Package org.keycloak.services.resources.admin.permissions

Class RolePermissionsV2

java.lang.Object

org.keycloak.services.resources.admin.permissions.RolePermissionsV2

All Implemented Interfaces:

RolePermissionEvaluator, RolePermissionManagement

public class RolePermissionsV2
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
protected final AuthorizationProvider	authz
protected final PolicyStore	policyStore
protected final RealmModel	realm
protected final ResourceStore	resourceStore
protected final org.keycloak.services.resources.admin.permissions.MgmtPermissions	root
protected final KeycloakSession	session

Fields inherited from interface org.keycloak.services.resources.admin.permissions.RolePermissionManagement

MAP_ROLE_CLIENT_SCOPE_SCOPE, MAP_ROLE_COMPOSITE_SCOPE, MAP_ROLE_SCOPE

Method Summary

Modifier and Type	Method	Description
boolean	canList(RoleContainerModel container)	Returns true if RolePermissionEvaluator.canView(RoleContainerModel) returns true.
boolean	canManage(RoleContainerModel container)	If the role is a realm role, it returns true if RealmPermissionEvaluator.canManageRealm() returns true.
boolean	canManage(RoleModel role)	If the role is a realm role, it returns true if RealmPermissionEvaluator.canManageRealm() returns true.
boolean	canManageDefault(RoleModel role)
boolean	canMapClientScope(RoleModel role)	Returns true if ClientPermissions.canManageClientsDefault() returns true.
boolean	canMapComposite(RoleModel role)	Returns true if RolePermissions.canManageDefault(RoleModel) and RolePermissions.checkAdminRoles(RoleModel) returns true.
boolean	canMapRole(RoleModel role)	Is admin allowed to map this role?
boolean	canView(RoleContainerModel container)	If the role is a realm role, it returns true if RealmPermissionEvaluator.canViewRealm() returns true.
boolean	canView(RoleModel role)	If the role is a realm role, it returns true if RealmPermissionEvaluator.canViewRealm() returns true.
Map<String,String>	getPermissions(RoleModel role)
Set<String>	getRoleIdsByScope(String scope)	Returns the IDs of the roles that the current user can perform based on scope.
boolean	isPermissionsEnabled(RoleModel role)
Policy	manageUsersPolicy(ResourceServer server)
Policy	mapClientScopePermission(RoleModel role)
Policy	mapCompositePermission(RoleModel role)
Policy	mapRolePermission(RoleModel role)
void	requireList(RoleContainerModel container)	Throws ForbiddenException if RolePermissionEvaluator.canList(RoleContainerModel) returns false.
void	requireManage(RoleContainerModel container)	Throws ForbiddenException if RolePermissionEvaluator.canManage(RoleContainerModel) returns false.
void	requireManage(RoleModel role)	Throws ForbiddenException if RolePermissionEvaluator.canManage(RoleModel) returns false.
void	requireMapClientScope(RoleModel role)	Throws ForbiddenException if RolePermissionEvaluator.canMapClientScope(RoleModel) returns false.
void	requireMapComposite(RoleModel role)	Throws ForbiddenException if RolePermissionEvaluator.canMapComposite(RoleModel) returns false.
void	requireMapRole(RoleModel role)	Throws ForbiddenException if RolePermissionEvaluator.canMapRole(RoleModel) returns false.
void	requireView(RoleContainerModel container)	Throws ForbiddenException if RolePermissionEvaluator.canView(RoleContainerModel) returns false.
void	requireView(RoleModel role)	Throws ForbiddenException if RolePermissionEvaluator.canView(RoleModel) returns false.
Resource	resource(RoleModel role)
ResourceServer	resourceServer(RoleModel role)
Policy	rolePolicy(ResourceServer server, RoleModel role)
void	setPermissionsEnabled(RoleModel role, boolean enable)
Policy	viewUsersPolicy(ResourceServer server)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

session

protected final KeycloakSession session

realm

protected final RealmModel realm

authz

protected final AuthorizationProvider authz

root

protected final org.keycloak.services.resources.admin.permissions.MgmtPermissions root

resourceStore

protected final ResourceStore resourceStore

policyStore

protected final PolicyStore policyStore

Method Details

canMapClientScope

public boolean canMapClientScope(RoleModel role)

Description copied from interface: RolePermissionEvaluator

Returns true if ClientPermissions.canManageClientsDefault() returns true.

