inteligr8/alfresco-keycloak
1
0
Fork 0
mirror of https://github.com/bmlong137/alfresco-keycloak.git synced 2025-05-26 21:44:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

added ticket invalidation on group change

Browse Source
This commit is contained in:
Brian Long 2023-03-07 15:18:54 -05:00
parent d5a9d521c9
commit 26ee2896b2
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
repository/src/main/globalConfig/subsystems/Authentication/keycloak/keycloak-authentication-context.xml
View File

@ -222,6 +222,7 @@
<property name="syncGroupMembershipOnLogin" value="${keycloak.authentication.syncGroupMembershipOnLogin}" />
<property name="transactionService" ref="TransactionService" />
<property name="authorityService" ref="AuthorityService" />
<property name="authenticationService" ref="localAuthenticationService" />
</bean>
<bean id="userFilter.containedInGroup" class="${project.artifactId}.sync.GroupContainmentUserFilter">

22
repository/src/main/java/de/acosix/alfresco/keycloak/repo/authentication/KeycloakTokenGroupSyncProcessor.java
View File

@ -25,6 +25,7 @@ import org.alfresco.repo.security.authentication.AuthenticationUtil;
import org.alfresco.repo.transaction.AlfrescoTransactionSupport;
import org.alfresco.repo.transaction.AlfrescoTransactionSupport.TxnReadState;
import org.alfresco.service.cmr.repository.DuplicateChildNodeNameException;
import org.alfresco.service.cmr.security.AuthenticationService;
import org.alfresco.service.cmr.security.AuthorityService;
import org.alfresco.service.cmr.security.AuthorityType;
import org.alfresco.service.cmr.security.PermissionService;
@ -64,6 +65,8 @@ public class KeycloakTokenGroupSyncProcessor implements TokenProcessor, Initiali
protected AuthorityService authorityService;
protected AuthenticationService authenticationService;
protected Collection<AuthorityExtractor> authorityExtractors;
/**
@ -159,7 +162,14 @@ public class KeycloakTokenGroupSyncProcessor implements TokenProcessor, Initiali
if (this.syncGroupMembershipOnLogin)
{
AuthenticationUtil.runAsSystem(() -> this.transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
this.syncGroupMemberships(groups);
boolean changed = this.syncGroupMemberships(groups);
if (changed) {
String ticket = this.authenticationService.getCurrentTicket();
if (ticket != null) {
LOGGER.debug("Invalidating Alflresco ticket as group membership changed: {}", ticket);
this.authenticationService.invalidateTicket(ticket);
}
}
return null;
}, false, requiresNew));
}
@ -222,11 +232,13 @@ public class KeycloakTokenGroupSyncProcessor implements TokenProcessor, Initiali
*
* @param groups
* the Alfresco group authorities as determined from the Keycloak access token for the current user
* @return true if group membership changed
*/
protected void syncGroupMemberships(final Collection<String> groups)
protected boolean syncGroupMemberships(final Collection<String> groups)
{
final String userName = AuthenticationUtil.getFullyAuthenticatedUser();
final String maskedUsername = AlfrescoCompatibilityUtil.maskUsername(userName);
boolean changed = false;
LOGGER.debug("Synchronising group membership for user {} and token extracted groups {}", maskedUsername, groups);
@ -241,6 +253,7 @@ public class KeycloakTokenGroupSyncProcessor implements TokenProcessor, Initiali
{
LOGGER.debug("Adding user {} to group {}", maskedUsername, group);
this.authorityService.addAuthority(group, userName);
changed = true;
}
}
@ -248,6 +261,9 @@ public class KeycloakTokenGroupSyncProcessor implements TokenProcessor, Initiali
{
LOGGER.debug("Removing user {} from group {}", maskedUsername, group);
this.authorityService.removeAuthority(group, userName);
}
changed = true;
}
return changed;
}
}