Add HardCodedTenantMapper

[joas8211]

This pull request implements HardCodedTenantMapper that can assign active tenant for OpenID session. We need it to set active tenant for API clients that do not have ability to interact with login forms.

[gpproton]

I'm experiencing a simlilar situation where i need to have a default tenant or switch to a new tenant using the API. Really hoping the pull request is considered.

[anarsultanov]

@joas8211 thank you for the contribution, I've been on vacation the last few weeks so haven't had a chance to check the PR but will do so asap.

[anarsultanov]

@joas8211 @gpproton wouldn't it be useful to be able to configure role as well?

[joas8211]

Sorry for long silence, I was also on holiday. We haven't had reason to use tenant roles because they don't integrate with Keycloak's authorization system. We created our own system to map realm roles to tenants so that we can use them instead.

[anarsultanov]

Thanks for the clarification, @joas8211! Let's proceed with merging this since it fits your use case, and we can extend it if needed in the future. Could you also elaborate on how you integrate realm roles with tenants? Your approach might present potential improvements for the extension.

[joas8211]

We use realm role attribute with tenant ID as the value to make a role available for a tenant. We have a custom service that contacts Keycloak Admin API to report and define assigned and available roles to users. The realm roles are used with Keycloak's access control system to assign wanted permissions for a session. For now we use regex policy to match active tenant from the session attributes, but that could definitely be improved by implementing a custom policy type for active tenant.

[oleaasbo]

Hi!

I am currently using Keycloak version 22.0.3. After upgrading to the latest version of this extension, I encountered an issue where Keycloak can no longer be built due to the introduction of the following mapper:

dev.sultanov.keycloak.multitenancy.protocol.oidc.mappers.HardcodedTenantMapper

The problem arises because the mapper uses the function:

void org.keycloak.provider.ProviderConfigProperty.<init>(java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.lang.Object, boolean, boolean)

This function was introduced in Keycloak version 23.0.0, but is not present in my current version (22.0.3). Specifically, the use of the boolean required parameter is causing the build to fail.

If the goal is to maintain backwards compatibility, this will need to be addressed!

Thanks!

[anarsultanov]

Thank you for your comment, @oleaasbo. I appreciate your feedback.
However, as mentioned in the README, this extension is intended to support only the latest version of Keycloak. Maintaining backwards compatibility with all previous versions is not within the scope of this project.