Package org.keycloak.services.resources.admin.permissions

Interface RolePermissionEvaluator

All Known Implementing Classes:

RolePermissionsV2

public interface RolePermissionEvaluator

Version:

$Revision: 1 $

Author:

Bill Burke

Method Summary

Modifier and Type	Method	Description
boolean	canList(RoleContainerModel container)	Returns true if canView(RoleContainerModel) returns true.
boolean	canManage(RoleContainerModel container)	If the role is a realm role, it returns true if RealmPermissionEvaluator.canManageRealm() returns true.
boolean	canManage(RoleModel role)	If the role is a realm role, it returns true if RealmPermissionEvaluator.canManageRealm() returns true.
boolean	canMapClientScope(RoleModel role)	Returns true if ClientPermissions.canManageClientsDefault() returns true.
boolean	canMapComposite(RoleModel role)	Returns true if RolePermissions.canManageDefault(RoleModel) and RolePermissions.checkAdminRoles(RoleModel) returns true.
boolean	canMapRole(RoleModel role)	Returns true if the caller has AdminRoles.MANAGE_USERS role and RolePermissions.checkAdminRoles(RoleModel) returns true.
boolean	canView(RoleContainerModel container)	If the role is a realm role, it returns true if RealmPermissionEvaluator.canViewRealm() returns true.
boolean	canView(RoleModel role)	If the role is a realm role, it returns true if RealmPermissionEvaluator.canViewRealm() returns true.
Set<String>	getRoleIdsByScope(String scope)	Returns the IDs of the roles that the current user can perform based on scope.
void	requireList(RoleContainerModel container)	Throws ForbiddenException if canList(RoleContainerModel) returns false.
void	requireManage(RoleContainerModel container)	Throws ForbiddenException if canManage(RoleContainerModel) returns false.
void	requireManage(RoleModel role)	Throws ForbiddenException if canManage(RoleModel) returns false.
void	requireMapClientScope(RoleModel role)	Throws ForbiddenException if canMapClientScope(RoleModel) returns false.
void	requireMapComposite(RoleModel role)	Throws ForbiddenException if canMapComposite(RoleModel) returns false.
void	requireMapRole(RoleModel role)	Throws ForbiddenException if canMapRole(RoleModel) returns false.
void	requireView(RoleContainerModel container)	Throws ForbiddenException if canView(RoleContainerModel) returns false.
void	requireView(RoleModel role)	Throws ForbiddenException if canView(RoleModel) returns false.

Method Details

canList

boolean canList(RoleContainerModel container)

Returns true if canView(RoleContainerModel) returns true.

Or if the role is a realm role, then it returns true if RealmPermissionEvaluator.canViewRealm() returns true or if the caller has at least one of the AdminRoles.QUERY_USERS, AdminRoles.QUERY_USERS, AdminRoles.QUERY_CLIENTS, AdminRoles.QUERY_REALMS, AdminRoles.QUERY_GROUPS roles.

requireList

void requireList(RoleContainerModel container)

Throws ForbiddenException if canList(RoleContainerModel) returns false.

canMapRole

boolean canMapRole(RoleModel role)

Returns true if the caller has AdminRoles.MANAGE_USERS role and RolePermissions.checkAdminRoles(RoleModel) returns true.

Or if the role is a client role and ClientPermissionEvaluator.canMapRoles(ClientModel) returns true.

Or if the caller has permission to RolePermissionManagement.MAP_ROLE_SCOPE and RolePermissions.checkAdminRoles(RoleModel) returns true.

For V2 only: Also if the caller has a permission to RolePermissionManagement.MAP_ROLE_SCOPE all roles.

requireMapRole

void requireMapRole(RoleModel role)

Throws ForbiddenException if canMapRole(RoleModel) returns false.

canManage

boolean canManage(RoleModel role)

If the role is a realm role, it returns true if RealmPermissionEvaluator.canManageRealm() returns true.

If the role is a client role, it returns true if ClientPermissionEvaluator.canConfigure(ClientModel) returns true.

requireManage

void requireManage(RoleModel role)

Throws ForbiddenException if canManage(RoleModel) returns false.

canView

boolean canView(RoleModel role)

If the role is a realm role, it returns true if RealmPermissionEvaluator.canViewRealm() returns true.

If the role is a client role, it returns true if ClientPermissionEvaluator.canView(ClientModel) returns true.

requireView

void requireView(RoleModel role)

Throws ForbiddenException if canView(RoleModel) returns false.

canMapClientScope

boolean canMapClientScope(RoleModel role)

Returns true if ClientPermissions.canManageClientsDefault() returns true.

Or if the role is a client role and ClientPermissionEvaluator.canMapClientScopeRoles(ClientModel) returns true.

Or if the caller has permission to RolePermissionManagement.MAP_ROLE_CLIENT_SCOPE_SCOPE.

For V2 only: Also if the caller has a permission to RolePermissionManagement.MAP_ROLE_CLIENT_SCOPE_SCOPE all roles.

requireMapClientScope

void requireMapClientScope(RoleModel role)

Throws ForbiddenException if canMapClientScope(RoleModel) returns false.

canMapComposite

boolean canMapComposite(RoleModel role)

Returns true if RolePermissions.canManageDefault(RoleModel) and RolePermissions.checkAdminRoles(RoleModel) returns true.

Or if the role is a client role and ClientPermissionEvaluator.canMapCompositeRoles(ClientModel) returns true.

Or if the caller has permission to RolePermissionManagement.MAP_ROLE_COMPOSITE_SCOPE and RolePermissions.checkAdminRoles(RoleModel) returns true.

For V2 only: Also if the caller has a permission to RolePermissionManagement.MAP_ROLE_COMPOSITE_SCOPE all roles.

requireMapComposite

void requireMapComposite(RoleModel role)

Throws ForbiddenException if canMapComposite(RoleModel) returns false.

canManage

boolean canManage(RoleContainerModel container)

If the role is a realm role, it returns true if RealmPermissionEvaluator.canManageRealm() returns true.

If the role is a client role, it returns true if ClientPermissionEvaluator.canConfigure(ClientModel) returns true.

requireManage

void requireManage(RoleContainerModel container)

Throws ForbiddenException if canManage(RoleContainerModel) returns false.

canView

boolean canView(RoleContainerModel container)

If the role is a realm role, it returns true if RealmPermissionEvaluator.canViewRealm() returns true.

If the role is a client role, it returns true if ClientPermissionEvaluator.canView(ClientModel) returns true.

requireView

void requireView(RoleContainerModel container)

Throws ForbiddenException if canView(RoleContainerModel) returns false.

getRoleIdsByScope

Set<String> getRoleIdsByScope(String scope)

Returns the IDs of the roles that the current user can perform based on scope.

Returns:

Stream of IDs of roles with scope permission.