Examples with PermissionTicket org.keycloak.authorization.model.PermissionTicket used on opensource projects

Example 11 with PermissionTicket

use of org.keycloak.authorization.model.PermissionTicket in project keycloak by keycloak.

the class JPAPermissionTicketStore method findByResource.

@Override
public List<PermissionTicket> findByResource(final String resourceId, String resourceServerId) {
    TypedQuery<String> query = entityManager.createNamedQuery("findPermissionIdByResource", String.class);
    query.setFlushMode(FlushModeType.COMMIT);
    query.setParameter("resourceId", resourceId);
    query.setParameter("serverId", resourceServerId);
    List<String> result = query.getResultList();
    List<PermissionTicket> list = new LinkedList<>();
    PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
    for (String id : result) {
        PermissionTicket ticket = ticketStore.findById(id, resourceServerId);
        if (Objects.nonNull(ticket)) {
            list.add(ticket);
        }
    }
    return list;
}

Example 12 with PermissionTicket

use of org.keycloak.authorization.model.PermissionTicket in project keycloak by keycloak.

the class JPAPermissionTicketStore method findByResourceServer.

@Override
public List<PermissionTicket> findByResourceServer(final String resourceServerId) {
    TypedQuery<String> query = entityManager.createNamedQuery("findPolicyIdByServerId", String.class);
    query.setParameter("serverId", resourceServerId);
    List<String> result = query.getResultList();
    List<PermissionTicket> list = new LinkedList<>();
    PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
    for (String id : result) {
        PermissionTicket ticket = ticketStore.findById(id, resourceServerId);
        if (Objects.nonNull(ticket)) {
            list.add(ticket);
        }
    }
    return list;
}

Example 13 with PermissionTicket

use of org.keycloak.authorization.model.PermissionTicket in project keycloak by keycloak.

the class JPAPermissionTicketStore method findByScope.

@Override
public List<PermissionTicket> findByScope(String scopeId, String resourceServerId) {
    if (scopeId == null) {
        return Collections.emptyList();
    }
    // Use separate subquery to handle DB2 and MSSSQL
    TypedQuery<String> query = entityManager.createNamedQuery("findPermissionIdByScope", String.class);
    query.setFlushMode(FlushModeType.COMMIT);
    query.setParameter("scopeId", scopeId);
    query.setParameter("serverId", resourceServerId);
    List<String> result = query.getResultList();
    List<PermissionTicket> list = new LinkedList<>();
    PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
    for (String id : result) {
        PermissionTicket ticket = ticketStore.findById(id, resourceServerId);
        if (Objects.nonNull(ticket)) {
            list.add(ticket);
        }
    }
    return list;
}

Example 14 with PermissionTicket

use of org.keycloak.authorization.model.PermissionTicket in project keycloak by keycloak.

the class JPAPermissionTicketStore method find.

@Override
public List<PermissionTicket> find(Map<PermissionTicket.FilterOption, String> attributes, String resourceServerId, int firstResult, int maxResult) {
    CriteriaBuilder builder = entityManager.getCriteriaBuilder();
    CriteriaQuery<PermissionTicketEntity> querybuilder = builder.createQuery(PermissionTicketEntity.class);
    Root<PermissionTicketEntity> root = querybuilder.from(PermissionTicketEntity.class);
    querybuilder.select(root.get("id"));
    List<Predicate> predicates = getPredicates(builder, root, resourceServerId, attributes);
    querybuilder.where(predicates.toArray(new Predicate[predicates.size()])).orderBy(builder.asc(root.get("id")));
    TypedQuery query = entityManager.createQuery(querybuilder);
    List<String> result = paginateQuery(query, firstResult, maxResult).getResultList();
    List<PermissionTicket> list = new LinkedList<>();
    PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
    for (String id : result) {
        PermissionTicket ticket = ticketStore.findById(id, resourceServerId);
        if (Objects.nonNull(ticket)) {
            list.add(ticket);
        }
    }
    return list;
}

Example 15 with PermissionTicket

use of org.keycloak.authorization.model.PermissionTicket in project keycloak by keycloak.

the class ResourceService method revoke.

/**
 * Updates the permission set for a resource based on the given {@code permissions}.
 *
 * @param permissions the permissions that should be updated
 * @return if successful, a {@link Response.Status#NO_CONTENT} response
 */
@PUT
@Path("permissions")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
public Response revoke(List<Permission> permissions) {
    auth.require(AccountRoles.MANAGE_ACCOUNT);
    if (permissions == null || permissions.isEmpty()) {
        throw new BadRequestException("invalid_permissions");
    }
    Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
    filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId());
    for (Permission permission : permissions) {
        UserModel user = getUser(permission.getUsername());
        filters.put(PermissionTicket.FilterOption.REQUESTER, user.getId());
        List<PermissionTicket> tickets = ticketStore.find(filters, resource.getResourceServer(), -1, -1);
        // grants all requested permissions
        if (tickets.isEmpty()) {
            for (String scope : permission.getScopes()) {
                grantPermission(user, scope);
            }
        } else {
            Iterator<String> scopesIterator = permission.getScopes().iterator();
            while (scopesIterator.hasNext()) {
                org.keycloak.authorization.model.Scope scope = getScope(scopesIterator.next(), resourceServer);
                Iterator<PermissionTicket> ticketIterator = tickets.iterator();
                while (ticketIterator.hasNext()) {
                    PermissionTicket ticket = ticketIterator.next();
                    if (scope.getId().equals(ticket.getScope().getId())) {
                        if (!ticket.isGranted()) {
                            ticket.setGrantedTimestamp(System.currentTimeMillis());
                        }
                        // permission exists, remove from the list to avoid deletion
                        ticketIterator.remove();
                        // scope already granted, remove from the list to avoid creating it again
                        scopesIterator.remove();
                    }
                }
            }
            // only create permissions for the scopes that don't have a tocket
            for (String scope : permission.getScopes()) {
                grantPermission(user, scope);
            }
            // remove all tickets that are not within the requested permissions
            for (PermissionTicket ticket : tickets) {
                ticketStore.delete(ticket.getId());
            }
        }
    }
    return Response.noContent().build();
}