Examples with RoleMappingResource org.keycloak.admin.client.resource.RoleMappingResource used on opensource projects

Example 1 with RoleMappingResource

use of org.keycloak.admin.client.resource.RoleMappingResource in project openremote by openremote.

the class ManagerKeycloakIdentityProvider method updateRoles.

@Override
public void updateRoles(ClientRequestInfo clientRequestInfo, String realm, String userId, Role[] roles) {
    RoleMappingResource roleMappingResource = getRealms(clientRequestInfo).realm(realm).users().get(userId).roles();
    ClientsResource clientsResource = getRealms(clientRequestInfo).realm(realm).clients();
    String clientId = clientsResource.findByClientId(KEYCLOAK_CLIENT_ID).get(0).getId();
    List<RoleRepresentation> rolesToAdd = new ArrayList<>();
    List<RoleRepresentation> rolesToRemove = new ArrayList<>();
    for (Role role : roles) {
        RoleRepresentation roleRepresentation = new RoleRepresentation();
        roleRepresentation.setId(role.getId());
        roleRepresentation.setName(role.getName());
        if (role.isAssigned()) {
            rolesToAdd.add(roleRepresentation);
        } else {
            rolesToRemove.add(roleRepresentation);
        }
    }
    roleMappingResource.clientLevel(clientId).add(rolesToAdd);
    roleMappingResource.clientLevel(clientId).remove(rolesToRemove);
}

Example 2 with RoleMappingResource

use of org.keycloak.admin.client.resource.RoleMappingResource in project keycloak by keycloak.

the class UserTest method rolesCanBeAssignedEvenWhenTheyAreAlreadyIndirectlyAssigned.

/**
 * Test for KEYCLOAK-10603.
 */
@Test
public void rolesCanBeAssignedEvenWhenTheyAreAlreadyIndirectlyAssigned() {
    RealmResource realm = adminClient.realms().realm("test");
    RoleRepresentation realmCompositeRole = RoleBuilder.create().name("realm-composite").build();
    realm.roles().create(realmCompositeRole);
    realm.roles().create(RoleBuilder.create().name("realm-child").build());
    realm.roles().get("realm-composite").addComposites(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
    realm.roles().create(RoleBuilder.create().name("realm-role-in-group").build());
    Response response = realm.clients().create(ClientBuilder.create().clientId("myclient").build());
    String clientUuid = ApiUtil.getCreatedId(response);
    response.close();
    RoleRepresentation clientCompositeRole = RoleBuilder.create().name("client-composite").build();
    realm.clients().get(clientUuid).roles().create(clientCompositeRole);
    realm.clients().get(clientUuid).roles().create(RoleBuilder.create().name("client-child").build());
    realm.clients().get(clientUuid).roles().get("client-composite").addComposites(Collections.singletonList(realm.clients().get(clientUuid).roles().get("client-child").toRepresentation()));
    realm.clients().get(clientUuid).roles().create(RoleBuilder.create().name("client-role-in-group").build());
    GroupRepresentation group = GroupBuilder.create().name("mygroup").build();
    response = realm.groups().add(group);
    String groupId = ApiUtil.getCreatedId(response);
    response.close();
    response = realm.users().create(UserBuilder.create().username("myuser").build());
    String userId = ApiUtil.getCreatedId(response);
    response.close();
    // Make indirect assignments
    // .. add roles to the group and add it to the user
    realm.groups().group(groupId).roles().realmLevel().add(Collections.singletonList(realm.roles().get("realm-role-in-group").toRepresentation()));
