Package org.keycloak.services.resources.admin.permissions

Class ClientPermissionsV2

java.lang.Object

org.keycloak.services.resources.admin.permissions.ClientPermissionsV2

All Implemented Interfaces:

ClientPermissionEvaluator, ClientPermissionManagement

public class ClientPermissionsV2
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
protected final AuthorizationProvider	authz
protected final RealmModel	realm
protected final ResourceStore	resourceStore
protected final org.keycloak.services.resources.admin.permissions.MgmtPermissions	root
protected final KeycloakSession	session

Fields inherited from interface org.keycloak.services.resources.admin.permissions.ClientPermissionManagement

CONFIGURE_SCOPE, MAP_ROLES_CLIENT_SCOPE, MAP_ROLES_COMPOSITE_SCOPE, MAP_ROLES_SCOPE

Constructor Summary

Constructors

Constructor	Description
ClientPermissionsV2(KeycloakSession session, RealmModel realm, AuthorizationProvider authz, org.keycloak.services.resources.admin.permissions.MgmtPermissionsV2 root)

Method Summary

Modifier and Type	Method	Description
boolean	canConfigure(ClientModel client)	Returns true if ClientPermissionEvaluator.canManage(ClientModel) returns true.
boolean	canExchangeTo(ClientModel authorizedClient, ClientModel client)
boolean	canExchangeTo(ClientModel authorizedClient, ClientModel to, AccessToken token)
boolean	canList()	Returns true if ClientPermissionEvaluator.canView() returns true.
boolean	canList(ClientModel clientModel)
boolean	canListClientScopes()	Returns true if ClientPermissionEvaluator.canView() returns true.
boolean	canManage()	Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.
boolean	canManage(ClientModel client)	Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.
boolean	canManage(ClientScopeModel clientScope)	Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.
boolean	canManageClientScopes()	Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.
boolean	canManageClientsDefault()
boolean	canMapClientScopeRoles(ClientModel client)	Returns true if the caller has a permission to ClientPermissionManagement.MAP_ROLES_CLIENT_SCOPE for the client.
boolean	canMapCompositeRoles(ClientModel client)	Returns true if the caller has a permission to ClientPermissionManagement.MAP_ROLES_COMPOSITE_SCOPE for the client.
boolean	canMapRoles(ClientModel client)	Returns true if the caller has a permission to ClientPermissionManagement.MAP_ROLES_SCOPE for the client.
boolean	canView()	Returns true if the caller has at least one of the AdminRoles.MANAGE_CLIENTS or AdminRoles.VIEW_CLIENTS roles.
boolean	canView(ClientModel client)	Returns true if ClientPermissionEvaluator.canView() or ClientPermissionEvaluator.canConfigure(ClientModel) returns true.
boolean	canView(ClientScopeModel clientScope)	Returns true if the caller has at least one of the AdminRoles.VIEW_CLIENTS or AdminRoles.MANAGE_CLIENTS roles.
boolean	canViewClientDefault()
boolean	canViewClientScopes()	Returns true if ClientPermissionEvaluator.canView() returns true.
Policy	configurePermission(ClientModel client)
Policy	exchangeToPermission(ClientModel client)
Map<String,Boolean>	getAccess(ClientModel client)
Set<String>	getClientsWithPermission(String scope)
Map<String,String>	getPermissions(ClientModel client)
boolean	isPermissionsEnabled(ClientModel client)
Policy	managePermission(ClientModel client)
Policy	mapRolesClientScopePermission(ClientModel client)
Policy	mapRolesCompositePermission(ClientModel client)
Policy	mapRolesPermission(ClientModel client)
void	requireConfigure(ClientModel client)	Throws ForbiddenException if ClientPermissionEvaluator.canConfigure(ClientModel) returns false.
void	requireList()	Throws ForbiddenException if ClientPermissionEvaluator.canList() returns false.
void	requireListClientScopes()	Throws ForbiddenException if ClientPermissionEvaluator.canListClientScopes() returns false.
void	requireManage()	Throws ForbiddenException if ClientPermissionEvaluator.canManage() returns false.
void	requireManage(ClientModel client)	Throws ForbiddenException if ClientPermissionEvaluator.canManage(ClientModel) returns false.
void	requireManage(ClientScopeModel clientScope)	Throws ForbiddenException if ClientPermissionEvaluator.canManage(ClientScopeModel) returns false.
void	requireManageClientScopes()	Throws ForbiddenException if ClientPermissionEvaluator.canManageClientScopes() returns false.
void	requireView()	Returns true if ClientPermissionEvaluator.canView() returns true.
void	requireView(ClientModel client)	Throws ForbiddenException if ClientPermissionEvaluator.canView(ClientModel) returns false.
void	requireView(ClientScopeModel clientScope)	Throws ForbiddenException if ClientPermissionEvaluator.canView(ClientScopeModel) returns false.
void	requireViewClientScopes()	Returns true if ClientPermissionEvaluator.canViewClientScopes() returns true.
Resource	resource(ClientModel client)
ResourceServer	resourceServer(ClientModel client)
void	setPermissionsEnabled(ClientModel client, boolean enable)
Policy	viewPermission(ClientModel client)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

