Package org.keycloak.authorization.policy.evaluation

Interface Realm

  • public interface Realm
    This interface provides methods to query information from a realm.
    Author:
    Pedro Igor

    • Method Detail

      • isUserInGroup

        default boolean isUserInGroup​(String id,
                              String group)

        Checks whether or not a user with the given id is a member of the given group.

        This method will also consider memberships where the user is a member of any child group of the given group. For instance, if user is member of /Group A/Group B and this method is checking if user is a member of /Group A the result will be true given that the user is a member of a child group of /Group A.

        Parameters:
        id - the user id. It can be the id, username or email
        group - the group path. For instance, /Group A/Group B.
        Returns:
        true if user is a member of the given group. Otherwise returns false.

      • isUserInGroup

        boolean isUserInGroup​(String id,
                      String group,
                      boolean checkParent)
        Checks whether or not a user with the given id is a member of the given group.
        Parameters:
        id - the user id. It can be the id, username or email
        group - the group path. For instance, /Group A/Group B.
        checkParent - if true, this method returns true even though the user is not directly associated with the given group but a member of any child of the group.
        Returns:
        true if user is a member of the given group. Otherwise returns false.

      • isUserInRealmRole

        boolean isUserInRealmRole​(String id,
                          String role)
        Checks whether or not a user with the given id is granted with the given realm role.
        Parameters:
        id - the user id. It can be the id, username or email
        role - the role name
        Returns:
        true if the user is granted with the role. Otherwise, false.

      • isUserInClientRole

        boolean isUserInClientRole​(String id,
                           String clientId,
                           String role)
        Checks whether or not a user with the given id is granted with the given client role.
        Parameters:
        id - the user id. It can be the id, username or email
        clientId - the client id
        role - the role name
        Returns:
        true if the user is granted with the role. Otherwise, false.

      • isGroupInRole

        boolean isGroupInRole​(String group,
                      String role)
        Checks whether or not a group is granted with the given realm role.
        Parameters:
        group - the group path. For instance, /Group A/Group B.
        role - the role name
        Returns:
        true if the group is granted with the role. Otherwise, false.

      • getUserRealmRoles

        List<String> getUserRealmRoles​(String id)
        Returns all realm roles granted for a user with the given id.
        Parameters:
        id - the user id. It can be the id, username or email
        Returns:
        the roles granted to the user

      • getUserClientRoles

        List<String> getUserClientRoles​(String id,
                                String clientId)
        Returns all client roles granted for a user with the given id.
        Parameters:
        id - the user id. It can be the id, username or email
        clientId - the client id
        Returns:
        the roles granted to the user

      • getUserGroups

        List<String> getUserGroups​(String id)
        Returns all groups which the user with the given id is a member.
        Parameters:
        id - the user id. It can be the id, username or email
        Returns:
        the groups which the user is a member

      • getUserAttributes

        Map<String,​List<String>> getUserAttributes​(String id)
        Returns all attributes associated with the a user with the given id.
        Parameters:
        id - the user id. It can be the id, username or email
        Returns:
        a map with the attributes associated with the user