Package org.keycloak.authorization

Class AdminPermissionsSchema

java.lang.Object

org.keycloak.representations.idm.authorization.AuthorizationSchema

org.keycloak.authorization.AdminPermissionsSchema

public class AdminPermissionsSchema
extends AuthorizationSchema

Nested Class Summary

Nested classes/interfaces inherited from class org.keycloak.representations.idm.authorization.AuthorizationSchema

AuthorizationSchema.ResourceTypeDeserializer

Field Summary

Fields

Modifier and Type	Field	Description
static final ResourceType	CLIENTS
static final String	CLIENTS_RESOURCE_TYPE
static final ResourceType	GROUPS
static final String	GROUPS_RESOURCE_TYPE
static final String	IMPERSONATE
static final String	IMPERSONATE_MEMBERS
static final String	MANAGE
static final String	MANAGE_GROUP_MEMBERSHIP
static final String	MANAGE_MEMBERS
static final String	MANAGE_MEMBERSHIP
static final String	MAP_ROLE
static final String	MAP_ROLE_CLIENT_SCOPE
static final String	MAP_ROLE_COMPOSITE
static final String	MAP_ROLES
static final String	MAP_ROLES_CLIENT_SCOPE
static final String	MAP_ROLES_COMPOSITE
static final ResourceType	ROLES
static final String	ROLES_RESOURCE_TYPE
static final AdminPermissionsSchema	SCHEMA
static final ResourceType	USERS
static final String	USERS_RESOURCE_TYPE
static final String	VIEW
static final String	VIEW_MEMBERS

Method Summary

Modifier and Type	Method	Description
void	addUResourceTypeResource(KeycloakSession session, ResourceServer resourceServer, Policy policy, String resourceType)
List<jakarta.persistence.criteria.Predicate>	applyAuthorizationFilters(KeycloakSession session, ResourceType resourceType, PartialEvaluationStorageProvider evaluator, RealmModel realm, jakarta.persistence.criteria.CriteriaBuilder builder, jakarta.persistence.criteria.CriteriaQuery<?> queryBuilder, jakarta.persistence.criteria.Path<?> path)
List<jakarta.persistence.criteria.Predicate>	applyAuthorizationFilters(KeycloakSession session, ResourceType resourceType, RealmModel realm, jakarta.persistence.criteria.CriteriaBuilder builder, jakarta.persistence.criteria.CriteriaQuery<?> queryBuilder, jakarta.persistence.criteria.Path<?> path)
AuthorizationSchema	getAuthorizationSchema(ClientModel client)
Resource	getOrCreateResource(KeycloakSession session, ResourceServer resourceServer, String policyType, String resourceType, String id)
PolicyEvaluator	getPolicyEvaluator(KeycloakSession session, ResourceServer resourceServer)
String	getResourceName(KeycloakSession session, Policy policy, Resource resource)
String	getResourceName(KeycloakSession session, ResourceServer resourceServer, String resourceType, String resourceName)
Resource	getResourceTypeResource(KeycloakSession session, ResourceServer resourceServer, String resourceType)
Scope	getScope(KeycloakSession session, ResourceServer resourceServer, String resourceType, String id)
Set<String>	getScopeAliases(String resourceType, Scope scope)
void	init(KeycloakSession session, RealmModel realm)
boolean	isAdminPermissionClient(RealmModel realm, String id)
boolean	isAdminPermissionsEnabled(RealmModel realm)
static boolean	isSkipEvaluation(KeycloakSession session)	Returns if authorization is disabled in the context of the given session at the moment that this method is called.
boolean	isSupportedPolicyType(KeycloakSession session, ResourceServer resourceServer, String type)
void	removeOrphanResources(Policy policy, AuthorizationProvider authorization)
void	removeResource(Resource resource, Policy policy, AuthorizationProvider authorization)
void	removeResourceObject(AuthorizationProvider authorization, ProviderEvent event)
static void	runWithoutAuthorization(KeycloakSession session, Runnable runnable)	Disables authorization and evaluation of permissions for realm resource types when executing the given runnable in the context of the given session.
void	throwExceptionIfAdminPermissionClient(KeycloakSession session, String id)
void	throwExceptionIfResourceTypeOrScopesNotProvided(KeycloakSession session, ResourceServer resourceServer, AbstractPolicyRepresentation rep)

Methods inherited from class org.keycloak.representations.idm.authorization.AuthorizationSchema

getResourceTypes

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

CLIENTS_RESOURCE_TYPE

public static final String CLIENTS_RESOURCE_TYPE

See Also:

• Constant Field Values

GROUPS_RESOURCE_TYPE

public static final String GROUPS_RESOURCE_TYPE

See Also:

• Constant Field Values

ROLES_RESOURCE_TYPE

public static final String ROLES_RESOURCE_TYPE

See Also:

• Constant Field Values

USERS_RESOURCE_TYPE

public static final String USERS_RESOURCE_TYPE

See Also:

• Constant Field Values

MANAGE

public static final String MANAGE

See Also:

• Constant Field Values

VIEW

public static final String VIEW

See Also:

• Constant Field Values

MAP_ROLES

public static final String MAP_ROLES

See Also:

• Constant Field Values

MAP_ROLES_CLIENT_SCOPE

public static final String MAP_ROLES_CLIENT_SCOPE

See Also:

