libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Remove RealmModel from authorization services interfaces (#26708)

Browse source 
Closes #26530
Signed-off-by: Michal Hajas <mhajas@redhat.com>
This commit is contained in:
Michal Hajas 2024-02-02 16:51:32 +01:00 committed by GitHub
parent 277af021d7
commit 00742a62dd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
55 changed files with 343 additions and 458 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/client/ClientPolicyProviderFactory.java
View file

@ -140,7 +140,7 @@ public class ClientPolicyProviderFactory implements PolicyProviderFactory<Client
try { try {
if (clients.isEmpty()) { if (clients.isEmpty()) {
policyStore.delete(removedClient.getRealm(), policy.getId()); policyStore.delete(policy.getId());
} else { } else {
policy.putConfig("clients", JsonSerialization.writeValueAsString(clients)); policy.putConfig("clients", JsonSerialization.writeValueAsString(clients));
} }

5
authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/clientscope/ClientScopePolicyProviderFactory.java
View file

@ -69,13 +69,12 @@ public class ClientScopePolicyProviderFactory implements PolicyProviderFactory<C
StoreFactory storeFactory = provider.getStoreFactory(); StoreFactory storeFactory = provider.getStoreFactory();
PolicyStore policyStore = storeFactory.getPolicyStore(); PolicyStore policyStore = storeFactory.getPolicyStore();
ClientScopeModel removedClientScope = ((ClientScopeRemovedEvent) event).getClientScope(); ClientScopeModel removedClientScope = ((ClientScopeRemovedEvent) event).getClientScope();
RealmModel realm = ((ClientScopeRemovedEvent) event).getClientScope().getRealm();
Map<Policy.FilterOption, String[]> filters = new HashMap<>(); Map<Policy.FilterOption, String[]> filters = new HashMap<>();
filters.put(Policy.FilterOption.TYPE, new String[] { getId() }); filters.put(Policy.FilterOption.TYPE, new String[] { getId() });
policyStore.find(realm, null, filters, null, null).forEach(new Consumer<Policy>() { policyStore.find(null, filters, null, null).forEach(new Consumer<Policy>() {
@Override @Override
public void accept(Policy policy) { public void accept(Policy policy) {
@ -94,7 +93,7 @@ public class ClientScopePolicyProviderFactory implements PolicyProviderFactory<C
} }
if (clientScopes.isEmpty()) { if (clientScopes.isEmpty()) {
policyStore.delete(realm, policy.getId()); policyStore.delete(policy.getId());
} else { } else {
try { try {
policy.putConfig("clientScopes", JsonSerialization.writeValueAsString(clientScopes)); policy.putConfig("clientScopes", JsonSerialization.writeValueAsString(clientScopes));

14
authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/permission/UMAPolicyProviderFactory.java
View file

@ -125,7 +125,6 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
public void onUpdate(Policy policy, UmaPermissionRepresentation representation, AuthorizationProvider authorization) { public void onUpdate(Policy policy, UmaPermissionRepresentation representation, AuthorizationProvider authorization) {
PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore(); PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore();
Set<Policy> associatedPolicies = policy.getAssociatedPolicies(); Set<Policy> associatedPolicies = policy.getAssociatedPolicies();
RealmModel realm = policy.getResourceServer().getRealm();
for (Policy associatedPolicy : associatedPolicies) { for (Policy associatedPolicy : associatedPolicies) {
AbstractPolicyRepresentation associatedRep = ModelToRepresentation.toRepresentation(associatedPolicy, authorization, false, false); AbstractPolicyRepresentation associatedRep = ModelToRepresentation.toRepresentation(associatedPolicy, authorization, false, false);
@ -144,7 +143,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
} }
if (rep.getRoles().isEmpty()) { if (rep.getRoles().isEmpty()) {
policyStore.delete(realm, associatedPolicy.getId()); policyStore.delete(associatedPolicy.getId());
} else { } else {
RepresentationToModel.toModel(rep, authorization, associatedPolicy); RepresentationToModel.toModel(rep, authorization, associatedPolicy);
} }
@ -155,7 +154,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
rep.setType(representation.getCondition()); rep.setType(representation.getCondition());
RepresentationToModel.toModel(rep, authorization, associatedPolicy); RepresentationToModel.toModel(rep, authorization, associatedPolicy);
} else { } else {
policyStore.delete(realm, associatedPolicy.getId()); policyStore.delete(associatedPolicy.getId());
} }
} else if ("group".equals(associatedRep.getType())) { } else if ("group".equals(associatedRep.getType())) {
GroupPolicyRepresentation rep = GroupPolicyRepresentation.class.cast(associatedRep); GroupPolicyRepresentation rep = GroupPolicyRepresentation.class.cast(associatedRep);
@ -171,7 +170,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
} }
if (rep.getGroups().isEmpty()) { if (rep.getGroups().isEmpty()) {
policyStore.delete(realm, associatedPolicy.getId()); policyStore.delete(associatedPolicy.getId());
} else { } else {
RepresentationToModel.toModel(rep, authorization, associatedPolicy); RepresentationToModel.toModel(rep, authorization, associatedPolicy);
} }
@ -189,7 +188,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
} }
if (rep.getClients().isEmpty()) { if (rep.getClients().isEmpty()) {
policyStore.delete(realm, associatedPolicy.getId()); policyStore.delete(associatedPolicy.getId());
} else { } else {
RepresentationToModel.toModel(rep, authorization, associatedPolicy); RepresentationToModel.toModel(rep, authorization, associatedPolicy);
} }
@ -207,7 +206,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
} }
if (rep.getUsers().isEmpty()) { if (rep.getUsers().isEmpty()) {
policyStore.delete(realm, associatedPolicy.getId()); policyStore.delete(associatedPolicy.getId());
} else { } else {
RepresentationToModel.toModel(rep, authorization, associatedPolicy); RepresentationToModel.toModel(rep, authorization, associatedPolicy);
} }
@ -365,10 +364,9 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
@Override @Override
public void onRemove(Policy policy, AuthorizationProvider authorization) { public void onRemove(Policy policy, AuthorizationProvider authorization) {
PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore(); PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore();
RealmModel realm = policy.getResourceServer().getRealm();
for (Policy associatedPolicy : policy.getAssociatedPolicies()) { for (Policy associatedPolicy : policy.getAssociatedPolicies()) {
policyStore.delete(realm, associatedPolicy.getId()); policyStore.delete(associatedPolicy.getId());
} }
} }

2
authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java
View file

@ -246,7 +246,7 @@ public class RolePolicyProviderFactory implements PolicyProviderFactory<RolePoli
try { try {
if (roles.isEmpty()) { if (roles.isEmpty()) {
policyStore.delete(clientModel.getRealm(), policy.getId()); policyStore.delete(policy.getId());
} else { } else {
policy.putConfig("roles", JsonSerialization.writeValueAsString(roles)); policy.putConfig("roles", JsonSerialization.writeValueAsString(roles));
} }

9
model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/InfinispanCacheStoreFactoryProviderFactory.java vendored
View file

@ -45,15 +45,6 @@ public class InfinispanCacheStoreFactoryProviderFactory implements CachedStorePr
protected volatile StoreFactoryCacheManager storeCache; protected volatile StoreFactoryCacheManager storeCache;
/**
* Legacy store doesn't store realm id for any entity and no method there is using new introduced RealmModel parameter.
* The parameter was introduced for usage only in the new storage. Therefore, in some cases we may break our rule specified in JavaDoc
* and use {@code null} value as parameter that otherwise cannot be {@code null}. We need to be careful and place such value only to a method call
* that cannot end up in the new store because it would end with {@link NullPointerException}. To mark all places where we do this,
* we use this variable so it is easily searchable.
*/
public static final RealmModel NULL_REALM = null;
@Override @Override
public CachedStoreFactoryProvider create(KeycloakSession session) { public CachedStoreFactoryProvider create(KeycloakSession session) {
lazyInit(session); lazyInit(session);

17
model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/PermissionTicketAdapter.java vendored
View file

@ -22,7 +22,6 @@ import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.models.cache.infinispan.authorization.entities.CachedPermissionTicket; import org.keycloak.models.cache.infinispan.authorization.entities.CachedPermissionTicket;
/** /**
@ -43,8 +42,8 @@ public class PermissionTicketAdapter implements PermissionTicket, CachedModel<Pe
@Override @Override
public PermissionTicket getDelegateForUpdate() { public PermissionTicket getDelegateForUpdate() {
if (updated == null) { if (updated == null) {
ResourceServer resourceServer = cacheSession.getResourceServerStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()); ResourceServer resourceServer = cacheSession.getResourceServerStoreDelegate().findById(cached.getResourceServerId());
updated = cacheSession.getPermissionTicketStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, cached.getId()); updated = cacheSession.getPermissionTicketStoreDelegate().findById(resourceServer, cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database"); if (updated == null) throw new IllegalStateException("Not found in database");
cacheSession.registerPermissionTicketInvalidation(cached.getId(), cached.getOwner(), cached.getRequester(), cached.getResourceId(), updated.getResource().getName(), cached.getScopeId(), cached.getResourceServerId()); cacheSession.registerPermissionTicketInvalidation(cached.getId(), cached.getOwner(), cached.getRequester(), cached.getResourceId(), updated.getResource().getName(), cached.getScopeId(), cached.getResourceServerId());
} }
@ -71,8 +70,8 @@ public class PermissionTicketAdapter implements PermissionTicket, CachedModel<Pe
protected boolean isUpdated() { protected boolean isUpdated() {
if (updated != null) return true; if (updated != null) return true;
if (!invalidated) return false; if (!invalidated) return false;
ResourceServer resourceServer = cacheSession.getResourceServerStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()); ResourceServer resourceServer = cacheSession.getResourceServerStoreDelegate().findById(cached.getResourceServerId());
updated = cacheSession.getPermissionTicketStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, cached.getId()); updated = cacheSession.getPermissionTicketStoreDelegate().findById(resourceServer, cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database"); if (updated == null) throw new IllegalStateException("Not found in database");
return true; return true;
} }
@ -123,13 +122,13 @@ public class PermissionTicketAdapter implements PermissionTicket, CachedModel<Pe
@Override @Override
public ResourceServer getResourceServer() { public ResourceServer getResourceServer() {
return cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()); return cacheSession.getResourceServerStore().findById(cached.getResourceServerId());
} }
@Override @Override
public Policy getPolicy() { public Policy getPolicy() {
if (isUpdated()) return updated.getPolicy(); if (isUpdated()) return updated.getPolicy();
return cacheSession.getPolicyStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()), cached.getPolicy()); return cacheSession.getPolicyStore().findById(cacheSession.getResourceServerStore().findById(cached.getResourceServerId()), cached.getPolicy());
} }
@Override @Override
@ -141,12 +140,12 @@ public class PermissionTicketAdapter implements PermissionTicket, CachedModel<Pe
@Override @Override
public Resource getResource() { public Resource getResource() {
return cacheSession.getResourceStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getResourceId()); return cacheSession.getResourceStore().findById(getResourceServer(), cached.getResourceId());
} }
@Override @Override
public Scope getScope() { public Scope getScope() {
return cacheSession.getScopeStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getScopeId()); return cacheSession.getScopeStore().findById(getResourceServer(), cached.getScopeId());
} }
@Override @Override

13
model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/PolicyAdapter.java vendored
View file

@ -21,7 +21,6 @@ import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.PolicyStore; import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.ResourceStore; import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.authorization.store.ScopeStore; import org.keycloak.authorization.store.ScopeStore;
@ -86,7 +85,7 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
protected boolean isUpdated() { protected boolean isUpdated() {
if (updated != null) return true; if (updated != null) return true;
if (!invalidated) return false; if (!invalidated) return false;
updated = cacheSession.getPolicyStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()), cached.getId()); updated = cacheSession.getPolicyStoreDelegate().findById(cacheSession.getResourceServerStore().findById(cached.getResourceServerId()), cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database"); if (updated == null) throw new IllegalStateException("Not found in database");
return true; return true;
} }
@ -113,7 +112,7 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
@Override @Override
public ResourceServer getResourceServer() { public ResourceServer getResourceServer() {
return cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()); return cacheSession.getResourceServerStore().findById(cached.getResourceServerId());
} }
@Override @Override
@ -209,7 +208,7 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
PolicyStore policyStore = cacheSession.getPolicyStore(); PolicyStore policyStore = cacheSession.getPolicyStore();
String resourceServerId = cached.getResourceServerId(); String resourceServerId = cached.getResourceServerId();
for (String id : cached.getAssociatedPoliciesIds(modelSupplier)) { for (String id : cached.getAssociatedPoliciesIds(modelSupplier)) {
Policy policy = policyStore.findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServerId), id); Policy policy = policyStore.findById(cacheSession.getResourceServerStore().findById(resourceServerId), id);
if (policy == null) { if (policy == null) {
// probably because the policy was removed // probably because the policy was removed
continue; continue;
@ -230,7 +229,7 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
ResourceStore resourceStore = cacheSession.getResourceStore(); ResourceStore resourceStore = cacheSession.getResourceStore();
ResourceServer resourceServer = getResourceServer(); ResourceServer resourceServer = getResourceServer();
for (String resourceId : cached.getResourcesIds(modelSupplier)) { for (String resourceId : cached.getResourcesIds(modelSupplier)) {
Resource resource = resourceStore.findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId); Resource resource = resourceStore.findById(resourceServer, resourceId);
cacheSession.cacheResource(resource); cacheSession.cacheResource(resource);
resources.add(resource); resources.add(resource);
} }
@ -295,7 +294,7 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
ResourceServer resourceServer = getResourceServer(); ResourceServer resourceServer = getResourceServer();
ScopeStore scopeStore = cacheSession.getScopeStore(); ScopeStore scopeStore = cacheSession.getScopeStore();
for (String scopeId : cached.getScopesIds(modelSupplier)) { for (String scopeId : cached.getScopesIds(modelSupplier)) {
Scope scope = scopeStore.findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, scopeId); Scope scope = scopeStore.findById(resourceServer, scopeId);
cacheSession.cacheScope(scope); cacheSession.cacheScope(scope);
scopes.add(scope); scopes.add(scope);
} }
@ -330,6 +329,6 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
} }
private Policy getPolicyModel() { private Policy getPolicyModel() {
return cacheSession.getPolicyStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()), cached.getId()); return cacheSession.getPolicyStoreDelegate().findById(cacheSession.getResourceServerStore().findById(cached.getResourceServerId()), cached.getId());
} }
} }

10
model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/ResourceAdapter.java vendored
View file

@ -81,7 +81,7 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
protected boolean isUpdated() { protected boolean isUpdated() {
if (updated != null) return true; if (updated != null) return true;
if (!invalidated) return false; if (!invalidated) return false;
updated = cacheSession.getResourceStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getId()); updated = cacheSession.getResourceStoreDelegate().findById(getResourceServer(), cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database"); if (updated == null) throw new IllegalStateException("Not found in database");
return true; return true;
} }
@ -134,7 +134,7 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
@Override @Override
public ResourceServer getResourceServer() { public ResourceServer getResourceServer() {
return cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()); return cacheSession.getResourceServerStore().findById(cached.getResourceServerId());
} }
@Override @Override
@ -172,7 +172,7 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
if (scopes != null) return scopes; if (scopes != null) return scopes;
scopes = new LinkedList<>(); scopes = new LinkedList<>();
for (String scopeId : cached.getScopesIds(modelSupplier)) { for (String scopeId : cached.getScopesIds(modelSupplier)) {
scopes.add(cacheSession.getScopeStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), scopeId)); scopes.add(cacheSession.getScopeStore().findById(getResourceServer(), scopeId));
} }
return scopes = Collections.unmodifiableList(scopes); return scopes = Collections.unmodifiableList(scopes);
} }
@ -206,7 +206,7 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
List<PermissionTicket> permissions = permissionStore.findByScope(getResourceServer(), scope); List<PermissionTicket> permissions = permissionStore.findByScope(getResourceServer(), scope);
for (PermissionTicket permission : permissions) { for (PermissionTicket permission : permissions) {
permissionStore.delete(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, permission.getId()); permissionStore.delete(permission.getId());
} }
} }
} }
@ -282,6 +282,6 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
} }
private Resource getResourceModel() { private Resource getResourceModel() {
return cacheSession.getResourceStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getId()); return cacheSession.getResourceStoreDelegate().findById(getResourceServer(), cached.getId());
} }
} }

18
model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/ResourceServerAdapter.java vendored
View file

