Sync WLAN password (NT hash) to Keycloak on password change

When projectforge.keycloak.wlanPasswordAttribute is set, KeycloakMasterLoginHandler
writes the Samba NT hash of the WLAN password to the configured Keycloak user
attribute on every WLAN password change. Intended for RADIUS/WPA2-Enterprise setups
where a RADIUS server reads the NT hash directly from Keycloak.

- KeycloakConfig: add wlanPasswordAttribute property
- KeycloakAdminClient: add getUserById() for fetching current user attributes before update
- KeycloakMasterLoginHandler: implement syncWlanPasswordToKeycloak()
- application.properties: document new property (commented out)
- README.md: document WLAN password sync in Phase 2, user attributes table,
  and migration note (users must set a new WLAN password once to trigger sync)

Author: kreinhard

projectforge-business/src/main/resources/application.properties

@@ -49,6 +49,9 @@ projectforge.keycloak.syncPasswords=false
 # Group attribute mappings: pfFieldName=keycloakAttributeName
 # Supported fields: description, organization
 # projectforge.keycloak.groupAttributes.description=description
+# WLAN password sync: Keycloak attribute name for the Samba NT hash of the WLAN password.
+# If set, the NT hash is written to this attribute on every WLAN password change (KeycloakMasterLoginHandler only).
+# projectforge.keycloak.wlanPasswordAttribute=sambaNTPassword
 hibernate.search.directory.root=${projectforge.base.dir}/hibernateSearch
 projectforge.resourcesDirectory=
 projectforge.fontsDirectory=

projectforge-keycloak/README.md

@@ -11,15 +11,16 @@
 
 Create the following custom user attributes with validators:
 
-| Attribute      | Min Length | Max Length | Notes                                           |
-|----------------|------------|------------|-------------------------------------------------|
-| `jiraUsername` | 0          | 100        | length                                          |
-| `mobilePhone`  | 0          | 255        | length                                          |
-| `gender`       |            |            | options: `MALE`, `FEMALE`, `DIVERSE`, `UNKNOWN` |
-| `locale`       | 0          | —          | Validated automatically (`de`, `en`)            |
-| `organization` | 0          | 255        | length                                          |
-| `description`  | 0          | 255        | length                                          |
-| `nickname`     | 0          | 255        | length                                          |
+| Attribute        | Min Length | Max Length | Notes                                           |
+|------------------|------------|------------|-------------------------------------------------|
+| `jiraUsername`   | 0          | 100        | length                                          |
+| `mobilePhone`    | 0          | 255        | length                                          |
+| `gender`         |            |            | options: `MALE`, `FEMALE`, `DIVERSE`, `UNKNOWN` |
+| `locale`         | 0          | —          | Validated automatically (`de`, `en`)            |
+| `organization`   | 0          | 255        | length                                          |
+| `description`    | 0          | 255        | length                                          |
+| `nickname`       | 0          | 255        | length                                          |
+| `sambaNTWlanPassword`| 0          | 255        | WLAN password (Samba NT hash); see below        |
 
