Passing data from UserStorageProvider to token claim #14359

crbednarz · 2022-09-12T22:41:32Z

crbednarz
Sep 12, 2022

Hello,

I'm trying to get a better understanding of the best practices around persisting data and error handling when writing a custom UserStorageProvider and OIDCProtocolMapper.

At a high-level, the goal is to have the UserStorageProvider reach out to a backend service during authentication and gather user/request information. This data would then be passed to an OIDCProtocolMapper which would both add the data as a claim, or make additional backend calls. As these backend calls can produce errors, there would ideally be a mechanism in place to handle them in a user friendly way.

I've put together a basic demo of the approach I've taken so far, but the general process is as follows:

The UserStorageProvider's isValid call makes a request to the backend service grabbing additional information about the user and the request itself. For this example, it's just a single string. As isValid only returns a boolean, it seems the only mechanism to get information out is a KeycloakSession attribute. Example:

    public boolean isValid(RealmModel realm, UserModel user, CredentialInput input) {
        // In order to simplify this example, doBackendServiceCall simply returns a
        // string which we'd like to act on later in the ProtocolMapper.
        String backendCallResult = doBackendServiceCall();
        session.setAttribute("demo-backend-data-attribute", backendCallResult);


        // Authenticate for a single user "user" with password "password"
        if (!supportsCredentialType(input.getType()) || !(input instanceof UserCredentialModel))
            return false;
        var password = ((UserCredentialModel) input).getValue();
        return user.getUsername() == "user" && password.equals("password");
    }

Since KeycloakSession is per-request, the attribute is read from a replacement custom UsernamePasswordForm authenticator, and converted to a user session note via context.getAuthenticationSession().setUserSessionNote. Example:

    public void action(AuthenticationFlowContext context) {
        super.action(context);


        // Convert keycloak session attribute to a user session note, so it will be accessible
        // from the ProtocolMapper later.
        var backendCallResult = (String)context.getSession().getAttribute("demo-backend-data-attribute");
        context.getAuthenticationSession().setUserSessionNote("demo-backend-data-note", backendCallResult);
    }

Finally, with the data available throughout the whole user session, it is read from a OIDCProtocolMapper which maps the session note to a claim. I'm aware this can be done with a built-in mapper, however the data would potentially feed into further claims and backend calls. Example:

    public AccessToken transformAccessToken(AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession keycloakSession, UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
        // Retrieve data from the UserStorageProvider's backend call.
        String backendCallResult = userSession.getNote("demo-backend-data-note");
        token.getOtherClaims().put("demo-backend-data-1", backendCallResult);


        // Do another mock call to the backend. In order to keep things simple,
        // the result here is a String as well.
        String additionalResult = doAdditionalBackendCall();
        token.getOtherClaims().put("demo-backend-data-2", additionalResult);


        setClaim(token, mappingModel, userSession, keycloakSession, clientSessionCtx);
        return token;
    }

This had lead to a couple of questions:

When working with a UserStorageProvider.isValid, is there a preferred method of getting user data out of the isValid method?
As it stands I'm using the KeycloakSession attributes, which seem less than ideal, as I need to then convert it to a user session note later. However, I don't see any other mechanism for getting data out of the method. Perhaps this is not the appropriate place for such backend calls?
Adding to that, when the backend call in isValid encounters an issue, what's the preferred method for passing additional error context (such as a message) back to the form?
Given that the UsernamePasswordForm is already being extended, it seems to follow that the message could be passed via the KeycloakSession attribute, and simply consumed immediately to provide context for the error.
Should a backend call encounter an error within the ProtocolMapper, are there any best practices to follow to report that failure back to the user?
Given when this call typically occurs, I'm not entirely sure what can be done. I'd be curious to know if there's any existing conventions to follow. Perhaps having backend calls within the mapper is incorrect to begin with?

Any recommendations are welcome.

Thanks

Navigation Menu

Repository navigation

Passing data from UserStorageProvider to token claim #14359

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Passing data from UserStorageProvider to token claim #14359

Uh oh!

Uh oh!

crbednarz Sep 12, 2022

Replies: 0 comments

crbednarz
Sep 12, 2022