Examples with AuthorizationProvider org.keycloak.authorization.AuthorizationProvider used on opensource projects

Example 31 with AuthorizationProvider

use of org.keycloak.authorization.AuthorizationProvider in project keycloak by keycloak.

the class GroupPolicyProviderFactory method updatePolicy.

private void updatePolicy(Policy policy, String groupsClaim, Set<GroupPolicyRepresentation.GroupDefinition> groups, AuthorizationProvider authorization) {
    if (groups == null || groups.isEmpty()) {
        throw new RuntimeException("You must provide at least one group");
    }
    Map<String, String> config = new HashMap<>(policy.getConfig());
    if (groupsClaim != null) {
        config.put("groupsClaim", groupsClaim);
    }
    List<GroupModel> topLevelGroups = authorization.getRealm().getTopLevelGroupsStream().collect(Collectors.toList());
    for (GroupPolicyRepresentation.GroupDefinition definition : groups) {
        GroupModel group = null;
        if (definition.getId() != null) {
            group = authorization.getRealm().getGroupById(definition.getId());
        }
        String path = definition.getPath();
        if (group == null && path != null) {
            String canonicalPath = path.startsWith("/") ? path.substring(1, path.length()) : path;
            if (canonicalPath != null) {
                String[] parts = canonicalPath.split("/");
                GroupModel parent = null;
                for (String part : parts) {
                    if (parent == null) {
                        parent = topLevelGroups.stream().filter(groupModel -> groupModel.getName().equals(part)).findFirst().orElseThrow(() -> new RuntimeException("Top level group with name [" + part + "] not found"));
                    } else {
                        group = parent.getSubGroupsStream().filter(groupModel -> groupModel.getName().equals(part)).findFirst().orElseThrow(() -> new RuntimeException("Group with name [" + part + "] not found"));
                        parent = group;
                    }
                }
                if (parts.length == 1) {
                    group = parent;
                }
            }
        }
        if (group == null) {
            throw new RuntimeException("Group with id [" + definition.getId() + "] not found");
        }
        definition.setId(group.getId());
        definition.setPath(null);
    }
    try {
        config.put("groups", JsonSerialization.writeValueAsString(groups));
    } catch (IOException cause) {
        throw new RuntimeException("Failed to serialize groups", cause);
    }
    policy.setConfig(config);
}

Example 32 with AuthorizationProvider

use of org.keycloak.authorization.AuthorizationProvider in project keycloak by keycloak.

the class ClientPolicyProvider method evaluate.

@Override
public void evaluate(Evaluation evaluation) {
    ClientPolicyRepresentation representation = representationFunction.apply(evaluation.getPolicy(), evaluation.getAuthorizationProvider());
    AuthorizationProvider authorizationProvider = evaluation.getAuthorizationProvider();
    RealmModel realm = authorizationProvider.getKeycloakSession().getContext().getRealm();
    EvaluationContext context = evaluation.getContext();
    for (String client : representation.getClients()) {
        ClientModel clientModel = realm.getClientById(client);
        if (context.getAttributes().containsValue("kc.client.id", clientModel.getClientId())) {
            evaluation.grant();
            return;
        }
    }
}

Example 33 with AuthorizationProvider

use of org.keycloak.authorization.AuthorizationProvider in project keycloak by keycloak.

the class ClientScopePolicyProvider method evaluate.

@Override
public void evaluate(Evaluation evaluation) {
    Policy policy = evaluation.getPolicy();
    Set<ClientScopePolicyRepresentation.ClientScopeDefinition> clientScopeIds = representationFunction.apply(policy, evaluation.getAuthorizationProvider()).getClientScopes();
    AuthorizationProvider authorizationProvider = evaluation.getAuthorizationProvider();
    RealmModel realm = authorizationProvider.getKeycloakSession().getContext().getRealm();
    Identity identity = evaluation.getContext().getIdentity();
    for (ClientScopePolicyRepresentation.ClientScopeDefinition clientScopeDefinition : clientScopeIds) {
        ClientScopeModel clientScope = realm.getClientScopeById(clientScopeDefinition.getId());
        if (clientScope != null) {
            boolean hasClientScope = hasClientScope(identity, clientScope);
            if (!hasClientScope && clientScopeDefinition.isRequired()) {
                evaluation.deny();
                return;
            } else if (hasClientScope) {
                evaluation.grant();
            }
        }
    }
}

Example 34 with AuthorizationProvider

use of org.keycloak.authorization.AuthorizationProvider in project keycloak by keycloak.

the class GroupPolicyProvider method evaluate.

@Override
public void evaluate(Evaluation evaluation) {
    AuthorizationProvider authorizationProvider = evaluation.getAuthorizationProvider();
    GroupPolicyRepresentation policy = representationFunction.apply(evaluation.getPolicy(), authorizationProvider);
    RealmModel realm = authorizationProvider.getRealm();
    Attributes.Entry groupsClaim = evaluation.getContext().getIdentity().getAttributes().getValue(policy.getGroupsClaim());
    if (groupsClaim == null || groupsClaim.isEmpty()) {
        List<String> userGroups = evaluation.getRealm().getUserGroups(evaluation.getContext().getIdentity().getId());
        groupsClaim = new Entry(policy.getGroupsClaim(), userGroups);
    }
    for (GroupPolicyRepresentation.GroupDefinition definition : policy.getGroups()) {
        GroupModel allowedGroup = realm.getGroupById(definition.getId());
        for (int i = 0; i < groupsClaim.size(); i++) {
            String group = groupsClaim.asString(i);
            if (group.indexOf('/') != -1) {
                String allowedGroupPath = buildGroupPath(allowedGroup);
                if (group.equals(allowedGroupPath) || (definition.isExtendChildren() && group.startsWith(allowedGroupPath))) {
                    evaluation.grant();
                    return;
                }
            }
            // in case the group from the claim does not represent a path, we just check an exact name match
            if (group.equals(allowedGroup.getName())) {
                evaluation.grant();
                return;
            }
        }
    }
}

Example 35 with AuthorizationProvider

use of org.keycloak.authorization.AuthorizationProvider in project keycloak by keycloak.

the class UserPolicyProviderFactory method onExport.

@Override
public void onExport(Policy policy, PolicyRepresentation representation, AuthorizationProvider authorizationProvider) {
    UserPolicyRepresentation userRep = toRepresentation(policy, authorizationProvider);
    Map<String, String> config = new HashMap<>();
    try {
        UserProvider userProvider = authorizationProvider.getKeycloakSession().users();
        RealmModel realm = authorizationProvider.getRealm();
        config.put("users", JsonSerialization.writeValueAsString(userRep.getUsers().stream().map(id -> userProvider.getUserById(realm, id).getUsername()).collect(Collectors.toList())));
    } catch (IOException cause) {
        throw new RuntimeException("Failed to export user policy [" + policy.getName() + "]", cause);
    }
    representation.setConfig(config);
}