Method for dynamically loading IDP on Keyblock
By implementing the method of dynamically loading IDP on Keycloak, using IDP scanner, class loader and cache management module, the flexibility and response speed problems caused by static configuration of Keycloak IDP are solved, real-time effectiveness and rapid response are achieved, improving user experience and reducing operation and maintenance costs.
Patent Information
- Application Number
- CN202411362863.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-27
- Publication Date
- 2025-02-25
AI Technical Summary
Keycloak's IDP does not support dynamic loading. The configuration is based on static methods. Each time IDP is added or modified and the service needs to be manually restarted, which affects flexibility and response speed. It also responds slowly to the support of new identity providers, which affects the user experience.
Implement the method of dynamically loading IDP on Keycloak. Through the IDP scanner module, IDP class loader module and IDP cache management module, listen to changes in IDP files, parse and load CLASS files and HTML files, and dynamically update Keycloak's IDP configuration to achieve real-time effectiveness and rapid response.
Dynamically load and update IDP without restarting the Keycloak service, improving system flexibility and response speed, improving user login experience, and reducing operation and maintenance costs.
Smart Images
Figure CN119513832A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of software management, and in particular to a method for dynamically loading an IDP implemented on Keycloak. Background Art
[0002] Now enterprises use SSO (single sign-on) to log in to various business systems, so that users can access multiple related but independent systems with one login credential. Keycloak is an open source identity and access management solution that provides single sign-on, identity management and authentication services. It also supports different IDPs (Identity Providers) and simplifies authentication integration through its built-in methods. Therefore, enterprises choose to use Keycloak as an identity and access management solution and use Keycloak to integrate different IDPs. However, Keycloak's IDP does not support dynamic loading, and the configuration is based on a static method. Each time an IDP and configuration are added or modified, the service needs to be restarted manually, which affects flexibility and responsiveness. At the same time, the support for new identity providers is slow, and the user experience is affected. In a complex business environment, it may be necessary to dynamically switch or add identity providers based on user needs, geographic location or specific scenarios. Therefore, it is necessary to provide a method for dynamically loading IDPs on Keycloak that can solve the above problems. Summary of the invention
[0003] The purpose of the present invention is to provide a method for dynamically loading IDP (Identity Provider) on Keycloak (an open source identity and access management solution). The main purpose is that after an enterprise implements an IDP for the standard interface provided by Keycloak, it can directly use the IDP for login without restarting the Keycloak service. In a complex business environment, IDP can be dynamically switched or added according to user needs, geographic location or specific scenarios. Real-time effectiveness and fast response.
[0004] To achieve the above-mentioned object, the present invention provides the following technical solution: a method for dynamically loading IDP implemented on Keycloak, characterized in that it includes: an IDP scanner module, an IDP class loader module and an IDP cache management module, the IDP scanner module includes an IDP file listener and an IDP file parser, which are used to monitor changes in IDP files and parse IDP file contents, and the IDP scanner module is connected to the IDP class loader module and the IDP cache management module.
[0005] Preferably, the workflow of the IDP file listener is as follows: 1.1: It can periodically scan whether the JAR file in the idps folder of the Keycloak service has any changes, and can judge according to the update time of the JAR file; 1.2: After each scan of the JAR file, the update time of the JAR file will be compared with the update time recorded in the IDP cache manager; 1.3: If there is no corresponding JAR record in the cache manager or there is a record but the update time is inconsistent, it means that the file has changed and needs to be reloaded, and the record of the IDP cache manager will be updated at the same time, otherwise no operation will be performed.
[0006] Preferably, the workflow of the IDP file parser is as follows: 2.1: After the IDP file listener detects changes in the JAR file, it will call the IDP file parser to parse the JAR file and parse out the CLASS file and the HTML file; 2.2: The CLASS file is handed over to the IDP class loader module for loading; the HTML file is copied to the themes\base\admin\resources\partials folder of the Keycloak service, and the IDP cache management module is notified to perform a cache update operation.
[0007] Preferably, the CLASS file includes code for implementing the IDP standard interface of Keycloak, and the HTML file includes page code for IDP configuration.
[0008] Preferably, the workflow of the IDP class loader module is as follows: 3.1: The IDP class loader is used to load Java's CLASS files, which are used to update the CLASS files that are not loaded or have been loaded by Keycloak; 3.2: When the IDP file listener in the IDP scanner module monitors the changes of the JAR file, the IDP file parser hands the CLASS file to the IDP class loader for loading. After the loading is completed, the data in the Java JVM memory will be updated in real time.