 ## Keycloak Admin: Username Validator
 
@@ -82,6 +83,24 @@ Additional property:
 projectforge.keycloak.syncPasswords=true
 ```
 
+#### WLAN Password Sync (optional)
+
+If WLAN passwords are managed in PF (e.g. for RADIUS/WPA2-Enterprise), the Samba NT hash can be
+written to a custom Keycloak user attribute on every WLAN password change:
+
+```properties
+# Keycloak attribute name that receives the Samba NT hash on every WLAN password change.
+projectforge.keycloak.wlanPasswordAttribute=sambaNTWlanPassword
+```
+
+- The value stored is the **Samba NT hash** of the WLAN password (same format as LDAP `sambaNTWlanPassword`).
+- A RADIUS server can read this attribute from Keycloak to perform MS-CHAPv2 authentication.
+- The attribute must be created in the Keycloak realm beforehand (see User Attributes table above).
+- If `wlanPasswordAttribute` is not set, no WLAN password is written to Keycloak (default behaviour).
+- **Migration note:** The sync is triggered only when a user actively changes their WLAN password in PF.
+  There is no bulk-sync of existing WLAN passwords. During migration, all users must therefore
+  set a new WLAN password once so that the NT hash is written to Keycloak.
+
 ### Phase 3 — Keycloak as Master (target state)
 
 **Handler:** `KeycloakLoginHandler`

projectforge-keycloak/src/main/kotlin/org/projectforge/keycloak/client/KeycloakAdminClient.kt

@@ -50,6 +50,9 @@ private val log = KotlinLogging.logger {}
  * Writes (migration + password sync):
  *   POST   /admin/realms/{realm}/users                          → createUser()
  *   PUT    /admin/realms/{realm}/users/{id}                     → updateUser()
+ *
+ * Single-user read:
+ *   GET /admin/realms/{realm}/users/{id}                        → getUserById()
  *   POST   /admin/realms/{realm}/groups                         → createGroup()
  *   PUT    /admin/realms/{realm}/users/{id}/groups/{groupId}    → addUserToGroup()
  *   DELETE /admin/realms/{realm}/users/{id}/groups/{groupId}    → removeUserFromGroup()
@@ -176,6 +179,15 @@ open class KeycloakAdminClient(
         }
     }
 
+    /**
+     * Returns a single Keycloak user by their ID, or null if not found.
+     */
+    fun getUserById(userId: String): KeycloakUser? {
+        val url = "$adminBaseUrl/users/$userId"
+        val response = restTemplate.exchange(url, HttpMethod.GET, HttpEntity<Void>(bearerHeaders()), KeycloakUser::class.java)
+        return response.body
+    }
+
     /**
      * Finds a Keycloak user by username. Returns null if not found.
      * Uses the search endpoint for exact username matching.

projectforge-keycloak/src/main/kotlin/org/projectforge/keycloak/config/KeycloakConfig.kt

@@ -95,6 +95,13 @@ open class KeycloakConfig {
      */
     var syncPasswords: Boolean = false
 
+    /**
+     * Keycloak attribute name for the WLAN (Samba NT) password hash.
+     * If set, the NT hash is written to this Keycloak user attribute on every WLAN password change.
+     * Example: projectforge.keycloak.wlanPasswordAttribute=sambaNTPassword
+     */
+    var wlanPasswordAttribute: String? = null
+
     fun isConfigured() = serverUrl.isNotBlank() && realm.isNotBlank()
             && clientId.isNotBlank() && clientSecret.isNotBlank()
 }

projectforge-keycloak/src/main/kotlin/org/projectforge/keycloak/handler/KeycloakMasterLoginHandler.kt

@@ -23,6 +23,7 @@
 
 package org.projectforge.keycloak.handler
 
+import arlut.csd.crypto.SmbEncrypt
 import mu.KotlinLogging
 import org.projectforge.common.logging.LogDuration
 import org.projectforge.business.ldap.LdapMasterLoginHandler
@@ -210,6 +211,12 @@ open class KeycloakMasterLoginHandler : LoginHandler {
     }
 
     override fun wlanPasswordChanged(user: PFUserDO, newPassword: CharArray) {
+        val wlanAttr = keycloakConfig.wlanPasswordAttribute
+        if (keycloakConfig.isConfigured() && !wlanAttr.isNullOrBlank()
+            && !user.localUser && !user.deleted
+        ) {
+            syncWlanPasswordToKeycloak(user, newPassword, wlanAttr)
+        }
         if (isLdapConfigured()) {
             try {
                 ldapMasterLoginHandler.wlanPasswordChanged(user, newPassword)
@@ -432,6 +439,30 @@ open class KeycloakMasterLoginHandler : LoginHandler {
         }
     }
 
+    private fun syncWlanPasswordToKeycloak(user: PFUserDO, password: CharArray, attributeName: String) {
+        try {
+            val kcId = user.keycloakId ?: run {
+                val found = keycloakAdminClient.findUserByUsername(user.username ?: return)?.id
+                if (found == null) {
+                    log.info("Keycloak user not found for '${user.username}', skipping WLAN password sync.")
+                    return
+                }
+                found
+            }
+            val ntHash = SmbEncrypt.NTUNICODEHash(password)
+            val currentUser = keycloakAdminClient.getUserById(kcId) ?: run {
+                log.warn("Keycloak user id '$kcId' not found, skipping WLAN password sync.")
+                return
+            }
+            val updatedAttrs = (currentUser.attributes ?: emptyMap()).toMutableMap()
+            updatedAttrs[attributeName] = listOf(ntHash)
+            keycloakAdminClient.updateUser(kcId, currentUser.copy(attributes = updatedAttrs))
+            log.info("WLAN password (NT hash) synced to Keycloak attribute '$attributeName' for user: ${user.username}")
+        } catch (ex: Exception) {
+            log.error("Failed to sync WLAN password to Keycloak for user '${user.username}' (ignoring): ${ex.message}", ex)
+        }
+    }
+
     /** Returns true if LDAP is configured (projectforge.ldap.server is set). */
     private fun isLdapConfigured(): Boolean = !ldapService.ldapConfig?.server.isNullOrBlank()