Or if the role is a client role and ClientPermissionEvaluator.canMapClientScopeRoles(ClientModel) returns true.

Or if the caller has permission to RolePermissionManagement.MAP_ROLE_CLIENT_SCOPE_SCOPE.

For V2 only: Also if the caller has a permission to RolePermissionManagement.MAP_ROLE_CLIENT_SCOPE_SCOPE all roles.

Specified by:

canMapClientScope in interface RolePermissionEvaluator

canMapComposite

public boolean canMapComposite(RoleModel role)

Description copied from interface: RolePermissionEvaluator

Returns true if RolePermissions.canManageDefault(RoleModel) and RolePermissions.checkAdminRoles(RoleModel) returns true.

Or if the role is a client role and ClientPermissionEvaluator.canMapCompositeRoles(ClientModel) returns true.

Or if the caller has permission to RolePermissionManagement.MAP_ROLE_COMPOSITE_SCOPE and RolePermissions.checkAdminRoles(RoleModel) returns true.

For V2 only: Also if the caller has a permission to RolePermissionManagement.MAP_ROLE_COMPOSITE_SCOPE all roles.

Specified by:

canMapComposite in interface RolePermissionEvaluator

canMapRole

public boolean canMapRole(RoleModel role)

Is admin allowed to map this role?

Specified by:

canMapRole in interface RolePermissionEvaluator

getRoleIdsByScope

public Set<String> getRoleIdsByScope(String scope)

Description copied from interface: RolePermissionEvaluator

Returns the IDs of the roles that the current user can perform based on scope.

Specified by:

getRoleIdsByScope in interface RolePermissionEvaluator

Returns:

Stream of IDs of roles with scope permission.

isPermissionsEnabled

public boolean isPermissionsEnabled(RoleModel role)

Specified by:

isPermissionsEnabled in interface RolePermissionManagement

setPermissionsEnabled

public void setPermissionsEnabled(RoleModel role,
 boolean enable)

Specified by:

setPermissionsEnabled in interface RolePermissionManagement

getPermissions

public Map<String,String> getPermissions(RoleModel role)

Specified by:

getPermissions in interface RolePermissionManagement

mapRolePermission

public Policy mapRolePermission(RoleModel role)

Specified by:

mapRolePermission in interface RolePermissionManagement

mapCompositePermission

public Policy mapCompositePermission(RoleModel role)

Specified by:

mapCompositePermission in interface RolePermissionManagement

mapClientScopePermission

public Policy mapClientScopePermission(RoleModel role)

Specified by:

mapClientScopePermission in interface RolePermissionManagement

resource

public Resource resource(RoleModel role)

Specified by:

resource in interface RolePermissionManagement

resourceServer

public ResourceServer resourceServer(RoleModel role)

Specified by:

resourceServer in interface RolePermissionManagement

manageUsersPolicy

public Policy manageUsersPolicy(ResourceServer server)

Specified by:

manageUsersPolicy in interface RolePermissionManagement

viewUsersPolicy

public Policy viewUsersPolicy(ResourceServer server)

Specified by:

viewUsersPolicy in interface RolePermissionManagement

rolePolicy

public Policy rolePolicy(ResourceServer server,
 RoleModel role)

Specified by:

rolePolicy in interface RolePermissionManagement

requireMapRole

public void requireMapRole(RoleModel role)

Description copied from interface: RolePermissionEvaluator

Throws ForbiddenException if RolePermissionEvaluator.canMapRole(RoleModel) returns false.