[0009] Preferably, the IDP class loader module is a key part for dynamically loading the IDP and not requiring restarting the Keycloak service.
[0010] Preferably, the workflow of the IDP cache management module is as follows: 4.1: After being used, the theme file of Keycloak will be cached on the server disk. Unless the cache expires, the page of Keycloak will not change. Therefore, the role of the IDP cache management module is to update the cache; 4.2: Each time a new IDP is added, the HTML configuration file corresponding to the IDP must be updated at the same time, and the HTML configuration file must be stored in the theme file of Keycloak to take effect; 4.3: When the IDP file listener in the IDP scanner module monitors the changes in the JAR file, the IDP file parser copies the HTML file to the theme folder of Keycloak, and then notifies the IDP cache manager to delete the theme cache content, so that the cache is updated in real time, and the latest page can be seen after refreshing the Keycloak page.
[0011] The present invention proposes a method for dynamically loading IDP on Keycloak. A listener is implemented on Keycloak to monitor the changes of JAR package files in the idps directory of the Keycloak service. The condition for judging the change is whether the update time is consistent with the last time, and the CLASS file and HTML file in the JAR package are parsed at the same time. The CLASS file in the JAR package is reloaded using a custom class loader to replace the CLASS file of the IDP already loaded by Keycloak. The HTML file in the JAR package is added or replaced with the HTML file corresponding to the IDP in the theme folder of Keycloak. The following technical effects can be achieved: 1. When the login requirements change and a login method needs to be added or removed, you only need to add or delete the corresponding IDP JAR package in the idps directory of the Keycloak service. There is no need to restart the Keycloak service. The changes take effect in real time, allowing the business system to better adapt to rapidly changing business needs.
[0012] 2. No need to restart or stop the Keycloak service, which will not affect the business systems using the Keycloak service, and truly achieve user-unaware updates. This improves the user's login experience and reduces operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS
[0013] Figure 1 It is a principle block diagram of the present invention; Figure 2 This is the dynamic loading IDP activity graph of the present invention. DETAILED DESCRIPTION
[0014] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0015] See also Figure 1-2 The present invention provides a technical solution: a method for dynamically loading an IDP implemented on Keycloak, characterized in that it includes: an IDP scanner module, an IDP class loader module and an IDP cache management module, the IDP scanner module includes an IDP file listener and an IDP file parser, which are used to monitor changes in IDP files and parse IDP file contents, and the IDP scanner module is connected to the IDP class loader module and the IDP cache management module.
[0016] The workflow of the IDP file listener is as follows: 1.1: It can periodically scan whether the JAR file in the idps folder of the Keycloak service has changed, and can judge based on the update time of the JAR file; 1.2: After each scan of the JAR file, the update time of the JAR file will be compared with the update time recorded in the IDP cache manager; 1.3: If there is no corresponding JAR record in the cache manager or there is a record but the update time is inconsistent, it means that the file has changed and needs to be reloaded, and the record of the IDP cache manager will be updated at the same time, otherwise no operation will be performed.
[0017] Working principle: Based on time comparison: The IDP file listener periodically scans the update time of the JAR file in the idps folder of the Keycloak service to determine whether the file has changed. This time-based comparison method is a simple and effective way. For example, in an environment where multiple development teams maintain different IDP-related JAR files at the same time, each team may update the JAR files they are responsible for at different times. The file listener can accurately detect these updates.
[0018] Interaction with the cache manager: After each scan, it compares the update time recorded in the IDP's cache manager. If there is no corresponding JAR record in the cache manager, this may be the first time the JAR file has been added; if there is a record but the update time is inconsistent, it means that the file has changed and needs to be reloaded. This interaction ensures that only JAR files that have actually changed will be further processed, avoiding unnecessary operations.
[0019] The workflow of the IDP file parser is as follows: 2.1: After the IDP file listener detects changes in the JAR file, it will call the IDP file parser to parse the JAR file and parse out the CLASS file and HTML file; 2.2: The CLASS file is handed over to the IDP class loader module for loading; the HTML file is copied to the themes\base\admin\resources\partials folder of the Keycloak service, and the IDP cache management module is notified to perform a cache update operation. The CLASS file contains the code that implements the Keycloak IDP standard interface, and the HTML file contains the page code configured by the IDP.
[0020] JAR file parsing content: When the IDP file listener detects changes in the JAR file, the IDP file parser starts working. It parses the JAR file to obtain the CLASS file and HTML file. For example, in a multi-tenant authentication system based on Keycloak, different tenants may use different IDP configurations. These configuration information may be included in the HTML file, while the code that implements the authentication logic is in the CLASS file.