@ -18,9 +18,6 @@ package org.keycloak.models.cache.infinispan.authorization;
import org.keycloak.authorization.model.CachedModel; import org.keycloak.authorization.model.CachedModel;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.models.ClientModel;
import org.keycloak.models.RealmModel;
import org.keycloak.models.cache.infinispan.authorization.entities.CachedResourceServer; import org.keycloak.models.cache.infinispan.authorization.entities.CachedResourceServer;
import org.keycloak.representations.idm.authorization.DecisionStrategy; import org.keycloak.representations.idm.authorization.DecisionStrategy;
import org.keycloak.representations.idm.authorization.PolicyEnforcementMode; import org.keycloak.representations.idm.authorization.PolicyEnforcementMode;
@ -32,21 +29,19 @@ import org.keycloak.representations.idm.authorization.PolicyEnforcementMode;
public class ResourceServerAdapter implements ResourceServer, CachedModel<ResourceServer> { public class ResourceServerAdapter implements ResourceServer, CachedModel<ResourceServer> {
protected CachedResourceServer cached; protected CachedResourceServer cached;
protected StoreFactoryCacheSession cacheSession; protected StoreFactoryCacheSession cacheSession;
private RealmModel realm;
protected ResourceServer updated; protected ResourceServer updated;
public ResourceServerAdapter(RealmModel realm, CachedResourceServer cached, public ResourceServerAdapter(CachedResourceServer cached,
StoreFactoryCacheSession cacheSession) { StoreFactoryCacheSession cacheSession) {
this.cached = cached; this.cached = cached;
this.cacheSession = cacheSession; this.cacheSession = cacheSession;
this.realm = realm;
} }
@Override @Override
public ResourceServer getDelegateForUpdate() { public ResourceServer getDelegateForUpdate() {
if (updated == null) { if (updated == null) {
cacheSession.registerResourceServerInvalidation(cached.getId()); cacheSession.registerResourceServerInvalidation(cached.getId());
updated = cacheSession.getResourceServerStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getId()); updated = cacheSession.getResourceServerStoreDelegate().findById(cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database"); if (updated == null) throw new IllegalStateException("Not found in database");
} }
return updated; return updated;
@ -73,7 +68,7 @@ public class ResourceServerAdapter implements ResourceServer, CachedModel<Resour
protected boolean isUpdated() { protected boolean isUpdated() {
if (updated != null) return true; if (updated != null) return true;
if (!invalidated) return false; if (!invalidated) return false;
updated = cacheSession.getResourceServerStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getId()); updated = cacheSession.getResourceServerStoreDelegate().findById(cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database"); if (updated == null) throw new IllegalStateException("Not found in database");
return true; return true;
} }
@ -127,11 +122,6 @@ public class ResourceServerAdapter implements ResourceServer, CachedModel<Resour
return getId(); return getId();
} }
@Override
public RealmModel getRealm() {
return realm;
}
@Override @Override
public boolean equals(Object o) { public boolean equals(Object o) {
if (this == o) return true; if (this == o) return true;

7
model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/ScopeAdapter.java vendored
View file

@ -19,7 +19,6 @@ package org.keycloak.models.cache.infinispan.authorization;
import org.keycloak.authorization.model.CachedModel; import org.keycloak.authorization.model.CachedModel;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.models.cache.infinispan.authorization.entities.CachedScope; import org.keycloak.models.cache.infinispan.authorization.entities.CachedScope;
/** /**
@ -40,7 +39,7 @@ public class ScopeAdapter implements Scope, CachedModel<Scope> {
public Scope getDelegateForUpdate() { public Scope getDelegateForUpdate() {
if (updated == null) { if (updated == null) {
cacheSession.registerScopeInvalidation(cached.getId(), cached.getName(), cached.getResourceServerId()); cacheSession.registerScopeInvalidation(cached.getId(), cached.getName(), cached.getResourceServerId());
updated = cacheSession.getScopeStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getId()); updated = cacheSession.getScopeStoreDelegate().findById(getResourceServer(), cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database"); if (updated == null) throw new IllegalStateException("Not found in database");
} }
return updated; return updated;
@ -67,7 +66,7 @@ public class ScopeAdapter implements Scope, CachedModel<Scope> {
protected boolean isUpdated() { protected boolean isUpdated() {
if (updated != null) return true; if (updated != null) return true;
if (!invalidated) return false; if (!invalidated) return false;
updated = cacheSession.getScopeStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getId()); updated = cacheSession.getScopeStoreDelegate().findById(getResourceServer(), cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database"); if (updated == null) throw new IllegalStateException("Not found in database");
return true; return true;
} }
@ -119,7 +118,7 @@ public class ScopeAdapter implements Scope, CachedModel<Scope> {
@Override @Override
public ResourceServer getResourceServer() { public ResourceServer getResourceServer() {
return cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()); return cacheSession.getResourceServerStore().findById(cached.getResourceServerId());
} }
@Override @Override

115
model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/StoreFactoryCacheSession.java vendored
View file

@ -47,7 +47,6 @@ import org.keycloak.models.ClientModel;
import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakTransaction; import org.keycloak.models.KeycloakTransaction;
import org.keycloak.models.ModelException; import org.keycloak.models.ModelException;
import org.keycloak.models.RealmModel;
import org.keycloak.models.cache.authorization.CachedStoreFactoryProvider; import org.keycloak.models.cache.authorization.CachedStoreFactoryProvider;
import org.keycloak.models.cache.infinispan.authorization.entities.CachedPermissionTicket; import org.keycloak.models.cache.infinispan.authorization.entities.CachedPermissionTicket;
import org.keycloak.models.cache.infinispan.authorization.entities.CachedPolicy; import org.keycloak.models.cache.infinispan.authorization.entities.CachedPolicy;
@ -310,9 +309,9 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
return Collections.emptySet(); return Collections.emptySet();
} }
ResourceServer resourceServer = getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, serverId); ResourceServer resourceServer = getResourceServerStore().findById(serverId);
return resources.stream().map(resourceId -> { return resources.stream().map(resourceId -> {
Resource resource = getResourceStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId); Resource resource = getResourceStore().findById(resourceServer, resourceId);
String type = resource.getType(); String type = resource.getType();
if (type != null) { if (type != null) {
@ -451,7 +450,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
public void delete(ClientModel client) { public void delete(ClientModel client) {
String id = client.getId(); String id = client.getId();
if (id == null) return; if (id == null) return;
ResourceServer server = findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, id); ResourceServer server = findById(id);
if (server == null) return; if (server == null) return;
cache.invalidateObject(id); cache.invalidateObject(id);
@ -462,7 +461,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} }
@Override @Override
public ResourceServer findById(RealmModel realm, String id) { public ResourceServer findById(String id) {
if (id == null) return null; if (id == null) return null;
CachedResourceServer cached = cache.get(id, CachedResourceServer.class); CachedResourceServer cached = cache.get(id, CachedResourceServer.class);
if (cached != null) { if (cached != null) {
@ -472,7 +471,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (cached == null) { if (cached == null) {
Long loaded = cache.getCurrentRevision(id); Long loaded = cache.getCurrentRevision(id);
if (! modelMightExist(id)) return null; if (! modelMightExist(id)) return null;
ResourceServer model = getResourceServerStoreDelegate().findById(realm, id); ResourceServer model = getResourceServerStoreDelegate().findById(id);
if (model == null) { if (model == null) {
setModelDoesNotExists(id, loaded); setModelDoesNotExists(id, loaded);
return null; return null;
@ -481,18 +480,18 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
cached = new CachedResourceServer(loaded, model); cached = new CachedResourceServer(loaded, model);
cache.addRevisioned(cached, startupRevision); cache.addRevisioned(cached, startupRevision);
} else if (invalidations.contains(id)) { } else if (invalidations.contains(id)) {
return getResourceServerStoreDelegate().findById(realm, id); return getResourceServerStoreDelegate().findById(id);
} else if (managedResourceServers.containsKey(id)) { } else if (managedResourceServers.containsKey(id)) {
return managedResourceServers.get(id); return managedResourceServers.get(id);
} }
ResourceServerAdapter adapter = new ResourceServerAdapter(realm, cached, StoreFactoryCacheSession.this); ResourceServerAdapter adapter = new ResourceServerAdapter(cached, StoreFactoryCacheSession.this);
managedResourceServers.put(id, adapter); managedResourceServers.put(id, adapter);
return adapter; return adapter;
} }
@Override @Override
public ResourceServer findByClient(ClientModel client) { public ResourceServer findByClient(ClientModel client) {
return findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, client.getId()); return findById(client.getId());
} }
} }
@ -510,19 +509,19 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
if (id == null) return; if (id == null) return;
Scope scope = findById(realm, null, id); Scope scope = findById(null, id);
if (scope == null) return; if (scope == null) return;
cache.invalidateObject(id); cache.invalidateObject(id);
invalidationEvents.add(ScopeRemovedEvent.create(id, scope.getName(), scope.getResourceServer().getId())); invalidationEvents.add(ScopeRemovedEvent.create(id, scope.getName(), scope.getResourceServer().getId()));
cache.scopeRemoval(id, scope.getName(), scope.getResourceServer().getId(), invalidations); cache.scopeRemoval(id, scope.getName(), scope.getResourceServer().getId(), invalidations);
getScopeStoreDelegate().delete(realm, id); getScopeStoreDelegate().delete(id);
} }
@Override @Override
public Scope findById(RealmModel realm, ResourceServer resourceServer, String id) { public Scope findById(ResourceServer resourceServer, String id) {
if (id == null) return null; if (id == null) return null;
CachedScope cached = cache.get(id, CachedScope.class); CachedScope cached = cache.get(id, CachedScope.class);
if (cached != null) { if (cached != null) {
@ -531,7 +530,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (cached == null) { if (cached == null) {
Long loaded = cache.getCurrentRevision(id); Long loaded = cache.getCurrentRevision(id);
if (! modelMightExist(id)) return null; if (! modelMightExist(id)) return null;
Scope model = getScopeStoreDelegate().findById(realm, resourceServer, id); Scope model = getScopeStoreDelegate().findById(resourceServer, id);
if (model == null) { if (model == null) {
setModelDoesNotExists(id, loaded); setModelDoesNotExists(id, loaded);
return null; return null;
@ -540,7 +539,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
cached = new CachedScope(loaded, model); cached = new CachedScope(loaded, model);
cache.addRevisioned(cached, startupRevision); cache.addRevisioned(cached, startupRevision);
} else if (invalidations.contains(id)) { } else if (invalidations.contains(id)) {
return getScopeStoreDelegate().findById(realm, resourceServer, id); return getScopeStoreDelegate().findById(resourceServer, id);
} else if (managedScopes.containsKey(id)) { } else if (managedScopes.containsKey(id)) {
return managedScopes.get(id); return managedScopes.get(id);
} }
@ -573,7 +572,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (invalidations.contains(id)) { if (invalidations.contains(id)) {
return getScopeStoreDelegate().findByName(resourceServer, name); return getScopeStoreDelegate().findByName(resourceServer, name);
} }
return findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, id); return findById(resourceServer, id);
} }
} }
@ -593,29 +592,29 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
@Override @Override
public Resource create(ResourceServer resourceServer, String id, String name, String owner) { public Resource create(ResourceServer resourceServer, String id, String name, String owner) {
Resource resource = getResourceStoreDelegate().create(resourceServer, id, name, owner); Resource resource = getResourceStoreDelegate().create(resourceServer, id, name, owner);
Resource cached = findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resource.getId()); Resource cached = findById(resourceServer, resource.getId());
registerResourceInvalidation(resource.getId(), resource.getName(), resource.getType(), resource.getUris(), resource.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()), resourceServer.getId(), resource.getOwner()); registerResourceInvalidation(resource.getId(), resource.getName(), resource.getType(), resource.getUris(), resource.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()), resourceServer.getId(), resource.getOwner());
if (cached == null) { if (cached == null) {
cached = findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resource.getId()); cached = findById(resourceServer, resource.getId());
} }
return cached; return cached;
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
if (id == null) return; if (id == null) return;
Resource resource = findById(realm, null, id); Resource resource = findById(null, id);
if (resource == null) return; if (resource == null) return;
cache.invalidateObject(id); cache.invalidateObject(id);
invalidationEvents.add(ResourceRemovedEvent.create(id, resource.getName(), resource.getType(), resource.getUris(), resource.getOwner(), resource.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()), resource.getResourceServer().getId())); invalidationEvents.add(ResourceRemovedEvent.create(id, resource.getName(), resource.getType(), resource.getUris(), resource.getOwner(), resource.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()), resource.getResourceServer().getId()));
cache.resourceRemoval(id, resource.getName(), resource.getType(), resource.getUris(), resource.getOwner(), resource.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()), resource.getResourceServer().getId(), invalidations); cache.resourceRemoval(id, resource.getName(), resource.getType(), resource.getUris(), resource.getOwner(), resource.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()), resource.getResourceServer().getId(), invalidations);
getResourceStoreDelegate().delete(realm, id); getResourceStoreDelegate().delete(id);
} }
@Override @Override
public Resource findById(RealmModel realm, ResourceServer resourceServer, String id) { public Resource findById(ResourceServer resourceServer, String id) {
if (id == null) return null; if (id == null) return null;
CachedResource cached = cache.get(id, CachedResource.class); CachedResource cached = cache.get(id, CachedResource.class);
if (cached != null) { if (cached != null) {
@ -624,7 +623,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (cached == null) { if (cached == null) {
Long loaded = cache.getCurrentRevision(id); Long loaded = cache.getCurrentRevision(id);
if (! modelMightExist(id)) return null; if (! modelMightExist(id)) return null;
Resource model = getResourceStoreDelegate().findById(realm, resourceServer, id); Resource model = getResourceStoreDelegate().findById(resourceServer, id);
if (model == null) { if (model == null) {
setModelDoesNotExists(id, loaded); setModelDoesNotExists(id, loaded);
return null; return null;
@ -633,7 +632,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
cached = new CachedResource(loaded, model); cached = new CachedResource(loaded, model);
cache.addRevisioned(cached, startupRevision); cache.addRevisioned(cached, startupRevision);
} else if (invalidations.contains(id)) { } else if (invalidations.contains(id)) {
return getResourceStoreDelegate().findById(realm, resourceServer, id); return getResourceStoreDelegate().findById(resourceServer, id);
} else if (managedResources.containsKey(id)) { } else if (managedResources.containsKey(id)) {
return managedResources.get(id); return managedResources.get(id);
} }
@ -666,20 +665,20 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} }
@Override @Override
public List<Resource> findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId) { public List<Resource> findByOwner(ResourceServer resourceServer, String ownerId) {
String resourceServerId = resourceServer == null ? null : resourceServer.getId(); String resourceServerId = resourceServer == null ? null : resourceServer.getId();
String cacheKey = getResourceByOwnerCacheKey(ownerId, resourceServerId); String cacheKey = getResourceByOwnerCacheKey(ownerId, resourceServerId);
return cacheQuery(cacheKey, ResourceListQuery.class, () -> getResourceStoreDelegate().findByOwner(realm, resourceServer, ownerId), return cacheQuery(cacheKey, ResourceListQuery.class, () -> getResourceStoreDelegate().findByOwner(resourceServer, ownerId),
(revision, resources) -> new ResourceListQuery(revision, cacheKey, resources.stream().map(Resource::getId).collect(Collectors.toSet()), resourceServerId), resourceServer); (revision, resources) -> new ResourceListQuery(revision, cacheKey, resources.stream().map(Resource::getId).collect(Collectors.toSet()), resourceServerId), resourceServer);
} }
@Override @Override
public void findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) { public void findByOwner(ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
String resourceServerId = resourceServer == null ? null : resourceServer.getId(); String resourceServerId = resourceServer == null ? null : resourceServer.getId();
String cacheKey = getResourceByOwnerCacheKey(ownerId, resourceServerId); String cacheKey = getResourceByOwnerCacheKey(ownerId, resourceServerId);
cacheQuery(cacheKey, ResourceListQuery.class, () -> { cacheQuery(cacheKey, ResourceListQuery.class, () -> {
List<Resource> resources = new ArrayList<>(); List<Resource> resources = new ArrayList<>();
getResourceStoreDelegate().findByOwner(realm, resourceServer, ownerId, new Consumer<Resource>() { getResourceStoreDelegate().findByOwner(resourceServer, ownerId, new Consumer<Resource>() {
@Override @Override
public void accept(Resource resource) { public void accept(Resource resource) {
consumer.andThen(resources::add) consumer.andThen(resources::add)
@ -698,8 +697,8 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} }
@Override @Override
public List<Resource> find(RealmModel realm, ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) { public List<Resource> find(ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return getResourceStoreDelegate().find(realm, resourceServer, attributes, firstResult, maxResults); return getResourceStoreDelegate().find(resourceServer, attributes, firstResult, maxResults);
} }
@Override @Override
@ -837,9 +836,9 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
Set<String> resources = query.getResources(); Set<String> resources = query.getResources();
if (consumer != null) { if (consumer != null) {
resources.stream().map(resourceId -> (R) findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId)).forEach(consumer); resources.stream().map(resourceId -> (R) findById(resourceServer, resourceId)).forEach(consumer);
} else { } else {
model = resources.stream().map(resourceId -> (R) findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId)).collect(Collectors.toList()); model = resources.stream().map(resourceId -> (R) findById(resourceServer, resourceId)).collect(Collectors.toList());
} }
} }
@ -855,18 +854,18 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
@Override @Override
public Policy create(ResourceServer resourceServer, AbstractPolicyRepresentation representation) { public Policy create(ResourceServer resourceServer, AbstractPolicyRepresentation representation) {
Policy policy = getPolicyStoreDelegate().create(resourceServer, representation); Policy policy = getPolicyStoreDelegate().create(resourceServer, representation);
Policy cached = findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, policy.getId()); Policy cached = findById(resourceServer, policy.getId());
registerPolicyInvalidation(policy.getId(), representation.getName(), representation.getResources(), representation.getScopes(), null, resourceServer.getId()); registerPolicyInvalidation(policy.getId(), representation.getName(), representation.getResources(), representation.getScopes(), null, resourceServer.getId());
if (cached == null) { if (cached == null) {
cached = findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, policy.getId()); cached = findById(resourceServer, policy.getId());
} }
return cached; return cached;
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
if (id == null) return; if (id == null) return;
Policy policy = findById(realm, null, id); Policy policy = findById(null, id);
if (policy == null) return; if (policy == null) return;
cache.invalidateObject(id); cache.invalidateObject(id);
@ -880,12 +879,12 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
Set<String> scopes = policy.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()); Set<String> scopes = policy.getScopes().stream().map(Scope::getId).collect(Collectors.toSet());
invalidationEvents.add(PolicyRemovedEvent.create(id, policy.getName(), resources, resourceTypes, scopes, resourceServer.getId())); invalidationEvents.add(PolicyRemovedEvent.create(id, policy.getName(), resources, resourceTypes, scopes, resourceServer.getId()));
cache.policyRemoval(id, policy.getName(), resources, resourceTypes, scopes, resourceServer.getId(), invalidations); cache.policyRemoval(id, policy.getName(), resources, resourceTypes, scopes, resourceServer.getId(), invalidations);
getPolicyStoreDelegate().delete(realm, id); getPolicyStoreDelegate().delete(id);
} }
@Override @Override
public Policy findById(RealmModel realm, ResourceServer resourceServer, String id) { public Policy findById(ResourceServer resourceServer, String id) {
if (id == null) return null; if (id == null) return null;
CachedPolicy cached = cache.get(id, CachedPolicy.class); CachedPolicy cached = cache.get(id, CachedPolicy.class);
@ -894,7 +893,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} }
if (cached == null) { if (cached == null) {
if (! modelMightExist(id)) return null; if (! modelMightExist(id)) return null;
Policy model = getPolicyStoreDelegate().findById(realm, resourceServer, id); Policy model = getPolicyStoreDelegate().findById(resourceServer, id);
Long loaded = cache.getCurrentRevision(id); Long loaded = cache.getCurrentRevision(id);
if (model == null) { if (model == null) {
setModelDoesNotExists(id, loaded); setModelDoesNotExists(id, loaded);
@ -904,7 +903,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
cached = new CachedPolicy(loaded, model); cached = new CachedPolicy(loaded, model);
cache.addRevisioned(cached, startupRevision); cache.addRevisioned(cached, startupRevision);
} else if (invalidations.contains(id)) { } else if (invalidations.contains(id)) {
return getPolicyStoreDelegate().findById(realm, resourceServer, id); return getPolicyStoreDelegate().findById(resourceServer, id);
} else if (managedPolicies.containsKey(id)) { } else if (managedPolicies.containsKey(id)) {
return managedPolicies.get(id); return managedPolicies.get(id);
} }
@ -941,8 +940,8 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} }
@Override @Override
public List<Policy> find(RealmModel realm, ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) { public List<Policy> find(ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return getPolicyStoreDelegate().find(realm, resourceServer, attributes, firstResult, maxResults); return getPolicyStoreDelegate().find(resourceServer, attributes, firstResult, maxResults);
} }
@Override @Override
@ -1086,10 +1085,10 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (consumer != null) { if (consumer != null) {
for (String id : policies) { for (String id : policies) {
consumer.accept((R) findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, id)); consumer.accept((R) findById(resourceServer, id));
} }
} else { } else {
model = policies.stream().map(resourceId -> (R) findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId)) model = policies.stream().map(resourceId -> (R) findById(resourceServer, resourceId))
.filter(Objects::nonNull).collect(Collectors.toList()); .filter(Objects::nonNull).collect(Collectors.toList());
} }
} }
@ -1114,9 +1113,9 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
if (id == null) return; if (id == null) return;
PermissionTicket permission = findById(realm, null, id); PermissionTicket permission = findById(null, id);
if (permission == null) return; if (permission == null) return;
cache.invalidateObject(id); cache.invalidateObject(id);
@ -1126,13 +1125,13 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} }
invalidationEvents.add(PermissionTicketRemovedEvent.create(id, permission.getOwner(), permission.getRequester(), permission.getResource().getId(), permission.getResource().getName(), scopeId, permission.getResourceServer().getId())); invalidationEvents.add(PermissionTicketRemovedEvent.create(id, permission.getOwner(), permission.getRequester(), permission.getResource().getId(), permission.getResource().getName(), scopeId, permission.getResourceServer().getId()));
cache.permissionTicketRemoval(id, permission.getOwner(), permission.getRequester(), permission.getResource().getId(), permission.getResource().getName(),scopeId, permission.getResourceServer().getId(), invalidations); cache.permissionTicketRemoval(id, permission.getOwner(), permission.getRequester(), permission.getResource().getId(), permission.getResource().getName(),scopeId, permission.getResourceServer().getId(), invalidations);
getPermissionTicketStoreDelegate().delete(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, id); getPermissionTicketStoreDelegate().delete(id);
UserManagedPermissionUtil.removePolicy(permission, StoreFactoryCacheSession.this); UserManagedPermissionUtil.removePolicy(permission, StoreFactoryCacheSession.this);
} }
@Override @Override
public PermissionTicket findById(RealmModel realm, ResourceServer resourceServer, String id) { public PermissionTicket findById(ResourceServer resourceServer, String id) {
if (id == null) return null; if (id == null) return null;
CachedPermissionTicket cached = cache.get(id, CachedPermissionTicket.class); CachedPermissionTicket cached = cache.get(id, CachedPermissionTicket.class);
@ -1142,7 +1141,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (cached == null) { if (cached == null) {
Long loaded = cache.getCurrentRevision(id); Long loaded = cache.getCurrentRevision(id);
if (! modelMightExist(id)) return null; if (! modelMightExist(id)) return null;
PermissionTicket model = getPermissionTicketStoreDelegate().findById(realm, resourceServer, id); PermissionTicket model = getPermissionTicketStoreDelegate().findById(resourceServer, id);
if (model == null) { if (model == null) {
setModelDoesNotExists(id, loaded); setModelDoesNotExists(id, loaded);
return null; return null;
@ -1151,7 +1150,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
cached = new CachedPermissionTicket(loaded, model); cached = new CachedPermissionTicket(loaded, model);
cache.addRevisioned(cached, startupRevision); cache.addRevisioned(cached, startupRevision);
} else if (invalidations.contains(id)) { } else if (invalidations.contains(id)) {
return getPermissionTicketStoreDelegate().findById(realm, resourceServer, id); return getPermissionTicketStoreDelegate().findById(resourceServer, id);
} else if (managedPermissionTickets.containsKey(id)) { } else if (managedPermissionTickets.containsKey(id)) {
return managedPermissionTickets.get(id); return managedPermissionTickets.get(id);
} }
@ -1177,8 +1176,8 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} }
@Override @Override
public List<PermissionTicket> find(RealmModel realm, ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResult) { public List<PermissionTicket> find(ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResult) {
return getPermissionTicketStoreDelegate().find(realm, resourceServer, attributes, firstResult, maxResult); return getPermissionTicketStoreDelegate().find(resourceServer, attributes, firstResult, maxResult);
} }
@Override @Override
@ -1198,13 +1197,13 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} }
@Override @Override
public List<Resource> findGrantedResources(RealmModel realm, String requester, String name, Integer first, Integer max) { public List<Resource> findGrantedResources(String requester, String name, Integer first, Integer max) {
return getPermissionTicketStoreDelegate().findGrantedResources(realm, requester, name, first, max); return getPermissionTicketStoreDelegate().findGrantedResources(requester, name, first, max);
} }
@Override @Override
public List<Resource> findGrantedOwnerResources(RealmModel realm, String owner, Integer firstResult, Integer maxResults) { public List<Resource> findGrantedOwnerResources(String owner, Integer firstResult, Integer maxResults) {
return getPermissionTicketStoreDelegate().findGrantedOwnerResources(realm, owner, firstResult, maxResults); return getPermissionTicketStoreDelegate().findGrantedOwnerResources(owner, firstResult, maxResults);
} }
private <R, Q extends PermissionTicketQuery> List<R> cacheQuery(String cacheKey, Class<Q> queryType, Supplier<List<R>> resultSupplier, BiFunction<Long, List<R>, Q> querySupplier, ResourceServer resourceServer) { private <R, Q extends PermissionTicketQuery> List<R> cacheQuery(String cacheKey, Class<Q> queryType, Supplier<List<R>> resultSupplier, BiFunction<Long, List<R>, Q> querySupplier, ResourceServer resourceServer) {
@ -1223,7 +1222,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} else if (query.isInvalid(invalidations)) { } else if (query.isInvalid(invalidations)) {
return resultSupplier.get(); return resultSupplier.get();
} else { } else {
return query.getPermissions().stream().map(resourceId -> (R) findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId)).collect(Collectors.toList()); return query.getPermissions().stream().map(resourceId -> (R) findById(resourceServer, resourceId)).collect(Collectors.toList());
} }
} }
} }

