Examples with Scope org.keycloak.authorization.model.Scope used on opensource projects

Example 1 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class UserPermissions method initialize.

private void initialize() {
    root.initializeRealmResourceServer();
    root.initializeRealmDefaultScopes();
    ResourceServer server = root.realmResourceServer();
    Scope manageScope = root.realmManageScope();
    Scope viewScope = root.realmViewScope();
    Scope mapRolesScope = root.initializeRealmScope(MAP_ROLES_SCOPE);
    Scope impersonateScope = root.initializeRealmScope(IMPERSONATE_SCOPE);
    Scope userImpersonatedScope = root.initializeRealmScope(USER_IMPERSONATED_SCOPE);
    Scope manageGroupMembershipScope = root.initializeRealmScope(MANAGE_GROUP_MEMBERSHIP_SCOPE);
    Resource usersResource = resourceStore.findByName(USERS_RESOURCE, server.getId());
    if (usersResource == null) {
        usersResource = resourceStore.create(USERS_RESOURCE, server, server.getId());
        Set<Scope> scopeset = new HashSet<>();
        scopeset.add(manageScope);
        scopeset.add(viewScope);
        scopeset.add(mapRolesScope);
        scopeset.add(impersonateScope);
        scopeset.add(manageGroupMembershipScope);
        scopeset.add(userImpersonatedScope);
        usersResource.updateScopes(scopeset);
    }
    Policy managePermission = policyStore.findByName(MANAGE_PERMISSION_USERS, server.getId());
    if (managePermission == null) {
        Helper.addEmptyScopePermission(authz, server, MANAGE_PERMISSION_USERS, usersResource, manageScope);
    }
    Policy viewPermission = policyStore.findByName(VIEW_PERMISSION_USERS, server.getId());
    if (viewPermission == null) {
        Helper.addEmptyScopePermission(authz, server, VIEW_PERMISSION_USERS, usersResource, viewScope);
    }
    Policy mapRolesPermission = policyStore.findByName(MAP_ROLES_PERMISSION_USERS, server.getId());
    if (mapRolesPermission == null) {
        Helper.addEmptyScopePermission(authz, server, MAP_ROLES_PERMISSION_USERS, usersResource, mapRolesScope);
    }
    Policy membershipPermission = policyStore.findByName(MANAGE_GROUP_MEMBERSHIP_PERMISSION_USERS, server.getId());
    if (membershipPermission == null) {
        Helper.addEmptyScopePermission(authz, server, MANAGE_GROUP_MEMBERSHIP_PERMISSION_USERS, usersResource, manageGroupMembershipScope);
    }
    Policy impersonatePermission = policyStore.findByName(ADMIN_IMPERSONATING_PERMISSION, server.getId());
    if (impersonatePermission == null) {
        Helper.addEmptyScopePermission(authz, server, ADMIN_IMPERSONATING_PERMISSION, usersResource, impersonateScope);
    }
    impersonatePermission = policyStore.findByName(USER_IMPERSONATED_PERMISSION, server.getId());
    if (impersonatePermission == null) {
        Helper.addEmptyScopePermission(authz, server, USER_IMPERSONATED_PERMISSION, usersResource, userImpersonatedScope);
    }
}

Example 2 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class ClientPermissions method canExchangeTo.

@Override
public boolean canExchangeTo(ClientModel authorizedClient, ClientModel to) {
    if (!authorizedClient.equals(to)) {
        ResourceServer server = resourceServer(to);
        if (server == null) {
            logger.debug("No resource server set up for target client");
            return false;
        }
        Resource resource = authz.getStoreFactory().getResourceStore().findByName(getResourceName(to), server.getId());
        if (resource == null) {
            logger.debug("No resource object set up for target client");
            return false;
        }
        Policy policy = authz.getStoreFactory().getPolicyStore().findByName(getExchangeToPermissionName(to), server.getId());
        if (policy == null) {
            logger.debug("No permission object set up for target client");
            return false;
        }
        Set<Policy> associatedPolicies = policy.getAssociatedPolicies();
        // if no policies attached to permission then just do default behavior
        if (associatedPolicies == null || associatedPolicies.isEmpty()) {
            logger.debug("No policies set up for permission on target client");
            return false;
        }
        Scope scope = exchangeToScope(server);
        if (scope == null) {
            logger.debug(TOKEN_EXCHANGE + " not initialized");
            return false;
        }
        ClientModelIdentity identity = new ClientModelIdentity(session, authorizedClient);
        EvaluationContext context = new DefaultEvaluationContext(identity, session) {

            @Override
            public Map<String, Collection<String>> getBaseAttributes() {
                Map<String, Collection<String>> attributes = super.getBaseAttributes();
                attributes.put("kc.client.id", Arrays.asList(authorizedClient.getClientId()));
                return attributes;
            }
        };
        return root.evaluatePermission(resource, server, context, scope);
    }
    return true;
}

Example 3 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class ClientPermissions method canConfigure.

@Override
public boolean canConfigure(ClientModel client) {
    if (canManage(client))
        return true;
    if (!root.isAdminSameRealm()) {
        return false;
    }
    ResourceServer server = resourceServer(client);
    if (server == null)
        return false;
    Resource resource = authz.getStoreFactory().getResourceStore().findByName(getResourceName(client), server.getId());
    if (resource == null)
        return false;
    Policy policy = authz.getStoreFactory().getPolicyStore().findByName(getConfigurePermissionName(client), server.getId());
    if (policy == null) {
        return false;
    }
    Set<Policy> associatedPolicies = policy.getAssociatedPolicies();
    // if no policies attached to permission then just do default behavior
    if (associatedPolicies == null || associatedPolicies.isEmpty()) {
        return false;
    }
    Scope scope = configureScope(server);
    return root.evaluatePermission(resource, server, scope);
}

Example 4 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class ClientPermissions method canMapClientScopeRoles.

@Override
public boolean canMapClientScopeRoles(ClientModel client) {
    ResourceServer server = resourceServer(client);
    if (server == null)
        return false;
    Resource resource = authz.getStoreFactory().getResourceStore().findByName(getResourceName(client), server.getId());
    if (resource == null)
        return false;
    Policy policy = authz.getStoreFactory().getPolicyStore().findByName(getMapRolesClientScopePermissionName(client), server.getId());
    if (policy == null) {
        return false;
    }
    Set<Policy> associatedPolicies = policy.getAssociatedPolicies();
    // if no policies attached to permission then just do default behavior
    if (associatedPolicies == null || associatedPolicies.isEmpty()) {
        return false;
    }
    Scope scope = authz.getStoreFactory().getScopeStore().findByName(MAP_ROLES_CLIENT_SCOPE, server.getId());
    return root.evaluatePermission(resource, server, scope);
}

Example 5 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class ClientPermissions method hasView.

private boolean hasView(ClientModel client) {
    if (canView())
        return true;
    if (!root.isAdminSameRealm()) {
        return false;
    }
    ResourceServer server = resourceServer(client);
    if (server == null)
        return false;
    Resource resource = authz.getStoreFactory().getResourceStore().findByName(getResourceName(client), server.getId());
    if (resource == null)
        return false;
    Policy policy = authz.getStoreFactory().getPolicyStore().findByName(getViewPermissionName(client), server.getId());
    if (policy == null) {
        return false;
    }
    Set<Policy> associatedPolicies = policy.getAssociatedPolicies();
    // if no policies attached to permission then just do default behavior
    if (associatedPolicies == null || associatedPolicies.isEmpty()) {
        return false;
    }
    Scope scope = viewScope(server);
    return root.evaluatePermission(resource, server, scope);
}