    realm.groups().group(groupId).roles().clientLevel(clientUuid).add(Collections.singletonList(realm.clients().get(clientUuid).roles().get("client-role-in-group").toRepresentation()));
    realm.users().get(userId).joinGroup(groupId);
    // .. assign composite roles
    RoleMappingResource userRoles = realm.users().get(userId).roles();
    userRoles.realmLevel().add(Collections.singletonList(realm.roles().get("realm-composite").toRepresentation()));
    userRoles.clientLevel(clientUuid).add(Collections.singletonList(realm.clients().get(clientUuid).roles().get("client-composite").toRepresentation()));
    // check state before making the direct assignments
    assertNames(userRoles.realmLevel().listAll(), "realm-composite", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    assertNames(userRoles.realmLevel().listAvailable(), "realm-child", "realm-role-in-group", "admin", "customer-user-premium", "realm-composite-role", "sample-realm-role", "attribute-role", "user", "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION);
    assertNames(userRoles.realmLevel().listEffective(), "realm-composite", "realm-child", "realm-role-in-group", "user", "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    assertNames(userRoles.clientLevel(clientUuid).listAll(), "client-composite");
    assertNames(userRoles.clientLevel(clientUuid).listAvailable(), "client-child", "client-role-in-group");
    assertNames(userRoles.clientLevel(clientUuid).listEffective(), "client-composite", "client-child", "client-role-in-group");
    // Make direct assignments for roles which are already indirectly assigned
    userRoles.realmLevel().add(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
    userRoles.realmLevel().add(Collections.singletonList(realm.roles().get("realm-role-in-group").toRepresentation()));
    userRoles.clientLevel(clientUuid).add(Collections.singletonList(realm.clients().get(clientUuid).roles().get("client-child").toRepresentation()));
    userRoles.clientLevel(clientUuid).add(Collections.singletonList(realm.clients().get(clientUuid).roles().get("client-role-in-group").toRepresentation()));
    // List realm roles
    assertNames(userRoles.realmLevel().listAll(), "realm-composite", "realm-child", "realm-role-in-group", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    assertNames(userRoles.realmLevel().listAvailable(), "admin", "customer-user-premium", "realm-composite-role", "sample-realm-role", "attribute-role", "user", "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION);
    assertNames(userRoles.realmLevel().listEffective(), "realm-composite", "realm-child", "realm-role-in-group", "user", "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    // List client roles
    assertNames(userRoles.clientLevel(clientUuid).listAll(), "client-composite", "client-child", "client-role-in-group");
    assertNames(userRoles.clientLevel(clientUuid).listAvailable());
    assertNames(userRoles.clientLevel(clientUuid).listEffective(), "client-composite", "client-child", "client-role-in-group");
    // Get mapping representation
    MappingsRepresentation all = userRoles.getAll();
    assertNames(all.getRealmMappings(), "realm-composite", "realm-child", "realm-role-in-group", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    assertEquals(1, all.getClientMappings().size());
    assertNames(all.getClientMappings().get("myclient").getMappings(), "client-composite", "client-child", "client-role-in-group");
}

