Examples with PolicyStore org.keycloak.authorization.store.PolicyStore used on opensource projects

Example 1 with PolicyStore

use of org.keycloak.authorization.store.PolicyStore in project keycloak by keycloak.

the class AuthorizationProvider method createResourceStoreWrapper.

private ResourceStore createResourceStoreWrapper(StoreFactory storeFactory) {
    return new ResourceStore() {

        ResourceStore delegate = storeFactory.getResourceStore();

        @Override
        public Resource create(String name, ResourceServer resourceServer, String owner) {
            return delegate.create(name, resourceServer, owner);
        }

        @Override
        public Resource create(String id, String name, ResourceServer resourceServer, String owner) {
            return delegate.create(id, name, resourceServer, owner);
        }

        @Override
        public void delete(String id) {
            Resource resource = findById(id, null);
            StoreFactory storeFactory = AuthorizationProvider.this.getStoreFactory();
            PermissionTicketStore ticketStore = storeFactory.getPermissionTicketStore();
            List<PermissionTicket> permissions = ticketStore.findByResource(id, resource.getResourceServer());
            for (PermissionTicket permission : permissions) {
                ticketStore.delete(permission.getId());
            }
            PolicyStore policyStore = storeFactory.getPolicyStore();
            List<Policy> policies = policyStore.findByResource(id, resource.getResourceServer());
            for (Policy policyModel : policies) {
                if (policyModel.getResources().size() == 1) {
                    policyStore.delete(policyModel.getId());
                } else {
                    policyModel.removeResource(resource);
                }
            }
            delegate.delete(id);
        }

        @Override
        public Resource findById(String id, String resourceServerId) {
            return delegate.findById(id, resourceServerId);
        }

        @Override
        public List<Resource> findByOwner(String ownerId, String resourceServerId) {
            return delegate.findByOwner(ownerId, resourceServerId);
        }

        @Override
        public void findByOwner(String ownerId, String resourceServerId, Consumer<Resource> consumer) {
            delegate.findByOwner(ownerId, resourceServerId, consumer);
        }

        @Override
        public List<Resource> findByOwner(String ownerId, String resourceServerId, int first, int max) {
            return delegate.findByOwner(ownerId, resourceServerId, first, max);
        }

        @Override
        public List<Resource> findByUri(String uri, String resourceServerId) {
            return delegate.findByUri(uri, resourceServerId);
        }

        @Override
        public List<Resource> findByResourceServer(String resourceServerId) {
            return delegate.findByResourceServer(resourceServerId);
        }

        @Override
        public List<Resource> findByResourceServer(Map<Resource.FilterOption, String[]> attributes, String resourceServerId, int firstResult, int maxResult) {
            return delegate.findByResourceServer(attributes, resourceServerId, firstResult, maxResult);
        }

        @Override
        public List<Resource> findByScope(List<String> id, String resourceServerId) {
            return delegate.findByScope(id, resourceServerId);
        }

        @Override
        public void findByScope(List<String> scopes, String resourceServerId, Consumer<Resource> consumer) {
            delegate.findByScope(scopes, resourceServerId, consumer);
        }

        @Override
        public Resource findByName(String name, String resourceServerId) {
            return delegate.findByName(name, resourceServerId);
        }

        @Override
        public Resource findByName(String name, String ownerId, String resourceServerId) {
            return delegate.findByName(name, ownerId, resourceServerId);
        }

        @Override
        public List<Resource> findByType(String type, String resourceServerId) {
            return delegate.findByType(type, resourceServerId);
        }

        @Override
        public void findByType(String type, String resourceServerId, Consumer<Resource> consumer) {
            delegate.findByType(type, resourceServerId, consumer);
        }

        @Override
        public void findByType(String type, String owner, String resourceServerId, Consumer<Resource> consumer) {
            delegate.findByType(type, owner, resourceServerId, consumer);
        }

        @Override
        public List<Resource> findByType(String type, String owner, String resourceServerId) {
            return delegate.findByType(type, resourceServerId);
        }

        @Override
        public List<Resource> findByTypeInstance(String type, String resourceServerId) {
            return delegate.findByTypeInstance(type, resourceServerId);
        }

        @Override
        public void findByTypeInstance(String type, String resourceServerId, Consumer<Resource> consumer) {
            delegate.findByTypeInstance(type, resourceServerId, consumer);
        }
    };
}

Example 2 with PolicyStore

use of org.keycloak.authorization.store.PolicyStore in project keycloak by keycloak.

the class RepresentationToModel method updateAssociatedPolicies.

