Examples with PermissionTicket org.keycloak.authorization.model.PermissionTicket used on opensource projects

Example 26 with PermissionTicket

use of org.keycloak.authorization.model.PermissionTicket in project keycloak by keycloak.

the class ResourcesService method getPendingRequests.

/**
 */
@GET
@Path("pending-requests")
@Produces(MediaType.APPLICATION_JSON)
public Response getPendingRequests() {
    Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
    filters.put(PermissionTicket.FilterOption.REQUESTER, user.getId());
    filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.FALSE.toString());
    final List<PermissionTicket> permissionTickets = ticketStore.find(filters, null, -1, -1);
    final List<ResourcePermission> resourceList = new ArrayList<>(permissionTickets.size());
    for (PermissionTicket ticket : permissionTickets) {
        ResourcePermission resourcePermission = new ResourcePermission(ticket.getResource(), provider);
        resourcePermission.addScope(new Scope(ticket.getScope()));
        resourceList.add(resourcePermission);
    }
    return queryResponse((f, m) -> resourceList.stream(), -1, resourceList.size());
}

Example 27 with PermissionTicket

use of org.keycloak.authorization.model.PermissionTicket in project keycloak by keycloak.

the class ResourcesService method toPermissions.

private Collection<ResourcePermission> toPermissions(List<org.keycloak.authorization.model.Resource> resources, boolean withRequesters) {
    Collection<ResourcePermission> permissions = new ArrayList<>();
    PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
    for (org.keycloak.authorization.model.Resource resource : resources) {
        ResourcePermission permission = new ResourcePermission(resource, provider);
        List<PermissionTicket> tickets;
        if (withRequesters) {
            Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
            filters.put(PermissionTicket.FilterOption.OWNER, user.getId());
            filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
            filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId());
            tickets = ticketStore.find(filters, null, -1, -1);
        } else {
            tickets = ticketStore.findGranted(resource.getName(), user.getId(), null);
        }
        for (PermissionTicket ticket : tickets) {
            if (resource.equals(ticket.getResource())) {
                if (withRequesters) {
                    Permission user = permission.getPermission(ticket.getRequester());
                    if (user == null) {
                        permission.addPermission(ticket.getRequester(), user = new Permission(ticket.getRequester(), provider));
                    }
                    user.addScope(ticket.getScope().getName());
                } else {
                    permission.addScope(new Scope(ticket.getScope()));
                }
            }
        }
        permissions.add(permission);
    }
    return permissions;
}

Example 28 with PermissionTicket

use of org.keycloak.authorization.model.PermissionTicket in project keycloak by keycloak.

the class JPAPermissionTicketStore method create.

@Override
public PermissionTicket create(String resourceId, String scopeId, String requester, ResourceServer resourceServer) {
    PermissionTicketEntity entity = new PermissionTicketEntity();
    entity.setId(KeycloakModelUtils.generateId());
    entity.setResource(ResourceAdapter.toEntity(entityManager, provider.getStoreFactory().getResourceStore().findById(resourceId, resourceServer.getId())));
    entity.setRequester(requester);
    entity.setCreatedTimestamp(System.currentTimeMillis());
    if (scopeId != null) {
        entity.setScope(ScopeAdapter.toEntity(entityManager, provider.getStoreFactory().getScopeStore().findById(scopeId, resourceServer.getId())));
    }
    entity.setOwner(entity.getResource().getOwner());
    entity.setResourceServer(ResourceServerAdapter.toEntity(entityManager, resourceServer));
    this.entityManager.persist(entity);
    this.entityManager.flush();
    PermissionTicket model = new PermissionTicketAdapter(entity, entityManager, provider.getStoreFactory());
    return model;
}

Example 29 with PermissionTicket

use of org.keycloak.authorization.model.PermissionTicket in project keycloak by keycloak.

the class JPAPermissionTicketStore method findByOwner.

@Override
public List<PermissionTicket> findByOwner(String owner, String resourceServerId) {
    TypedQuery<String> query = entityManager.createNamedQuery("findPolicyIdByType", String.class);
    query.setFlushMode(FlushModeType.COMMIT);
    query.setParameter("serverId", resourceServerId);
    query.setParameter("owner", owner);
    List<String> result = query.getResultList();
    List<PermissionTicket> list = new LinkedList<>();
    PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
    for (String id : result) {
        PermissionTicket ticket = ticketStore.findById(id, resourceServerId);
        if (Objects.nonNull(ticket)) {
            list.add(ticket);
        }
    }
    return list;
}

Example 30 with PermissionTicket

use of org.keycloak.authorization.model.PermissionTicket in project keycloak by keycloak.

the class PolicyEvaluationResponseBuilder method toRepresentation.

private static PolicyEvaluationResponse.PolicyResultRepresentation toRepresentation(Result.PolicyResult result, AuthorizationProvider authorization) {
    PolicyEvaluationResponse.PolicyResultRepresentation policyResultRep = new PolicyEvaluationResponse.PolicyResultRepresentation();
    PolicyRepresentation representation = new PolicyRepresentation();
    Policy policy = result.getPolicy();
    representation.setId(policy.getId());
    representation.setName(policy.getName());
    representation.setType(policy.getType());
    representation.setDecisionStrategy(policy.getDecisionStrategy());
    representation.setDescription(policy.getDescription());
    if ("uma".equals(representation.getType())) {
        Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
        filters.put(PermissionTicket.FilterOption.POLICY_ID, policy.getId());
        List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(filters, policy.getResourceServer().getId(), -1, 1);
        if (!tickets.isEmpty()) {
            KeycloakSession keycloakSession = authorization.getKeycloakSession();
            RealmModel realm = authorization.getRealm();
            PermissionTicket ticket = tickets.get(0);
            UserModel userOwner = keycloakSession.users().getUserById(realm, ticket.getOwner());
            UserModel requester = keycloakSession.users().getUserById(realm, ticket.getRequester());
            String resourceOwner;
            if (userOwner != null) {
                resourceOwner = getUserEmailOrUserName(userOwner);
            } else {
                ClientModel clientOwner = realm.getClientById(ticket.getOwner());
                resourceOwner = clientOwner.getClientId();
            }
            representation.setDescription("Resource owner (" + resourceOwner + ") grants access to " + getUserEmailOrUserName(requester));
        } else {
            String description = representation.getDescription();
            if (description != null) {
                representation.setDescription(description + " (User-Managed Policy)");
            } else {
                representation.setDescription("User-Managed Policy");
            }
        }
    }
    representation.setResources(policy.getResources().stream().map(resource -> resource.getName()).collect(Collectors.toSet()));
    Set<String> scopeNames = policy.getScopes().stream().map(scope -> scope.getName()).collect(Collectors.toSet());
    representation.setScopes(scopeNames);
    policyResultRep.setPolicy(representation);
    if (result.getEffect() == Decision.Effect.DENY) {
        policyResultRep.setStatus(DecisionEffect.DENY);
        policyResultRep.setScopes(representation.getScopes());
    } else {
        policyResultRep.setStatus(DecisionEffect.PERMIT);
    }
    policyResultRep.setAssociatedPolicies(result.getAssociatedPolicies().stream().map(policy1 -> toRepresentation(policy1, authorization)).collect(Collectors.toList()));
    return policyResultRep;
}