session

protected final KeycloakSession session

realm

protected final RealmModel realm

authz

protected final AuthorizationProvider authz

root

protected final org.keycloak.services.resources.admin.permissions.MgmtPermissions root

resourceStore

protected final ResourceStore resourceStore

Constructor Details

ClientPermissionsV2

public ClientPermissionsV2(KeycloakSession session,
 RealmModel realm,
 AuthorizationProvider authz,
 org.keycloak.services.resources.admin.permissions.MgmtPermissionsV2 root)

Method Details

canConfigure

public boolean canConfigure(ClientModel client)

Description copied from interface: ClientPermissionEvaluator

Returns true if ClientPermissionEvaluator.canManage(ClientModel) returns true.

Or if the caller has a permission to ClientPermissionManagement.CONFIGURE_SCOPE the client.

For V2 only: Also if the caller has a permission to AdminPermissionsSchema.CONFIGURE all clients.

Specified by:

canConfigure in interface ClientPermissionEvaluator

canManage

public boolean canManage(ClientModel client)

Description copied from interface: ClientPermissionEvaluator

Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.

Or if the caller has a permission to AdminPermissionManagement.MANAGE_SCOPE the client.

For V2 only: Also if the caller has a permission to AdminPermissionsSchema.MANAGE all clients.

Specified by:

canManage in interface ClientPermissionEvaluator

canManage

public boolean canManage()

Description copied from interface: ClientPermissionEvaluator

Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.

For V2 only: Also if it has permission to AdminPermissionsSchema.MANAGE.

Specified by:

canManage in interface ClientPermissionEvaluator

canView

public boolean canView(ClientModel client)

Description copied from interface: ClientPermissionEvaluator

Returns true if ClientPermissionEvaluator.canView() or ClientPermissionEvaluator.canConfigure(ClientModel) returns true.

Or if the caller has a permission to AdminPermissionManagement.VIEW_SCOPE the client.

For V2 only: Also if the caller has a permission to AdminPermissionsSchema.VIEW all clients.

Specified by:

canView in interface ClientPermissionEvaluator

canView

public boolean canView()

Description copied from interface: ClientPermissionEvaluator

Returns true if the caller has at least one of the AdminRoles.MANAGE_CLIENTS or AdminRoles.VIEW_CLIENTS roles.

For V2 only: Also if it has permission to AdminPermissionsSchema.VIEW.

Specified by:

canView in interface ClientPermissionEvaluator

canMapRoles

public boolean canMapRoles(ClientModel client)

Description copied from interface: ClientPermissionEvaluator

Returns true if the caller has a permission to ClientPermissionManagement.MAP_ROLES_SCOPE for the client.

For V2 only: Also if the caller has a permission to AdminPermissionsSchema.MAP_ROLES for all clients.

Specified by:

canMapRoles in interface ClientPermissionEvaluator

canMapCompositeRoles

public boolean canMapCompositeRoles(ClientModel client)

Description copied from interface: ClientPermissionEvaluator

Returns true if the caller has a permission to ClientPermissionManagement.MAP_ROLES_COMPOSITE_SCOPE for the client.

