public function Keycloak::buildConfigurationForm in Keycloak OpenID Connect 8

Form constructor.

Plugin forms are embedded in other forms. In order to know where the plugin form is located in the parent form, #parents and #array_parents must be known, but these are not available during the initial build phase. In order to have these properties available when building the plugin form's elements, let this method return a form element that has a #process callback and build the rest of the form in the callback. By the time the callback is executed, the element's #parents and #array_parents properties will have been set by the form API. For more documentation on #parents and #array_parents, see \Drupal\Core\Render\Element\FormElement.

Parameters

array $form: An associative array containing the initial structure of the plugin form.

\Drupal\Core\Form\FormStateInterface $form_state: The current state of the form. Calling code should pass on a subform state created through \Drupal\Core\Form\SubformState::createForSubform().

Return value

array The form structure.

Overrides OpenIDConnectClientBase::buildConfigurationForm

File

src/Plugin/OpenIDConnectClient/Keycloak.php, line 186

Class

Keycloak

OpenID Connect client for Keycloak.

Namespace

Drupal\keycloak\Plugin\OpenIDConnectClient

Code

public function buildConfigurationForm(array $form, FormStateInterface $form_state) {
  $form = parent::buildConfigurationForm($form, $form_state);
  $form_state
    ->setCached(FALSE);
  $form['keycloak_base'] = [
    '#title' => $this
      ->t('Keycloak base URL'),
    '#description' => $this
      ->t('The base URL of your Keycloak server. Typically <em>https://example.com[:PORT]/auth</em>.'),
    '#type' => 'textfield',
    '#default_value' => $this->configuration['keycloak_base'],
  ];
  $form['keycloak_realm'] = [
    '#title' => $this
      ->t('Keycloak realm'),
    '#description' => $this
      ->t('The realm you connect to.'),
    '#type' => 'textfield',
    '#default_value' => $this->configuration['keycloak_realm'],
  ];

  // Synchronize email addresses with Keycloak. This is safe as long as
  // Keycloak is the only identity broker, because - as Drupal - it allows
  // unique email addresses only within a single realm.
  $form['userinfo_update_email'] = [
    '#title' => $this
      ->t('Update email address in user profile'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['userinfo_update_email']) ? $this->configuration['userinfo_update_email'] : '',
    '#description' => $this
      ->t('If email address has been changed for existing user, save the new value to the user profile.'),
  ];