Example 3 with RoleMappingResource

use of org.keycloak.admin.client.resource.RoleMappingResource in project keycloak by keycloak.

the class UserTest method roleMappings.

@Test
public void roleMappings() {
    RealmResource realm = adminClient.realms().realm("test");
    // Enable events
    RealmRepresentation realmRep = RealmBuilder.edit(realm.toRepresentation()).testEventListener().build();
    realm.update(realmRep);
    RoleRepresentation realmCompositeRole = RoleBuilder.create().name("realm-composite").singleAttribute("attribute1", "value1").build();
    realm.roles().create(RoleBuilder.create().name("realm-role").build());
    realm.roles().create(realmCompositeRole);
    realm.roles().create(RoleBuilder.create().name("realm-child").build());
    realm.roles().get("realm-composite").addComposites(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
    final String clientUuid;
    try (Response response = realm.clients().create(ClientBuilder.create().clientId("myclient").build())) {
        clientUuid = ApiUtil.getCreatedId(response);
    }
    RoleRepresentation clientCompositeRole = RoleBuilder.create().name("client-composite").singleAttribute("attribute1", "value1").build();
    realm.clients().get(clientUuid).roles().create(RoleBuilder.create().name("client-role").build());
    realm.clients().get(clientUuid).roles().create(RoleBuilder.create().name("client-role2").build());
    realm.clients().get(clientUuid).roles().create(clientCompositeRole);
    realm.clients().get(clientUuid).roles().create(RoleBuilder.create().name("client-child").build());
    realm.clients().get(clientUuid).roles().get("client-composite").addComposites(Collections.singletonList(realm.clients().get(clientUuid).roles().get("client-child").toRepresentation()));
    final String userId;
    try (Response response = realm.users().create(UserBuilder.create().username("myuser").build())) {
        userId = ApiUtil.getCreatedId(response);
    }
    // Admin events for creating role, client or user tested already in other places
    assertAdminEvents.clear();
    RoleMappingResource roles = realm.users().get(userId).roles();
    assertNames(roles.realmLevel().listAll(), Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    assertNames(roles.realmLevel().listEffective(), "user", "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    // Add realm roles
    List<RoleRepresentation> l = new LinkedList<>();
    l.add(realm.roles().get("realm-role").toRepresentation());
    l.add(realm.roles().get("realm-composite").toRepresentation());
    roles.realmLevel().add(l);
    assertAdminEvents.assertEvent("test", OperationType.CREATE, AdminEventPaths.userRealmRoleMappingsPath(userId), l, ResourceType.REALM_ROLE_MAPPING);
    // Add client roles
    List<RoleRepresentation> list = Collections.singletonList(realm.clients().get(clientUuid).roles().get("client-role").toRepresentation());
    roles.clientLevel(clientUuid).add(list);
    assertAdminEvents.assertEvent("test", OperationType.CREATE, AdminEventPaths.userClientRoleMappingsPath(userId, clientUuid), list, ResourceType.CLIENT_ROLE_MAPPING);
    list = Collections.singletonList(realm.clients().get(clientUuid).roles().get("client-composite").toRepresentation());
    roles.clientLevel(clientUuid).add(list);
    assertAdminEvents.assertEvent("test", OperationType.CREATE, AdminEventPaths.userClientRoleMappingsPath(userId, clientUuid), ResourceType.CLIENT_ROLE_MAPPING);
    // List realm roles
    assertNames(roles.realmLevel().listAll(), "realm-role", "realm-composite", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    assertNames(roles.realmLevel().listAvailable(), "realm-child", "admin", "customer-user-premium", "realm-composite-role", "sample-realm-role", "attribute-role", "user", "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION);
    assertNames(roles.realmLevel().listEffective(), "realm-role", "realm-composite", "realm-child", "user", "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    // List realm effective role with full representation
    List<RoleRepresentation> realmRolesFullRepresentations = roles.realmLevel().listEffective(false);
    RoleRepresentation realmCompositeRoleFromList = getRoleByName("realm-composite", realmRolesFullRepresentations);
    assertNotNull(realmCompositeRoleFromList);
    assertTrue(realmCompositeRoleFromList.getAttributes().containsKey("attribute1"));
    // List client roles
    assertNames(roles.clientLevel(clientUuid).listAll(), "client-role", "client-composite");
    assertNames(roles.clientLevel(clientUuid).listAvailable(), "client-role2", "client-child");
    assertNames(roles.clientLevel(clientUuid).listEffective(), "client-role", "client-composite", "client-child");
    // List client effective role with full representation
    List<RoleRepresentation> rolesFullRepresentations = roles.clientLevel(clientUuid).listEffective(false);
    RoleRepresentation clientCompositeRoleFromList = getRoleByName("client-composite", rolesFullRepresentations);
    assertNotNull(clientCompositeRoleFromList);
    assertTrue(clientCompositeRoleFromList.getAttributes().containsKey("attribute1"));
    // Get mapping representation
    MappingsRepresentation all = roles.getAll();
    assertNames(all.getRealmMappings(), "realm-role", "realm-composite", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    assertEquals(1, all.getClientMappings().size());
    assertNames(all.getClientMappings().get("myclient").getMappings(), "client-role", "client-composite");
    // Remove realm role
    RoleRepresentation realmRoleRep = realm.roles().get("realm-role").toRepresentation();
    roles.realmLevel().remove(Collections.singletonList(realmRoleRep));
    assertAdminEvents.assertEvent("test", OperationType.DELETE, AdminEventPaths.userRealmRoleMappingsPath(userId), Collections.singletonList(realmRoleRep), ResourceType.REALM_ROLE_MAPPING);
    assertNames(roles.realmLevel().listAll(), "realm-composite", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
    // Remove client role
    RoleRepresentation clientRoleRep = realm.clients().get(clientUuid).roles().get("client-role").toRepresentation();
    roles.clientLevel(clientUuid).remove(Collections.singletonList(clientRoleRep));
    assertAdminEvents.assertEvent("test", OperationType.DELETE, AdminEventPaths.userClientRoleMappingsPath(userId, clientUuid), Collections.singletonList(clientRoleRep), ResourceType.CLIENT_ROLE_MAPPING);
    assertNames(roles.clientLevel(clientUuid).listAll(), "client-composite");
}

Example 4 with RoleMappingResource

use of org.keycloak.admin.client.resource.RoleMappingResource in project keycloak by keycloak.

the class GroupTest method roleMappings.

