federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java
/**
     * Called after successful kerberos authentication
     *
     * @param realm realm
     * @param username username without realm prefix
     * @return finded or newly created user
     */
Called after successful kerberos authentication

@param realm realm
@param username username without realm prefix
@return finded or newly created user
Called after successful kerberos authentication @param realm realm @param username username without realm prefix @return finded or newly created user
protected UserModel findOrCreateAuthenticatedUser(RealmModel realm, String username) {
        UserModel user = session.userStorage().getUserByUsername(username, realm);
        if (user != null) {
            logger.debugf("Kerberos authenticated user [%s] found in Keycloak storage", username);
            if (!model.getId().equals(user.getFederationLink())) {
                logger.warnf("User with username [%s] already exists, but is not linked to provider [%s]", username, model.getDisplayName());
                return null;
            } else {
                LDAPObject ldapObject = loadAndValidateUser(realm, user);
                if (ldapObject != null) {
                    return proxy(realm, user, ldapObject);
                } else {
                    logger.warnf("User with username [%s] aready exists and is linked to provider [%s] but is not valid. Stale LDAP_ID on local user is: %s",
                            username,  model.getDisplayName(), user.getAttribute(LDAPConstants.LDAP_ID));
                    logger.warn("Will re-create user");
                    session.userStorage().removeUser(realm, user);
                }
            }
        }
        logger.debugf("Kerberos authenticated user [%s] not in Keycloak storage. Creating him", username);
        return getUserByUsername(realm, username);
    }
protected UserModel findOrCreateAuthenticatedUser ( RealmModel realm , String username ) { UserModel user = session . userStorage ( ) . getUserByUsername ( username , realm ) ; if ( user != null ) { logger . debugf ( "Kerberos authenticated user [%s] found in Keycloak storage" , username ) ; if ( ! model . getId ( ) . equals ( user . getFederationLink ( ) ) ) { logger . warnf ( "User with username [%s] already exists, but is not linked to provider [%s]" , username , model . getDisplayName ( ) ) ; return null ; } else { LDAPObject ldapObject = loadAndValidateUser ( realm , user ) ; if ( ldapObject != null ) { return proxy ( realm , user , ldapObject ) ; } else { logger . warnf ( "User with username [%s] aready exists and is linked to provider [%s] but is not valid. Stale LDAP_ID on local user is: %s" , username , model . getDisplayName ( ) , user . getAttribute ( LDAPConstants . LDAP_ID ) ) ; logger . warn ( "Will re-create user" ) ; session . userStorage ( ) . removeUser ( realm , user ) ; } } } logger . debugf ( "Kerberos authenticated user [%s] not in Keycloak storage. Creating him" , username ) ; return getUserByUsername ( realm , username ) ; }
Called after successful kerberos authentication
Called after successful kerberos authentication
// Creating user to local storage