For V2 only: Also if the caller has a permission to AdminPermissionsSchema.MAP_ROLES_COMPOSITE for all clients.

Specified by:

canMapCompositeRoles in interface ClientPermissionEvaluator

canMapClientScopeRoles

public boolean canMapClientScopeRoles(ClientModel client)

Description copied from interface: ClientPermissionEvaluator

Returns true if the caller has a permission to ClientPermissionManagement.MAP_ROLES_CLIENT_SCOPE for the client.

For V2 only: Also if the caller has a permission to AdminPermissionsSchema.MAP_ROLES_CLIENT_SCOPE for all clients.

Specified by:

canMapClientScopeRoles in interface ClientPermissionEvaluator

canManageClientScopes

public boolean canManageClientScopes()

Description copied from interface: ClientPermissionEvaluator

Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.

For V2 only: Also if it has permission to AdminPermissionsSchema.MANAGE.

Specified by:

canManageClientScopes in interface ClientPermissionEvaluator

canManage

public boolean canManage(ClientScopeModel clientScope)

Description copied from interface: ClientPermissionEvaluator

Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.

For V2 only: Also if it has permission to AdminPermissionsSchema.MANAGE.

Specified by:

canManage in interface ClientPermissionEvaluator

canView

public boolean canView(ClientScopeModel clientScope)

Description copied from interface: ClientPermissionEvaluator

Returns true if the caller has at least one of the AdminRoles.VIEW_CLIENTS or AdminRoles.MANAGE_CLIENTS roles.

For V2 only: Also if it has permission to AdminPermissionsSchema.VIEW or AdminPermissionsSchema.MANAGE.

Specified by:

canView in interface ClientPermissionEvaluator

getClientsWithPermission

public Set<String> getClientsWithPermission(String scope)

Specified by:

getClientsWithPermission in interface ClientPermissionEvaluator

canExchangeTo

public boolean canExchangeTo(ClientModel authorizedClient,
 ClientModel to,
 AccessToken token)

Specified by:

canExchangeTo in interface ClientPermissionManagement

exchangeToPermission

public Policy exchangeToPermission(ClientModel client)

Specified by:

exchangeToPermission in interface ClientPermissionManagement

mapRolesPermission

public Policy mapRolesPermission(ClientModel client)

Specified by:

mapRolesPermission in interface ClientPermissionManagement

mapRolesClientScopePermission

public Policy mapRolesClientScopePermission(ClientModel client)

Specified by:

mapRolesClientScopePermission in interface ClientPermissionManagement

mapRolesCompositePermission

public Policy mapRolesCompositePermission(ClientModel client)

Specified by:

mapRolesCompositePermission in interface ClientPermissionManagement

managePermission

public Policy managePermission(ClientModel client)

Specified by:

managePermission in interface ClientPermissionManagement

configurePermission

public Policy configurePermission(ClientModel client)

Specified by:

configurePermission in interface ClientPermissionManagement

viewPermission

public Policy viewPermission(ClientModel client)

Specified by:

viewPermission in interface ClientPermissionManagement

isPermissionsEnabled

public boolean isPermissionsEnabled(ClientModel client)

Specified by:

isPermissionsEnabled in interface ClientPermissionEvaluator

Specified by:

isPermissionsEnabled in interface ClientPermissionManagement

setPermissionsEnabled

public void setPermissionsEnabled(ClientModel client,
 boolean enable)

Specified by:

setPermissionsEnabled in interface ClientPermissionEvaluator

Specified by:

setPermissionsEnabled in interface ClientPermissionManagement

resource

public Resource resource(ClientModel client)

Specified by:

resource in interface ClientPermissionManagement

getPermissions

public Map<String,String> getPermissions(ClientModel client)

Specified by:

getPermissions in interface ClientPermissionManagement

canList

public boolean canList()

Description copied from interface: ClientPermissionEvaluator

Returns true if ClientPermissionEvaluator.canView() returns true.

Or if the caller has at least one of the AdminRoles.QUERY_CLIENTS or AdminRoles.QUERY_USERS roles.

