[openid_connect 3.x] Support role mapping

Created on 9 June 2023, over 1 year ago
Updated 15 June 2023, over 1 year ago

Problem/Motivation

Currently, role mapping doesn't work. The keycloakRoleMapper service is retrieving role configuration from the old config objects instead of the openid connect provider entity.

I guess it makes sense to move all the role mapping logic to the keycloak provider plugin, since the mapping of the roles is saved in the config of the provider plugin.

The KeycloakRoleMapper currently supports only 1 provider. By moving all the logic to the plugin, it's possible to have multiple keycloak instances with it's own role mapping logic.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

📌 Task
Status

Fixed

Version

2.2

Component

Code

Created by

🇧🇪Belgium JeroenT 🇧🇪

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @JeroenT
  • @jeroent opened merge request.
  • Status changed to Needs review over 1 year ago
  • 🇧🇪Belgium JeroenT 🇧🇪
  • Status changed to Needs work over 1 year ago
  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪

    Will need a rebase.

    This is a major feature which was still somewhere on my roadmap to tackle. Thanks for your work Jeroen! Will try to test this next week.

  • Status changed to Needs review over 1 year ago
  • 🇧🇪Belgium JeroenT 🇧🇪
  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪
    Warning: Undefined array key "enabled" in Drupal\keycloak\Plugin\OpenIDConnectClient\Keycloak->applyRoleRules() (line 758 of /var/www/html/web/modules/contrib/keycloak/src/Plugin/OpenIDConnectClient/Keycloak.php)
    

    Noticed the following in the logs which should be fixed as well.

  • Status changed to Needs work over 1 year ago
  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪

    The Add and Remove button on the role mappings is still breaking the AJAX callback with the following errors:

    Warning: Trying to access array offset on value of type null in Drupal\keycloak\Plugin\OpenIDConnectClient\Keycloak->rulesAjaxCallback() (line 530 of /var/www/html/web/modules/contrib/keycloak/src/Plugin/OpenIDConnectClient/Keycloak.php)
    
    Message	TypeError: Drupal\Core\Render\MainContent\AjaxRenderer::renderResponse(): Argument #1 ($main_content) must be of type array, null given, called in /var/www/html/web/core/lib/Drupal/Core/Form/FormAjaxResponseBuilder.php on line 89 in Drupal\Core\Render\MainContent\AjaxRenderer->renderResponse() (line 49 of /var/www/html/web/core/lib/Drupal/Core/Render/MainContent/AjaxRenderer.php)
    
  • Status changed to Needs review over 1 year ago
  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪
  • Status changed to RTBC over 1 year ago
  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪

    One thing that could improved is an explanation what the "Pattern" field does. I had to look into the code to figure out that the group pattern needed to be without the slash in front of it. So not /groupname but groupname. I guess a few examples with more complex use cases could help.

    I'll create a small follow up for that. I tested this and it works great!

  • Status changed to Fixed over 1 year ago
  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪

    Created follow up: 📌 Explain the groups pattern field + documentation Active

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024