Repository navigation
Allow service account users to be stored in external user storage providers #49802
jbutturini
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Proposal
Service account users (
service-account-<clientId>) are always created in local JPA storage, even when a realm uses an external UserStorageProvider for all other users. UserStorageManager.addUser hard-codes a local-storage path for usernames with the service-account prefix, and getServiceAccount only queries local storage.This is a creates issues for deployments that:
Proposed solution
Updated Interface
Add an optional capability interface
UserServiceAccountProvider(in server-spi-private) that aUserStorageProvidercan implement:Implementation Details
UserStorageManagerchanges:addUser: for service-account usernames. To do this, iterate through the enabled providers implementingUserServiceAccountProviderin priority order; first non-null wins; fall back to local storage if none claim it.getServiceAccount: check local storage first (which preserves behavior for existing realms with locally-stored service accounts), then iterate though theUserServiceAccountProviderimplementations.removeUser: run federated-storage preRemove cleanup for externally-stored service accounts (previously skipped for all service accounts).AbstractUserAdapter/AbstractUserAdapterFederatedStoragechangesget/setServiceAccountClientLinkso implementers can persist the client link in their backing store.Backward compatibility
Realms without a provider implementing this interface are unaffected, such that service accounts continue to be created and looked up in local storage. Existing locally-stored service accounts remain resolvable because lookup checks local storage first. The interface is placed in server-spi-private and is not a stable public SPI.
Alternatives
UserRegistrationProviderpath but rejected it because most external stores should not receive service accounts by default; an explicit opt-in interface is safer.All reactions