Specified by:

requireMapRole in interface RolePermissionEvaluator

canList

public boolean canList(RoleContainerModel container)

Description copied from interface: RolePermissionEvaluator

Returns true if RolePermissionEvaluator.canView(RoleContainerModel) returns true.

Or if the role is a realm role, then it returns true if RealmPermissionEvaluator.canViewRealm() returns true or if the caller has at least one of the AdminRoles.QUERY_USERS, AdminRoles.QUERY_USERS, AdminRoles.QUERY_CLIENTS, AdminRoles.QUERY_REALMS, AdminRoles.QUERY_GROUPS roles.

Specified by:

canList in interface RolePermissionEvaluator

requireList

public void requireList(RoleContainerModel container)

Description copied from interface: RolePermissionEvaluator

Throws ForbiddenException if RolePermissionEvaluator.canList(RoleContainerModel) returns false.

Specified by:

requireList in interface RolePermissionEvaluator

canManage

public boolean canManage(RoleContainerModel container)

Description copied from interface: RolePermissionEvaluator

If the role is a realm role, it returns true if RealmPermissionEvaluator.canManageRealm() returns true.

If the role is a client role, it returns true if ClientPermissionEvaluator.canConfigure(ClientModel) returns true.

Specified by:

canManage in interface RolePermissionEvaluator

requireManage

public void requireManage(RoleContainerModel container)

Description copied from interface: RolePermissionEvaluator

Throws ForbiddenException if RolePermissionEvaluator.canManage(RoleContainerModel) returns false.

Specified by:

requireManage in interface RolePermissionEvaluator

canView

public boolean canView(RoleContainerModel container)

Description copied from interface: RolePermissionEvaluator

If the role is a realm role, it returns true if RealmPermissionEvaluator.canViewRealm() returns true.

If the role is a client role, it returns true if ClientPermissionEvaluator.canView(ClientModel) returns true.

Specified by:

canView in interface RolePermissionEvaluator

requireView

public void requireView(RoleContainerModel container)

Description copied from interface: RolePermissionEvaluator

Throws ForbiddenException if RolePermissionEvaluator.canView(RoleContainerModel) returns false.

Specified by:

requireView in interface RolePermissionEvaluator

requireMapComposite

public void requireMapComposite(RoleModel role)

Description copied from interface: RolePermissionEvaluator

Throws ForbiddenException if RolePermissionEvaluator.canMapComposite(RoleModel) returns false.

Specified by:

requireMapComposite in interface RolePermissionEvaluator

requireMapClientScope

public void requireMapClientScope(RoleModel role)

Description copied from interface: RolePermissionEvaluator

Throws ForbiddenException if RolePermissionEvaluator.canMapClientScope(RoleModel) returns false.

Specified by:

requireMapClientScope in interface RolePermissionEvaluator

canManage

public boolean canManage(RoleModel role)

Description copied from interface: RolePermissionEvaluator

If the role is a realm role, it returns true if RealmPermissionEvaluator.canManageRealm() returns true.

If the role is a client role, it returns true if ClientPermissionEvaluator.canConfigure(ClientModel) returns true.

Specified by:

canManage in interface RolePermissionEvaluator

canManageDefault

public boolean canManageDefault(RoleModel role)

requireManage

public void requireManage(RoleModel role)

Description copied from interface: RolePermissionEvaluator

Throws ForbiddenException if RolePermissionEvaluator.canManage(RoleModel) returns false.

Specified by:

requireManage in interface RolePermissionEvaluator

canView

public boolean canView(RoleModel role)

Description copied from interface: RolePermissionEvaluator

If the role is a realm role, it returns true if RealmPermissionEvaluator.canViewRealm() returns true.

If the role is a client role, it returns true if ClientPermissionEvaluator.canView(ClientModel) returns true.

Specified by:

canView in interface RolePermissionEvaluator

requireView

public void requireView(RoleModel role)

Description copied from interface: RolePermissionEvaluator

Throws ForbiddenException if RolePermissionEvaluator.canView(RoleModel) returns false.

Specified by:

requireView in interface RolePermissionEvaluator