Package org.keycloak.forms.login.freemarker.model

Class IdentityProviderBean

java.lang.Object
org.keycloak.forms.login.freemarker.model.IdentityProviderBean
Direct Known Subclasses:
OrganizationAwareIdentityProviderBean
public class IdentityProviderBean extends Object
Author:
Stian Thorgersen, Vlastimil Elias (velias at redhat dot com)

  • Field Details

    • IDP_COMPARATOR_INSTANCE

      public static org.keycloak.models.OrderedModel.OrderedModelComparator<IdentityProviderBean.IdentityProvider> IDP_COMPARATOR_INSTANCE

    • context

      protected org.keycloak.authentication.AuthenticationFlowContext context

    • providers

      protected List<IdentityProviderBean.IdentityProvider> providers

    • session

      protected org.keycloak.models.KeycloakSession session

    • realm

      protected org.keycloak.models.RealmModel realm

    • baseURI

      protected URI baseURI

  • Constructor Details

    • IdentityProviderBean

      public IdentityProviderBean(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, URI baseURI, org.keycloak.authentication.AuthenticationFlowContext context)

  • Method Details

    • getProviders

      public List<IdentityProviderBean.IdentityProvider> getProviders()

    • getSession

      public org.keycloak.models.KeycloakSession getSession()

    • getRealm

      public org.keycloak.models.RealmModel getRealm()

    • getBaseURI

      public URI getBaseURI()

    • getFlowContext

      public org.keycloak.authentication.AuthenticationFlowContext getFlowContext()

    • createIdentityProvider

      protected IdentityProviderBean.IdentityProvider createIdentityProvider(org.keycloak.models.RealmModel realm, URI baseURI, org.keycloak.models.IdentityProviderModel identityProvider)
      Creates an IdentityProviderBean.IdentityProvider instance from the specified IdentityProviderModel.
      Parameters:
      realm - a reference to the realm.
      baseURI - the base URI.
      identityProvider - the IdentityProviderModel from which the freemarker IdentityProviderBean.IdentityProvider is to be built.
      Returns:
      the constructed IdentityProviderBean.IdentityProvider.

    • getExistingIDP

      protected String getExistingIDP(org.keycloak.models.KeycloakSession session, org.keycloak.authentication.AuthenticationFlowContext context)
      Checks if an IDP is being connected to the user's account. In this case the currentUser is null and the current flow is the FIRST_BROKER_LOGIN_PATH, so we should retrieve the IDP they used for login and filter it out of the list of IDPs that are available for login. (GHI #14173).
      Parameters:
      session - a reference to the KeycloakSession.
      context - a reference to the AuthenticationFlowContext.
      Returns:
      the alias of the IDP used for login before linking a new IDP to the user's account (if any).

    • getLinkedBrokerAliases

      protected Set<String> getLinkedBrokerAliases(org.keycloak.models.KeycloakSession session, org.keycloak.models.RealmModel realm, org.keycloak.authentication.AuthenticationFlowContext context)
      Returns the list of IDPs linked with the user's federated identities, if any. In case these IDPs exist, the login page should show only the IDPs already linked to the user. Returning null indicates that all public enabled IDPs should be available.

      Returning an empty set essentially narrows the list of available IDPs to zero, so no IDPs will be shown for login.
      Parameters:
      session - a reference to the KeycloakSession.
      realm - a reference to the realm.
      context - a reference to the AuthenticationFlowContext.
      Returns:
      a Set containing the aliases of the IDPs that should be available for login. An empty set indicates that no IDPs should be available.

    • getFederatedIdentityProviders

      protected List<IdentityProviderBean.IdentityProvider> getFederatedIdentityProviders(Set<String> federatedProviders, String existingIDP)
      Builds and returns a list of IdentityProviderBean.IdentityProvider instances from the specified set of federated IDPs. The IDPs must be enabled, not link-only, and not set to be hidden on login page. If any IDP has an alias that matches the existingIDP parameter, it must be filtered out.
      Parameters:
      federatedProviders - a Set containing the aliases of the federated IDPs that should be considered for login.
      existingIDP - the alias of the IDP that must be filtered out from the result (used when linking a new IDP to a user's account).
      Returns:
      a List containing the constructed IdentityProviderBean.IdentityProviders.

    • federatedProviderPredicate

      protected Predicate<org.keycloak.models.IdentityProviderModel> federatedProviderPredicate()
      Returns a predicate that can filter out IDPs associated with the current user's federated identities before those are converted into IdentityProviderBean.IdentityProviders. Subclasses may use this as a way to further refine the IDPs that are to be returned.
      Returns:
      the custom Predicate used as a last filter before conversion into IdentityProviderBean.IdentityProvider

    • searchForIdentityProviders

      protected List<IdentityProviderBean.IdentityProvider> searchForIdentityProviders(String existingIDP)
      Builds and returns a list of IdentityProviderBean.IdentityProvider instances that will be available for login. This method goes to the IdentityProviderStorageProvider to fetch the IDPs that can be used for login (enabled, not link-only and not set to be hidden on login page).
      Parameters:
      existingIDP - the alias of the IDP that must be filtered out from the result (used when linking a new IDP to a user's account).
      Returns:
      a List containing the constructed IdentityProviderBean.IdentityProviders.