Package org.keycloak.utils

Class RoleResolveUtil

java.lang.Object

org.keycloak.utils.RoleResolveUtil

public class RoleResolveUtil
extends Object

Helper class to ensure that all the user's permitted roles (including composite roles) are loaded just once per request. Then all underlying protocolMappers can consume them.

Author:

Marek Posolda

Constructor Summary

Constructors

Constructor	Description
RoleResolveUtil()

Method Summary

Modifier and Type	Method	Description
static Map<String,AccessToken.Access>	getAllResolvedClientRoles(KeycloakSession session, ClientSessionContext clientSessionCtx)	Object (but can be empty map) containing all the user's client roles of all clients.
static AccessToken.Access	getResolvedClientRoles(KeycloakSession session, ClientSessionContext clientSessionCtx, String clientId, boolean createIfMissing)	Object (possibly null) containing all the user's client roles of client specified by clientId.
static AccessToken.Access	getResolvedRealmRoles(KeycloakSession session, ClientSessionContext clientSessionCtx, boolean createIfMissing)	Object (possibly null) containing all the user's realm roles.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

RoleResolveUtil

public RoleResolveUtil()

Method Detail

getResolvedRealmRoles

public static AccessToken.Access getResolvedRealmRoles(KeycloakSession session,
                                                       ClientSessionContext clientSessionCtx,
                                                       boolean createIfMissing)

Object (possibly null) containing all the user's realm roles. Including user's groups roles. Composite roles are expanded. Just the roles, which current client has role-scope-mapping for (or it's clientScopes) are included. Current client means the client corresponding to specified clientSessionCtx.

Parameters:

session -

clientSessionCtx -

createIfMissing -

Returns:

can return null (just in case that createIfMissing is false)

getResolvedClientRoles

public static AccessToken.Access getResolvedClientRoles(KeycloakSession session,
                                                        ClientSessionContext clientSessionCtx,
                                                        String clientId,
                                                        boolean createIfMissing)

Object (possibly null) containing all the user's client roles of client specified by clientId. Including user's groups roles. Composite roles are expanded. Just the roles, which current client has role-scope-mapping for (or it's clientScopes) are included. Current client means the client corresponding to specified clientSessionCtx.

Parameters:

session -

clientSessionCtx -

clientId -

createIfMissing -

Returns:

can return null (just in case that createIfMissing is false)

getAllResolvedClientRoles

public static Map<String,AccessToken.Access> getAllResolvedClientRoles(KeycloakSession session,
                                                                             ClientSessionContext clientSessionCtx)

Object (but can be empty map) containing all the user's client roles of all clients. Including user's groups roles. Composite roles are expanded. Just the roles, which current client has role-scope-mapping for (or it's clientScopes) are included. Current client means the client corresponding to specified clientSessionCtx.

Parameters:

session -

clientSessionCtx -

Returns:

not-null object (can return empty map)