Examples with ResourceServer org.keycloak.authorization.model.ResourceServer used on opensource projects

Example 61 with ResourceServer

use of org.keycloak.authorization.model.ResourceServer in project keycloak by keycloak.

the class GroupPermissions method hasPermission.

private boolean hasPermission(Resource resource, EvaluationContext context, String... scopes) {
    ResourceServer server = root.realmResourceServer();
    Collection<Permission> permissions;
    if (context == null) {
        permissions = root.evaluatePermission(new ResourcePermission(resource, resource.getScopes(), server), server);
    } else {
        permissions = root.evaluatePermission(new ResourcePermission(resource, resource.getScopes(), server), server, context);
    }
    List<String> expectedScopes = Arrays.asList(scopes);
    for (Permission permission : permissions) {
        for (String scope : permission.getScopes()) {
            if (expectedScopes.contains(scope)) {
                return true;
            }
        }
    }
    return false;
}

Example 62 with ResourceServer

use of org.keycloak.authorization.model.ResourceServer in project keycloak by keycloak.

the class GroupPermissions method resource.

@Override
public Resource resource(GroupModel group) {
    ResourceServer server = root.realmResourceServer();
    if (server == null)
        return null;
    Resource resource = resourceStore.findByName(getGroupResourceName(group), server.getId());
    if (resource == null)
        return null;
    return resource;
}

Example 63 with ResourceServer

use of org.keycloak.authorization.model.ResourceServer in project keycloak by keycloak.

the class GroupPermissions method initialize.

private void initialize(GroupModel group) {
    root.initializeRealmResourceServer();
    root.initializeRealmDefaultScopes();
    ResourceServer server = root.realmResourceServer();
    Scope manageScope = root.realmManageScope();
    Scope viewScope = root.realmViewScope();
    Scope manageMembersScope = root.initializeRealmScope(MANAGE_MEMBERS_SCOPE);
    Scope viewMembersScope = root.initializeRealmScope(VIEW_MEMBERS_SCOPE);
    Scope manageMembershipScope = root.initializeRealmScope(MANAGE_MEMBERSHIP_SCOPE);
    String groupResourceName = getGroupResourceName(group);
    Resource groupResource = resourceStore.findByName(groupResourceName, server.getId());
    if (groupResource == null) {
        groupResource = resourceStore.create(groupResourceName, server, server.getId());
        Set<Scope> scopeset = new HashSet<>();
        scopeset.add(manageScope);
        scopeset.add(viewScope);
        scopeset.add(viewMembersScope);
        scopeset.add(manageMembershipScope);
        scopeset.add(manageMembersScope);
        groupResource.updateScopes(scopeset);
        groupResource.setType("Group");
    }
    String managePermissionName = getManagePermissionGroup(group);
    Policy managePermission = policyStore.findByName(managePermissionName, server.getId());
    if (managePermission == null) {
        Helper.addEmptyScopePermission(authz, server, managePermissionName, groupResource, manageScope);
    }
    String viewPermissionName = getViewPermissionGroup(group);
    Policy viewPermission = policyStore.findByName(viewPermissionName, server.getId());
    if (viewPermission == null) {
        Helper.addEmptyScopePermission(authz, server, viewPermissionName, groupResource, viewScope);
    }
    String manageMembersPermissionName = getManageMembersPermissionGroup(group);
    Policy manageMembersPermission = policyStore.findByName(manageMembersPermissionName, server.getId());
    if (manageMembersPermission == null) {
        Helper.addEmptyScopePermission(authz, server, manageMembersPermissionName, groupResource, manageMembersScope);
    }
    String viewMembersPermissionName = getViewMembersPermissionGroup(group);
    Policy viewMembersPermission = policyStore.findByName(viewMembersPermissionName, server.getId());
    if (viewMembersPermission == null) {
        Helper.addEmptyScopePermission(authz, server, viewMembersPermissionName, groupResource, viewMembersScope);
    }
    String manageMembershipPermissionName = getManageMembershipPermissionGroup(group);
    Policy manageMembershipPermission = policyStore.findByName(manageMembershipPermissionName, server.getId());
    if (manageMembershipPermission == null) {
        Helper.addEmptyScopePermission(authz, server, manageMembershipPermissionName, groupResource, manageMembershipScope);
    }
}

Example 64 with ResourceServer

use of org.keycloak.authorization.model.ResourceServer in project keycloak by keycloak.

the class GroupPermissions method deletePermissions.

private void deletePermissions(GroupModel group) {
    ResourceServer server = root.realmResourceServer();
    if (server == null)
        return;
    Policy managePermission = managePermission(group);
    if (managePermission != null) {
        policyStore.delete(managePermission.getId());
    }
    Policy viewPermission = viewPermission(group);
    if (viewPermission != null) {
        policyStore.delete(viewPermission.getId());
    }
    Policy manageMembersPermission = manageMembersPermission(group);
    if (manageMembersPermission != null) {
        policyStore.delete(manageMembersPermission.getId());
    }
    Policy viewMembersPermission = viewMembersPermission(group);
    if (viewMembersPermission != null) {
        policyStore.delete(viewMembersPermission.getId());
    }
    Policy manageMembershipPermission = manageMembershipPermission(group);
    if (manageMembershipPermission != null) {
        policyStore.delete(manageMembershipPermission.getId());
    }
    Resource resource = groupResource(group);
    if (resource != null)
        resourceStore.delete(resource.getId());
}

Example 65 with ResourceServer

use of org.keycloak.authorization.model.ResourceServer in project keycloak by keycloak.

the class ClientPermissions method canMapCompositeRoles.

@Override
public boolean canMapCompositeRoles(ClientModel client) {
    ResourceServer server = resourceServer(client);
    if (server == null)
        return false;
    Resource resource = authz.getStoreFactory().getResourceStore().findByName(getResourceName(client), server.getId());
    if (resource == null)
        return false;
    Policy policy = authz.getStoreFactory().getPolicyStore().findByName(getMapRolesCompositePermissionName(client), server.getId());
    if (policy == null) {
        return false;
    }
    Set<Policy> associatedPolicies = policy.getAssociatedPolicies();
    // if no policies attached to permission then just do default behavior
    if (associatedPolicies == null || associatedPolicies.isEmpty()) {
        return false;
    }
    Scope scope = authz.getStoreFactory().getScopeStore().findByName(MAP_ROLES_COMPOSITE_SCOPE, server.getId());
    return root.evaluatePermission(resource, server, scope);
}