69 lines
2.3 KiB
YAML
69 lines
2.3 KiB
YAML
---
|
|
apiVersion: v1
|
|
data:
|
|
domain-group-authenticator.js: |
|
|
// Helper function to map domain to group using group attributes
|
|
function mapDomainToGroups(domain, realm) {
|
|
// Fetch all groups and check their attributes for email domain mapping
|
|
var groups = realm.getGroupsStream().toArray();
|
|
LOG.info("groups: " + groups);
|
|
var allowedGroups = [];
|
|
for (var i = 0; i < groups.length; i++) {
|
|
var allowedDomains = groups[i].getAttributeStream("allowedDomains").toArray();
|
|
LOG.info("allowedDomains: " + allowedDomains);
|
|
for (var j = 0; j < allowedDomains.length; j++) {
|
|
if (allowedDomains[j] == domain) {
|
|
allowedGroups.push(groups[i])
|
|
break;
|
|
};
|
|
}
|
|
}
|
|
|
|
return allowedGroups;
|
|
}
|
|
|
|
// Helper function to extract email domain
|
|
function getEmailDomain(email) {
|
|
var parts = email.split("@");
|
|
return parts.length === 2 ? parts[1] : null;
|
|
}
|
|
|
|
function authenticate(context) {
|
|
var user = context.getUser();
|
|
var realm = context.getRealm();
|
|
var authenticationSession = context.getAuthenticationSession();
|
|
|
|
// Extract email domain from user's email
|
|
var email = user.getEmail();
|
|
var domain = getEmailDomain(email);
|
|
LOG.info("Email domain" + domain);
|
|
|
|
// Map email domain to a group using group attributes
|
|
var groups = mapDomainToGroups(domain, realm);
|
|
|
|
if (groups.length > 0) {
|
|
// var group = realm.getGroupByPath("/" + groupName);
|
|
groups.forEach(function (group) {
|
|
LOG.info("joining group" + group);
|
|
user.joinGroup(group)
|
|
});
|
|
}
|
|
|
|
// Continue with the authentication flow
|
|
context.success();
|
|
};
|
|
keycloak-scripts.json: |
|
|
{
|
|
"authenticators": [
|
|
{
|
|
"name": "Email domain group mapping",
|
|
"fileName": "domain-group-authenticator.js",
|
|
"description": "Applies a group to a user account based on their email domain matching a group's allowedDomains attribute"
|
|
}
|
|
]
|
|
}
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: keycloak-scripts-5h96f8448g
|
|
namespace: keycloak
|