  // Enable/disable i18n support and map language codes to Keycloak locales.
  $language_manager = \Drupal::languageManager();
  if ($language_manager
    ->isMultilingual()) {
    $form['keycloak_i18n_enabled'] = [
      '#title' => $this
        ->t('Enable multi-language support'),
      '#type' => 'checkbox',
      '#default_value' => !empty($this->configuration['keycloak_i18n']['enabled']) ? $this->configuration['keycloak_i18n']['enabled'] : '',
      '#description' => $this
        ->t('Adds language parameters to Keycloak authentication requests and maps OpenID connect language tags to Drupal languages.'),
    ];
    $form['keycloak_i18n'] = [
      '#title' => $this
        ->t('Multi-language settings'),
      '#type' => 'fieldset',
      '#collapsible' => FALSE,
      '#states' => [
        'visible' => [
          ':input[name="clients[keycloak][settings][keycloak_i18n_enabled]"]' => [
            'checked' => TRUE,
          ],
        ],
      ],
    ];
    $form['keycloak_i18n']['mapping'] = [
      '#title' => $this
        ->t('Language mappings'),
      '#description' => $this
        ->t('If your Keycloak is using different locale codes than Drupal (e.g. "zh-CN" in Keycloak vs. "zh-hans" in Drupal), define the Keycloak language codes here that match your Drupal setup.'),
      '#type' => 'details',
      '#collapsible' => FALSE,
    ];
    $languages = $this->keycloak
      ->getI18nMapping();
    foreach ($languages as $langcode => $language) {
      $form['keycloak_i18n']['mapping'][$langcode] = [
        '#type' => 'container',
        'langcode' => [
          '#type' => 'hidden',
          '#value' => $langcode,
        ],
        'target' => [
          '#title' => sprintf('%s (%s)', $language['label'], $langcode),
          '#type' => 'textfield',
          '#size' => 30,
          '#default_value' => $language['locale'],
        ],
      ];
    }
  }
  else {
    $form['keycloak_i18n_enabled'] = [
      '#type' => 'hidden',
      '#value' => FALSE,
    ];
  }
  $form['keycloak_sso'] = [
    '#title' => $this
      ->t('Replace Drupal login with Keycloak single sign-on (SSO)'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['keycloak_sso']) ? $this->configuration['keycloak_sso'] : '',
    '#description' => $this
      ->t("Changes Drupal's authentication back-end to use Keycloak by default. Drupal's user login and registration pages will redirect to Keycloak. Existing users will be able to login using their Drupal credentials at <em>/keycloak/login</em>."),
  ];
  $form['keycloak_sign_out'] = [
    '#title' => $this
      ->t('Enable Drupal-initiated single sign-out'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['keycloak_sign_out']) ? $this->configuration['keycloak_sign_out'] : 0,
    '#description' => $this
      ->t("Whether to sign out of Keycloak, when the user logs out of Drupal."),
  ];
  $form['check_session_enabled'] = [
    '#title' => $this
      ->t('Enable Keycloak-initiated single sign-out'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['check_session']['enabled']) ? $this->configuration['check_session']['enabled'] : 0,
    '#description' => $this
      ->t('Whether to log out of Drupal, when the user ends its Keycloak session.'),
  ];
  $form['check_session'] = [
    '#title' => $this
      ->t('Check session settings'),
    '#type' => 'fieldset',
    '#states' => [
      'visible' => [
        ':input[name="clients[keycloak][settings][check_session_enabled]"]' => [
          'checked' => TRUE,
        ],
      ],
    ],
  ];
  $form['check_session']['interval'] = [
    '#title' => $this
      ->t('Check session interval'),
    '#type' => 'number',
    '#min' => 1,
    '#max' => 99999,
    '#step' => 1,
    '#size' => 5,
    '#field_suffix' => $this
      ->t('seconds'),
    '#default_value' => !isset($this->configuration['check_session']['interval']) ? $this->configuration['check_session']['interval'] : 2,
  ];
  $form['keycloak_groups_enabled'] = [
    '#title' => $this
      ->t('Enable user role mapping'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['keycloak_groups']['enabled']) ? $this->configuration['keycloak_groups']['enabled'] : '',
    '#description' => $this
      ->t('Enables assigning Drupal user roles based on Keycloak group name patterns.'),
  ];
  $form['keycloak_groups'] = [
    '#title' => $this
      ->t('User role assignment settings'),
    '#type' => 'fieldset',
    '#collapsible' => FALSE,
    '#states' => [
      'visible' => [
        ':input[name="clients[keycloak][settings][keycloak_groups_enabled]"]' => [
          'checked' => TRUE,
        ],
      ],
    ],
  ];
  $form['keycloak_groups']['description'] = [
    '#markup' => $this
      ->t("<p>You can assign and remove Drupal user roles based on the user groups given to the user in Keycloak. The Keycloak user's groups will be retrieved using the UserInfo endpoint of your realm.<br />Before using this feature, you need to map group memberships to the userinfo within the mappers section of your Keycloak client settings.</p>"),
  ];
  $form['keycloak_groups']['claim_name'] = [
    '#title' => $this
      ->t('User groups claim name'),
    '#type' => 'textfield',
    '#default_value' => !empty($this->configuration['keycloak_groups']['claim_name']) ? $this->configuration['keycloak_groups']['claim_name'] : 'groups',
    '#description' => $this
      ->t('Name of the user groups claim. This can be a fully qualified name like "additional.groups". In this case, the user groups will be taken from the nested "groups" attribute of the "additional" claim.'),
  ];
  $form['keycloak_groups']['split_groups'] = [
    '#title' => $this
      ->t('Split group paths'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['keycloak_groups']['split_groups']) ? $this->configuration['keycloak_groups']['split_groups'] : '',
    '#description' => $this
      ->t('Allows splitting group paths into single group names. If enabled, Keycloak group paths will be splitted using the "/" character and every path segment will be treated as single user group name. E.g. the group path "/Internal/Public Relations" will be split into the groups "Internal" and "Public Relations", and the mapping rules will be applied to both groups. Please note: If this option is enabled, using "/" within any group name may have unintended side effects.'),
  ];
  $form['keycloak_groups']['split_groups_limit'] = [
    '#title' => $this
      ->t('Group path nesting limit'),
    '#type' => 'number',
    '#min' => 0,
    '#max' => 99,
    '#step' => 1,
    '#size' => 2,
    '#default_value' => !empty($this->configuration['keycloak_groups']['split_groups_limit']) ? $this->configuration['keycloak_groups']['split_groups_limit'] : 0,
    '#description' => $this
      ->t('Allows limiting the nesting level of split group paths. E.g. the group path "/Internal/Public Relations/Social Media" with a group path nesting limit of "1" will split the group path into "Internal" only, a group path nesting limit of "2" will return "Internal" and "Public Relations", and so on. A value of "0" will not limit nesting and return all groups.'),
    '#states' => [
      'visible' => [
        ':input[name="clients[keycloak][settings][keycloak_groups][split_groups]"]' => [
          'checked' => TRUE,
        ],
      ],
    ],
  ];
  $form['keycloak_groups']['rules_description'] = [
    '#markup' => sprintf('<strong>%s</strong>', $this
      ->t('Mapping rules')),
  ];
  $form = array_merge_recursive($form, $this
    ->getGroupRuleTable($form_state));
  return $form;
}