private static void updateAssociatedPolicies(Set<String> policyIds, Policy policy, StoreFactory storeFactory) {
    ResourceServer resourceServer = policy.getResourceServer();
    if (policyIds != null) {
        if (policyIds.isEmpty()) {
            for (Policy associated : new HashSet<Policy>(policy.getAssociatedPolicies())) {
                policy.removeAssociatedPolicy(associated);
            }
            return;
        }
        PolicyStore policyStore = storeFactory.getPolicyStore();
        for (String policyId : policyIds) {
            boolean hasPolicy = false;
            for (Policy policyModel : new HashSet<Policy>(policy.getAssociatedPolicies())) {
                if (policyModel.getId().equals(policyId) || policyModel.getName().equals(policyId)) {
                    hasPolicy = true;
                }
            }
            if (!hasPolicy) {
                Policy associatedPolicy = policyStore.findById(policyId, resourceServer.getId());
                if (associatedPolicy == null) {
                    associatedPolicy = policyStore.findByName(policyId, resourceServer.getId());
                    if (associatedPolicy == null) {
                        throw new RuntimeException("Policy with id or name [" + policyId + "] does not exist");
                    }
                }
                policy.addAssociatedPolicy(associatedPolicy);
            }
        }
        for (Policy policyModel : new HashSet<Policy>(policy.getAssociatedPolicies())) {
            boolean hasPolicy = false;
            for (String policyId : policyIds) {
                if (policyModel.getId().equals(policyId) || policyModel.getName().equals(policyId)) {
                    hasPolicy = true;
                }
            }
            if (!hasPolicy) {
                policy.removeAssociatedPolicy(policyModel);
            }
        }
    }
    policy.removeConfig("applyPolicies");
}

Example 3 with PolicyStore

use of org.keycloak.authorization.store.PolicyStore in project keycloak by keycloak.

the class MigrateTo2_1_0 method migrateRolePolicies.

// KEYCLOAK-3338: Changes to how role policy config is stored"
private void migrateRolePolicies(RealmModel realm, KeycloakSession session) {
    AuthorizationProvider authorizationProvider = session.getProvider(AuthorizationProvider.class);
    StoreFactory storeFactory = authorizationProvider.getStoreFactory();
    PolicyStore policyStore = storeFactory.getPolicyStore();
    realm.getClientsStream().forEach(clientModel -> {
        ResourceServer resourceServer = storeFactory.getResourceServerStore().findByClient(clientModel);
        if (resourceServer != null) {
            policyStore.findByType("role", resourceServer.getId()).forEach(policy -> {
                Map<String, String> config = new HashMap(policy.getConfig());
                String roles = config.get("roles");
                List roleConfig;
                try {
                    roleConfig = JsonSerialization.readValue(roles, List.class);
                } catch (Exception e) {
                    throw new RuntimeException("Malformed configuration for role policy [" + policy.getName() + "].", e);
                }
                if (!roleConfig.isEmpty() && roleConfig.get(0) instanceof String) {
                    try {
                        config.put("roles", JsonSerialization.writeValueAsString(roleConfig.stream().map(new Function<String, Map>() {

                            @Override
                            public Map apply(String roleId) {
                                Map updated = new HashMap();
                                updated.put("id", roleId);
                                return updated;
                            }
                        }).collect(Collectors.toList())));
                        policy.setConfig(config);
                    } catch (Exception e) {
                        throw new RuntimeException("Failed to migrate role policy [" + policy.getName() + "].", e);
                    }
                }
            });
        }
    });
}

Example 4 with PolicyStore

use of org.keycloak.authorization.store.PolicyStore in project keycloak by keycloak.

the class JPAPolicyStore method findByScopeIds.

@Override
public List<Policy> findByScopeIds(List<String> scopeIds, String resourceServerId) {
    if (scopeIds == null || scopeIds.isEmpty()) {
        return Collections.emptyList();
    }
    // Use separate subquery to handle DB2 and MSSSQL
    TypedQuery<PolicyEntity> query = entityManager.createNamedQuery("findPolicyIdByScope", PolicyEntity.class);
    query.setFlushMode(FlushModeType.COMMIT);
    query.setParameter("scopeIds", scopeIds);
    query.setParameter("serverId", resourceServerId);
    List<Policy> list = new LinkedList<>();
    PolicyStore storeFactory = provider.getStoreFactory().getPolicyStore();
    for (PolicyEntity entity : query.getResultList()) {
        list.add(storeFactory.findById(entity.getId(), resourceServerId));
    }
    return list;
}

Example 5 with PolicyStore

use of org.keycloak.authorization.store.PolicyStore in project keycloak by keycloak.

the class JPAPolicyStore method findByResource.

@Override
public void findByResource(String resourceId, String resourceServerId, Consumer<Policy> consumer) {
    TypedQuery<PolicyEntity> query = entityManager.createNamedQuery("findPolicyIdByResource", PolicyEntity.class);
    query.setFlushMode(FlushModeType.COMMIT);
    query.setParameter("resourceId", resourceId);
    query.setParameter("serverId", resourceServerId);
    PolicyStore storeFactory = provider.getStoreFactory().getPolicyStore();
    closing(query.getResultStream().map(entity -> storeFactory.findById(entity.getId(), resourceServerId)).filter(Objects::nonNull)).forEach(consumer::accept);
}