• Constant Field Values

MAP_ROLES_COMPOSITE

public static final String MAP_ROLES_COMPOSITE

See Also:

• Constant Field Values

MANAGE_MEMBERSHIP

public static final String MANAGE_MEMBERSHIP

See Also:

• Constant Field Values

MANAGE_MEMBERS

public static final String MANAGE_MEMBERS

See Also:

• Constant Field Values

VIEW_MEMBERS

public static final String VIEW_MEMBERS

See Also:

• Constant Field Values

IMPERSONATE_MEMBERS

public static final String IMPERSONATE_MEMBERS

See Also:

• Constant Field Values

MAP_ROLE

public static final String MAP_ROLE

See Also:

• Constant Field Values

MAP_ROLE_CLIENT_SCOPE

public static final String MAP_ROLE_CLIENT_SCOPE

See Also:

• Constant Field Values

MAP_ROLE_COMPOSITE

public static final String MAP_ROLE_COMPOSITE

See Also:

• Constant Field Values

IMPERSONATE

public static final String IMPERSONATE

See Also:

• Constant Field Values

MANAGE_GROUP_MEMBERSHIP

public static final String MANAGE_GROUP_MEMBERSHIP

See Also:

• Constant Field Values

CLIENTS

public static final ResourceType CLIENTS

GROUPS

public static final ResourceType GROUPS

ROLES

public static final ResourceType ROLES

USERS

public static final ResourceType USERS

SCHEMA

public static final AdminPermissionsSchema SCHEMA

Method Details

getOrCreateResource

public Resource getOrCreateResource(KeycloakSession session,
 ResourceServer resourceServer,
 String policyType,
 String resourceType,
 String id)

getResourceTypeResource

public Resource getResourceTypeResource(KeycloakSession session,
 ResourceServer resourceServer,
 String resourceType)

isSupportedPolicyType

public boolean isSupportedPolicyType(KeycloakSession session,
 ResourceServer resourceServer,
 String type)

isAdminPermissionClient

public boolean isAdminPermissionClient(RealmModel realm,
 String id)

throwExceptionIfAdminPermissionClient

public void throwExceptionIfAdminPermissionClient(KeycloakSession session,
 String id)

throwExceptionIfResourceTypeOrScopesNotProvided

public void throwExceptionIfResourceTypeOrScopesNotProvided(KeycloakSession session,
 ResourceServer resourceServer,
 AbstractPolicyRepresentation rep)

getScope

public Scope getScope(KeycloakSession session,
 ResourceServer resourceServer,
 String resourceType,
 String id)

init

public void init(KeycloakSession session,
 RealmModel realm)

isAdminPermissionsEnabled

public boolean isAdminPermissionsEnabled(RealmModel realm)

getAuthorizationSchema

public AuthorizationSchema getAuthorizationSchema(ClientModel client)

removeResource

public void removeResource(Resource resource,
 Policy policy,
 AuthorizationProvider authorization)

removeOrphanResources

public void removeOrphanResources(Policy policy,
 AuthorizationProvider authorization)

getResourceName

public String getResourceName(KeycloakSession session,
 Policy policy,
 Resource resource)

getResourceName

public String getResourceName(KeycloakSession session,
 ResourceServer resourceServer,
 String resourceType,
 String resourceName)

addUResourceTypeResource

public void addUResourceTypeResource(KeycloakSession session,
 ResourceServer resourceServer,
 Policy policy,
 String resourceType)

removeResourceObject

public void removeResourceObject(AuthorizationProvider authorization,
 ProviderEvent event)

applyAuthorizationFilters

public List<jakarta.persistence.criteria.Predicate> applyAuthorizationFilters(KeycloakSession session,
 ResourceType resourceType,
 RealmModel realm,
 jakarta.persistence.criteria.CriteriaBuilder builder,
 jakarta.persistence.criteria.CriteriaQuery<?> queryBuilder,
 jakarta.persistence.criteria.Path<?> path)

applyAuthorizationFilters

public List<jakarta.persistence.criteria.Predicate> applyAuthorizationFilters(KeycloakSession session,
 ResourceType resourceType,
 PartialEvaluationStorageProvider evaluator,
 RealmModel realm,
 jakarta.persistence.criteria.CriteriaBuilder builder,
 jakarta.persistence.criteria.CriteriaQuery<?> queryBuilder,
 jakarta.persistence.criteria.Path<?> path)

getPolicyEvaluator

public PolicyEvaluator getPolicyEvaluator(KeycloakSession session,
 ResourceServer resourceServer)

getScopeAliases

public Set<String> getScopeAliases(String resourceType,
 Scope scope)

runWithoutAuthorization

public static void runWithoutAuthorization(KeycloakSession session,
 Runnable runnable)

Disables authorization and evaluation of permissions for realm resource types when executing the given runnable in the context of the given session.

This method should be used whenever a code block should be executed without any evaluation or filtering based on the permissions set to a realm. For instance, when caching realm resources where access enforcement does not apply.

Parameters:

session - the session. If null, authorization is enabled when executing the code block

runnable - the runnable to execute

isSkipEvaluation

public static boolean isSkipEvaluation(KeycloakSession session)

Returns if authorization is disabled in the context of the given session at the moment that this method is called.

Parameters:

session - the session

Returns:

true if authorization is disabled. Otherwise, returns false. Otherwise, false.

See Also:

• runWithoutAuthorization(KeycloakSession, Runnable)