Examples with Scope org.keycloak.authorization.model.Scope used on opensource projects

Example 6 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class IdentityProviderPermissions method canExchangeTo.

@Override
public boolean canExchangeTo(ClientModel authorizedClient, IdentityProviderModel to) {
    ResourceServer server = root.initializeRealmResourceServer();
    if (server == null) {
        logger.debug("No resource server set up for target idp");
        return false;
    }
    Resource resource = authz.getStoreFactory().getResourceStore().findByName(getResourceName(to), server.getId());
    if (resource == null) {
        logger.debug("No resource object set up for target idp");
        return false;
    }
    Policy policy = authz.getStoreFactory().getPolicyStore().findByName(getExchangeToPermissionName(to), server.getId());
    if (policy == null) {
        logger.debug("No permission object set up for target idp");
        return false;
    }
    Set<Policy> associatedPolicies = policy.getAssociatedPolicies();
    // if no policies attached to permission then just do default behavior
    if (associatedPolicies == null || associatedPolicies.isEmpty()) {
        logger.debug("No policies set up for permission on target idp");
        return false;
    }
    Scope scope = exchangeToScope(server);
    if (scope == null) {
        logger.debug(TOKEN_EXCHANGE + " not initialized");
        return false;
    }
    ClientModelIdentity identity = new ClientModelIdentity(session, authorizedClient);
    EvaluationContext context = new DefaultEvaluationContext(identity, session) {

        @Override
        public Map<String, Collection<String>> getBaseAttributes() {
            Map<String, Collection<String>> attributes = super.getBaseAttributes();
            attributes.put("kc.client.id", Arrays.asList(authorizedClient.getClientId()));
            return attributes;
        }
    };
    return root.evaluatePermission(resource, server, context, scope);
}

Example 7 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class RolePermissions method canMapRole.

/**
 * Is admin allowed to map this role?
 *
 * @param role
 * @return
 */
@Override
public boolean canMapRole(RoleModel role) {
    if (root.users().canManageDefault())
        return checkAdminRoles(role);
    if (!root.isAdminSameRealm()) {
        return false;
    }
    if (role.getContainer() instanceof ClientModel) {
        if (root.clients().canMapRoles((ClientModel) role.getContainer()))
            return true;
    }
    if (!isPermissionsEnabled(role)) {
        return false;
    }
    ResourceServer resourceServer = resourceServer(role);
    if (resourceServer == null)
        return false;
    Policy policy = authz.getStoreFactory().getPolicyStore().findByName(getMapRolePermissionName(role), resourceServer.getId());
    if (policy == null || policy.getAssociatedPolicies().isEmpty()) {
        return false;
    }
    Resource roleResource = resource(role);
    Scope mapRoleScope = mapRoleScope(resourceServer);
    if (root.evaluatePermission(roleResource, resourceServer, mapRoleScope)) {
        return checkAdminRoles(role);
    } else {
        return false;
    }
}

Example 8 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class PolicyAdapter method getScopes.

@Override
public Set<Scope> getScopes() {
    if (isUpdated())
        return updated.getScopes();
    if (scopes != null)
        return scopes;
    scopes = new HashSet<>();
    ScopeStore scopeStore = cacheSession.getScopeStore();
    String resourceServerId = cached.getResourceServerId();
    for (String scopeId : cached.getScopesIds(modelSupplier)) {
        Scope scope = scopeStore.findById(scopeId, resourceServerId);
        cacheSession.cacheScope(scope);
        scopes.add(scope);
    }
    return scopes = Collections.unmodifiableSet(scopes);
}

Example 9 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class PermissionTicketAwareDecisionResultCollector method onComplete.

@Override
public void onComplete() {
    super.onComplete();
    if (request.isSubmitRequest()) {
        StoreFactory storeFactory = authorization.getStoreFactory();
        ResourceStore resourceStore = storeFactory.getResourceStore();
        List<Permission> permissions = ticket.getPermissions();
        if (permissions != null) {
            for (Permission permission : permissions) {
                Resource resource = resourceStore.findById(permission.getResourceId(), resourceServer.getId());
                if (resource == null) {
                    resource = resourceStore.findByName(permission.getResourceId(), identity.getId(), resourceServer.getId());
                }
                if (resource == null || !resource.isOwnerManagedAccess() || resource.getOwner().equals(identity.getId()) || resource.getOwner().equals(resourceServer.getId())) {
                    continue;
                }
                Set<String> scopes = permission.getScopes();
                if (scopes.isEmpty()) {
                    scopes = resource.getScopes().stream().map(Scope::getName).collect(Collectors.toSet());
                }
                if (scopes.isEmpty()) {
                    Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
                    filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId());
                    filters.put(PermissionTicket.FilterOption.REQUESTER, identity.getId());
                    filters.put(PermissionTicket.FilterOption.SCOPE_IS_NULL, Boolean.TRUE.toString());
                    List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(filters, resource.getResourceServer(), -1, -1);
                    if (tickets.isEmpty()) {
                        authorization.getStoreFactory().getPermissionTicketStore().create(resource.getId(), null, identity.getId(), resourceServer);
                    }
                } else {
                    ScopeStore scopeStore = authorization.getStoreFactory().getScopeStore();
                    for (String scopeId : scopes) {
                        Scope scope = scopeStore.findByName(scopeId, resourceServer.getId());
                        if (scope == null) {
                            scope = scopeStore.findById(scopeId, resourceServer.getId());
                        }
                        Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
                        filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId());
                        filters.put(PermissionTicket.FilterOption.REQUESTER, identity.getId());
                        filters.put(PermissionTicket.FilterOption.SCOPE_ID, scope.getId());
                        List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(filters, resource.getResourceServer(), -1, -1);
                        if (tickets.isEmpty()) {
                            authorization.getStoreFactory().getPermissionTicketStore().create(resource.getId(), scope.getId(), identity.getId(), resourceServer);
                        }
                    }
                }
            }
        }
    }
}

Example 10 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class ExportUtils method createPolicyRepresentation.

private static PolicyRepresentation createPolicyRepresentation(AuthorizationProvider authorizationProvider, Policy policy) {
    try {
        PolicyRepresentation rep = toRepresentation(policy, authorizationProvider, true, true);
        Map<String, String> config = new HashMap<>(rep.getConfig());
        rep.setConfig(config);
        Set<Scope> scopes = policy.getScopes();
        if (!scopes.isEmpty()) {
            List<String> scopeNames = scopes.stream().map(Scope::getName).collect(Collectors.toList());
            config.put("scopes", JsonSerialization.writeValueAsString(scopeNames));
        }
        Set<Resource> policyResources = policy.getResources();
        if (!policyResources.isEmpty()) {
            List<String> resourceNames = policyResources.stream().map(Resource::getName).collect(Collectors.toList());
            config.put("resources", JsonSerialization.writeValueAsString(resourceNames));
        }
        Set<Policy> associatedPolicies = policy.getAssociatedPolicies();
        if (!associatedPolicies.isEmpty()) {
            config.put("applyPolicies", JsonSerialization.writeValueAsString(associatedPolicies.stream().map(associated -> associated.getName()).collect(Collectors.toList())));
        }
        return rep;
    } catch (Exception e) {
        throw new RuntimeException("Error while exporting policy [" + policy.getName() + "].", e);
    }
}