Examples with UserPolicyRepresentation org.keycloak.representations.idm.authorization.UserPolicyRepresentation used on opensource projects

Example 1 with UserPolicyRepresentation

use of org.keycloak.representations.idm.authorization.UserPolicyRepresentation in project keycloak by keycloak.

the class UMAPolicyProviderFactory method onUpdate.

@Override
public void onUpdate(Policy policy, UmaPermissionRepresentation representation, AuthorizationProvider authorization) {
    PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore();
    Set<Policy> associatedPolicies = policy.getAssociatedPolicies();
    for (Policy associatedPolicy : associatedPolicies) {
        AbstractPolicyRepresentation associatedRep = ModelToRepresentation.toRepresentation(associatedPolicy, authorization, false, false);
        if ("role".equals(associatedRep.getType())) {
            RolePolicyRepresentation rep = RolePolicyRepresentation.class.cast(associatedRep);
            rep.setRoles(new HashSet<>());
            Set<String> updatedRoles = representation.getRoles();
            if (updatedRoles != null) {
                for (String role : updatedRoles) {
                    rep.addRole(role);
                }
            }
            if (rep.getRoles().isEmpty()) {
                policyStore.delete(associatedPolicy.getId());
            } else {
                RepresentationToModel.toModel(rep, authorization, associatedPolicy);
            }
        } else if ("js".equals(associatedRep.getType())) {
            JSPolicyRepresentation rep = JSPolicyRepresentation.class.cast(associatedRep);
            if (representation.getCondition() != null) {
                rep.setCode(representation.getCondition());
                RepresentationToModel.toModel(rep, authorization, associatedPolicy);
            } else {
                policyStore.delete(associatedPolicy.getId());
            }
        } else if ("group".equals(associatedRep.getType())) {
            GroupPolicyRepresentation rep = GroupPolicyRepresentation.class.cast(associatedRep);
            rep.setGroups(new HashSet<>());
            Set<String> updatedGroups = representation.getGroups();
            if (updatedGroups != null) {
                for (String group : updatedGroups) {
                    rep.addGroupPath(group);
                }
            }
            if (rep.getGroups().isEmpty()) {
                policyStore.delete(associatedPolicy.getId());
            } else {
                RepresentationToModel.toModel(rep, authorization, associatedPolicy);
            }
        } else if ("client".equals(associatedRep.getType())) {
            ClientPolicyRepresentation rep = ClientPolicyRepresentation.class.cast(associatedRep);
            rep.setClients(new HashSet<>());
            Set<String> updatedClients = representation.getClients();
            if (updatedClients != null) {
                for (String client : updatedClients) {
                    rep.addClient(client);
                }
            }
            if (rep.getClients().isEmpty()) {
                policyStore.delete(associatedPolicy.getId());
            } else {
                RepresentationToModel.toModel(rep, authorization, associatedPolicy);
            }
        } else if ("user".equals(associatedRep.getType())) {
            UserPolicyRepresentation rep = UserPolicyRepresentation.class.cast(associatedRep);
            rep.setUsers(new HashSet<>());
            Set<String> updatedUsers = representation.getUsers();
            if (updatedUsers != null) {
                for (String user : updatedUsers) {
                    rep.addUser(user);
                }
            }
            if (rep.getUsers().isEmpty()) {
                policyStore.delete(associatedPolicy.getId());
            } else {
                RepresentationToModel.toModel(rep, authorization, associatedPolicy);
            }
        }
    }
    Set<String> updatedRoles = representation.getRoles();
    if (updatedRoles != null) {
        boolean createPolicy = true;
        for (Policy associatedPolicy : associatedPolicies) {
            if ("role".equals(associatedPolicy.getType())) {
                createPolicy = false;
            }
        }
        if (createPolicy) {
            for (String role : updatedRoles) {
                createRolePolicy(policy, policyStore, role, policy.getOwner());
            }
        }
    }
    Set<String> updatedGroups = representation.getGroups();
    if (updatedGroups != null) {
        boolean createPolicy = true;
        for (Policy associatedPolicy : associatedPolicies) {
            if ("group".equals(associatedPolicy.getType())) {
                createPolicy = false;
            }
        }
        if (createPolicy) {
            for (String group : updatedGroups) {
                createGroupPolicy(policy, policyStore, group, policy.getOwner());
            }
        }
    }
    Set<String> updatedClients = representation.getClients();
    if (updatedClients != null) {
        boolean createPolicy = true;
        for (Policy associatedPolicy : associatedPolicies) {
            if ("client".equals(associatedPolicy.getType())) {
                createPolicy = false;
            }
        }
        if (createPolicy) {
            for (String client : updatedClients) {
                createClientPolicy(policy, policyStore, client, policy.getOwner());
            }
        }
    }
    Set<String> updatedUsers = representation.getUsers();
    if (updatedUsers != null) {
        boolean createPolicy = true;
        for (Policy associatedPolicy : associatedPolicies) {
            if ("user".equals(associatedPolicy.getType())) {
                createPolicy = false;
            }
        }
        if (createPolicy) {
            for (String user : updatedUsers) {
                createUserPolicy(policy, policyStore, user, policy.getOwner());
            }
        }
    }
    String condition = representation.getCondition();
    if (condition != null) {
        boolean createPolicy = true;
        for (Policy associatedPolicy : associatedPolicies) {
            if ("js".equals(associatedPolicy.getType())) {
                createPolicy = false;
            }
        }
        if (createPolicy) {
            createJSPolicy(policy, policyStore, condition, policy.getOwner());
        }
    }
}

