ESB-890: Dynamic user authorization mapping driven by KC profile

engine/src/main/java/com/agiletec/aps/system/common/entity/AbstractEntitySearcherDAO.java

@@ -136,6 +136,7 @@ protected EntitySearchFilter[] addFilter(EntitySearchFilter[] filters, EntitySea
 
     private PreparedStatement buildStatement(EntitySearchFilter[] filters, boolean isCount, boolean selectAll, Connection conn) {
         String query = this.createQueryString(filters, isCount, selectAll);
+
         PreparedStatement stat = null;
         try {
             stat = conn.prepareStatement(query);
@@ -567,4 +568,4 @@ protected String getMasterTableName() {
         return this.getEntityMasterTableName();
     }
 
-}
+}

engine/src/main/java/com/agiletec/aps/system/services/authorization/AuthorizationManager.java

@@ -40,7 +40,7 @@
 
 /**
  * Servizio di autorizzazione. Il servizio espone tutti i metodi necessari per
- * la verifica verifica delle autorizzazioni utente, qualsiasi sia la sua
+ * la verifica delle autorizzazioni utente, qualsiasi sia la sua
  * provenienza e definizione.
  * @author E.Santoboni
  */
@@ -749,4 +749,4 @@ public void setGroupManager(IGroupManager groupManager) {
     private IRoleManager _roleManager;
     private IGroupManager _groupManager;
 
-}
+}

keycloak-plugin/README.md

@@ -10,6 +10,7 @@ Information below is for building from source or running locally as a contributo
 ### What this plugin does
 * Enables SSO capabilities to an Entando Instance by using Keycloak.
 * Moves User Management to Keycloak.
+* Assigns on-the-fly authorizations to the logging-in users; such authorizations might come from keycloak itself or external sources   
 
 ### What this plugin does not
 This plugin doesn't come with Role and Group management, because Entando Core roles/groups model isn't compatible with Keycloak. That means that even with the same users across multiple Entando Instances, the role and group mappings have to be configured on each instance.
@@ -24,6 +25,10 @@ This plugin doesn't come with Role and Group management, because Entando Core ro
 >- `keycloak.secure.uris`: **[OPTIONAL]** Use if you want to secure an endpoint. Works with wildcards, comma separated.
 >- `keycloak.authenticated.user.default.authorizations`: **[OPTIONAL]** Use if you want to automatically assign `group:role` to any user that logs in, comma separated. Example: `administrators:admin,readers`
 
+## Environment variables
+>- `KC_MAPPING_UPDATE`: specifies the refresh period -Chron style!- of the dynamic configuration used to assign authorizations to the loggin-in users. The default is `0 * * * * *`
+
+
 ## Installing
 
 ### Installing on your project

keycloak-plugin/pom.xml

@@ -13,6 +13,37 @@
     <name>Entando Plugin: Keycloak</name>
     <url>http://www.entando.com/</url>
     <build>
+        <resources>
+            <resource>
+                <directory>src/main/resources</directory>
+                <excludes>
+                    <exclude>src/main/resources/component</exclude>
+                </excludes>
+            </resource>
+            <resource>
+                <directory>src/main/resources</directory>
+                <includes>
+                    <include>**/*component.xml</include>
+                </includes>
+                <filtering>true</filtering>
+            </resource>
+            <resource>
+                <directory>src/main/java</directory>
+                <includes>
+                    <include>**/*.properties</include>
+                    <include>**/*.xml</include>
+                    <include>**/*.xsd</include>
+                    <include>**/*.txt</include>
+                </includes>
+            </resource>
+            <resource>
+                <directory>src/test/java</directory>
+                <includes>
+                    <include>**/*.sql</include>
+                    <include>**/*.json</include>
+                </includes>
+            </resource>
+        </resources>
         <plugins>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>

keycloak-plugin/src/main/java/org/entando/entando/aps/servlet/security/KeycloakAuthenticationFilter.java

@@ -87,6 +87,7 @@ public Authentication attemptAuthentication(final HttpServletRequest request, fi
         }
 
         final String bearerToken = authorization.substring("Bearer ".length());
+
         final ResponseEntity<AccessToken> resp = oidcService.validateToken(bearerToken);
         final AccessToken accessToken = resp.getBody();
 
@@ -111,7 +112,7 @@ public Authentication attemptAuthentication(final HttpServletRequest request, fi
             setUserOnContext(request, user, userAuthentication);
 
             // TODO optimise to not check on every request
-            keycloakGroupManager.processNewUser(user);
+            keycloakGroupManager.processNewUser(user, bearerToken, true);
 
             return userAuthentication;
         } catch (EntException e) {
@@ -174,4 +175,4 @@ public void onAuthenticationFailure(HttpServletRequest request,
         response.addHeader("Content-Type", "application/json");
         response.getOutputStream().println(objectMapper.writeValueAsString(restResponse));
     }
-}
+}

keycloak-plugin/src/main/java/org/entando/entando/keycloak/filter/KeycloakFilter.java

@@ -256,7 +256,7 @@ private void doLogin(final HttpServletRequest request, final HttpServletResponse
                 session.setAttribute(SESSION_PARAM_ID_TOKEN, responseEntity.getBody().getIdToken());
                 session.setAttribute(SESSION_PARAM_REFRESH_TOKEN, responseEntity.getBody().getRefreshToken());
 
-                keycloakGroupManager.processNewUser(user);
+                keycloakGroupManager.processNewUser(user, responseEntity.getBody().getAccessToken(), true);
                 saveUserOnSession(request, user);
                 log.info("Successfully authenticated user {}", user.getUsername());
             } catch (HttpClientErrorException e) {