9
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAAuthorizationStoreFactory.java
View file

@ -35,15 +35,6 @@ import static org.keycloak.models.jpa.JpaRealmProviderFactory.PROVIDER_PRIORITY;
*/ */
public class JPAAuthorizationStoreFactory implements AuthorizationStoreFactory { public class JPAAuthorizationStoreFactory implements AuthorizationStoreFactory {
/**
* Legacy store doesn't store realm id for any entity and no method there is using new introduced RealmModel parameter.
* The parameter was introduced for usage only in the new storage. Therefore, in some cases we may break our rule specified in JavaDoc
* and use {@code null} value as parameter that otherwise cannot be {@code null}. We need to be careful and place such value only to a method call
* that cannot end up in the new store because it would end with {@link NullPointerException}. To mark all places where we do this,
* we use this variable so it is easily searchable.
*/
public static final RealmModel NULL_REALM = null;
@Override @Override
public StoreFactory create(KeycloakSession session) { public StoreFactory create(KeycloakSession session) {
AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class); AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);

25
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAPermissionTicketStore.java
View file

@ -41,7 +41,6 @@ import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore; import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.ResourceStore; import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.common.util.Time; import org.keycloak.common.util.Time;
import org.keycloak.models.RealmModel;
import org.keycloak.models.utils.KeycloakModelUtils; import org.keycloak.models.utils.KeycloakModelUtils;
import jakarta.persistence.LockModeType; import jakarta.persistence.LockModeType;
@ -152,7 +151,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
PermissionTicketEntity policy = entityManager.find(PermissionTicketEntity.class, id, LockModeType.PESSIMISTIC_WRITE); PermissionTicketEntity policy = entityManager.find(PermissionTicketEntity.class, id, LockModeType.PESSIMISTIC_WRITE);
if (policy != null) { if (policy != null) {
this.entityManager.remove(policy); this.entityManager.remove(policy);
@ -161,7 +160,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
@Override @Override
public PermissionTicket findById(RealmModel realm, ResourceServer resourceServer, String id) { public PermissionTicket findById(ResourceServer resourceServer, String id) {
if (id == null) { if (id == null) {
return null; return null;
} }
@ -185,7 +184,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore(); PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
for (String id : result) { for (String id : result) {
PermissionTicket ticket = ticketStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id); PermissionTicket ticket = ticketStore.findById(resourceServer, id);
if (Objects.nonNull(ticket)) { if (Objects.nonNull(ticket)) {
list.add(ticket); list.add(ticket);
} }
@ -212,7 +211,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore(); PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
for (String id : result) { for (String id : result) {
PermissionTicket ticket = ticketStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id); PermissionTicket ticket = ticketStore.findById(resourceServer, id);
if (Objects.nonNull(ticket)) { if (Objects.nonNull(ticket)) {
list.add(ticket); list.add(ticket);
} }
@ -222,7 +221,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
} }
@Override @Override
public List<PermissionTicket> find(RealmModel realm, ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResult) { public List<PermissionTicket> find(ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResult) {
CriteriaBuilder builder = entityManager.getCriteriaBuilder(); CriteriaBuilder builder = entityManager.getCriteriaBuilder();
CriteriaQuery<String> querybuilder = builder.createQuery(String.class); CriteriaQuery<String> querybuilder = builder.createQuery(String.class);
Root<PermissionTicketEntity> root = querybuilder.from(PermissionTicketEntity.class); Root<PermissionTicketEntity> root = querybuilder.from(PermissionTicketEntity.class);
@ -240,7 +239,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore(); PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
for (String id : result) { for (String id : result) {
PermissionTicket ticket = ticketStore.findById(realm, resourceServer, id); PermissionTicket ticket = ticketStore.findById(resourceServer, id);
if (Objects.nonNull(ticket)) { if (Objects.nonNull(ticket)) {
list.add(ticket); list.add(ticket);
} }
@ -256,7 +255,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString()); filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
filters.put(PermissionTicket.FilterOption.REQUESTER, userId); filters.put(PermissionTicket.FilterOption.REQUESTER, userId);
return find(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, filters, null, null); return find(resourceServer, filters, null, null);
} }
@Override @Override
@ -267,11 +266,11 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString()); filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
filters.put(PermissionTicket.FilterOption.REQUESTER, userId); filters.put(PermissionTicket.FilterOption.REQUESTER, userId);
return find(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, filters, null, null); return find(resourceServer, filters, null, null);
} }
@Override @Override
public List<Resource> findGrantedResources(RealmModel realm, String requester, String name, Integer first, Integer max) { public List<Resource> findGrantedResources(String requester, String name, Integer first, Integer max) {
TypedQuery<String> query = name == null ? TypedQuery<String> query = name == null ?
entityManager.createNamedQuery("findGrantedResources", String.class) : entityManager.createNamedQuery("findGrantedResources", String.class) :
entityManager.createNamedQuery("findGrantedResourcesByName", String.class); entityManager.createNamedQuery("findGrantedResourcesByName", String.class);
@ -288,7 +287,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore(); ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
for (String id : result) { for (String id : result) {
Resource resource = resourceStore.findById(realm, null, id); Resource resource = resourceStore.findById(null, id);
if (Objects.nonNull(resource)) { if (Objects.nonNull(resource)) {
list.add(resource); list.add(resource);
@ -299,7 +298,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
} }
@Override @Override
public List<Resource> findGrantedOwnerResources(RealmModel realm, String owner, Integer firstResult, Integer maxResults) { public List<Resource> findGrantedOwnerResources(String owner, Integer firstResult, Integer maxResults) {
TypedQuery<String> query = entityManager.createNamedQuery("findGrantedOwnerResources", String.class); TypedQuery<String> query = entityManager.createNamedQuery("findGrantedOwnerResources", String.class);
query.setFlushMode(FlushModeType.COMMIT); query.setFlushMode(FlushModeType.COMMIT);
@ -310,7 +309,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore(); ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
for (String id : result) { for (String id : result) {
Resource resource = resourceStore.findById(realm, null, id); Resource resource = resourceStore.findById(null, id);
if (Objects.nonNull(resource)) { if (Objects.nonNull(resource)) {
list.add(resource); list.add(resource);

19
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAPolicyStore.java
View file

@ -42,7 +42,6 @@ import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PolicyStore; import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.utils.KeycloakModelUtils; import org.keycloak.models.utils.KeycloakModelUtils;
import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation; import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
import jakarta.persistence.LockModeType; import jakarta.persistence.LockModeType;
@ -83,7 +82,7 @@ public class JPAPolicyStore implements PolicyStore {
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
PolicyEntity policy = entityManager.find(PolicyEntity.class, id, LockModeType.PESSIMISTIC_WRITE); PolicyEntity policy = entityManager.find(PolicyEntity.class, id, LockModeType.PESSIMISTIC_WRITE);
if (policy != null) { if (policy != null) {
this.entityManager.remove(policy); this.entityManager.remove(policy);
@ -92,7 +91,7 @@ public class JPAPolicyStore implements PolicyStore {
@Override @Override
public Policy findById(RealmModel realm, ResourceServer resourceServer, String id) { public Policy findById(ResourceServer resourceServer, String id) {
if (id == null) { if (id == null) {
return null; return null;
} }
@ -130,7 +129,7 @@ public class JPAPolicyStore implements PolicyStore {
List<String> result = query.getResultList(); List<String> result = query.getResultList();
List<Policy> list = new LinkedList<>(); List<Policy> list = new LinkedList<>();
for (String id : result) { for (String id : result) {
Policy policy = provider.getStoreFactory().getPolicyStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id); Policy policy = provider.getStoreFactory().getPolicyStore().findById(resourceServer, id);
if (Objects.nonNull(policy)) { if (Objects.nonNull(policy)) {
list.add(policy); list.add(policy);
} }
@ -139,7 +138,7 @@ public class JPAPolicyStore implements PolicyStore {
} }
@Override @Override
public List<Policy> find(RealmModel realm, ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) { public List<Policy> find(ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
CriteriaBuilder builder = entityManager.getCriteriaBuilder(); CriteriaBuilder builder = entityManager.getCriteriaBuilder();
CriteriaQuery<String> querybuilder = builder.createQuery(String.class); CriteriaQuery<String> querybuilder = builder.createQuery(String.class);
Root<PolicyEntity> root = querybuilder.from(PolicyEntity.class); Root<PolicyEntity> root = querybuilder.from(PolicyEntity.class);
@ -200,7 +199,7 @@ public class JPAPolicyStore implements PolicyStore {
List<Policy> list = new LinkedList<>(); List<Policy> list = new LinkedList<>();
PolicyStore policyStore = provider.getStoreFactory().getPolicyStore(); PolicyStore policyStore = provider.getStoreFactory().getPolicyStore();
for (String id : result) { for (String id : result) {
Policy policy = policyStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id); Policy policy = policyStore.findById(resourceServer, id);
if (Objects.nonNull(policy)) { if (Objects.nonNull(policy)) {
list.add(policy); list.add(policy);
} }
@ -219,7 +218,7 @@ public class JPAPolicyStore implements PolicyStore {
PolicyStore storeFactory = provider.getStoreFactory().getPolicyStore(); PolicyStore storeFactory = provider.getStoreFactory().getPolicyStore();
closing(query.getResultStream() closing(query.getResultStream()
.map(entity -> storeFactory.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, entity.getId())) .map(entity -> storeFactory.findById(resourceServer, entity.getId()))
.filter(Objects::nonNull)) .filter(Objects::nonNull))
.forEach(consumer::accept); .forEach(consumer::accept);
} }
@ -255,7 +254,7 @@ public class JPAPolicyStore implements PolicyStore {
PolicyStore storeFactory = provider.getStoreFactory().getPolicyStore(); PolicyStore storeFactory = provider.getStoreFactory().getPolicyStore();
for (PolicyEntity entity : query.getResultList()) { for (PolicyEntity entity : query.getResultList()) {
list.add(storeFactory.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, entity.getId())); list.add(storeFactory.findById(resourceServer, entity.getId()));
} }
return list; return list;
@ -296,7 +295,7 @@ public class JPAPolicyStore implements PolicyStore {
List<String> result = query.getResultList(); List<String> result = query.getResultList();
List<Policy> list = new LinkedList<>(); List<Policy> list = new LinkedList<>();
for (String id : result) { for (String id : result) {
Policy policy = provider.getStoreFactory().getPolicyStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id); Policy policy = provider.getStoreFactory().getPolicyStore().findById(resourceServer, id);
if (Objects.nonNull(policy)) { if (Objects.nonNull(policy)) {
list.add(policy); list.add(policy);
} }
@ -316,7 +315,7 @@ public class JPAPolicyStore implements PolicyStore {
List<String> result = query.getResultList(); List<String> result = query.getResultList();
List<Policy> list = new LinkedList<>(); List<Policy> list = new LinkedList<>();
for (String id : result) { for (String id : result) {
Policy policy = provider.getStoreFactory().getPolicyStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id); Policy policy = provider.getStoreFactory().getPolicyStore().findById(resourceServer, id);
if (Objects.nonNull(policy)) { if (Objects.nonNull(policy)) {
list.add(policy); list.add(policy);
} }