Example 2 with UserPolicyRepresentation

use of org.keycloak.representations.idm.authorization.UserPolicyRepresentation in project keycloak by keycloak.

the class UMAPolicyProviderFactory method createUserPolicy.

private void createUserPolicy(Policy policy, PolicyStore policyStore, String user, String owner) {
    UserPolicyRepresentation rep = new UserPolicyRepresentation();
    rep.setName(KeycloakModelUtils.generateId());
    rep.addUser(user);
    Policy associatedPolicy = policyStore.create(rep, policy.getResourceServer());
    associatedPolicy.setOwner(owner);
    policy.addAssociatedPolicy(associatedPolicy);
}

Example 3 with UserPolicyRepresentation

use of org.keycloak.representations.idm.authorization.UserPolicyRepresentation in project keycloak by keycloak.

the class UserPolicyProvider method evaluate.

@Override
public void evaluate(Evaluation evaluation) {
    EvaluationContext context = evaluation.getContext();
    UserPolicyRepresentation representation = representationFunction.apply(evaluation.getPolicy(), evaluation.getAuthorizationProvider());
    for (String userId : representation.getUsers()) {
        if (context.getIdentity().getId().equals(userId)) {
            evaluation.grant();
            break;
        }
    }
}

Example 4 with UserPolicyRepresentation

use of org.keycloak.representations.idm.authorization.UserPolicyRepresentation in project keycloak by keycloak.

the class UserSynchronizer method removeFromUserPolicies.

private void removeFromUserPolicies(UserRemovedEvent event, AuthorizationProvider authorizationProvider) {
    StoreFactory storeFactory = authorizationProvider.getStoreFactory();
    PolicyStore policyStore = storeFactory.getPolicyStore();
    UserModel userModel = event.getUser();
    Map<Policy.FilterOption, String[]> attributes = new EnumMap<>(Policy.FilterOption.class);
    attributes.put(Policy.FilterOption.TYPE, new String[] { "user" });
    attributes.put(Policy.FilterOption.CONFIG, new String[] { "users", userModel.getId() });
    List<Policy> search = policyStore.findByResourceServer(attributes, null, -1, -1);
    for (Policy policy : search) {
        PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType());
        UserPolicyRepresentation representation = UserPolicyRepresentation.class.cast(policyFactory.toRepresentation(policy, authorizationProvider));
        Set<String> users = representation.getUsers();
        users.remove(userModel.getId());
        if (users.isEmpty()) {
            policyFactory.onRemove(policy, authorizationProvider);
            policyStore.delete(policy.getId());
        } else {
            policyFactory.onUpdate(policy, representation, authorizationProvider);
        }
    }
}

Example 5 with UserPolicyRepresentation

use of org.keycloak.representations.idm.authorization.UserPolicyRepresentation in project keycloak by keycloak.

the class FineGrainAdminUnitTest method setupUsers.

