Develop Reference

Searching users in Keycloak from Java code

I am using Spring Boot, Keycloak 10, java 8 and keycloak-admin-client jar. I am able to get user, his groups and roles.
When it comes to search I see different search method options for example I could :
List<UserRepresentation> search = getKeycloakInstance().realm("my-realm").users()
.search("username");
https://www.keycloak.org/docs-api/10.0/javadocs/org/keycloak/admin/client/resource/UsersResource.html
But what i need to do i to write couple of methods:
search by roles (so search users who has some roles)
search by groups and group attributes
search by text (firstname, lastname, email) in 'contains' manner: mytext
search by roles and text
search by list of ids (uuids of users)
I dont' see such possibilities in keycloak-admin-client, or it is possible of what else should I use instead of keycloak-admin-client ?

Unfortunately, keycloak-admin-client doesn't provide lots of search options.
How to find users by role:
RoleResource roleResource = getKeycloakInstance().realm("realm_name")
.roles().get("role_name");
roleResource.getRoleUserMembers();
How to find all users in the group:
getKeycloakInstance().realm("realm_name").groups().group("your_group").members();
How to find users by username, firstName, lastName, email:
getKeycloakInstance().realm("my-realm").users()
.search("username", "lastName", "email");
If it's okay for you, try to use Keycloak Admin REST API to get more search opportunities.

Picketlink: finding users with given role

I configured a JPA store and see users and roles getting added correctly to the db when I call the related picketlink (2.7.1) API's
My questions is this: how does one get a list of all users that have a given role?
I tried doing this using the following RelationshipQuery
RelationshipQuery<Grant> rq = relationshipManager.createRelationshipQuery(Grant.class);
rq.setParameter(Grant.ROLE, role);
List<Grant> grants = rq.getResultList()
But the resulting grant list contains a single assignment grant, that refers to the last user in the database that has that role.
I checked the example queries in the documentation and tests but found nothing that does what I want. I know the project is no longer active but am hoping to find a solution to this.

Found out that role data wasn't imported correctly from the old db. Once I fixed that the above code worked as expected.

LDAP: Get list of users in a specific group

I'm trying to get all users of a specific user group. I'm doing this in java, I can connect to ldap and get results from different queries. However I've searched to find solution but as far as I can tell the LDAP of my workplace is structured differently than what seems normal.
dn of users:
ou=Users,O=MYCOMPANY.COM
dn of the user group:
cn=Admin,ou=Profiles,ou=MYAPP,ou=Applirights,O=MYCOMPANY.COM
For the user group, cn is the privilege level / group name (Admin) and the name of the application is in an organisational unit. With this structure, how would I query for all users in this specific group?
I tried:
NamingEnumeration<?> namingEnum = ctx.search("ou=Users,O=MYCOMPANY.COM", "(cn=Admin,ou=Profiles,ou=MYAPP,ou=Applirights,O=MYCOMPANY.COM)", searchControls);
However what attributes would need to be in search controls? I use uid which is the users login name.
I also tried whats outlined here:
(&(objectCategory=user)(memberOf=cn=Admin,ou=MYAPP,ou=Applirights,O=MYCOMPANY.COM))
Nothing works and with that, I mean I get 0 results but no error. How can I achieve this with the given organisation of ldap?

Groups have something called memberOf:
So try this:
search -s sub -b "DC=whatever,DC=mydomain,DC=com" "(&(objectCategory=user)(memberOf=CN=GROUP,DC=whatever,DC=mydomain,DC=com))"
you fill in whatever mydomain and GROUP above ^

What attributes would need to be in search controls?
The attributes listed in searchControls are the ones you want returned. The one containing the group members. Depending on what objectClass the group object is, it might be:
uniqueMember for groupOfUniqueNames
roleOccupant for organizationalRole
and so forth.

How to exclude user from "people" group in Sun Java System Messaging Server 6.3?

I am new at Sun Java System Messaging Server 6.3. I am managing my e-mail users and group via ldapbrowser version 2.8.2.
I want to exclude a particular user from people group.
I found the below string in people group's configuration:
memberURL: ldap:///o=domain.com,dc=domain,dc=com??sub?(&(Employeenumber=*)(InetUserStatus=active))

The definition of the 'People' group is:
Within ldap:///o=domain.com,dc=domain,dc=com, where the attribute Employeenumber is present (Employeenumber=*), and the attribute InetUserStatus has the value active (InetUserStatus=active).
So, if you want to exclude someone, you need and attribute to match, and the value to exclude and construct the LDAP search filter that matches this, and update the filter (&(Employeenumber=*)(InetUserStatus=active)) to correspond to this.
so, if they were Employeenumber 55, then you don't want them in the list, so the condition for this is !(Employeenumber=55), so you need to plug this into the selection condition as:
(&(&(Employeenumber=*)(InetUserStatus=active))(!(Employeenumber=55)))
If you wanted to filter a second user (e.g. Employeenumber 99 as well, then it becomes:
(&(&(&(Employeenumber=*)(InetUserStatus=active))(!(Employeenumber=55)))(!(Employeenumber=99)))
You can see how this will get very complicated very quickly.

How can I make AccountManager handle multiple accounts per username?

I would like to use Android's built-in AccountManager to handle accounts for our native Android app. However, we have a peculiar need.
It appears that Android's concept of an Account is a combination of name (i.e. MazerRackham#example.com) and type (i.e. com.example). Name is the username you login with. Type is associated with your application or company.
However, our REST backend allows a single user to have multiple accounts and each account must be accessed by its own unique hash tied to the combination of one username and one account number (in addition to type).
I already have the AccountAuthenticator, AuthenticationService, and AccountAuthenticatorActivity working for a single user with a single account number and single stored hash. Is there any way in which I could implement my AccountAuthenticator to handle users with multiple accounts under the same username, each requiring a hash? Would it be possible to attach a delimiter to the username and split it into username and account number every time I use it?
If I cannot figure out a way to handle this, how should I gracefully fall back during AbstractAccountAuthenticator.getAuthToken? Would it make sense to set the hash to a special flag value and use legacy login methods for that user? Or is that too much of a hack?
Thanks for your help!

If you don't mind the hash being public, you can certainly make the account name username|hash (or whatever separator you want) - the system does not care what you use for an account name except that it uniquely defines a user.

I ended up serializing the data into the username using an at sign (#) as a delimiter. I chose the at sign because it's the only restricted character in an e-mail address that should only be used exactly one time.
Here is the code from getAuthToken in my AccountAuthenticator which gets called only if I need to obtain a fresh token for that user and account id:
/*
*
* The login params need to handle users with multiple accounts under the same username.
*
* Since Android's AccountManager does not allow multiple accounts per username, I had
* to create a hack which joins and splits the username on a delimiter to serialize the
* data and retrieve the account number for users with multiple accounts. I chose the #
* sign as a delimiter because e-mail addresses have VERY few invalid characters in
* the account name part of the address.
*
* If the user has multiple accounts, we need to create each one in AccountManager.
*
* */
String[] accountParts = account.name.split("#");
numParts = accountParts.length;
if (numParts<2) {
Log.wtf(Config.TAG, "Username split produced too few parts. WTF.");
return null;
}
String email = accountParts[0] + "#" + accountParts[1];
if (numParts==3) {
String account_id = accountParts[2];
} else if (numParts>3) {
Log.wtf(Config.TAG, "Username split produced too many parts. WTF.");
return null;
}