9
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAResourceServerStore.java
View file

@ -25,7 +25,6 @@ import org.keycloak.authorization.jpa.entities.ScopeEntity;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.store.ResourceServerStore; import org.keycloak.authorization.store.ResourceServerStore;
import org.keycloak.models.ModelException; import org.keycloak.models.ModelException;
import org.keycloak.models.RealmModel;
import org.keycloak.storage.StorageId; import org.keycloak.storage.StorageId;
import jakarta.persistence.EntityManager; import jakarta.persistence.EntityManager;
@ -58,7 +57,7 @@ public class JPAResourceServerStore implements ResourceServerStore {
this.entityManager.persist(entity); this.entityManager.persist(entity);
return new ResourceServerAdapter(client.getRealm(), entity, entityManager, provider.getStoreFactory()); return new ResourceServerAdapter(entity, entityManager, provider.getStoreFactory());
} }
@Override @Override
@ -122,14 +121,14 @@ public class JPAResourceServerStore implements ResourceServerStore {
} }
@Override @Override
public ResourceServer findById(RealmModel realm, String id) { public ResourceServer findById(String id) {
ResourceServerEntity entity = entityManager.find(ResourceServerEntity.class, id); ResourceServerEntity entity = entityManager.find(ResourceServerEntity.class, id);
if (entity == null) return null; if (entity == null) return null;
return new ResourceServerAdapter(provider.getRealm(), entity, entityManager, provider.getStoreFactory()); return new ResourceServerAdapter(entity, entityManager, provider.getStoreFactory());
} }
@Override @Override
public ResourceServer findByClient(ClientModel client) { public ResourceServer findByClient(ClientModel client) {
return findById(JPAAuthorizationStoreFactory.NULL_REALM, client.getId()); return findById(client.getId());
} }
} }

15
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAResourceStore.java
View file

@ -23,7 +23,6 @@ import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.ResourceStore; import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.utils.KeycloakModelUtils; import org.keycloak.models.utils.KeycloakModelUtils;
import jakarta.persistence.EntityManager; import jakarta.persistence.EntityManager;
@ -80,7 +79,7 @@ public class JPAResourceStore implements ResourceStore {
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
ResourceEntity resource = entityManager.getReference(ResourceEntity.class, id); ResourceEntity resource = entityManager.getReference(ResourceEntity.class, id);
if (resource == null) return; if (resource == null) return;
@ -89,7 +88,7 @@ public class JPAResourceStore implements ResourceStore {
} }
@Override @Override
public Resource findById(RealmModel realm, ResourceServer resourceServer, String id) { public Resource findById(ResourceServer resourceServer, String id) {
if (id == null) { if (id == null) {
return null; return null;
} }
@ -100,7 +99,7 @@ public class JPAResourceStore implements ResourceStore {
} }
@Override @Override
public void findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) { public void findByOwner(ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
findByOwnerFilter(ownerId, resourceServer, consumer, -1, -1); findByOwnerFilter(ownerId, resourceServer, consumer, -1, -1);
} }
@ -127,7 +126,7 @@ public class JPAResourceStore implements ResourceStore {
} }
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore(); ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
closing(query.getResultStream().map(id -> resourceStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id.getId()))).forEach(consumer); closing(query.getResultStream().map(id -> resourceStore.findById(resourceServer, id.getId()))).forEach(consumer);
} }
@Override @Override
@ -141,7 +140,7 @@ public class JPAResourceStore implements ResourceStore {
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore(); ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
for (String id : result) { for (String id : result) {
Resource resource = resourceStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id); Resource resource = resourceStore.findById(resourceServer, id);
if (resource != null) { if (resource != null) {
list.add(resource); list.add(resource);
@ -152,7 +151,7 @@ public class JPAResourceStore implements ResourceStore {
} }
@Override @Override
public List<Resource> find(RealmModel realm, ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) { public List<Resource> find(ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
CriteriaBuilder builder = entityManager.getCriteriaBuilder(); CriteriaBuilder builder = entityManager.getCriteriaBuilder();
CriteriaQuery<String> querybuilder = builder.createQuery(String.class); CriteriaQuery<String> querybuilder = builder.createQuery(String.class);
Root<ResourceEntity> root = querybuilder.from(ResourceEntity.class); Root<ResourceEntity> root = querybuilder.from(ResourceEntity.class);
@ -205,7 +204,7 @@ public class JPAResourceStore implements ResourceStore {
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore(); ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
for (String id : result) { for (String id : result) {
Resource resource = resourceStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id); Resource resource = resourceStore.findById(resourceServer, id);
if (resource != null) { if (resource != null) {
list.add(resource); list.add(resource);

11
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAScopeStore.java
View file

@ -35,7 +35,6 @@ import org.keycloak.authorization.jpa.entities.ScopeEntity;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.ScopeStore; import org.keycloak.authorization.store.ScopeStore;
import org.keycloak.models.RealmModel;
import org.keycloak.models.utils.KeycloakModelUtils; import org.keycloak.models.utils.KeycloakModelUtils;
import jakarta.persistence.LockModeType; import jakarta.persistence.LockModeType;
@ -79,7 +78,7 @@ public class JPAScopeStore implements ScopeStore {
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
ScopeEntity scope = entityManager.find(ScopeEntity.class, id, LockModeType.PESSIMISTIC_WRITE); ScopeEntity scope = entityManager.find(ScopeEntity.class, id, LockModeType.PESSIMISTIC_WRITE);
if (scope != null) { if (scope != null) {
@ -88,7 +87,7 @@ public class JPAScopeStore implements ScopeStore {
} }
@Override @Override
public Scope findById(RealmModel realm, ResourceServer resourceServer, String id) { public Scope findById(ResourceServer resourceServer, String id) {
if (id == null) { if (id == null) {
return null; return null;
} }
@ -109,7 +108,7 @@ public class JPAScopeStore implements ScopeStore {
query.setParameter("name", name); query.setParameter("name", name);
String id = query.getSingleResult(); String id = query.getSingleResult();
return provider.getStoreFactory().getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id); return provider.getStoreFactory().getScopeStore().findById(resourceServer, id);
} catch (NoResultException nre) { } catch (NoResultException nre) {
return null; return null;
} }
@ -125,7 +124,7 @@ public class JPAScopeStore implements ScopeStore {
List<String> result = query.getResultList(); List<String> result = query.getResultList();
List<Scope> list = new LinkedList<>(); List<Scope> list = new LinkedList<>();
for (String id : result) { for (String id : result) {
list.add(provider.getStoreFactory().getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id)); list.add(provider.getStoreFactory().getScopeStore().findById(resourceServer, id));
} }
return list; return list;
} }
@ -160,7 +159,7 @@ public class JPAScopeStore implements ScopeStore {
List<String> result = paginateQuery(query, firstResult, maxResults).getResultList(); List<String> result = paginateQuery(query, firstResult, maxResults).getResultList();
List<Scope> list = new LinkedList<>(); List<Scope> list = new LinkedList<>();
for (String id : result) { for (String id : result) {
list.add(provider.getStoreFactory().getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id)); list.add(provider.getStoreFactory().getScopeStore().findById(resourceServer, id));
} }
return list; return list;

10
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/PermissionTicketAdapter.java
View file

@ -90,7 +90,7 @@ public class PermissionTicketAdapter implements PermissionTicket, JpaModel<Permi
@Override @Override
public ResourceServer getResourceServer() { public ResourceServer getResourceServer() {
return storeFactory.getResourceServerStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, entity.getResourceServer().getId()); return storeFactory.getResourceServerStore().findById(entity.getResourceServer().getId());
} }
@Override @Override
@ -101,8 +101,8 @@ public class PermissionTicketAdapter implements PermissionTicket, JpaModel<Permi
return null; return null;
} }
ResourceServer resourceServer = storeFactory.getResourceServerStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, entity.getResourceServer().getId()); ResourceServer resourceServer = storeFactory.getResourceServerStore().findById(entity.getResourceServer().getId());
return storeFactory.getPolicyStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, policy.getId()); return storeFactory.getPolicyStore().findById(resourceServer, policy.getId());
} }
@Override @Override
@ -114,7 +114,7 @@ public class PermissionTicketAdapter implements PermissionTicket, JpaModel<Permi
@Override @Override
public Resource getResource() { public Resource getResource() {
return storeFactory.getResourceStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, getResourceServer(), entity.getResource().getId()); return storeFactory.getResourceStore().findById(getResourceServer(), entity.getResource().getId());
} }
@Override @Override
@ -125,7 +125,7 @@ public class PermissionTicketAdapter implements PermissionTicket, JpaModel<Permi
return null; return null;
} }
return storeFactory.getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, getResourceServer(), scope.getId()); return storeFactory.getScopeStore().findById(getResourceServer(), scope.getId());
} }
@Override @Override

6
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/PolicyAdapter.java
View file

@ -153,7 +153,7 @@ public class PolicyAdapter extends AbstractAuthorizationModel implements Policy,
@Override @Override
public ResourceServer getResourceServer() { public ResourceServer getResourceServer() {
return storeFactory.getResourceServerStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, entity.getResourceServer().getId()); return storeFactory.getResourceServerStore().findById(entity.getResourceServer().getId());
} }
@Override @Override
@ -170,7 +170,7 @@ public class PolicyAdapter extends AbstractAuthorizationModel implements Policy,
Set<Resource> set = new HashSet<>(); Set<Resource> set = new HashSet<>();
ResourceServer resourceServer = getResourceServer(); ResourceServer resourceServer = getResourceServer();
for (ResourceEntity res : entity.getResources()) { for (ResourceEntity res : entity.getResources()) {
set.add(storeFactory.getResourceStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, res.getId())); set.add(storeFactory.getResourceStore().findById(resourceServer, res.getId()));
} }
return Collections.unmodifiableSet(set); return Collections.unmodifiableSet(set);
} }
@ -180,7 +180,7 @@ public class PolicyAdapter extends AbstractAuthorizationModel implements Policy,
Set<Scope> set = new HashSet<>(); Set<Scope> set = new HashSet<>();
ResourceServer resourceServer = getResourceServer(); ResourceServer resourceServer = getResourceServer();
for (ScopeEntity res : entity.getScopes()) { for (ScopeEntity res : entity.getScopes()) {
set.add(storeFactory.getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, res.getId())); set.add(storeFactory.getScopeStore().findById(resourceServer, res.getId()));
} }
return Collections.unmodifiableSet(set); return Collections.unmodifiableSet(set);
} }

4
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/ResourceAdapter.java
View file

@ -118,7 +118,7 @@ public class ResourceAdapter extends AbstractAuthorizationModel implements Resou
List<Scope> scopes = new LinkedList<>(); List<Scope> scopes = new LinkedList<>();
ResourceServer resourceServer = getResourceServer(); ResourceServer resourceServer = getResourceServer();
for (ScopeEntity scope : entity.getScopes()) { for (ScopeEntity scope : entity.getScopes()) {
scopes.add(storeFactory.getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, scope.getId())); scopes.add(storeFactory.getScopeStore().findById(resourceServer, scope.getId()));
} }
return Collections.unmodifiableList(scopes); return Collections.unmodifiableList(scopes);
@ -138,7 +138,7 @@ public class ResourceAdapter extends AbstractAuthorizationModel implements Resou
@Override @Override
public ResourceServer getResourceServer() { public ResourceServer getResourceServer() {
return storeFactory.getResourceServerStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, entity.getResourceServer()); return storeFactory.getResourceServerStore().findById(entity.getResourceServer());
} }
@Override @Override

8
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/ResourceServerAdapter.java
View file

@ -20,7 +20,6 @@ import org.keycloak.authorization.jpa.entities.ResourceServerEntity;
import org.keycloak.authorization.model.AbstractAuthorizationModel; import org.keycloak.authorization.model.AbstractAuthorizationModel;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.jpa.JpaModel; import org.keycloak.models.jpa.JpaModel;
import org.keycloak.representations.idm.authorization.DecisionStrategy; import org.keycloak.representations.idm.authorization.DecisionStrategy;
import org.keycloak.representations.idm.authorization.PolicyEnforcementMode; import org.keycloak.representations.idm.authorization.PolicyEnforcementMode;
@ -36,7 +35,7 @@ public class ResourceServerAdapter extends AbstractAuthorizationModel implements
private EntityManager em; private EntityManager em;
private StoreFactory storeFactory; private StoreFactory storeFactory;
public ResourceServerAdapter(RealmModel realm, ResourceServerEntity entity, EntityManager em, StoreFactory storeFactory) { public ResourceServerAdapter(ResourceServerEntity entity, EntityManager em, StoreFactory storeFactory) {
super(storeFactory); super(storeFactory);
this.entity = entity; this.entity = entity;
this.em = em; this.em = em;
@ -93,11 +92,6 @@ public class ResourceServerAdapter extends AbstractAuthorizationModel implements
return getId(); return getId();
} }
@Override
public RealmModel getRealm() {
return null;
}
@Override @Override
public boolean equals(Object o) { public boolean equals(Object o) {
if (this == o) return true; if (this == o) return true;

2
model/jpa/src/main/java/org/keycloak/authorization/jpa/store/ScopeAdapter.java
View file

@ -88,7 +88,7 @@ public class ScopeAdapter extends AbstractAuthorizationModel implements Scope, J
@Override @Override
public ResourceServer getResourceServer() { public ResourceServer getResourceServer() {
return storeFactory.getResourceServerStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, entity.getResourceServer().getId()); return storeFactory.getResourceServerStore().findById(entity.getResourceServer().getId());
} }
public static ScopeEntity toEntity(EntityManager em, Scope scope) { public static ScopeEntity toEntity(EntityManager em, Scope scope) {

63
server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationProvider.java
View file

