Examples with Scope org.keycloak.authorization.model.Scope used on opensource projects

Example 16 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class AuthorizationTokenService method resolveRequestedScopes.

private Set<Scope> resolveRequestedScopes(KeycloakAuthorizationRequest request, ResourceServer resourceServer, ScopeStore scopeStore, Permission permission) {
    String clientAdditionalScopes = request.getScope();
    Set<String> requestedScopes = permission.getScopes();
    if (permission.getScopes() == null) {
        requestedScopes = new HashSet<>();
    }
    if (clientAdditionalScopes != null) {
        requestedScopes.addAll(Arrays.asList(clientAdditionalScopes.split(" ")));
    }
    Set<Scope> requestedScopesModel = requestedScopes.stream().map(s -> scopeStore.findByName(s, resourceServer.getId())).filter(Objects::nonNull).collect(Collectors.toSet());
    if (!requestedScopes.isEmpty() && requestedScopesModel.isEmpty()) {
        CorsErrorResponseException invalidScopeException = new CorsErrorResponseException(request.getCors(), "invalid_scope", "One of the given scopes " + permission.getScopes() + " is invalid", Status.BAD_REQUEST);
        fireErrorEvent(request.getEvent(), Errors.INVALID_REQUEST, invalidScopeException);
        throw invalidScopeException;
    }
    return requestedScopesModel;
}

Example 17 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class AuthorizationTokenService method resolvePreviousGrantedPermissions.

private void resolvePreviousGrantedPermissions(PermissionTicketToken ticket, KeycloakAuthorizationRequest request, ResourceServer resourceServer, Map<String, ResourcePermission> permissionsToEvaluate, ResourceStore resourceStore, ScopeStore scopeStore, AtomicInteger limit) {
    AccessToken rpt = request.getRpt();
    if (rpt != null && rpt.isActive()) {
        Authorization authorizationData = rpt.getAuthorization();
        if (authorizationData != null) {
            Collection<Permission> permissions = authorizationData.getPermissions();
            if (permissions != null) {
                for (Permission grantedPermission : permissions) {
                    if (limit != null && limit.get() <= 0) {
                        break;
                    }
                    Resource resource = resourceStore.findById(grantedPermission.getResourceId(), ticket.getIssuedFor());
                    if (resource != null) {
                        ResourcePermission permission = permissionsToEvaluate.get(resource.getId());
                        if (permission == null) {
                            permission = new ResourcePermission(resource, new ArrayList<>(), resourceServer, grantedPermission.getClaims());
                            permissionsToEvaluate.put(resource.getId(), permission);
                            if (limit != null) {
                                limit.decrementAndGet();
                            }
                        } else {
                            if (grantedPermission.getClaims() != null) {
                                for (Entry<String, Set<String>> entry : grantedPermission.getClaims().entrySet()) {
                                    Set<String> claims = permission.getClaims().get(entry.getKey());
                                    if (claims != null) {
                                        claims.addAll(entry.getValue());
                                    }
                                }
                            }
                        }
                        for (String scopeName : grantedPermission.getScopes()) {
                            Scope scope = scopeStore.findByName(scopeName, resourceServer.getId());
                            if (scope != null) {
                                if (!permission.getScopes().contains(scope)) {
                                    permission.getScopes().add(scope);
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}

Example 18 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class ScopeService method create.

@POST
@NoCache
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
public Response create(ScopeRepresentation scope) {
    this.auth.realm().requireManageAuthorization();
    Scope model = toModel(scope, this.resourceServer, authorization);
    scope.setId(model.getId());
    audit(scope, scope.getId(), OperationType.CREATE);
    return Response.status(Status.CREATED).entity(scope).build();
}

Example 19 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class ScopeService method delete.

@Path("{id}")
@DELETE
public Response delete(@PathParam("id") String id) {
    this.auth.realm().requireManageAuthorization();
    StoreFactory storeFactory = authorization.getStoreFactory();
    List<Resource> resources = storeFactory.getResourceStore().findByScope(Arrays.asList(id), resourceServer.getId());
    if (!resources.isEmpty()) {
        return ErrorResponse.error("Scopes can not be removed while associated with resources.", Status.BAD_REQUEST);
    }
    Scope scope = storeFactory.getScopeStore().findById(id, resourceServer.getId());
    if (scope == null) {
        return Response.status(Status.NOT_FOUND).build();
    }
    PolicyStore policyStore = storeFactory.getPolicyStore();
    List<Policy> policies = policyStore.findByScopeIds(Arrays.asList(scope.getId()), resourceServer.getId());
    for (Policy policyModel : policies) {
        if (policyModel.getScopes().size() == 1) {
            policyStore.delete(policyModel.getId());
        } else {
            policyModel.removeScope(scope);
        }
    }
    storeFactory.getScopeStore().delete(id);
    audit(toRepresentation(scope), OperationType.DELETE);
    return Response.noContent().build();
}

Example 20 with Scope

use of org.keycloak.authorization.model.Scope in project keycloak by keycloak.

the class ScopeService method update.

@Path("{id}")
@PUT
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
public Response update(@PathParam("id") String id, ScopeRepresentation scope) {
    this.auth.realm().requireManageAuthorization();
    scope.setId(id);
    StoreFactory storeFactory = authorization.getStoreFactory();
    Scope model = storeFactory.getScopeStore().findById(scope.getId(), resourceServer.getId());
    if (model == null) {
        return Response.status(Status.NOT_FOUND).build();
    }
    toModel(scope, resourceServer, authorization);
    audit(scope, OperationType.UPDATE);
    return Response.noContent().build();
}