Class RoleResolveUtil


  • public class RoleResolveUtil
    extends Object
    Helper class to ensure that all the user's permitted roles (including composite roles) are loaded just once per request. Then all underlying protocolMappers can consume them.
    Author:
    Marek Posolda
    • Constructor Detail

      • RoleResolveUtil

        public RoleResolveUtil()
    • Method Detail

      • getResolvedRealmRoles

        public static AccessToken.Access getResolvedRealmRoles​(KeycloakSession session,
                                                               ClientSessionContext clientSessionCtx,
                                                               boolean createIfMissing)
        Object (possibly null) containing all the user's realm roles. Including user's groups roles. Composite roles are expanded. Just the roles, which current client has role-scope-mapping for (or it's clientScopes) are included. Current client means the client corresponding to specified clientSessionCtx.
        Parameters:
        session -
        clientSessionCtx -
        createIfMissing -
        Returns:
        can return null (just in case that createIfMissing is false)
      • getResolvedClientRoles

        public static AccessToken.Access getResolvedClientRoles​(KeycloakSession session,
                                                                ClientSessionContext clientSessionCtx,
                                                                String clientId,
                                                                boolean createIfMissing)
        Object (possibly null) containing all the user's client roles of client specified by clientId. Including user's groups roles. Composite roles are expanded. Just the roles, which current client has role-scope-mapping for (or it's clientScopes) are included. Current client means the client corresponding to specified clientSessionCtx.
        Parameters:
        session -
        clientSessionCtx -
        clientId -
        createIfMissing -
        Returns:
        can return null (just in case that createIfMissing is false)
      • getAllResolvedClientRoles

        public static Map<String,​AccessToken.Access> getAllResolvedClientRoles​(KeycloakSession session,
                                                                                     ClientSessionContext clientSessionCtx)
        Object (but can be empty map) containing all the user's client roles of all clients. Including user's groups roles. Composite roles are expanded. Just the roles, which current client has role-scope-mapping for (or it's clientScopes) are included. Current client means the client corresponding to specified clientSessionCtx.
        Parameters:
        session -
        clientSessionCtx -
        Returns:
        not-null object (can return empty map)