[0021] Interaction with other modules: The parsed CLASS file is handed over to the IDP class loader module for loading, which is a key step in dynamically updating Java classes. At the same time, the HTML file is copied to the themes\base\admin\resources\partials folder of the Keycloak service, and the IDP cache management module is notified to perform cache updates to ensure that page-related configurations can take effect in a timely manner.
[0022] The workflow of the IDP class loader module is as follows: 3.1: The IDP class loader is used to load Java's CLASS files, which are used to update the CLASS files that are not loaded or have been loaded by Keycloak; 3.2: When the IDP file listener in the IDP scanner module monitors the changes in the JAR file, the IDP file parser hands the CLASS file to the IDP class loader for loading. After the loading is complete, the data in the Java JVM memory will be updated in real time. The IDP class loader module is the key part of dynamically loading IDP and not requiring restarting the Keycloak service.
[0023] CLASS file loading: The IDP class loader is specifically used to load Java CLASS files. Whether Keycloak has not loaded or has loaded CLASS files, it can be updated. In the Java class loading mechanism, the class loader is responsible for loading bytecode files into the JVM memory. For example, when the implementation code of the IDP changes, the new CLASS file is loaded into the memory through the IDP class loader, so that the data in the Java JVM memory can be updated in real time. This is the core part of realizing dynamic loading of IDP without restarting the Keycloak service.
[0024] The key to dynamic loading: When the IDP file listener in the IDP scanner module detects changes in the JAR file, the IDP file parser hands the CLASS file to the IDP class loader for loading. This dynamic loading mechanism avoids the disadvantage of having to restart the service to update the class in the traditional way, and improves the availability and flexibility of the system.
[0025] The workflow of the IDP cache management module is as follows: 4.1: After being used, the Keycloak theme file will be cached on the server disk. Unless the cache expires, the Keycloak page will not change. Therefore, the role of the IDP cache management module is to update the cache; 4.2: Each time a new IDP is added, the HTML configuration file corresponding to the IDP must be updated at the same time, and the HTML configuration file must be stored in the Keycloak theme file to take effect; 4.3: When the IDP file listener in the IDP scanner module monitors the changes in the JAR file, the IDP file parser copies the HTML file to the Keycloak theme folder, and then notifies the IDP cache manager to delete the theme cache content, so that the cache can be updated in real time, and the latest page can be seen after refreshing the Keycloak page.
[0026] Necessity of cache update: In Keycloak, theme files are cached on the server disk after being used. If the cache is not updated, the Keycloak page will not change even if the related HTML configuration files have been updated. For example, in a web application, the style and layout of the user login page may be controlled by the Keycloak theme file. If the IDP-related configuration affects the display of the login page, such as adding a new identity provider icon or login option, the cache needs to be updated to allow users to see these changes.
[0027] Cache update process: Each time a new IDP is added, the HTML configuration file corresponding to the IDP must be updated. When the IDP file listener in the IDP scanner module detects changes in the JAR file, the IDP file parser copies the HTML file to the Keycloak theme folder and notifies the IDP cache manager to delete the theme cache content. In this way, the latest page can be seen after refreshing the Keycloak page, ensuring that the page seen by the user is consistent with the actual IDP configuration.
[0028] Example 1: After-sales management system; Background: Maintenance personnel use Feishu accounts to log in to the after-sales management system to maintain maintenance orders.
[0029] Implementation plan: 1. The after-sales management system uses Keycloak as the SSO login framework, and the users of the after-sales management system are managed by Keycloak; 2. The developer writes the code according to the interface requirements of the Lark open platform and the standard interface of Keycloak to connect to IDP, packages the code into a JAR package, names the JAR package lark.jar, and then puts it in the idps folder of the Keycloak site. At this time, the IDP scanner of Keycloak detects that the files in the idps folder have changed, and notifies the IDP class loader to load the lark.jar package and the IDP cache manager to perform cache update operations; 3. Log in to the Lark Open Platform and create a new web application. After the application is created, the AppId and AppSecret information will be generated; 4. Log in to the management backend of Keycloak. There will be an additional IDP option named lark in the IDP list. Select lark's IDP, enter the IDP configuration page, and configure the AppID and AppSecret parameters of Feishu in the previous step. 5. Open the login page of the after-sales management system. At this time, there will be an additional Feishu login option on the login page. The user selects Feishu login method, scans the Feishu code or logs in with a Feishu account, and enters the homepage of the after-sales management system after success.