@Test
public void roleMappings() {
    RealmResource realm = adminClient.realms().realm("test");
    createRealmRole(realm, RoleBuilder.create().name("realm-role").build());
    createRealmRole(realm, RoleBuilder.create().name("realm-composite").build());
    createRealmRole(realm, RoleBuilder.create().name("realm-child").build());
    realm.roles().get("realm-composite").addComposites(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
    try (Response response = realm.clients().create(ClientBuilder.create().clientId("myclient").build())) {
        String clientId = ApiUtil.getCreatedId(response);
        getCleanup().addClientUuid(clientId);
        realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-role").build());
        realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-role2").build());
        realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-composite").build());
        realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-child").build());
        realm.clients().get(clientId).roles().get("client-composite").addComposites(Collections.singletonList(realm.clients().get(clientId).roles().get("client-child").toRepresentation()));
        // Roles+clients tested elsewhere
        assertAdminEvents.clear();
        GroupRepresentation group = new GroupRepresentation();
        group.setName("group");
        String groupId = createGroup(realm, group).getId();
        RoleMappingResource roles = realm.groups().group(groupId).roles();
        assertEquals(0, roles.realmLevel().listAll().size());
        // Add realm roles
        List<RoleRepresentation> l = new LinkedList<>();
        l.add(realm.roles().get("realm-role").toRepresentation());
        l.add(realm.roles().get("realm-composite").toRepresentation());
        roles.realmLevel().add(l);
        assertAdminEvents.assertEvent("test", OperationType.CREATE, AdminEventPaths.groupRolesRealmRolesPath(group.getId()), l, ResourceType.REALM_ROLE_MAPPING);
        // Add client roles
        RoleRepresentation clientRole = realm.clients().get(clientId).roles().get("client-role").toRepresentation();
        RoleRepresentation clientComposite = realm.clients().get(clientId).roles().get("client-composite").toRepresentation();
        roles.clientLevel(clientId).add(Collections.singletonList(clientRole));
        roles.clientLevel(clientId).add(Collections.singletonList(clientComposite));
        assertAdminEvents.assertEvent("test", OperationType.CREATE, AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientId), Collections.singletonList(clientRole), ResourceType.CLIENT_ROLE_MAPPING);
        assertAdminEvents.assertEvent("test", OperationType.CREATE, AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientId), Collections.singletonList(clientComposite), ResourceType.CLIENT_ROLE_MAPPING);
        // List realm roles
        assertNames(roles.realmLevel().listAll(), "realm-role", "realm-composite");
        assertNames(roles.realmLevel().listAvailable(), "realm-child", "admin", "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION, "user", "customer-user-premium", "realm-composite-role", "sample-realm-role", "attribute-role", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
        assertNames(roles.realmLevel().listEffective(), "realm-role", "realm-composite", "realm-child");
        // List client roles
        assertNames(roles.clientLevel(clientId).listAll(), "client-role", "client-composite");
        assertNames(roles.clientLevel(clientId).listAvailable(), "client-role2", "client-child");
        assertNames(roles.clientLevel(clientId).listEffective(), "client-role", "client-composite", "client-child");
        // Get mapping representation
        MappingsRepresentation all = roles.getAll();
        assertNames(all.getRealmMappings(), "realm-role", "realm-composite");
        assertEquals(1, all.getClientMappings().size());
        assertNames(all.getClientMappings().get("myclient").getMappings(), "client-role", "client-composite");
        // Remove realm role
        RoleRepresentation realmRoleRep = realm.roles().get("realm-role").toRepresentation();
        roles.realmLevel().remove(Collections.singletonList(realmRoleRep));
        assertAdminEvents.assertEvent("test", OperationType.DELETE, AdminEventPaths.groupRolesRealmRolesPath(group.getId()), Collections.singletonList(realmRoleRep), ResourceType.REALM_ROLE_MAPPING);
        assertNames(roles.realmLevel().listAll(), "realm-composite");
        // Remove client role
        RoleRepresentation clientRoleRep = realm.clients().get(clientId).roles().get("client-role").toRepresentation();
        roles.clientLevel(clientId).remove(Collections.singletonList(clientRoleRep));
        assertAdminEvents.assertEvent("test", OperationType.DELETE, AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientId), Collections.singletonList(clientRoleRep), ResourceType.CLIENT_ROLE_MAPPING);
        assertNames(roles.clientLevel(clientId).listAll(), "client-composite");
    }
}

Example 5 with RoleMappingResource

use of org.keycloak.admin.client.resource.RoleMappingResource in project keycloak by keycloak.

the class GroupTest method adminEndpointAccessibleWhenAdminRoleAssignedToUser.

/**
 * Verifies that the role assigned to a user is correctly handled by Keycloak Admin endpoint.
 * @link https://issues.jboss.org/browse/KEYCLOAK-2964
 */
@Test
public void adminEndpointAccessibleWhenAdminRoleAssignedToUser() {
    String userName = "user-" + UUID.randomUUID();
    final String realmName = AuthRealm.MASTER;
    RealmResource realm = adminClient.realms().realm(realmName);
    RoleRepresentation adminRole = realm.roles().get(AdminRoles.ADMIN).toRepresentation();
    assertThat(adminRole, notNullValue());
    assertThat(adminRole.getId(), notNullValue());
    String userId = createUser(realmName, userName, "pwd");
    assertThat(userId, notNullValue());
    RoleMappingResource mappings = realm.users().get(userId).roles();
    mappings.realmLevel().add(Collections.singletonList(adminRole));
    try (Keycloak userClient = Keycloak.getInstance(getAuthServerContextRoot() + "/auth", realmName, userName, "pwd", Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS())) {
        assertThat(// Any admin operation will do
        userClient.realms().findAll(), not(empty()));
    }
}