@ -250,21 +250,21 @@ public final class AuthorizationProvider implements Provider {
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
Scope scope = findById(realm, null, id); Scope scope = findById(null, id);
PermissionTicketStore ticketStore = AuthorizationProvider.this.getStoreFactory().getPermissionTicketStore(); PermissionTicketStore ticketStore = AuthorizationProvider.this.getStoreFactory().getPermissionTicketStore();
List<PermissionTicket> permissions = ticketStore.findByScope(scope.getResourceServer(), scope); List<PermissionTicket> permissions = ticketStore.findByScope(scope.getResourceServer(), scope);
for (PermissionTicket permission : permissions) { for (PermissionTicket permission : permissions) {
ticketStore.delete(realm, permission.getId()); ticketStore.delete(permission.getId());
} }
delegate.delete(realm, id); delegate.delete(id);
} }
@Override @Override
public Scope findById(RealmModel realm, ResourceServer resourceServer, String id) { public Scope findById(ResourceServer resourceServer, String id) {
return delegate.findById(realm, resourceServer, id); return delegate.findById(resourceServer, id);
} }
@Override @Override
@ -292,11 +292,10 @@ public final class AuthorizationProvider implements Provider {
@Override @Override
public Policy create(ResourceServer resourceServer, AbstractPolicyRepresentation representation) { public Policy create(ResourceServer resourceServer, AbstractPolicyRepresentation representation) {
Set<String> resources = representation.getResources(); Set<String> resources = representation.getResources();
RealmModel realm = resourceServer.getRealm();
if (resources != null) { if (resources != null) {
representation.setResources(resources.stream().map(id -> { representation.setResources(resources.stream().map(id -> {
Resource resource = storeFactory.getResourceStore().findById(realm, resourceServer, id); Resource resource = storeFactory.getResourceStore().findById(resourceServer, id);
if (resource == null) { if (resource == null) {
resource = storeFactory.getResourceStore().findByName(resourceServer, id); resource = storeFactory.getResourceStore().findByName(resourceServer, id);
@ -314,7 +313,7 @@ public final class AuthorizationProvider implements Provider {
if (scopes != null) { if (scopes != null) {
representation.setScopes(scopes.stream().map(id -> { representation.setScopes(scopes.stream().map(id -> {
Scope scope = storeFactory.getScopeStore().findById(realm, resourceServer, id); Scope scope = storeFactory.getScopeStore().findById(resourceServer, id);
if (scope == null) { if (scope == null) {
scope = storeFactory.getScopeStore().findByName(resourceServer, id); scope = storeFactory.getScopeStore().findByName(resourceServer, id);
@ -333,7 +332,7 @@ public final class AuthorizationProvider implements Provider {
if (policies != null) { if (policies != null) {
representation.setPolicies(policies.stream().map(id -> { representation.setPolicies(policies.stream().map(id -> {
Policy policy = storeFactory.getPolicyStore().findById(realm, resourceServer, id); Policy policy = storeFactory.getPolicyStore().findById(resourceServer, id);
if (policy == null) { if (policy == null) {
policy = storeFactory.getPolicyStore().findByName(resourceServer, id); policy = storeFactory.getPolicyStore().findByName(resourceServer, id);
@ -351,8 +350,8 @@ public final class AuthorizationProvider implements Provider {
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
Policy policy = findById(realm, null, id); Policy policy = findById(null, id);
if (policy != null) { if (policy != null) {
ResourceServer resourceServer = policy.getResourceServer(); ResourceServer resourceServer = policy.getResourceServer();
@ -363,7 +362,7 @@ public final class AuthorizationProvider implements Provider {
// only remove associated policies created from the policy being deleted // only remove associated policies created from the policy being deleted
if (associatedPolicy.getOwner() != null) { if (associatedPolicy.getOwner() != null) {
policy.removeAssociatedPolicy(associatedPolicy); policy.removeAssociatedPolicy(associatedPolicy);
policyStore.delete(realm, associatedPolicy.getId()); policyStore.delete(associatedPolicy.getId());
} }
} }
} }
@ -371,17 +370,17 @@ public final class AuthorizationProvider implements Provider {
findDependentPolicies(resourceServer, policy.getId()).forEach(dependentPolicy -> { findDependentPolicies(resourceServer, policy.getId()).forEach(dependentPolicy -> {
dependentPolicy.removeAssociatedPolicy(policy); dependentPolicy.removeAssociatedPolicy(policy);
if (dependentPolicy.getAssociatedPolicies().isEmpty()) { if (dependentPolicy.getAssociatedPolicies().isEmpty()) {
delete(realm, dependentPolicy.getId()); delete(dependentPolicy.getId());
} }
}); });
policyStore.delete(realm, id); policyStore.delete(id);
} }
} }
@Override @Override
public Policy findById(RealmModel realm, ResourceServer resourceServer, String id) { public Policy findById(ResourceServer resourceServer, String id) {
return policyStore.findById(realm, resourceServer, id); return policyStore.findById(resourceServer, id);
} }
@Override @Override
@ -395,8 +394,8 @@ public final class AuthorizationProvider implements Provider {
} }
@Override @Override
public List<Policy> find(RealmModel realm, ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) { public List<Policy> find(ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return policyStore.find(realm, resourceServer, attributes, firstResult, maxResults); return policyStore.find(resourceServer, attributes, firstResult, maxResults);
} }
@Override @Override
@ -461,14 +460,14 @@ public final class AuthorizationProvider implements Provider {
} }
@Override @Override
public void delete(RealmModel realm, String id) { public void delete(String id) {
Resource resource = findById(realm, null, id); Resource resource = findById(null, id);
StoreFactory storeFactory = AuthorizationProvider.this.getStoreFactory(); StoreFactory storeFactory = AuthorizationProvider.this.getStoreFactory();
PermissionTicketStore ticketStore = storeFactory.getPermissionTicketStore(); PermissionTicketStore ticketStore = storeFactory.getPermissionTicketStore();
List<PermissionTicket> permissions = ticketStore.findByResource(resource.getResourceServer(), resource); List<PermissionTicket> permissions = ticketStore.findByResource(resource.getResourceServer(), resource);
for (PermissionTicket permission : permissions) { for (PermissionTicket permission : permissions) {
ticketStore.delete(realm, permission.getId()); ticketStore.delete(permission.getId());
} }
PolicyStore policyStore = storeFactory.getPolicyStore(); PolicyStore policyStore = storeFactory.getPolicyStore();
@ -476,28 +475,28 @@ public final class AuthorizationProvider implements Provider {
for (Policy policyModel : policies) { for (Policy policyModel : policies) {
if (policyModel.getResources().size() == 1) { if (policyModel.getResources().size() == 1) {
policyStore.delete(realm, policyModel.getId()); policyStore.delete(policyModel.getId());
} else { } else {
policyModel.removeResource(resource); policyModel.removeResource(resource);
} }
} }
delegate.delete(realm, id); delegate.delete(id);
} }
@Override @Override
public Resource findById(RealmModel realm, ResourceServer resourceServer, String id) { public Resource findById(ResourceServer resourceServer, String id) {
return delegate.findById(realm, resourceServer, id); return delegate.findById(resourceServer, id);
} }
@Override @Override
public List<Resource> findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId) { public List<Resource> findByOwner(ResourceServer resourceServer, String ownerId) {
return delegate.findByOwner(realm, resourceServer, ownerId); return delegate.findByOwner(resourceServer, ownerId);
} }
@Override @Override
public void findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) { public void findByOwner(ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
delegate.findByOwner(realm, resourceServer, ownerId, consumer); delegate.findByOwner(resourceServer, ownerId, consumer);
} }
@Override @Override
@ -506,8 +505,8 @@ public final class AuthorizationProvider implements Provider {
} }
@Override @Override
public List<Resource> find(RealmModel realm, ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) { public List<Resource> find(ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return delegate.find(realm, resourceServer, attributes, firstResult, maxResults); return delegate.find(resourceServer, attributes, firstResult, maxResults);
} }
@Override @Override

10
server-spi-private/src/main/java/org/keycloak/authorization/UserManagedPermissionUtil.java
View file

@ -26,7 +26,6 @@ import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PolicyStore; import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.utils.KeycloakModelUtils; import org.keycloak.models.utils.KeycloakModelUtils;
import org.keycloak.representations.idm.authorization.PolicyRepresentation; import org.keycloak.representations.idm.authorization.PolicyRepresentation;
import org.keycloak.representations.idm.authorization.UserPolicyRepresentation; import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
@ -49,7 +48,7 @@ public class UserManagedPermissionUtil {
filter.put(PermissionTicket.FilterOption.RESOURCE_ID, ticket.getResource().getId()); filter.put(PermissionTicket.FilterOption.RESOURCE_ID, ticket.getResource().getId());
filter.put(PermissionTicket.FilterOption.POLICY_IS_NOT_NULL, Boolean.TRUE.toString()); filter.put(PermissionTicket.FilterOption.POLICY_IS_NOT_NULL, Boolean.TRUE.toString());
List<PermissionTicket> tickets = storeFactory.getPermissionTicketStore().find(resourceServer.getRealm(), resourceServer, filter, null, null); List<PermissionTicket> tickets = storeFactory.getPermissionTicketStore().find(resourceServer, filter, null, null);
if (!tickets.isEmpty()) { if (!tickets.isEmpty()) {
policy = tickets.iterator().next().getPolicy(); policy = tickets.iterator().next().getPolicy();
@ -74,7 +73,6 @@ public class UserManagedPermissionUtil {
public static void removePolicy(PermissionTicket ticket, StoreFactory storeFactory) { public static void removePolicy(PermissionTicket ticket, StoreFactory storeFactory) {
Policy policy = ticket.getPolicy(); Policy policy = ticket.getPolicy();
RealmModel realm = ticket.getResourceServer().getRealm();
if (policy != null) { if (policy != null) {
Map<PermissionTicket.FilterOption, String> filter = new EnumMap<>(PermissionTicket.FilterOption.class); Map<PermissionTicket.FilterOption, String> filter = new EnumMap<>(PermissionTicket.FilterOption.class);
@ -84,16 +82,16 @@ public class UserManagedPermissionUtil {
filter.put(PermissionTicket.FilterOption.RESOURCE_ID, ticket.getResource().getId()); filter.put(PermissionTicket.FilterOption.RESOURCE_ID, ticket.getResource().getId());
filter.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString()); filter.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
List<PermissionTicket> tickets = storeFactory.getPermissionTicketStore().find(realm, ticket.getResourceServer(), filter, null, null); List<PermissionTicket> tickets = storeFactory.getPermissionTicketStore().find(ticket.getResourceServer(), filter, null, null);
if (tickets.isEmpty()) { if (tickets.isEmpty()) {
PolicyStore policyStore = storeFactory.getPolicyStore(); PolicyStore policyStore = storeFactory.getPolicyStore();
for (Policy associatedPolicy : policy.getAssociatedPolicies()) { for (Policy associatedPolicy : policy.getAssociatedPolicies()) {
policyStore.delete(realm, associatedPolicy.getId()); policyStore.delete(associatedPolicy.getId());
} }
policyStore.delete(realm, policy.getId()); policyStore.delete(policy.getId());
} else if (ticket.getScope() != null) { } else if (ticket.getScope() != null) {
policy.removeScope(ticket.getScope()); policy.removeScope(ticket.getScope());
} }

8
server-spi-private/src/main/java/org/keycloak/authorization/model/ResourceServer.java
View file

@ -18,7 +18,6 @@
package org.keycloak.authorization.model; package org.keycloak.authorization.model;
import org.keycloak.models.RealmModel;
import org.keycloak.representations.idm.authorization.DecisionStrategy; import org.keycloak.representations.idm.authorization.DecisionStrategy;
import org.keycloak.representations.idm.authorization.PolicyEnforcementMode; import org.keycloak.representations.idm.authorization.PolicyEnforcementMode;
@ -85,11 +84,4 @@ public interface ResourceServer {
* @return id of client * @return id of client
*/ */
String getClientId(); String getClientId();
/**
* Returns reference of a realm that this {@link ResourceServer} belongs to.
*
* @return reference of a realm
*/
RealmModel getRealm();
} }

4
server-spi-private/src/main/java/org/keycloak/authorization/permission/Permissions.java
View file

@ -73,7 +73,7 @@ public final class Permissions {
} }
// obtain all resources where owner is the resource server // obtain all resources where owner is the resource server
resourceStore.findByOwner(resourceServer.getRealm(), resourceServer, resourceServer.getClientId(), resource -> { resourceStore.findByOwner(resourceServer, resourceServer.getClientId(), resource -> {
if (limit.decrementAndGet() >= 0) { if (limit.decrementAndGet() >= 0) {
evaluator.accept(createResourcePermissions(resource, resourceServer, resource.getScopes(), authorization, request)); evaluator.accept(createResourcePermissions(resource, resourceServer, resource.getScopes(), authorization, request));
} }
@ -82,7 +82,7 @@ public final class Permissions {
// resource server isn't current user // resource server isn't current user
if (!Objects.equals(resourceServer.getClientId(), identity.getId())) { if (!Objects.equals(resourceServer.getClientId(), identity.getId())) {
// obtain all resources where owner is the current user // obtain all resources where owner is the current user
resourceStore.findByOwner(resourceServer.getRealm(), resourceServer, identity.getId(), resource -> { resourceStore.findByOwner(resourceServer, identity.getId(), resource -> {
if (limit.decrementAndGet() >= 0) { if (limit.decrementAndGet() >= 0) {
evaluator.accept(createResourcePermissions(resource, resourceServer, resource.getScopes(), authorization, request)); evaluator.accept(createResourcePermissions(resource, resourceServer, resource.getScopes(), authorization, request));
} }

10
server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/PermissionTicketAwareDecisionResultCollector.java
View file

@ -32,7 +32,6 @@ import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.ResourceStore; import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.authorization.store.ScopeStore; import org.keycloak.authorization.store.ScopeStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.representations.idm.authorization.AuthorizationRequest; import org.keycloak.representations.idm.authorization.AuthorizationRequest;
import org.keycloak.representations.idm.authorization.Permission; import org.keycloak.representations.idm.authorization.Permission;
import org.keycloak.representations.idm.authorization.PermissionTicketToken; import org.keycloak.representations.idm.authorization.PermissionTicketToken;
@ -91,11 +90,10 @@ public class PermissionTicketAwareDecisionResultCollector extends DecisionPermis
StoreFactory storeFactory = authorization.getStoreFactory(); StoreFactory storeFactory = authorization.getStoreFactory();
ResourceStore resourceStore = storeFactory.getResourceStore(); ResourceStore resourceStore = storeFactory.getResourceStore();
List<Permission> permissions = ticket.getPermissions(); List<Permission> permissions = ticket.getPermissions();
RealmModel realm = resourceServer.getRealm();
if (permissions != null) { if (permissions != null) {
for (Permission permission : permissions) { for (Permission permission : permissions) {
Resource resource = resourceStore.findById(realm, resourceServer, permission.getResourceId()); Resource resource = resourceStore.findById(resourceServer, permission.getResourceId());
if (resource == null) { if (resource == null) {
resource = resourceStore.findByName(resourceServer, permission.getResourceId(), identity.getId()); resource = resourceStore.findByName(resourceServer, permission.getResourceId(), identity.getId());
@ -118,7 +116,7 @@ public class PermissionTicketAwareDecisionResultCollector extends DecisionPermis
filters.put(PermissionTicket.FilterOption.REQUESTER, identity.getId()); filters.put(PermissionTicket.FilterOption.REQUESTER, identity.getId());
filters.put(PermissionTicket.FilterOption.SCOPE_IS_NULL, Boolean.TRUE.toString()); filters.put(PermissionTicket.FilterOption.SCOPE_IS_NULL, Boolean.TRUE.toString());
List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(realm, resourceServer, filters, null, null); List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(resourceServer, filters, null, null);
if (tickets.isEmpty()) { if (tickets.isEmpty()) {
authorization.getStoreFactory().getPermissionTicketStore().create(resourceServer, resource, null, identity.getId()); authorization.getStoreFactory().getPermissionTicketStore().create(resourceServer, resource, null, identity.getId());
@ -130,7 +128,7 @@ public class PermissionTicketAwareDecisionResultCollector extends DecisionPermis
Scope scope = scopeStore.findByName(resourceServer, scopeId); Scope scope = scopeStore.findByName(resourceServer, scopeId);
if (scope == null) { if (scope == null) {
scope = scopeStore.findById(realm, resourceServer, scopeId); scope = scopeStore.findById(resourceServer, scopeId);
} }
Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class); Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
@ -139,7 +137,7 @@ public class PermissionTicketAwareDecisionResultCollector extends DecisionPermis
filters.put(PermissionTicket.FilterOption.REQUESTER, identity.getId()); filters.put(PermissionTicket.FilterOption.REQUESTER, identity.getId());
filters.put(PermissionTicket.FilterOption.SCOPE_ID, scope.getId()); filters.put(PermissionTicket.FilterOption.SCOPE_ID, scope.getId());
List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(realm, resourceServer, filters, null, null); List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(resourceServer, filters, null, null);
if (tickets.isEmpty()) { if (tickets.isEmpty()) {
authorization.getStoreFactory().getPermissionTicketStore().create(resourceServer, resource, scope, identity.getId()); authorization.getStoreFactory().getPermissionTicketStore().create(resourceServer, resource, scope, identity.getId());

45
server-spi-private/src/main/java/org/keycloak/authorization/store/PermissionTicketStore.java
View file