[0030] Note: During the entire process, neither the Keycloak site nor the after-sales management system site needs to stop site services, which will not affect the use of the business, allowing users to be unaware of updates and respond quickly to needs.
[0031] Example 2: Fanwei OA office system; Background: Enterprise employees use Fanwei OA for office work. After logging into the Fanwei OA system, they can also log in directly to each subsystem on the workbench without having to enter the OA account and password again to log in, which can achieve login-free.
[0032] Implementation plan: 1. Each subsystem on the workbench uses Keycloak as the single sign-on framework and has integrated Keycloak; 2. The developer writes the IDP code of Keycloak according to the docking document of Fanwei, packages the code into a JAR package, names the JAR package weaver.jar, and then puts it in the idps folder of the Keycloak site. At this time, the IDP scanner of Keycloak detects that the files in the idps folder have changed, and notifies the IDP class loader to load the weaver.jar package and the IDP cache manager to update the cache; 3. Log in to the management backend of Keycloak. There will be an additional IDP option named weaver in the IDP list. Select weaver's IDP, enter the IDP configuration page, and configure the AppID and AppSecret parameters provided by the Fanwei OA system.
[0033] 4. Configure the default login method for each subsystem to be Fanwei login. Employees enter the Fanwei OA workstation and click on each subsystem to enter directly without having to enter the account and password again; Note: During the entire process, Keycloak sites and subsystem sites do not need to stop site services to add a new login method.
[0034] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.
Claims
1. A method for dynamically loading IDP implemented on Keycloak, characterized in that: include: IDP scanner module, IDP class loader module and IDP cache management module. The IDP scanner module includes an IDP file listener and an IDP file parser, which are used to monitor changes in IDP files and parse IDP file contents. The IDP scanner module is connected to the IDP class loader module and the IDP cache management module.
2. According to a method for dynamically loading IDP implemented on Keycloak according to claim 1, it is characterized in that: The workflow of the IDP file listener is as follows: 1.1: It can periodically scan the JAR files in the idps folder of the Keycloak service to see if there are any changes, and can judge based on the update time of the JAR files; 1.2: After each scan of a JAR file, the update time of the JAR file is compared with the update time recorded in the IDP cache manager; 1.3: If there is no corresponding JAR record in the cache manager or there is a record but the update time is inconsistent, it means that the file has changed and needs to be reloaded. At the same time, the record of the IDP cache manager will be updated, otherwise no operation will be performed.
3. According to a method for dynamically loading IDP implemented on Keycloak according to claim 2, it is characterized in that: The workflow of the IDP file parser is as follows: 2.1: After the IDP file listener detects changes in the JAR file, it will call the IDP file parser to parse the JAR file and parse out the CLASS file and HTML file; 2.2: Submit the CLASS file to the IDP class loader module for loading; copy the HTML file to the themes\base\admin\resources\partials folder of the Keycloak service, and notify the IDP cache management module to perform cache update operations.
4. According to a method for dynamically loading IDP implemented on Keycloak according to claim 3, it is characterized in that: The CLASS file contains the code that implements the IDP standard interface of Keycloak, and the HTML file contains the page code for IDP configuration.
5. According to a method for dynamically loading IDP implemented on Keycloak according to claim 4, it is characterized in that: The workflow of the IDP class loader module is as follows: 3.1: The IDP class loader is used to load Java CLASS files and to update CLASS files that are not loaded or have been loaded by Keycloak; 3.2: When the IDP file listener in the IDP scanner module detects changes in the JAR file, the IDP file parser will hand over the CLASS file to the IDP class loader for loading. After the loading is completed, the data in the Java JVM memory will be updated in real time.
6. A method for dynamically loading IDP implemented on Keycloak according to claim 5, characterized in that: The IDP class loader module is a key part for dynamically loading IDP and not requiring restarting the Keycloak service.
7. A method for dynamically loading IDP implemented on Keycloak according to claim 6, characterized in that: The workflow of the IDP cache management module is as follows: 4.1: After being used, Keycloak's theme file will be cached on the server disk. Unless the cache expires, the Keycloak page will not change. Therefore, the IDP cache management module is used to update the cache. 4.2: Every time you add an IDP, you need to update the HTML configuration file corresponding to the IDP. The HTML configuration file must be stored in the Keycloak theme file to take effect; 4.3: When the IDP file listener in the IDP scanner module detects changes in the JAR file, the IDP file parser copies the HTML file to the Keycloak theme folder and notifies the IDP cache manager to delete the theme cache content. This way, the cache is updated in real time, and you can see the latest page after refreshing the Keycloak page.