Package org.keycloak.models

Interface Permissions

All Known Implementing Classes:
DefaultPermissions
public interface Permissions
A permissions evaluator that can be used to check if the current user has permissions to perform an action on realm resources.

  • Method Summary

    Modifier and Type
    Method
    Description
    boolean
    hasPermission(String resourceType, String scope)
    Returns true if the current user has permissions to perform an action on realm resources with the given resourceType and with the given scope.
    boolean
    hasPermission(Model model, String resourceType, String scope)
    Returns true if the current user has permissions to perform an action on a realm resource type with the given scope
    boolean
    isAdminGroup(GroupModel group)
    Returns true if the given group has any admin role assigned, either directly, via parent groups, or via composite roles.
    boolean
    isAdminUser(UserModel user)
    Returns true if the given user has any admin role assigned, either directly, via group membership, or via composite roles.

  • Method Details

    • hasPermission

      boolean hasPermission(String resourceType, String scope)
      Returns true if the current user has permissions to perform an action on realm resources with the given resourceType and with the given scope.
      Parameters:
      resourceType - the realm resource type
      scope - the scope
      Returns:
      true if the current user has permissions to perform an action on a realm resource type with the given scope, false otherwise

    • hasPermission

      boolean hasPermission(Model model, String resourceType, String scope)
      Returns true if the current user has permissions to perform an action on a realm resource type with the given scope
      Parameters:
      resourceType - the realm resource type
      scope - the scope
      Returns:
      true if the current user has permissions to perform an action on a realm resource type with the given scope, false otherwise

    • isAdminUser

      boolean isAdminUser(UserModel user)
      Returns true if the given user has any admin role assigned, either directly, via group membership, or via composite roles.
      Parameters:
      user - the user to check
      Returns:
      true if the user has any admin role, false otherwise

    • isAdminGroup

      boolean isAdminGroup(GroupModel group)
      Returns true if the given group has any admin role assigned, either directly, via parent groups, or via composite roles.
      Parameters:
      group - the group to check
      Returns:
      true if the group has any admin role, false otherwise