@ -24,7 +24,6 @@ import org.keycloak.authorization.model.PermissionTicket;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.models.RealmModel;
/** /**
* A {@link PermissionTicketStore} is responsible to manage the persistence of {@link org.keycloak.authorization.model.PermissionTicket} instances. * A {@link PermissionTicketStore} is responsible to manage the persistence of {@link org.keycloak.authorization.model.PermissionTicket} instances.
@ -37,7 +36,7 @@ public interface PermissionTicketStore {
* Returns count of {@link PermissionTicket}, filtered by the given attributes. * Returns count of {@link PermissionTicket}, filtered by the given attributes.
* *
* *
* @param resourceServer the resource server. Cannot be {@code null}. * @param resourceServer the resource server.
* @param attributes permission tickets that do not match the attributes are not included with the count; possible filter options are given by {@link PermissionTicket.FilterOption} * @param attributes permission tickets that do not match the attributes are not included with the count; possible filter options are given by {@link PermissionTicket.FilterOption}
* @return an integer indicating the amount of permission tickets * @return an integer indicating the amount of permission tickets
* @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map * @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map
@ -49,7 +48,7 @@ public interface PermissionTicketStore {
* *
* @param resourceServer the resource server to which this permission ticket belongs. Cannot be {@code null}. * @param resourceServer the resource server to which this permission ticket belongs. Cannot be {@code null}.
* @param resource resource. Cannot be {@code null}. * @param resource resource. Cannot be {@code null}.
* @param scope scope. Cannot be {@code null} * @param scope scope.
* @param requester requester of the permission * @param requester requester of the permission
* @return a new instance of {@link PermissionTicket} * @return a new instance of {@link PermissionTicket}
*/ */
@ -58,22 +57,18 @@ public interface PermissionTicketStore {
/** /**
* Deletes a permission from the underlying persistence mechanism. * Deletes a permission from the underlying persistence mechanism.
* *
* @param realm realm. Cannot be {@code null}.
* @param id the id of the policy to delete * @param id the id of the policy to delete
*/ */
void delete(RealmModel realm, String id); void delete(String id);
/** /**
* Returns a {@link PermissionTicket} with the given <code>id</code> * Returns a {@link PermissionTicket} with the given <code>id</code>
* *
*
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the resource server. Ignored if {@code null}. * @param resourceServer the resource server. Ignored if {@code null}.
* @param id the identifier of the permission * @param id the identifier of the permission
* @return a permission with the given identifier. * @return a permission with the given identifier.
*/ */
PermissionTicket findById(RealmModel realm, ResourceServer resourceServer, String id); PermissionTicket findById(ResourceServer resourceServer, String id);
/** /**
* Returns a list of {@link PermissionTicket} associated with the {@link org.keycloak.authorization.model.Resource resource}. * Returns a list of {@link PermissionTicket} associated with the {@link org.keycloak.authorization.model.Resource resource}.
@ -97,18 +92,14 @@ public interface PermissionTicketStore {
/** /**
* Returns a list of {@link PermissionTicket}, filtered by the given attributes. * Returns a list of {@link PermissionTicket}, filtered by the given attributes.
* *
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer a resource server that resulting tickets should belong to. Ignored if {@code null}. * @param resourceServer a resource server that resulting tickets should belong to. Ignored if {@code null}.
* @param attributes a map of keys and values to filter on; possible filter options are given by {@link PermissionTicket.FilterOption} * @param attributes a map of keys and values to filter on; possible filter options are given by {@link PermissionTicket.FilterOption}
* @param firstResult first result to return. Ignored if negative or {@code null}. * @param firstResult first result to return. Ignored if negative or {@code null}.
* @param maxResults maximum number of results to return. Ignored if negative or {@code null}. * @param maxResults maximum number of results to return. Ignored if negative or {@code null}.
* @return a list of filtered and paginated permissions * @return a list of filtered and paginated permissions
*
* @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map * @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map
*
*/ */
List<PermissionTicket> find(RealmModel realm, ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResults); List<PermissionTicket> find(ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResults);
/** /**
* Returns a list of {@link PermissionTicket} granted to the given {@code userId}. * Returns a list of {@link PermissionTicket} granted to the given {@code userId}.
@ -134,25 +125,21 @@ public interface PermissionTicketStore {
/** /**
* Returns a list of {@link Resource} granted to the given {@code requester} * Returns a list of {@link Resource} granted to the given {@code requester}
* *
* * @param requester the requester
* @param realm realm that is searched. Cannot be {@code null} * @param name the keyword to query resources by name or null if any resource
* @param requester the requester
* @param name the keyword to query resources by name or null if any resource
* @param firstResult first result to return. Ignored if negative or {@code null}. * @param firstResult first result to return. Ignored if negative or {@code null}.
* @param maxResults maximum number of results to return. Ignored if negative or {@code null}. * @param maxResults maximum number of results to return. Ignored if negative or {@code null}.
* @return a list of {@link Resource} granted to the given {@code requester} * @return a list of {@link Resource} granted to the given {@code requester}
*/ */
List<Resource> findGrantedResources(RealmModel realm, String requester, String name, Integer firstResult, Integer maxResults); List<Resource> findGrantedResources(String requester, String name, Integer firstResult, Integer maxResults);
/** /**
* Returns a list of {@link Resource} granted by the owner to other users * Returns a list of {@link Resource} granted by the owner to other users
* *
* * @param owner the owner
* @param realm
* @param owner the owner
* @param firstResult first result to return. Ignored if negative or {@code null}. * @param firstResult first result to return. Ignored if negative or {@code null}.
* @param maxResults maximum number of results to return. Ignored if negative or {@code null}. * @param maxResults maximum number of results to return. Ignored if negative or {@code null}.
* @return a list of {@link Resource} granted by the owner * @return a list of {@link Resource} granted by the owner
*/ */
List<Resource> findGrantedOwnerResources(RealmModel realm, String owner, Integer firstResult, Integer maxResults); List<Resource> findGrantedOwnerResources(String owner, Integer firstResult, Integer maxResults);
} }

23
server-spi-private/src/main/java/org/keycloak/authorization/store/PolicyStore.java
View file

@ -26,7 +26,6 @@ import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.models.RealmModel;
import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation; import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
/** /**
@ -49,21 +48,18 @@ public interface PolicyStore {
/** /**
* Deletes a policy from the underlying persistence mechanism. * Deletes a policy from the underlying persistence mechanism.
* *
* @param realm the realm that the removed policy belongs to. Cannot be {@code null}
* @param id the id of the policy to delete * @param id the id of the policy to delete
*/ */
void delete(RealmModel realm, String id); void delete(String id);
/** /**
* Returns a {@link Policy} with the given <code>id</code> * Returns a {@link Policy} with the given <code>id</code>
* *
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the resource server. Ignored if {@code null}. * @param resourceServer the resource server. Ignored if {@code null}.
* @param id the identifier of the policy * @param id the identifier of the policy
* @return a policy with the given identifier. * @return a policy with the given identifier.
*/ */
Policy findById(RealmModel realm, ResourceServer resourceServer, String id); Policy findById(ResourceServer resourceServer, String id);
/** /**
* Returns a {@link Policy} with the given <code>name</code> * Returns a {@link Policy} with the given <code>name</code>
@ -85,17 +81,14 @@ public interface PolicyStore {
/** /**
* Returns a list of {@link Policy} associated with a {@link ResourceServer} with the given <code>resourceServerId</code>. * Returns a list of {@link Policy} associated with a {@link ResourceServer} with the given <code>resourceServerId</code>.
* *
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the identifier of a resource server. Ignored if {@code null}. * @param resourceServer the identifier of a resource server. Ignored if {@code null}.
* @param attributes a map holding the attributes that will be used as a filter; possible filter options are given by {@link Policy.FilterOption} * @param attributes a map holding the attributes that will be used as a filter; possible filter options are given by {@link Policy.FilterOption}
* @param firstResult first result to return. Ignored if negative or {@code null}. * @param firstResult first result to return. Ignored if negative or {@code null}.
* @param maxResults maximum number of results to return. Ignored if negative or {@code null}. * @param maxResults maximum number of results to return. Ignored if negative or {@code null}.
* @return a list of policies that belong to the given resource server * @return a list of policies that belong to the given resource server
*
* @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map * @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map
*/ */
List<Policy> find(RealmModel realm, ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults); List<Policy> find(ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults);
/** /**
* Returns a list of {@link Policy} associated with a {@link org.keycloak.authorization.model.Resource} * Returns a list of {@link Policy} associated with a {@link org.keycloak.authorization.model.Resource}
@ -189,7 +182,7 @@ public interface PolicyStore {
/** /**
* Returns a list of {@link Policy} that depends on another policy with the given <code>id</code>. * Returns a list of {@link Policy} that depends on another policy with the given <code>id</code>.
* *
* @param resourceServer the resource server * @param resourceServer the resource server. Cannot be {@code null}.
* @param id the id of the policy to query its dependents * @param id the id of the policy to query its dependents
* @return a list of policies that depends on the a policy with the given identifier * @return a list of policies that depends on the a policy with the given identifier
*/ */

6
server-spi-private/src/main/java/org/keycloak/authorization/store/ResourceServerStore.java
View file

@ -19,7 +19,6 @@ package org.keycloak.authorization.store;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.models.ClientModel; import org.keycloak.models.ClientModel;
import org.keycloak.models.RealmModel;
/** /**
* A {@link ResourceServerStore} is responsible to manage the persistence of {@link ResourceServer} instances. * A {@link ResourceServerStore} is responsible to manage the persistence of {@link ResourceServer} instances.
@ -47,13 +46,10 @@ public interface ResourceServerStore {
/** /**
* Returns a {@link ResourceServer} instance based on its identifier. * Returns a {@link ResourceServer} instance based on its identifier.
* *
*
* @param realm the realm. Cannot be {@code null}.
* @param id the identifier of an existing resource server instance * @param id the identifier of an existing resource server instance
*
* @return the resource server instance with the given identifier or null if no instance was found * @return the resource server instance with the given identifier or null if no instance was found
*/ */
ResourceServer findById(RealmModel realm, String id); ResourceServer findById(String id);
/** /**
* Returns a {@link ResourceServer} instance based on a client. * Returns a {@link ResourceServer} instance based on a client.

56
server-spi-private/src/main/java/org/keycloak/authorization/store/ResourceStore.java
View file

@ -19,7 +19,6 @@ package org.keycloak.authorization.store;
import org.keycloak.authorization.model.Resource; import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.models.RealmModel;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.LinkedList; import java.util.LinkedList;
@ -61,45 +60,45 @@ public interface ResourceStore {
/** /**
* Removes a {@link Resource} instance, with the given {@code id} from the persistent storage. * Removes a {@link Resource} instance, with the given {@code id} from the persistent storage.
* *
* @param realm the realm. Cannot be {@code null}.
* @param id the identifier of an existing resource instance * @param id the identifier of an existing resource instance
*/ */
void delete(RealmModel realm, String id); void delete(String id);
/** /**
* Returns a {@link Resource} instance based on its identifier. * Returns a {@link Resource} instance based on its identifier.
* *
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the resource server. Ignored if {@code null} * @param resourceServer the resource server. Ignored if {@code null}
* @param id the identifier of an existing resource instance * @param id the identifier of an existing resource instance
* @return the resource instance with the given identifier or null if no instance was found * @return the resource instance with the given identifier or null if no instance was found
*/ */
Resource findById(RealmModel realm, ResourceServer resourceServer, String id); Resource findById(ResourceServer resourceServer, String id);
/** /**
* Finds all {@link Resource} instances with the given {@code ownerId}. * Finds all {@link Resource} instances with the given {@code ownerId}.
* *
*
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer resource server. Ignored if {@code null} * @param resourceServer resource server. Ignored if {@code null}
* @param ownerId the identifier of the owner * @param ownerId the identifier of the owner
* @return a list with all resource instances owned by the given owner * @return a list with all resource instances owned by the given owner
*/ */
default List<Resource> findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId) { default List<Resource> findByOwner(ResourceServer resourceServer, String ownerId) {
List<Resource> list = new LinkedList<>(); List<Resource> list = new LinkedList<>();
findByOwner(realm, resourceServer, ownerId, list::add); findByOwner(resourceServer, ownerId, list::add);
return list; return list;
} }
void findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer);
/**
* Effectively the same method as {@link #findByOwner(ResourceServer, String)}, however in the end
* the {@code consumer} is fed with the result.
*
*/
void findByOwner(ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer);
/** /**
* Finds all {@link Resource} instances associated with a given resource server. * Finds all {@link Resource} instances associated with a given resource server.
* *
* @param resourceServer the identifier of the resource server. Cannot be {@code null}. * @param resourceServer the identifier of the resource server. Searches for resources without a resourceServer if {@code null}.
* @return a list with all resources associated with the given resource server * @return a list with all resources associated with the given resource server
*/ */
List<Resource> findByResourceServer(ResourceServer resourceServer); List<Resource> findByResourceServer(ResourceServer resourceServer);
@ -107,23 +106,20 @@ public interface ResourceStore {
/** /**
* Finds all {@link Resource} instances associated with a given resource server. * Finds all {@link Resource} instances associated with a given resource server.
* *
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the identifier of the resource server. Ignored if {@code null}. * @param resourceServer the identifier of the resource server. Ignored if {@code null}.
* @param attributes a map holding the attributes that will be used as a filter; possible filter options are given by {@link Resource.FilterOption} * @param attributes a map holding the attributes that will be used as a filter; possible filter options are given by {@link Resource.FilterOption}
* @param firstResult first result to return. Ignored if negative or {@code null}. * @param firstResult first result to return. Ignored if negative or {@code null}.
* @param maxResults maximum number of results to return. Ignored if negative or {@code null}. * @param maxResults maximum number of results to return. Ignored if negative or {@code null}.
* @return a list with all resources associated with the given resource server * @return a list with all resources associated with the given resource server
*
* @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map * @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map
*/ */
List<Resource> find(RealmModel realm, ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults); List<Resource> find(ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults);
/** /**
* Finds all {@link Resource} associated with a given scope. * Finds all {@link Resource} associated with a given scope.
* *
* *
* @param resourceServer the resource server. Cannot be {@code null}. * @param resourceServer the resource server. Searches for resources without a resourceServer if {@code null}.
* @param scopes one or more scope identifiers * @param scopes one or more scope identifiers
* @return a list of resources associated with the given scope(s) * @return a list of resources associated with the given scope(s)
*/ */
@ -139,7 +135,7 @@ public interface ResourceStore {
/** /**
* Find a {@link Resource} by its name where the owner is the resource server itself. * Find a {@link Resource} by its name where the owner is the resource server itself.
* *
* @param resourceServer the resource server. Cannot be {@code null}. * @param resourceServer the resource server. Searches for resources without a resourceServer if {@code null}.
* @param name the name of the resource * @param name the name of the resource
* @return a resource with the given name * @return a resource with the given name
*/ */
@ -150,7 +146,7 @@ public interface ResourceStore {
/** /**
* Find a {@link Resource} by its name where the owner is the given <code>ownerId</code>. * Find a {@link Resource} by its name where the owner is the given <code>ownerId</code>.
* *
* @param resourceServer the identifier of the resource server. Cannot be {@code null}. * @param resourceServer the identifier of the resource server. Searches for resources without a resourceServer if {@code null}.
* @param name the name of the resource * @param name the name of the resource
* @param ownerId the owner id * @param ownerId the owner id
* @return a resource with the given name * @return a resource with the given name
@ -158,10 +154,10 @@ public interface ResourceStore {
Resource findByName(ResourceServer resourceServer, String name, String ownerId); Resource findByName(ResourceServer resourceServer, String name, String ownerId);
/** /**
* Finds all {@link Resource} from {@link ResourceServer} with the given type. * Finds all {@link Resource} associated with the {@link ResourceServer} with the given type.
* *
* *
* @param resourceServer the resource server. Cannot be {@code null}. * @param resourceServer the resource server. Searches for resources without a resourceServer if {@code null}.
* @param type the type of the resource * @param type the type of the resource
* @return a list of resources with the given type * @return a list of resources with the given type
*/ */
@ -176,7 +172,7 @@ public interface ResourceStore {
/** /**
* Finds all {@link Resource} from {@link ResourceServer} with the given type. * Finds all {@link Resource} from {@link ResourceServer} with the given type.
* *
* @param resourceServer the resource server id. Cannot be {@code null}. * @param resourceServer the resource server id. Searches for resources without a resourceServer if {@code null}.
* @param type the type of the resource * @param type the type of the resource
* @param consumer the result consumer * @param consumer the result consumer
* @return a list of resources with the given type * @return a list of resources with the given type
@ -186,7 +182,7 @@ public interface ResourceStore {
/** /**
* Finds all {@link Resource} with the given type. * Finds all {@link Resource} with the given type.
* *
* @param resourceServer the resource server id. Cannot be {@code null} * @param resourceServer the resource server id. Searches for resources without a resourceServer if {@code null}.
* @param type the type of the resource * @param type the type of the resource
* @param owner the resource owner or null for any resource with a given type * @param owner the resource owner or null for any resource with a given type
* @param consumer the result consumer * @param consumer the result consumer
@ -197,7 +193,7 @@ public interface ResourceStore {
/** /**
* Finds all {@link Resource} by type where client represented by the {@code resourceServer} is not the owner * Finds all {@link Resource} by type where client represented by the {@code resourceServer} is not the owner
* *
* @param resourceServer the resourceServer. Cannot be {@code null}. * @param resourceServer the resourceServer. Searches for resources without a resourceServer if {@code null}.
* @param type searched type * @param type searched type
* @param consumer a consumer that will be fed with the resulting resources * @param consumer a consumer that will be fed with the resulting resources
*/ */

9
server-spi-private/src/main/java/org/keycloak/authorization/store/ScopeStore.java
View file

@ -19,7 +19,6 @@ package org.keycloak.authorization.store;
import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope; import org.keycloak.authorization.model.Scope;
import org.keycloak.models.RealmModel;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
@ -57,20 +56,18 @@ public interface ScopeStore {
/** /**
* Deletes a scope from the underlying persistence mechanism. * Deletes a scope from the underlying persistence mechanism.
* *
* @param realm the realm. Cannot be {@code null}.
* @param id the id of the scope to delete * @param id the id of the scope to delete
*/ */
void delete(RealmModel realm, String id); void delete(String id);
/** /**
* Returns a {@link Scope} with the given <code>id</code> * Returns a {@link Scope} with the given <code>id</code>
* *
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the resource server id. Ignored if {@code null}. * @param resourceServer the resource server id. Ignored if {@code null}.
* @param id the identifier of the scope * @param id the identifier of the scope
* @return a scope with the given identifier. * @return a scope with the given identifier.
*/ */
Scope findById(RealmModel realm, ResourceServer resourceServer, String id); Scope findById(ResourceServer resourceServer, String id);
/** /**
* Returns a {@link Scope} with the given <code>name</code> * Returns a {@link Scope} with the given <code>name</code>

4
server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/ClientApplicationSynchronizer.java
View file

