@Path("federated-identity-update")
@GET
public Response processFederatedIdentityUpdate(
@QueryParam("action") String action,
@QueryParam("provider_id") String providerId,
@QueryParam("stateChecker") String stateChecker) {
if (auth == null) {
return login("identity");
}
require(AccountRoles.MANAGE_ACCOUNT);
csrfCheck(stateChecker);
UserModel user = auth.getUser();
if (Validation.isEmpty(providerId)) {
setReferrerOnPage();
return account
.setError(Messages.MISSING_IDENTITY_PROVIDER)
.createResponse(AccountPages.FEDERATED_IDENTITY);
}
AccountSocialAction accountSocialAction = AccountSocialAction.getAction(action);
if (accountSocialAction == null) {
setReferrerOnPage();
return account
.setError(Messages.INVALID_FEDERATED_IDENTITY_ACTION)
.createResponse(AccountPages.FEDERATED_IDENTITY);
}
boolean hasProvider = false;
for (IdentityProviderModel model : realm.getIdentityProviders()) {
if (model.getAlias().equals(providerId)) {
hasProvider = true;
}
}
if (!hasProvider) {
setReferrerOnPage();
return account
.setError(Messages.IDENTITY_PROVIDER_NOT_FOUND)
.createResponse(AccountPages.FEDERATED_IDENTITY);
}
if (!user.isEnabled()) {
setReferrerOnPage();
return account
.setError(Messages.ACCOUNT_DISABLED)
.createResponse(AccountPages.FEDERATED_IDENTITY);
}
switch (accountSocialAction) {
case ADD:
String redirectUri =
UriBuilder.fromUri(
Urls.accountFederatedIdentityPage(uriInfo.getBaseUri(), realm.getName()))
.build()
.toString();
try {
ClientSessionModel clientSession = auth.getClientSession();
ClientSessionCode clientSessionCode = new ClientSessionCode(realm, clientSession);
clientSessionCode.setAction(ClientSessionModel.Action.AUTHENTICATE.name());
clientSession.setRedirectUri(redirectUri);
clientSession.setNote(OIDCLoginProtocol.STATE_PARAM, UUID.randomUUID().toString());
return Response.temporaryRedirect(
Urls.identityProviderAuthnRequest(
this.uriInfo.getBaseUri(),
providerId,
realm.getName(),
clientSessionCode.getCode()))
.build();
} catch (Exception spe) {
setReferrerOnPage();
return account
.setError(Messages.IDENTITY_PROVIDER_REDIRECT_ERROR)
.createResponse(AccountPages.FEDERATED_IDENTITY);
}
case REMOVE:
FederatedIdentityModel link = session.users().getFederatedIdentity(user, providerId, realm);
if (link != null) {
// Removing last social provider is not possible if you don't have other possibility to
// authenticate
if (session.users().getFederatedIdentities(user, realm).size() > 1
|| user.getFederationLink() != null
|| isPasswordSet(user)) {
session.users().removeFederatedIdentity(realm, user, providerId);
logger.debugv(
"Social provider {0} removed successfully from user {1}",
providerId, user.getUsername());
event
.event(EventType.REMOVE_FEDERATED_IDENTITY)
.client(auth.getClient())
.user(auth.getUser())
.detail(Details.USERNAME, link.getUserId() + "@" + link.getIdentityProvider())
.success();
setReferrerOnPage();
return account
.setSuccess(Messages.IDENTITY_PROVIDER_REMOVED)
.createResponse(AccountPages.FEDERATED_IDENTITY);
} else {
setReferrerOnPage();
return account
.setError(Messages.FEDERATED_IDENTITY_REMOVING_LAST_PROVIDER)
.createResponse(AccountPages.FEDERATED_IDENTITY);
}
} else {
setReferrerOnPage();
return account
.setError(Messages.FEDERATED_IDENTITY_NOT_ACTIVE)
.createResponse(AccountPages.FEDERATED_IDENTITY);
}
default:
throw new IllegalArgumentException();
}
}
public String getSocialUrl() {
return Urls.accountFederatedIdentityPage(baseQueryURI, realm).toString();
}