public static void setupUsers(KeycloakSession session) {
    RealmModel realm = session.realms().getRealmByName(TEST);
    ClientModel client = realm.getClientByClientId(CLIENT_NAME);
    RoleModel realmRole = realm.getRole("realm-role");
    RoleModel realmRole2 = realm.getRole("realm-role2");
    RoleModel clientRole = client.getRole("client-role");
    RoleModel mapperRole = realm.getRole("mapper");
    RoleModel managerRole = realm.getRole("manager");
    RoleModel compositeRole = realm.getRole("composite-role");
    ClientModel realmManagementClient = realm.getClientByClientId("realm-management");
    RoleModel adminRole = realmManagementClient.getRole(AdminRoles.REALM_ADMIN);
    RoleModel queryGroupsRole = realmManagementClient.getRole(AdminRoles.QUERY_GROUPS);
    RoleModel queryUsersRole = realmManagementClient.getRole(AdminRoles.QUERY_USERS);
    RoleModel queryClientsRole = realmManagementClient.getRole(AdminRoles.QUERY_CLIENTS);
    UserModel nomapAdmin = session.users().addUser(realm, "nomap-admin");
    nomapAdmin.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, nomapAdmin, UserCredentialModel.password("password"));
    nomapAdmin.grantRole(adminRole);
    UserModel anotherAdmin = session.users().addUser(realm, "anotherAdmin");
    anotherAdmin.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, anotherAdmin, UserCredentialModel.password("password"));
    anotherAdmin.grantRole(adminRole);
    UserModel authorizedUser = session.users().addUser(realm, "authorized");
    authorizedUser.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, authorizedUser, UserCredentialModel.password("password"));
    authorizedUser.grantRole(mapperRole);
    authorizedUser.grantRole(managerRole);
    UserModel authorizedComposite = session.users().addUser(realm, "authorizedComposite");
    authorizedComposite.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, authorizedComposite, UserCredentialModel.password("password"));
    authorizedComposite.grantRole(compositeRole);
    UserModel unauthorizedUser = session.users().addUser(realm, "unauthorized");
    unauthorizedUser.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, unauthorizedUser, UserCredentialModel.password("password"));
    UserModel unauthorizedMapper = session.users().addUser(realm, "unauthorizedMapper");
    unauthorizedMapper.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, unauthorizedMapper, UserCredentialModel.password("password"));
    unauthorizedMapper.grantRole(managerRole);
    UserModel user1 = session.users().addUser(realm, "user1");
    user1.setEnabled(true);
    // group management
    AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
    GroupModel group = KeycloakModelUtils.findGroupByPath(realm, "top");
    UserModel groupMember = session.users().addUser(realm, "groupMember");
    groupMember.joinGroup(group);
    groupMember.setEnabled(true);
    UserModel groupManager = session.users().addUser(realm, "groupManager");
    groupManager.grantRole(queryGroupsRole);
    groupManager.grantRole(queryUsersRole);
    groupManager.setEnabled(true);
    groupManager.grantRole(mapperRole);
    session.userCredentialManager().updateCredential(realm, groupManager, UserCredentialModel.password("password"));
    UserModel groupManagerNoMapper = session.users().addUser(realm, "noMapperGroupManager");
    groupManagerNoMapper.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, groupManagerNoMapper, UserCredentialModel.password("password"));
    groupManagerNoMapper.grantRole(queryGroupsRole);
    groupManagerNoMapper.grantRole(queryUsersRole);
    UserPolicyRepresentation groupManagerRep = new UserPolicyRepresentation();
    groupManagerRep.setName("groupManagers");
    groupManagerRep.addUser("groupManager");
    groupManagerRep.addUser("noMapperGroupManager");
    ResourceServer server = permissions.realmResourceServer();
    Policy groupManagerPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(groupManagerRep, server);
    permissions.groups().manageMembersPermission(group).addAssociatedPolicy(groupManagerPolicy);
    permissions.groups().manageMembershipPermission(group).addAssociatedPolicy(groupManagerPolicy);
    permissions.groups().viewPermission(group).addAssociatedPolicy(groupManagerPolicy);
    UserModel clientMapper = session.users().addUser(realm, "clientMapper");
    clientMapper.setEnabled(true);
    clientMapper.grantRole(managerRole);
    clientMapper.grantRole(queryUsersRole);
    session.userCredentialManager().updateCredential(realm, clientMapper, UserCredentialModel.password("password"));
    Policy clientMapperPolicy = permissions.clients().mapRolesPermission(client);
    UserPolicyRepresentation userRep = new UserPolicyRepresentation();
    userRep.setName("userClientMapper");
    userRep.addUser("clientMapper");
    Policy userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(userRep, permissions.clients().resourceServer(client));
    clientMapperPolicy.addAssociatedPolicy(userPolicy);
    UserModel clientManager = session.users().addUser(realm, "clientManager");
    clientManager.setEnabled(true);
    clientManager.grantRole(queryClientsRole);
    session.userCredentialManager().updateCredential(realm, clientManager, UserCredentialModel.password("password"));
    Policy clientManagerPolicy = permissions.clients().managePermission(client);
    userRep = new UserPolicyRepresentation();
    userRep.setName("clientManager");
    userRep.addUser("clientManager");
    userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(userRep, permissions.clients().resourceServer(client));
    clientManagerPolicy.addAssociatedPolicy(userPolicy);
    UserModel clientConfigurer = session.users().addUser(realm, "clientConfigurer");
    clientConfigurer.setEnabled(true);
    clientConfigurer.grantRole(queryClientsRole);
    session.userCredentialManager().updateCredential(realm, clientConfigurer, UserCredentialModel.password("password"));
    Policy clientConfigurePolicy = permissions.clients().configurePermission(client);
    userRep = new UserPolicyRepresentation();
    userRep.setName("clientConfigure");
    userRep.addUser("clientConfigurer");
    userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(userRep, permissions.clients().resourceServer(client));
    clientConfigurePolicy.addAssociatedPolicy(userPolicy);
    UserModel groupViewer = session.users().addUser(realm, "groupViewer");
    groupViewer.grantRole(queryGroupsRole);
    groupViewer.grantRole(queryUsersRole);
    groupViewer.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, groupViewer, UserCredentialModel.password("password"));
    UserPolicyRepresentation groupViewMembersRep = new UserPolicyRepresentation();
    groupViewMembersRep.setName("groupMemberViewers");
    groupViewMembersRep.addUser("groupViewer");
    Policy groupViewMembersPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(groupViewMembersRep, server);
    Policy groupViewMembersPermission = permissions.groups().viewMembersPermission(group);
    groupViewMembersPermission.addAssociatedPolicy(groupViewMembersPolicy);
}