@ -30,7 +30,6 @@ import org.keycloak.authorization.store.ResourceServerStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.KeycloakSessionFactory; import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.ClientModel.ClientRemovedEvent; import org.keycloak.models.ClientModel.ClientRemovedEvent;
import org.keycloak.models.RealmModel;
import org.keycloak.provider.ProviderFactory; import org.keycloak.provider.ProviderFactory;
import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation; import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
@ -51,7 +50,6 @@ public class ClientApplicationSynchronizer implements Synchronizer<ClientRemoved
StoreFactory storeFactory = authorizationProvider.getStoreFactory(); StoreFactory storeFactory = authorizationProvider.getStoreFactory();
ResourceServerStore store = storeFactory.getResourceServerStore(); ResourceServerStore store = storeFactory.getResourceServerStore();
ResourceServer resourceServer = store.findByClient(event.getClient()); ResourceServer resourceServer = store.findByClient(event.getClient());
RealmModel realm = event.getClient().getRealm();
if (resourceServer != null) { if (resourceServer != null) {
storeFactory.getResourceServerStore().delete(event.getClient()); storeFactory.getResourceServerStore().delete(event.getClient());
@ -63,7 +61,7 @@ public class ClientApplicationSynchronizer implements Synchronizer<ClientRemoved
attributes.put(Policy.FilterOption.CONFIG, new String[] {"clients", event.getClient().getId()}); attributes.put(Policy.FilterOption.CONFIG, new String[] {"clients", event.getClient().getId()});
attributes.put(Policy.FilterOption.ANY_OWNER, Policy.FilterOption.EMPTY_FILTER); attributes.put(Policy.FilterOption.ANY_OWNER, Policy.FilterOption.EMPTY_FILTER);
List<Policy> search = storeFactory.getPolicyStore().find(realm, null, attributes, null, null); List<Policy> search = storeFactory.getPolicyStore().find(null, attributes, null, null);
for (Policy policy : search) { for (Policy policy : search) {
PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType()); PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType());

4
server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/GroupSynchronizer.java
View file

@ -29,7 +29,6 @@ import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.GroupModel; import org.keycloak.models.GroupModel;
import org.keycloak.models.KeycloakSessionFactory; import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.provider.ProviderFactory; import org.keycloak.provider.ProviderFactory;
import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation; import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation;
@ -46,14 +45,13 @@ public class GroupSynchronizer implements Synchronizer<GroupModel.GroupRemovedEv
StoreFactory storeFactory = authorizationProvider.getStoreFactory(); StoreFactory storeFactory = authorizationProvider.getStoreFactory();
PolicyStore policyStore = storeFactory.getPolicyStore(); PolicyStore policyStore = storeFactory.getPolicyStore();
GroupModel group = event.getGroup(); GroupModel group = event.getGroup();
RealmModel realm = event.getRealm();
Map<Policy.FilterOption, String[]> attributes = new EnumMap<>(Policy.FilterOption.class); Map<Policy.FilterOption, String[]> attributes = new EnumMap<>(Policy.FilterOption.class);
attributes.put(Policy.FilterOption.TYPE, new String[] {"group"}); attributes.put(Policy.FilterOption.TYPE, new String[] {"group"});
attributes.put(Policy.FilterOption.CONFIG, new String[] {"groups", group.getId()}); attributes.put(Policy.FilterOption.CONFIG, new String[] {"groups", group.getId()});
attributes.put(Policy.FilterOption.ANY_OWNER, Policy.FilterOption.EMPTY_FILTER); attributes.put(Policy.FilterOption.ANY_OWNER, Policy.FilterOption.EMPTY_FILTER);
List<Policy> search = policyStore.find(realm, null, attributes, null, null); List<Policy> search = policyStore.find(null, attributes, null, null);
for (Policy policy : search) { for (Policy policy : search) {
PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType()); PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType());

20
server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/UserSynchronizer.java
View file

@ -31,7 +31,6 @@ import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.ResourceStore; import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.authorization.store.StoreFactory; import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.KeycloakSessionFactory; import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel; import org.keycloak.models.UserModel;
import org.keycloak.models.UserModel.UserRemovedEvent; import org.keycloak.models.UserModel.UserRemovedEvent;
import org.keycloak.provider.ProviderFactory; import org.keycloak.provider.ProviderFactory;
@ -56,14 +55,13 @@ public class UserSynchronizer implements Synchronizer<UserRemovedEvent> {
StoreFactory storeFactory = authorizationProvider.getStoreFactory(); StoreFactory storeFactory = authorizationProvider.getStoreFactory();
PolicyStore policyStore = storeFactory.getPolicyStore(); PolicyStore policyStore = storeFactory.getPolicyStore();
UserModel userModel = event.getUser(); UserModel userModel = event.getUser();
RealmModel realm = event.getRealm();
Map<Policy.FilterOption, String[]> attributes = new EnumMap<>(Policy.FilterOption.class); Map<Policy.FilterOption, String[]> attributes = new EnumMap<>(Policy.FilterOption.class);
attributes.put(Policy.FilterOption.TYPE, new String[] {"user"}); attributes.put(Policy.FilterOption.TYPE, new String[] {"user"});
attributes.put(Policy.FilterOption.CONFIG, new String[] {"users", userModel.getId()}); attributes.put(Policy.FilterOption.CONFIG, new String[] {"users", userModel.getId()});
attributes.put(Policy.FilterOption.ANY_OWNER, new String[] {Boolean.TRUE.toString()}); attributes.put(Policy.FilterOption.ANY_OWNER, new String[] {Boolean.TRUE.toString()});
List<Policy> search = policyStore.find(realm, null, attributes, null, null); List<Policy> search = policyStore.find(null, attributes, null, null);
for (Policy policy : search) { for (Policy policy : search) {
PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType()); PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType());
@ -81,18 +79,17 @@ public class UserSynchronizer implements Synchronizer<UserRemovedEvent> {
PolicyStore policyStore = storeFactory.getPolicyStore(); PolicyStore policyStore = storeFactory.getPolicyStore();
ResourceStore resourceStore = storeFactory.getResourceStore(); ResourceStore resourceStore = storeFactory.getResourceStore();
UserModel userModel = event.getUser(); UserModel userModel = event.getUser();
RealmModel realm = event.getRealm();
resourceStore.findByOwner(realm, null, userModel.getId(), resource -> { resourceStore.findByOwner(null, userModel.getId(), resource -> {
String resourceId = resource.getId(); String resourceId = resource.getId();
policyStore.findByResource(resource.getResourceServer(), resource).forEach(policy -> { policyStore.findByResource(resource.getResourceServer(), resource).forEach(policy -> {
if (policy.getResources().size() == 1) { if (policy.getResources().size() == 1) {
policyStore.delete(realm, policy.getId()); policyStore.delete(policy.getId());
} else { } else {
policy.removeResource(resource); policy.removeResource(resource);
} }
}); });
resourceStore.delete(realm, resourceId); resourceStore.delete(resourceId);
}); });
} }
@ -100,21 +97,20 @@ public class UserSynchronizer implements Synchronizer<UserRemovedEvent> {
StoreFactory storeFactory = authorizationProvider.getStoreFactory(); StoreFactory storeFactory = authorizationProvider.getStoreFactory();
PermissionTicketStore ticketStore = storeFactory.getPermissionTicketStore(); PermissionTicketStore ticketStore = storeFactory.getPermissionTicketStore();
UserModel userModel = event.getUser(); UserModel userModel = event.getUser();
RealmModel realm = event.getRealm();
Map<PermissionTicket.FilterOption, String> attributes = new EnumMap<>(PermissionTicket.FilterOption.class); Map<PermissionTicket.FilterOption, String> attributes = new EnumMap<>(PermissionTicket.FilterOption.class);
attributes.put(PermissionTicket.FilterOption.OWNER, userModel.getId()); attributes.put(PermissionTicket.FilterOption.OWNER, userModel.getId());
for (PermissionTicket ticket : ticketStore.find(realm, null, attributes, null, null)) { for (PermissionTicket ticket : ticketStore.find(null, attributes, null, null)) {
ticketStore.delete(realm, ticket.getId()); ticketStore.delete(ticket.getId());
} }
attributes.clear(); attributes.clear();
attributes.put(PermissionTicket.FilterOption.REQUESTER, userModel.getId()); attributes.put(PermissionTicket.FilterOption.REQUESTER, userModel.getId());
for (PermissionTicket ticket : ticketStore.find(realm, null, attributes, null, null)) { for (PermissionTicket ticket : ticketStore.find(null, attributes, null, null)) {
ticketStore.delete(realm, ticket.getId()); ticketStore.delete(ticket.getId());
} }
} }
} }

22
server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
View file

@ -1120,7 +1120,6 @@ public class RepresentationToModel {
private static Policy importPolicies(AuthorizationProvider authorization, ResourceServer resourceServer, List<PolicyRepresentation> policiesToImport, String parentPolicyName) { private static Policy importPolicies(AuthorizationProvider authorization, ResourceServer resourceServer, List<PolicyRepresentation> policiesToImport, String parentPolicyName) {
StoreFactory storeFactory = authorization.getStoreFactory(); StoreFactory storeFactory = authorization.getStoreFactory();
RealmModel realm = resourceServer.getRealm();
for (PolicyRepresentation policyRepresentation : policiesToImport) { for (PolicyRepresentation policyRepresentation : policiesToImport) {
if (parentPolicyName != null && !parentPolicyName.equals(policyRepresentation.getName())) { if (parentPolicyName != null && !parentPolicyName.equals(policyRepresentation.getName())) {
@ -1140,7 +1139,7 @@ public class RepresentationToModel {
Policy policy = policyStore.findByName(resourceServer, policyName); Policy policy = policyStore.findByName(resourceServer, policyName);
if (policy == null) { if (policy == null) {
policy = policyStore.findById(realm, resourceServer, policyName); policy = policyStore.findById(resourceServer, policyName);
} }
if (policy == null) { if (policy == null) {
@ -1160,7 +1159,7 @@ public class RepresentationToModel {
} }
PolicyStore policyStore = storeFactory.getPolicyStore(); PolicyStore policyStore = storeFactory.getPolicyStore();
Policy policy = policyStore.findById(realm, resourceServer, policyRepresentation.getId()); Policy policy = policyStore.findById(resourceServer, policyRepresentation.getId());
if (policy == null) { if (policy == null) {
policy = policyStore.findByName(resourceServer, policyRepresentation.getName()); policy = policyStore.findByName(resourceServer, policyRepresentation.getName());
@ -1267,7 +1266,6 @@ public class RepresentationToModel {
return; return;
} }
ResourceServer resourceServer = policy.getResourceServer(); ResourceServer resourceServer = policy.getResourceServer();
RealmModel realm = resourceServer.getRealm();
for (String scopeId : scopeIds) { for (String scopeId : scopeIds) {
boolean hasScope = false; boolean hasScope = false;
@ -1277,7 +1275,7 @@ public class RepresentationToModel {
} }
} }
if (!hasScope) { if (!hasScope) {
Scope scope = storeFactory.getScopeStore().findById(realm, resourceServer, scopeId); Scope scope = storeFactory.getScopeStore().findById(resourceServer, scopeId);
if (scope == null) { if (scope == null) {
scope = storeFactory.getScopeStore().findByName(resourceServer, scopeId); scope = storeFactory.getScopeStore().findByName(resourceServer, scopeId);
@ -1309,7 +1307,6 @@ public class RepresentationToModel {
private static void updateAssociatedPolicies(Set<String> policyIds, Policy policy, StoreFactory storeFactory) { private static void updateAssociatedPolicies(Set<String> policyIds, Policy policy, StoreFactory storeFactory) {
ResourceServer resourceServer = policy.getResourceServer(); ResourceServer resourceServer = policy.getResourceServer();
RealmModel realm = resourceServer.getRealm();
if (policyIds != null) { if (policyIds != null) {
if (policyIds.isEmpty()) { if (policyIds.isEmpty()) {
@ -1331,7 +1328,7 @@ public class RepresentationToModel {
} }
if (!hasPolicy) { if (!hasPolicy) {
Policy associatedPolicy = policyStore.findById(realm, resourceServer, policyId); Policy associatedPolicy = policyStore.findById(resourceServer, policyId);
if (associatedPolicy == null) { if (associatedPolicy == null) {
associatedPolicy = policyStore.findByName(resourceServer, policyId); associatedPolicy = policyStore.findByName(resourceServer, policyId);
@ -1369,7 +1366,6 @@ public class RepresentationToModel {
} }
} }
ResourceServer resourceServer = policy.getResourceServer(); ResourceServer resourceServer = policy.getResourceServer();
RealmModel realm = resourceServer.getRealm();
for (String resourceId : resourceIds) { for (String resourceId : resourceIds) {
boolean hasResource = false; boolean hasResource = false;
@ -1379,7 +1375,7 @@ public class RepresentationToModel {
} }
} }
if (!hasResource && !"".equals(resourceId)) { if (!hasResource && !"".equals(resourceId)) {
Resource resource = storeFactory.getResourceStore().findById(realm, resourceServer, resourceId); Resource resource = storeFactory.getResourceStore().findById(resourceServer, resourceId);
if (resource == null) { if (resource == null) {
resource = storeFactory.getResourceStore().findByName(resourceServer, resourceId); resource = storeFactory.getResourceStore().findByName(resourceServer, resourceId);
@ -1445,7 +1441,7 @@ public class RepresentationToModel {
Resource existing; Resource existing;
if (resource.getId() != null) { if (resource.getId() != null) {
existing = resourceStore.findById(realm, resourceServer, resource.getId()); existing = resourceStore.findById(resourceServer, resource.getId());
} else { } else {
existing = resourceStore.findByName(resourceServer, resource.getName(), ownerId); existing = resourceStore.findByName(resourceServer, resource.getName(), ownerId);
} }
@ -1519,7 +1515,7 @@ public class RepresentationToModel {
Scope existing; Scope existing;
if (scope.getId() != null) { if (scope.getId() != null) {
existing = scopeStore.findById(resourceServer.getRealm(), resourceServer, scope.getId()); existing = scopeStore.findById(resourceServer, scope.getId());
} else { } else {
existing = scopeStore.findByName(resourceServer, scope.getName()); existing = scopeStore.findByName(resourceServer, scope.getName());
} }
@ -1545,13 +1541,13 @@ public class RepresentationToModel {
public static PermissionTicket toModel(PermissionTicketRepresentation representation, ResourceServer resourceServer, AuthorizationProvider authorization) { public static PermissionTicket toModel(PermissionTicketRepresentation representation, ResourceServer resourceServer, AuthorizationProvider authorization) {
PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore(); PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore();
PermissionTicket ticket = ticketStore.findById(resourceServer.getRealm(), resourceServer, representation.getId()); PermissionTicket ticket = ticketStore.findById(resourceServer, representation.getId());
boolean granted = representation.isGranted(); boolean granted = representation.isGranted();
if (granted && !ticket.isGranted()) { if (granted && !ticket.isGranted()) {
ticket.setGrantedTimestamp(System.currentTimeMillis()); ticket.setGrantedTimestamp(System.currentTimeMillis());
} else if (!granted) { } else if (!granted) {
ticketStore.delete(resourceServer.getRealm(), ticket.getId()); ticketStore.delete(ticket.getId());
} }
return ticket; return ticket;

2
services/src/main/java/org/keycloak/authorization/admin/PolicyEvaluationService.java
View file

@ -191,7 +191,7 @@ public class PolicyEvaluationService {
Set<Scope> scopes = givenScopes.stream().map(scopeRepresentation -> scopeStore.findByName(resourceServer, scopeRepresentation.getName())).collect(Collectors.toSet()); Set<Scope> scopes = givenScopes.stream().map(scopeRepresentation -> scopeStore.findByName(resourceServer, scopeRepresentation.getName())).collect(Collectors.toSet());
if (resource.getId() != null) { if (resource.getId() != null) {
Resource resourceModel = storeFactory.getResourceStore().findById(resourceServer.getRealm(), resourceServer, resource.getId()); Resource resourceModel = storeFactory.getResourceStore().findById(resourceServer, resource.getId());
return new ArrayList<>(Arrays.asList( return new ArrayList<>(Arrays.asList(
Permissions.createResourcePermissions(resourceModel, resourceServer, scopes, authorization, request))).stream(); Permissions.createResourcePermissions(resourceModel, resourceServer, scopes, authorization, request))).stream();
} else if (resource.getType() != null) { } else if (resource.getType() != null) {

2
services/src/main/java/org/keycloak/authorization/admin/PolicyResourceService.java
View file

@ -114,7 +114,7 @@ public class PolicyResourceService {
resource.onRemove(policy, authorization); resource.onRemove(policy, authorization);
} }
policyStore.delete(resourceServer.getRealm(), policy.getId()); policyStore.delete(policy.getId());
audit(policyRep, OperationType.DELETE); audit(policyRep, OperationType.DELETE);

10
services/src/main/java/org/keycloak/authorization/admin/PolicyService.java
View file

