Examples with ScopeRepresentation org.keycloak.representations.idm.authorization.ScopeRepresentation used on opensource projects

Example 11 with ScopeRepresentation

use of org.keycloak.representations.idm.authorization.ScopeRepresentation in project keycloak by keycloak.

the class ResourceSetService method getScopes.

@Path("{id}/scopes")
@GET
@NoCache
@Produces("application/json")
public Response getScopes(@PathParam("id") String id) {
    requireView();
    StoreFactory storeFactory = authorization.getStoreFactory();
    Resource model = storeFactory.getResourceStore().findById(id, resourceServer.getId());
    if (model == null) {
        return Response.status(Status.NOT_FOUND).build();
    }
    List<ScopeRepresentation> scopes = model.getScopes().stream().map(scope -> {
        ScopeRepresentation representation = new ScopeRepresentation();
        representation.setId(scope.getId());
        representation.setName(scope.getName());
        return representation;
    }).collect(Collectors.toList());
    if (model.getType() != null && !model.getOwner().equals(resourceServer.getId())) {
        ResourceStore resourceStore = authorization.getStoreFactory().getResourceStore();
        for (Resource typed : resourceStore.findByType(model.getType(), resourceServer.getId())) {
            if (typed.getOwner().equals(resourceServer.getId()) && !typed.getId().equals(model.getId())) {
                scopes.addAll(typed.getScopes().stream().map(model1 -> {
                    ScopeRepresentation scope = new ScopeRepresentation();
                    scope.setId(model1.getId());
                    scope.setName(model1.getName());
                    String iconUri = model1.getIconUri();
                    if (iconUri != null) {
                        scope.setIconUri(iconUri);
                    }
                    return scope;
                }).filter(scopeRepresentation -> !scopes.contains(scopeRepresentation)).collect(Collectors.toList()));
            }
        }
    }
    return Response.ok(scopes).build();
}

Example 12 with ScopeRepresentation

use of org.keycloak.representations.idm.authorization.ScopeRepresentation in project keycloak by keycloak.

the class EntitlementAPITest method testPermissionOrder.

@Test
public void testPermissionOrder() throws Exception {
    ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
    AuthorizationResource authorization = client.authorization();
    JSPolicyRepresentation policy = new JSPolicyRepresentation();
    policy.setName(KeycloakModelUtils.generateId());
    policy.setCode("$evaluation.grant();");
    authorization.policies().js().create(policy).close();
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName("my_resource");
    resource.addScope("entity:read");
    try (Response response = authorization.resources().create(resource)) {
        resource = response.readEntity(ResourceRepresentation.class);
    }
    ScopeRepresentation featureAccessScope = new ScopeRepresentation("feature:access");
    authorization.scopes().create(featureAccessScope);
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName(KeycloakModelUtils.generateId());
    permission.addPolicy(policy.getName());
    permission.addResource(resource.getId());
    authorization.permissions().resource().create(permission).close();
    ScopePermissionRepresentation scopePermission = new ScopePermissionRepresentation();
    scopePermission.setName(KeycloakModelUtils.generateId());
    scopePermission.addPolicy(policy.getName());
    scopePermission.addScope(featureAccessScope.getName());
    authorization.permissions().scope().create(scopePermission).close();
    AuthorizationRequest request = new AuthorizationRequest();
    request.addPermission(null, "entity:read");
    request.addPermission(null, "feature:access");
    AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
    AuthorizationResponse response = authzClient.authorization().authorize(request);
    AccessToken token = toAccessToken(response.getToken());
    Authorization result = token.getAuthorization();
    assertEquals(2, result.getPermissions().size());
    assertTrue(result.getPermissions().stream().anyMatch(p -> p.getResourceId() == null && p.getScopes().contains(featureAccessScope.getName())));
    String resourceId = resource.getId();
    assertTrue(result.getPermissions().stream().anyMatch(p -> p.getResourceId() != null && p.getResourceId().equals(resourceId) && p.getScopes().contains("entity:read")));
    request = new AuthorizationRequest();
    request.addPermission(null, "feature:access");
    request.addPermission(null, "entity:read");
    response = authzClient.authorization().authorize(request);
    token = toAccessToken(response.getToken());
    result = token.getAuthorization();
    assertEquals(2, result.getPermissions().size());
    assertTrue(result.getPermissions().stream().anyMatch(p -> p.getResourceId() == null && p.getScopes().contains(featureAccessScope.getName())));
    assertTrue(result.getPermissions().stream().anyMatch(p -> p.getResourceId() != null && p.getResourceId().equals(resourceId) && p.getScopes().contains("entity:read")));
}

Example 13 with ScopeRepresentation

use of org.keycloak.representations.idm.authorization.ScopeRepresentation in project keycloak by keycloak.

the class PermissionManagementTest method testRemoveScopeFromResource.

