8000 Ensure that IDP's linked domains are remove when org is deleted or wh… by sguilhen · Pull Request #29520 · keycloak/keycloak · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Ensure that IDP's linked domains are remove when org is deleted or wh… #29520

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 14, 2024
Merged

Ensure that IDP's linked domains are remove when org is deleted or wh… #29520

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions model/jpa/src/main/java/org/keycloak/organization/jpa/JpaOrganizationProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,9 @@

package org.keycloak.organization.jpa;

import static org.keycloak.models.OrganizationModel.BROKER_PUBLIC;
import static org.keycloak.models.OrganizationModel.ORGANIZATION_ATTRIBUTE;
import static org.keycloak.models.OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE;
import static org.keycloak.models.jpa.PaginationUtils.paginateQuery;
import static org.keycloak.utils.StreamsUtil.closing;

Expand Down Expand Up @@ -327,7 +329,10 @@ public boolean removeIdentityProvider(OrganizationModel organization, IdentityPr
return false;
}

// clear the organization id and any domain assigned to the IDP.
identityProvider.setOrganizationId(null);
identityProvider.getConfig().remove(ORGANIZATION_DOMAIN_ATTRIBUTE);
identityProvider.getConfig().remove(BROKER_PUBLIC);
realm.updateIdentityProvider(identityProvider);

return true;
Expand Down
8 changes: 8 additions & 0 deletions model/jpa/src/main/java/org/keycloak/organization/jpa/OrganizationAdapter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,8 @@ public void setDomains(Set<OrganizationDomainModel> domains) {
throw new ModelValidationException("You must provide at least one domain");
}

List<IdentityProviderModel> idps = this.getIdentityProviders().toList();

Map<String, OrganizationDomainModel> modelMap = domains.stream()
.map(this::validateDomain)
.collect(Collectors.toMap(OrganizationDomainModel::getName, Function.identity()));
Expand All @@ -149,6 +151,12 @@ public void setDomains(Set<OrganizationDomainModel> domains) {
// remove domain that is not found in the new set.
else {
this.entity.removeDomain(domainEntity);
// check if any idp is assigned to the removed domain, and unset the domain if that's the case.
idps.forEach(idp -> {
if (Objects.equals(domainEntity.getName(), idp.getConfig().get(ORGANIZATION_DOMAIN_ATTRIBUTE))) {
idp.getConfig().remove(ORGANIZATION_DOMAIN_ATTRIBUTE);
}
});
}
}

Expand Down
1 change: 0 additions & 1 deletion ...ase/src/test/java/org/keycloak/testsuite/organization/admin/AbstractOrganizationTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@
import org.jboss.arquillian.graphene.page.Page;
import org.keycloak.admin.client.resource.OrganizationResource;
import org.keycloak.models.OrganizationModel;
import org.keycloak.representations.idm.ClientRepresentation;
import org.keycloak.admin.client.resource.UsersResource;
import org.keycloak.representations.idm.IdentityProviderRepresentation;
import org.keycloak.admin.client.resource.RealmResource;
Expand Down
29 changes: 28 additions & 1 deletion ...test/java/org/keycloak/testsuite/organization/admin/OrganizationIdentityProviderTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@
import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.equalTo;
import static org.junit.Assert.assertFalse;
import static org.hamcrest.Matchers.is;
import static org.hamcrest.Matchers.nullValue;
import static org.keycloak.models.OrganizationModel.BROKER_PUBLIC;
import static org.keycloak.models.OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE;

import jakarta.ws.rs.BadRequestException;
import jakarta.ws.rs.NotFoundException;
Expand Down Expand Up @@ -156,6 +160,8 @@ public void testRemovingOrgShouldRemoveIdP() {
IdentityProviderRepresentation idpRep = testRealm().identityProviders().get(bc.getIDPAlias()).toRepresentation();
// broker no longer linked to the org
Assert.assertNull(idpRep.getConfig().get(OrganizationModel.ORGANIZATION_ATTRIBUTE));
Assert.assertNull(idpRep.getConfig().get(ORGANIZATION_DOMAIN_ATTRIBUTE));
Assert.assertNull(idpRep.getConfig().get(BROKER_PUBLIC));
}

@Test
Expand Down Expand Up @@ -183,7 +189,7 @@ public void testAssignDomainNotBoundToOrganization() {
OrganizationResource orgResource = testRealm().organizations().get(orgRep.getId());
OrganizationIdentityProviderResource orgIdPResource = orgResource.identityProviders().get(bc.getIDPAlias());
IdentityProviderRepresentation idpRep = orgIdPResource.toRepresentation();
idpRep.getConfig().put(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE, "unknown.org");
idpRep.getConfig().put(ORGANIZATION_DOMAIN_ATTRIBUTE, "unknown.org");

try {
testRealm().identityProviders().get(idpRep.getAlias()).update(idpRep);
Expand Down Expand Up @@ -220,6 +226,27 @@ public void testAddIdpFromDifferentRealm() {
});
}

@Test
public void testRemovedDomainUpdatedInIDP() {
OrganizationRepresentation orgRep = createOrganization("testorg", "testorg.com", "testorg.net");
OrganizationResource orgResource = testRealm().organizations().get(orgRep.getId());
OrganizationIdentityProviderResource orgIdPResource = orgResource.identityProviders().get("testorg-identity-provider");
IdentityProviderRepresentation idpRep = orgIdPResource.toRepresentation();

// IDP should have been assigned to the first domain.
assertThat(idpRep.getConfig().get(ORGANIZATION_DOMAIN_ATTRIBUTE), is(equalTo("testorg.com")));

// let's update the organization, removing the domain linked to the IDP.
orgRep.removeDomain(orgRep.getDomain("testorg.com"));
try (Response response = orgResource.update(orgRep)) {
assertThat(response.getStatus(), is(equalTo(Status.NO_CONTENT.getStatusCode())));
}

// fetch the idp config and check if the domain has been unlinked.
idpRep = orgIdPResource.toRepresentation();
assertThat(idpRep.getConfig().get(ORGANIZATION_DOMAIN_ATTRIBUTE), is(nullValue()));
}

private IdentityProviderRepresentation createRep(String alias, String providerId) {
IdentityProviderRepresentation idp = new IdentityProviderRepresentation();

Expand Down
0