userID in external DB

Configuring the server
1

Hello,

I am beginning with Keycloak. I am searching how to configure our Keycloack server for our specific case and didn’t found any solution.

For each defined realm client (=SSO context with many applications), we would like

  1. either to define a specific (mysql) DB query in keycloack to find the userID in an “external DB” (= how can we define the DBname, DBuser, DBpasswd, and the request just to know if the user is or not allowed)
  2. or that keycloack provides the realm ID + email to an “external” application (on the same server) and this application will answer that the email is/or not “allowed”, keycloack would than check the password and other info/flow defined in the realm. In fact, in this solution the external application will implement the DB query used for the first solution.

To be clear: the external DB stores the email plus specific information but nothing to do with the Keycloack data. The email is the only relation ship between the external DB and the Keyckloack DB.

Should we develop a complete SPI for such issue ? Is it not an easier way to do that ?

Thanks a lot for any help.
Guillaume

2

The UserStorage SPI will be most probably your friend.
See these resources:

https://www.keycloak.org/docs/latest/server_development/index.html#_user-storage-spi

KEYCLOAK Implementing Custom User Storage Provider (in-depth) | Niko Köbler (@dasniko)

3

Hello

First of all, thanks a lot for your answer.

If I correctly understand the UserStorage SPI, it wouldn’t respond to our requests or will be difficult to implement it according the requests. Correct me if I am wrong :

The first issue is that the flow is the following:

  1. Keycloack checks in the memory if the users has the credentials
  2. if, not Keycloack process a login and checks the id+password (for example) with its own database
  3. if the users is not found in its databases it will use the UserStoragr SPI.

Is it right?

If it is, the problem is that our separate database may remove the permission before Keycloack. So if the user was previously allowed but is not more, at the step 2 Keycloack find the user and give him the permission he hasn’t any more.

I am thinking something else:
If I am right it would be possible to define a group which is allowed to use an application. Each user in the group would be allowed to use the application. I guess the user’s group are define in a table of the Keycloack databases.
Is it not possible for our application which gives the permission, to update the Keycloack table to add or remove a group from a user ?

Correct me, I am a little be confused between group and roles so maybe instead of updating the group I have to update the role of a user ?

Is this way possible ? And if it is could you tell me which table should be updated ?

Thanks a lot for any help/correction.
Best regards
Guillaume.