@Test
public void testRemoveScopeFromResource() throws Exception {
    ResourceRepresentation resource = addResource("Resource A", "kolo", true, "ScopeA", "ScopeB");
    PermissionRequest permissionRequest = new PermissionRequest(resource.getId(), "ScopeA", "ScopeB");
    AuthzClient authzClient = getAuthzClient();
    PermissionResponse response = authzClient.protection("marta", "password").permission().create(permissionRequest);
    assertNotNull(response.getTicket());
    AuthorizationRequest request = new AuthorizationRequest();
    request.setTicket(response.getTicket());
    request.setClaimToken(authzClient.obtainAccessToken("marta", "password").getToken());
    try {
        authzClient.authorization().authorize(request);
    } catch (Exception e) {
    }
    AuthorizationResource authorization = getClient(getRealm()).authorization();
    ResourceScopesResource scopes = authorization.scopes();
    ScopeRepresentation removedScope = scopes.findByName("ScopeA");
    List permissions = authzClient.protection().permission().findByScope(removedScope.getId());
    assertFalse(permissions.isEmpty());
    resource.setScopes(new HashSet<>());
    resource.addScope("ScopeB");
    authorization.resources().resource(resource.getId()).update(resource);
    permissions = authzClient.protection().permission().findByScope(removedScope.getId());
    assertTrue(permissions.isEmpty());
    ScopeRepresentation scopeB = scopes.findByName("ScopeB");
    permissions = authzClient.protection().permission().findByScope(scopeB.getId());
    assertFalse(permissions.isEmpty());
}

Example 14 with ScopeRepresentation

use of org.keycloak.representations.idm.authorization.ScopeRepresentation in project keycloak by keycloak.

the class ConflictingScopePermissionTest method createResourcesAndScopes.

private void createResourcesAndScopes() throws IOException {
    AuthzClient authzClient = getAuthzClient();
    Set<ScopeRepresentation> scopes = new HashSet<>();
    scopes.add(new ScopeRepresentation("read"));
    scopes.add(new ScopeRepresentation("write"));
    scopes.add(new ScopeRepresentation("execute"));
    List<ResourceRepresentation> resources = new ArrayList<>();
    resources.add(new ResourceRepresentation("Resource A", scopes));
    resources.add(new ResourceRepresentation("Resource B", scopes));
    resources.add(new ResourceRepresentation("Resource C", scopes));
    resources.forEach(resource -> authzClient.protection().resource().create(resource));
}

Example 15 with ScopeRepresentation

use of org.keycloak.representations.idm.authorization.ScopeRepresentation in project keycloak by keycloak.

the class ScopePermissionManagementTest method configureTest.

@Before
public void configureTest() {
    super.configureTest();
    RolesResource realmRoles = testRealmResource().roles();
    realmRoles.create(new RoleRepresentation("Role A", "", false));
    realmRoles.create(new RoleRepresentation("Role B", "", false));
    RolePolicyRepresentation policyA = new RolePolicyRepresentation();
    policyA.setName("Policy A");
    policyA.addRole("Role A");
    AuthorizationResource authorization = testRealmResource().clients().get(newClient.getId()).authorization();
    PoliciesResource policies = authorization.policies();
    RolePoliciesResource roles = policies.role();
    roles.create(policyA);
    RolePolicyRepresentation policyB = new RolePolicyRepresentation();
    policyB.setName("Policy B");
    policyB.addRole("Role B");
    roles.create(policyB);
    UserPolicyRepresentation policyC = new UserPolicyRepresentation();
    policyC.setName("Policy C");
    policyC.addUser("test");
    policies.user().create(policyC).close();
    authorization.scopes().create(new ScopeRepresentation("Scope A"));
    authorization.scopes().create(new ScopeRepresentation("Scope B"));
    authorization.scopes().create(new ScopeRepresentation("Scope C"));
    ResourcesResource resources = authorization.resources();
    resources.create(new ResourceRepresentation("Resource A", "Scope A"));
    resources.create(new ResourceRepresentation("Resource B", "Scope B", "Scope C"));
}