealmModel realm, UserModel user, CredentialInput credentialInput) { // 通过远程Keycloak验证用户凭证 AccessTokenResponse accessTokenResponse getRemoteKeycloak().validatePassword( componentModel.get(realm), componentModel.get(clientId), componentModel.get(clientSecret), user.getUsername(), credentialInput.getChallengeResponse(), OAuth2Constants.PASSWORD, profile email); return accessTokenResponse ! null; } }轻量级用户存储实现FlyweightAcmeUserStorageProvider展示了一种轻量级用户存储实现采用享元模式减少内存占用public class FlyweightAcmeUserStorageProvider implements UserStorageProvider, UserLookupProvider, UserQueryProvider, CredentialInputUpdater, CredentialInputValidator { private final AcmeUserRepository repository; Override public UserModel getUserByUsername(String username, RealmModel realm) { return createAdapter(realm, repository.findUserByUsernameOrEmail(username)); } protected UserModel createAdapter(RealmModel realm, AcmeUser acmeUser) { if (acmeUser null) { return null; } return new AcmeUserAdapter(session, realm, storageComponentModel, acmeUser); } Override public boolean isValid(RealmModel realm, UserModel user, CredentialInput input) { if (!supportsCredentialType(input.getType()) || !(input instanceof UserCredentialModel)) { return false; } UserCredentialModel cred (UserCredentialModel) input; return repository.validateCredentials(user.getUsername(), cred.getValue()); } }用户存储扩展的配置与使用配置认证流程在Keycloak管理控制台中您需要配置认证流程以使用自定义用户存储提供器。以下是一个典型的浏览器认证流程配置界面配置用户存储提供器为您的用户存储扩展配置必要的参数如角色名称、客户端ID等处理访问控制用户存储扩展可以与Keycloak的授权机制结合实现基于角色的访问控制。当用户没有所需角色时将显示访问被拒绝的错误页面如何开始开发克隆项目仓库git clone https://gitcode.com/gh_mirrors/ke/keycloak-extension-playground选择一个用户存储扩展示例作为起点如custom-ldap-user-storage-providerremote-keycloak-federationflyweight-user-storage-provider-extension根据您的需求修改代码实现自定义逻辑使用Maven构建扩展mvn clean install将生成的JAR文件部署到Keycloak的standalone/deployments目录总结keycloak-extension-playground提供了丰富的用户存储扩展示例涵盖了从LDAP集成到远程Keycloak联邦的多种场景。通过本文的介绍您应该对Keycloak用户存储扩展开发有了深入的了解。无论是企业级LDAP集成还是跨系统用户联邦Keycloak的用户存储扩展机制都能满足您的需求。希望本文能帮助您快速掌握Keycloak用户存储扩展开发如有任何问题欢迎查阅项目中的示例代码或相关文档。【免费下载链接】keycloak-extension-playgroundSimple project environment for creating custom Keycloak extensions项目地址: https://gitcode.com/gh_mirrors/ke/keycloak-extension-playground创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考