Specified by:

canList in interface ClientPermissionEvaluator

canList

public boolean canList(ClientModel clientModel)

requireList

public void requireList()

Description copied from interface: ClientPermissionEvaluator

Throws ForbiddenException if ClientPermissionEvaluator.canList() returns false.

Specified by:

requireList in interface ClientPermissionEvaluator

canListClientScopes

public boolean canListClientScopes()

Description copied from interface: ClientPermissionEvaluator

Returns true if ClientPermissionEvaluator.canView() returns true.

Or if the caller has AdminRoles.QUERY_CLIENTS role.

Specified by:

canListClientScopes in interface ClientPermissionEvaluator

requireListClientScopes

public void requireListClientScopes()

Description copied from interface: ClientPermissionEvaluator

Throws ForbiddenException if ClientPermissionEvaluator.canListClientScopes() returns false.

Specified by:

requireListClientScopes in interface ClientPermissionEvaluator

canManageClientsDefault

public boolean canManageClientsDefault()

canViewClientDefault

public boolean canViewClientDefault()

requireManage

public void requireManage()

Description copied from interface: ClientPermissionEvaluator

Throws ForbiddenException if ClientPermissionEvaluator.canManage() returns false.

Specified by:

requireManage in interface ClientPermissionEvaluator

requireView

public void requireView()

Description copied from interface: ClientPermissionEvaluator

Returns true if ClientPermissionEvaluator.canView() returns true.

Specified by:

requireView in interface ClientPermissionEvaluator

canExchangeTo

public boolean canExchangeTo(ClientModel authorizedClient,
 ClientModel client)

Specified by:

canExchangeTo in interface ClientPermissionManagement

requireConfigure

public void requireConfigure(ClientModel client)

Description copied from interface: ClientPermissionEvaluator

Throws ForbiddenException if ClientPermissionEvaluator.canConfigure(ClientModel) returns false.

Specified by:

requireConfigure in interface ClientPermissionEvaluator

requireManage

public void requireManage(ClientModel client)

Description copied from interface: ClientPermissionEvaluator

Throws ForbiddenException if ClientPermissionEvaluator.canManage(ClientModel) returns false.

Specified by:

requireManage in interface ClientPermissionEvaluator

requireView

public void requireView(ClientModel client)

Description copied from interface: ClientPermissionEvaluator

Throws ForbiddenException if ClientPermissionEvaluator.canView(ClientModel) returns false.

Specified by:

requireView in interface ClientPermissionEvaluator

canViewClientScopes

public boolean canViewClientScopes()

Description copied from interface: ClientPermissionEvaluator

Returns true if ClientPermissionEvaluator.canView() returns true.

Specified by:

canViewClientScopes in interface ClientPermissionEvaluator

requireManageClientScopes

public void requireManageClientScopes()

Description copied from interface: ClientPermissionEvaluator

Throws ForbiddenException if ClientPermissionEvaluator.canManageClientScopes() returns false.

Specified by:

requireManageClientScopes in interface ClientPermissionEvaluator

requireViewClientScopes

public void requireViewClientScopes()

Description copied from interface: ClientPermissionEvaluator

Returns true if ClientPermissionEvaluator.canViewClientScopes() returns true.

Specified by:

requireViewClientScopes in interface ClientPermissionEvaluator

requireManage

public void requireManage(ClientScopeModel clientScope)

Description copied from interface: ClientPermissionEvaluator

Throws ForbiddenException if ClientPermissionEvaluator.canManage(ClientScopeModel) returns false.

Specified by:

requireManage in interface ClientPermissionEvaluator

requireView

public void requireView(ClientScopeModel clientScope)

Description copied from interface: ClientPermissionEvaluator

Throws ForbiddenException if ClientPermissionEvaluator.canView(ClientScopeModel) returns false.

Specified by:

requireView in interface ClientPermissionEvaluator

resourceServer

public ResourceServer resourceServer(ClientModel client)

Specified by:

resourceServer in interface ClientPermissionManagement

getAccess

public Map<String,Boolean> getAccess(ClientModel client)

Specified by:

getAccess in interface ClientPermissionEvaluator