Cannot get keycloak protocol mapper to invoke when retrieving a token

Question

Keycloak 7.3.0GA Server

Using Library keycloak-services 3.4.3

Our team is having trouble getting our Keycloak protocol mapper to invoke during a token call:

The mapper is registered at startup and is available in the list of mappers for our clients
We add the mapper in the KC UI for our client
When I try the "Evaluate" tab, the custom mapper (Stackoverflow Custom Mapper) does show in the list as one of the "Effective Protocol Mappers"
However the mapper does not seem to be invoked from the Java side, I see nothing in my logs
At this point we're just hoping to see our log statement for transformAccessToken and the test claim we've added

Java Code:

public class SoamProtocolMapper extends AbstractOIDCProtocolMapper implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper{

public static final String PROVIDER_ID = "oidc-customprotocolmapper";
private static Logger logger = Logger.getLogger(SoamProtocolMapper.class);

private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();

@Override
public List<ProviderConfigProperty> getConfigProperties() {
    logger.info("SOAM: inside getConfigProperties");
    return configProperties;
}

@Override
public String getDisplayCategory() {
    logger.info("SOAM: inside getDisplayCategory");
    return TOKEN_MAPPER_CATEGORY;
}

@Override
public String getDisplayType() {
    logger.info("SOAM: inside getDisplayType");
    return "Stackoverflow Custom Protocol Mapper";
}

@Override
public String getId() {
    logger.info("SOAM: inside getId");
    return PROVIDER_ID;
}

@Override
public String getHelpText() {
    logger.info("SOAM: inside getHelpText");
    return "some help text";
}

@Override
public AccessToken transformAccessToken(AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession session,
        UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
    logger.info("SOAM: inside transformAccessToken");
    token.getOtherClaims().put("stackoverflowCustomToken", "stackoverflow");

    setClaim(token, mappingModel, userSession, session);
    return token;
}

public static ProtocolMapperModel create(String name, boolean accessToken, boolean idToken, boolean userInfo) {
    logger.info("SOAM: inside create");
    ProtocolMapperModel mapper = new ProtocolMapperModel();
    mapper.setName(name);
    mapper.setProtocolMapper(PROVIDER_ID);
    mapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
    Map<String, String> config = new HashMap<String, String>();
    mapper.setConfig(config);
    return mapper;
}}

Anything helps - thanks!

score 3 · Answer 1 · answered Nov 15 '19 at 00:56

Answering my own question. There was a couple of lines of code missing in the static and create initialization methods. Here is a working example:

package com.github.bcgov.keycloak.soam;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import org.keycloak.models.ProtocolMapperModel;
import org.keycloak.models.UserSessionModel;
import org.keycloak.protocol.oidc.OIDCLoginProtocol;
import org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper;
import org.keycloak.protocol.oidc.mappers.OIDCAccessTokenMapper;
import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
import org.keycloak.protocol.oidc.mappers.OIDCIDTokenMapper;
import org.keycloak.protocol.oidc.mappers.UserInfoTokenMapper;
import org.keycloak.provider.ProviderConfigProperty;
import org.keycloak.representations.IDToken;


/**
 * SOAM Protocol Mapper
 */
public class SoamProtocolMapper extends AbstractOIDCProtocolMapper implements     OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper {

private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();

static {
    OIDCAttributeMapperHelper.addTokenClaimNameConfig(configProperties);
    OIDCAttributeMapperHelper.addIncludeInTokensConfig(configProperties, SoamProtocolMapper.class);
}

public static final String PROVIDER_ID = "oidc-soam-mapper";


public List<ProviderConfigProperty> getConfigProperties() {
    return configProperties;
}

@Override
public String getId() {
    return PROVIDER_ID;
}

@Override
public String getDisplayType() {
    return "Soam Protocol Mapper";
}

@Override
public String getDisplayCategory() {
    return TOKEN_MAPPER_CATEGORY;
}

@Override
public String getHelpText() { 
    return "Map SOAM claims";
}

protected void setClaim(IDToken token, ProtocolMapperModel mappingModel, UserSessionModel userSession) {
    token.getOtherClaims().put("test_claim", "Working!");
}

public static ProtocolMapperModel create(String name,
                                  String tokenClaimName,
                                  boolean consentRequired, String consentText,
                                  boolean accessToken, boolean idToken) {
    ProtocolMapperModel mapper = new ProtocolMapperModel();
    mapper.setName(name);
    mapper.setProtocolMapper(PROVIDER_ID);
    mapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
    mapper.setConsentRequired(consentRequired);
    mapper.setConsentText(consentText);
    Map<String, String> config = new HashMap<String, String>();
    config.put(OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME, tokenClaimName);
    if (accessToken) config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
    if (idToken) config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ID_TOKEN, "true");
    mapper.setConfig(config);

    return mapper;
}

}

Hello, having the same problem now on Keycloak 7.4. Question, when is the create method invoked? Also, the methods ProtocolMapperModel.setConsentRequired and ProtocolMapperModel.setConsentText does not exist. — Ross Brigoli, Dec 06 '20 at 16:14
Hi Ross - we've upgraded to Keycloak 9; we did not have to make any changes to our code base (working as expected). I'm unsure where in the call stack the create method is being called. — Marco, Dec 07 '20 at 21:12

Cannot get keycloak protocol mapper to invoke when retrieving a token

1 Answers1