Repository navigation
Replies: 3 comments 2 replies
|
To explore how the user model can be extended, there is a branch here: https://github.com/ahus1/keycloak/tree/9931-move-authenticate-call-to-user-model -- it is built on top of the current WIP user LDAP map support. This will log in a user with the hard-coded password “anything” in this POC (see LdapUserEntity). It shows that this can be added to the existing APIs without breaking existing functionality. Existing functionality could later be deprecated once the new way proves itself to work as expected. LdapUserEntity has access to the current transaction and the LDAP configuration. Having access to the LDAP configuration would be sufficient to validate the user's credentials. |
|
There are now new commits on the branch that introduce a |
|
After talking to @hmlnarik on Monday, credential handling should handed in a separate class. UserCredentialManager should eventually disappear, as all interaction will then be focused on a user. This is now present in the branch listed above, including the integration with LDAP for updating and validation passwords. old: new: |
|
This has been discussion and generally approved in today's team meeting. The code changes are now part of PR #10700. |
|
Uh oh!
There was an error while loading. Please reload this page.
Problem statement
The current authentication for users in Map storage rely on credentials that are saved in the store and then validated on the logical layer, see #9932.
As for LDAP credentials are not accessible, and passwords are sent to LDAP for validation.
Approach
The validation of the
CredentialInputcould be done on the physical layer (in the Map LDAP module), and the input would be sent down there for validation.Benefits
Once the user has been looked up, this can be called directly on the user model.
Alternatives
All reactions