@ -93,7 +93,7 @@ public class PolicyService {
return doCreatePolicyTypeResource(type); return doCreatePolicyTypeResource(type);
} }
Policy policy = authorization.getStoreFactory().getPolicyStore().findById(resourceServer.getRealm(), resourceServer, type); Policy policy = authorization.getStoreFactory().getPolicyStore().findById(resourceServer, type);
return doCreatePolicyResource(policy); return doCreatePolicyResource(policy);
} }
@ -227,7 +227,7 @@ public class PolicyService {
if (resource != null && !"".equals(resource.trim())) { if (resource != null && !"".equals(resource.trim())) {
ResourceStore resourceStore = storeFactory.getResourceStore(); ResourceStore resourceStore = storeFactory.getResourceStore();
Resource resourceModel = resourceStore.findById(resourceServer.getRealm(), resourceServer, resource); Resource resourceModel = resourceStore.findById(resourceServer, resource);
if (resourceModel == null) { if (resourceModel == null) {
Map<Resource.FilterOption, String[]> resourceFilters = new EnumMap<>(Resource.FilterOption.class); Map<Resource.FilterOption, String[]> resourceFilters = new EnumMap<>(Resource.FilterOption.class);
@ -238,7 +238,7 @@ public class PolicyService {
resourceFilters.put(Resource.FilterOption.OWNER, new String[]{owner}); resourceFilters.put(Resource.FilterOption.OWNER, new String[]{owner});
} }
Set<String> resources = resourceStore.find(resourceServer.getRealm(), resourceServer, resourceFilters, -1, 1).stream().map(Resource::getId).collect(Collectors.toSet()); Set<String> resources = resourceStore.find(resourceServer, resourceFilters, -1, 1).stream().map(Resource::getId).collect(Collectors.toSet());
if (resources.isEmpty()) { if (resources.isEmpty()) {
return Response.noContent().build(); return Response.noContent().build();
@ -252,7 +252,7 @@ public class PolicyService {
if (scope != null && !"".equals(scope.trim())) { if (scope != null && !"".equals(scope.trim())) {
ScopeStore scopeStore = storeFactory.getScopeStore(); ScopeStore scopeStore = storeFactory.getScopeStore();
Scope scopeModel = scopeStore.findById(resourceServer.getRealm(), resourceServer, scope); Scope scopeModel = scopeStore.findById(resourceServer, scope);
if (scopeModel == null) { if (scopeModel == null) {
Map<Scope.FilterOption, String[]> scopeFilters = new EnumMap<>(Scope.FilterOption.class); Map<Scope.FilterOption, String[]> scopeFilters = new EnumMap<>(Scope.FilterOption.class);
@ -286,7 +286,7 @@ public class PolicyService {
protected List<Object> doSearch(Integer firstResult, Integer maxResult, String fields, Map<Policy.FilterOption, String[]> filters) { protected List<Object> doSearch(Integer firstResult, Integer maxResult, String fields, Map<Policy.FilterOption, String[]> filters) {
PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore(); PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore();
return policyStore.find(resourceServer.getRealm(), resourceServer, filters, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS).stream() return policyStore.find(resourceServer, filters, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS).stream()
.map(policy -> toRepresentation(policy, fields, authorization)) .map(policy -> toRepresentation(policy, fields, authorization))
.collect(Collectors.toList()); .collect(Collectors.toList());
} }

20
services/src/main/java/org/keycloak/authorization/admin/ResourceSetService.java
View file

@ -160,7 +160,7 @@ public class ResourceSetService {
resource.setId(id); resource.setId(id);
StoreFactory storeFactory = this.authorization.getStoreFactory(); StoreFactory storeFactory = this.authorization.getStoreFactory();
ResourceStore resourceStore = storeFactory.getResourceStore(); ResourceStore resourceStore = storeFactory.getResourceStore();
Resource model = resourceStore.findById(resourceServer.getRealm(), resourceServer, resource.getId()); Resource model = resourceStore.findById(resourceServer, resource.getId());
if (model == null) { if (model == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();
@ -182,7 +182,7 @@ public class ResourceSetService {
public Response delete(@PathParam("resource-id") String id) { public Response delete(@PathParam("resource-id") String id) {
requireManage(); requireManage();
StoreFactory storeFactory = authorization.getStoreFactory(); StoreFactory storeFactory = authorization.getStoreFactory();
Resource resource = storeFactory.getResourceStore().findById(resourceServer.getRealm(), resourceServer, id); Resource resource = storeFactory.getResourceStore().findById(resourceServer, id);
if (resource == null) { if (resource == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();
@ -191,7 +191,7 @@ public class ResourceSetService {
//to be able to access all lazy loaded fields it's needed to create representation before it's deleted //to be able to access all lazy loaded fields it's needed to create representation before it's deleted
ResourceRepresentation resourceRep = toRepresentation(resource, resourceServer, authorization); ResourceRepresentation resourceRep = toRepresentation(resource, resourceServer, authorization);
storeFactory.getResourceStore().delete(resourceServer.getRealm(), id); storeFactory.getResourceStore().delete(id);
audit(resourceRep, OperationType.DELETE); audit(resourceRep, OperationType.DELETE);
@ -216,7 +216,7 @@ public class ResourceSetService {
public Response findById(String id, Function<Resource, ? extends ResourceRepresentation> toRepresentation) { public Response findById(String id, Function<Resource, ? extends ResourceRepresentation> toRepresentation) {
requireView(); requireView();
StoreFactory storeFactory = authorization.getStoreFactory(); StoreFactory storeFactory = authorization.getStoreFactory();
Resource model = storeFactory.getResourceStore().findById(resourceServer.getRealm(), resourceServer, id); Resource model = storeFactory.getResourceStore().findById(resourceServer, id);
if (model == null) { if (model == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();
@ -239,7 +239,7 @@ public class ResourceSetService {
public Response getScopes(@PathParam("resource-id") String id) { public Response getScopes(@PathParam("resource-id") String id) {
requireView(); requireView();
StoreFactory storeFactory = authorization.getStoreFactory(); StoreFactory storeFactory = authorization.getStoreFactory();
Resource model = storeFactory.getResourceStore().findById(resourceServer.getRealm(), resourceServer, id); Resource model = storeFactory.getResourceStore().findById(resourceServer, id);
if (model == null) { if (model == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();
@ -290,7 +290,7 @@ public class ResourceSetService {
requireView(); requireView();
StoreFactory storeFactory = authorization.getStoreFactory(); StoreFactory storeFactory = authorization.getStoreFactory();
ResourceStore resourceStore = storeFactory.getResourceStore(); ResourceStore resourceStore = storeFactory.getResourceStore();
Resource model = resourceStore.findById(resourceServer.getRealm(), resourceServer, id); Resource model = resourceStore.findById(resourceServer, id);
if (model == null) { if (model == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();
@ -311,7 +311,7 @@ public class ResourceSetService {
resourceFilter.put(Resource.FilterOption.OWNER, new String[]{resourceServer.getClientId()}); resourceFilter.put(Resource.FilterOption.OWNER, new String[]{resourceServer.getClientId()});
resourceFilter.put(Resource.FilterOption.TYPE, new String[]{model.getType()}); resourceFilter.put(Resource.FilterOption.TYPE, new String[]{model.getType()});
for (Resource resourceType : resourceStore.find(resourceServer.getRealm(), resourceServer, resourceFilter, null, null)) { for (Resource resourceType : resourceStore.find(resourceServer, resourceFilter, null, null)) {
policies.addAll(policyStore.findByResource(resourceServer, resourceType)); policies.addAll(policyStore.findByResource(resourceServer, resourceType));
} }
} }
@ -347,7 +347,7 @@ public class ResourceSetService {
public Response getAttributes(@PathParam("resource-id") String id) { public Response getAttributes(@PathParam("resource-id") String id) {
requireView(); requireView();
StoreFactory storeFactory = authorization.getStoreFactory(); StoreFactory storeFactory = authorization.getStoreFactory();
Resource model = storeFactory.getResourceStore().findById(resourceServer.getRealm(), resourceServer, id); Resource model = storeFactory.getResourceStore().findById(resourceServer, id);
if (model == null) { if (model == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();
@ -475,7 +475,7 @@ public class ResourceSetService {
search.put(Resource.FilterOption.SCOPE_ID, scopes.stream().map(Scope::getId).toArray(String[]::new)); search.put(Resource.FilterOption.SCOPE_ID, scopes.stream().map(Scope::getId).toArray(String[]::new));
} }
List<Resource> resources = storeFactory.getResourceStore().find(resourceServer.getRealm(), this.resourceServer, search, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS); List<Resource> resources = storeFactory.getResourceStore().find(this.resourceServer, search, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS);
if (matchingUri != null && matchingUri && resources.isEmpty()) { if (matchingUri != null && matchingUri && resources.isEmpty()) {
Map<Resource.FilterOption, String[]> attributes = new EnumMap<>(Resource.FilterOption.class); Map<Resource.FilterOption, String[]> attributes = new EnumMap<>(Resource.FilterOption.class);
@ -483,7 +483,7 @@ public class ResourceSetService {
attributes.put(Resource.FilterOption.URI_NOT_NULL, new String[] {"true"}); attributes.put(Resource.FilterOption.URI_NOT_NULL, new String[] {"true"});
attributes.put(Resource.FilterOption.OWNER, new String[] {resourceServer.getClientId()}); attributes.put(Resource.FilterOption.OWNER, new String[] {resourceServer.getClientId()});
List<Resource> serverResources = storeFactory.getResourceStore().find(resourceServer.getRealm(), this.resourceServer, attributes, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : -1); List<Resource> serverResources = storeFactory.getResourceStore().find(this.resourceServer, attributes, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : -1);
PathMatcher<Map.Entry<String, Resource>> pathMatcher = new PathMatcher<Map.Entry<String, Resource>>() { PathMatcher<Map.Entry<String, Resource>> pathMatcher = new PathMatcher<Map.Entry<String, Resource>>() {
@Override @Override

15
services/src/main/java/org/keycloak/authorization/admin/ScopeService.java
View file

@ -109,7 +109,7 @@ public class ScopeService {
this.auth.realm().requireManageAuthorization(); this.auth.realm().requireManageAuthorization();
scope.setId(id); scope.setId(id);
StoreFactory storeFactory = authorization.getStoreFactory(); StoreFactory storeFactory = authorization.getStoreFactory();
Scope model = storeFactory.getScopeStore().findById(resourceServer.getRealm(), resourceServer, scope.getId()); Scope model = storeFactory.getScopeStore().findById(resourceServer, scope.getId());
if (model == null) { if (model == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();
@ -127,8 +127,7 @@ public class ScopeService {
public Response delete(@PathParam("scope-id") String id) { public Response delete(@PathParam("scope-id") String id) {
this.auth.realm().requireManageAuthorization(); this.auth.realm().requireManageAuthorization();
StoreFactory storeFactory = authorization.getStoreFactory(); StoreFactory storeFactory = authorization.getStoreFactory();
RealmModel realm = resourceServer.getRealm(); Scope scope = storeFactory.getScopeStore().findById(resourceServer, id);
Scope scope = storeFactory.getScopeStore().findById(realm, resourceServer, id);
if (scope == null) { if (scope == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();
} }
@ -144,7 +143,7 @@ public class ScopeService {
for (Policy policyModel : policies) { for (Policy policyModel : policies) {
if (policyModel.getScopes().size() == 1) { if (policyModel.getScopes().size() == 1) {
policyStore.delete(realm, policyModel.getId()); policyStore.delete(policyModel.getId());
} else { } else {
policyModel.removeScope(scope); policyModel.removeScope(scope);
} }
@ -153,7 +152,7 @@ public class ScopeService {
//to be able to access all lazy loaded fields it's needed to create representation before it's deleted //to be able to access all lazy loaded fields it's needed to create representation before it's deleted
ScopeRepresentation scopeRep = toRepresentation(scope); ScopeRepresentation scopeRep = toRepresentation(scope);
storeFactory.getScopeStore().delete(realm, id); storeFactory.getScopeStore().delete(id);
audit(scopeRep, OperationType.DELETE); audit(scopeRep, OperationType.DELETE);
@ -173,7 +172,7 @@ public class ScopeService {
}) })
public Response findById(@PathParam("scope-id") String id) { public Response findById(@PathParam("scope-id") String id) {
this.auth.realm().requireViewAuthorization(); this.auth.realm().requireViewAuthorization();
Scope model = this.authorization.getStoreFactory().getScopeStore().findById(resourceServer.getRealm(), resourceServer, id); Scope model = this.authorization.getStoreFactory().getScopeStore().findById(resourceServer, id);
if (model == null) { if (model == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();
@ -196,7 +195,7 @@ public class ScopeService {
public Response getResources(@PathParam("scope-id") String id) { public Response getResources(@PathParam("scope-id") String id) {
this.auth.realm().requireViewAuthorization(); this.auth.realm().requireViewAuthorization();
StoreFactory storeFactory = this.authorization.getStoreFactory(); StoreFactory storeFactory = this.authorization.getStoreFactory();
Scope model = storeFactory.getScopeStore().findById(resourceServer.getRealm(), resourceServer, id); Scope model = storeFactory.getScopeStore().findById(resourceServer, id);
if (model == null) { if (model == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();
@ -226,7 +225,7 @@ public class ScopeService {
public Response getPermissions(@PathParam("scope-id") String id) { public Response getPermissions(@PathParam("scope-id") String id) {
this.auth.realm().requireViewAuthorization(); this.auth.realm().requireViewAuthorization();
StoreFactory storeFactory = this.authorization.getStoreFactory(); StoreFactory storeFactory = this.authorization.getStoreFactory();
Scope model = storeFactory.getScopeStore().findById(resourceServer.getRealm(), resourceServer, id); Scope model = storeFactory.getScopeStore().findById(resourceServer, id);
if (model == null) { if (model == null) {
return Response.status(Status.NOT_FOUND).build(); return Response.status(Status.NOT_FOUND).build();

2
services/src/main/java/org/keycloak/authorization/admin/representation/PolicyEvaluationResponseBuilder.java
View file

@ -195,7 +195,7 @@ public class PolicyEvaluationResponseBuilder {
filters.put(PermissionTicket.FilterOption.POLICY_ID, policy.getId()); filters.put(PermissionTicket.FilterOption.POLICY_ID, policy.getId());
List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(resourceServer.getRealm(), resourceServer, filters, -1, 1); List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(resourceServer, filters, -1, 1);
if (!tickets.isEmpty()) { if (!tickets.isEmpty()) {
KeycloakSession keycloakSession = authorization.getKeycloakSession(); KeycloakSession keycloakSession = authorization.getKeycloakSession();

9
services/src/main/java/org/keycloak/authorization/authorization/AuthorizationTokenService.java
View file

@ -508,7 +508,6 @@ public class AuthorizationTokenService {
Map<String, ResourcePermission> permissionsToEvaluate, ResourceStore resourceStore, ScopeStore scopeStore, Map<String, ResourcePermission> permissionsToEvaluate, ResourceStore resourceStore, ScopeStore scopeStore,
AtomicInteger limit) { AtomicInteger limit) {
AccessToken rpt = request.getRpt(); AccessToken rpt = request.getRpt();
RealmModel realm = resourceServer.getRealm();
if (rpt != null && rpt.isActive()) { if (rpt != null && rpt.isActive()) {
Authorization authorizationData = rpt.getAuthorization(); Authorization authorizationData = rpt.getAuthorization();
@ -522,7 +521,7 @@ public class AuthorizationTokenService {
break; break;
} }
Resource resource = resourceStore.findById(realm, resourceServer, grantedPermission.getResourceId()); Resource resource = resourceStore.findById(resourceServer, grantedPermission.getResourceId());
if (resource != null) { if (resource != null) {
ResourcePermission permission = permissionsToEvaluate.get(resource.getId()); ResourcePermission permission = permissionsToEvaluate.get(resource.getId());
@ -606,7 +605,7 @@ public class AuthorizationTokenService {
Resource resource; Resource resource;
if (resourceId.indexOf('-') != -1) { if (resourceId.indexOf('-') != -1) {
resource = resourceStore.findById(resourceServer.getRealm(), resourceServer, resourceId); resource = resourceStore.findById(resourceServer, resourceId);
} else { } else {
resource = null; resource = null;
} }
@ -890,7 +889,7 @@ public class AuthorizationTokenService {
search.put(Resource.FilterOption.URI, new String[] { uri }); search.put(Resource.FilterOption.URI, new String[] { uri });
ResourceServer resourceServer = storeFactory.getResourceServerStore() ResourceServer resourceServer = storeFactory.getResourceServerStore()
.findByClient(getRealm().getClientByClientId(getAudience())); .findByClient(getRealm().getClientByClientId(getAudience()));
List<Resource> resources = storeFactory.getResourceStore().find(getRealm(), resourceServer, search, -1, List<Resource> resources = storeFactory.getResourceStore().find(resourceServer, search, -1,
Constants.DEFAULT_MAX_RESULTS); Constants.DEFAULT_MAX_RESULTS);
if (!matchingUri || !resources.isEmpty()) { if (!matchingUri || !resources.isEmpty()) {
@ -901,7 +900,7 @@ public class AuthorizationTokenService {
search.put(Resource.FilterOption.URI_NOT_NULL, new String[] { "true" }); search.put(Resource.FilterOption.URI_NOT_NULL, new String[] { "true" });
search.put(Resource.FilterOption.OWNER, new String[] { resourceServer.getClientId() }); search.put(Resource.FilterOption.OWNER, new String[] { resourceServer.getClientId() });
List<Resource> serverResources = storeFactory.getResourceStore().find(getRealm(), resourceServer, search, -1, -1); List<Resource> serverResources = storeFactory.getResourceStore().find(resourceServer, search, -1, -1);
PathMatcher<Map.Entry<String, Resource>> pathMatcher = new PathMatcher<Map.Entry<String, Resource>>() { PathMatcher<Map.Entry<String, Resource>> pathMatcher = new PathMatcher<Map.Entry<String, Resource>>() {
@Override @Override

2
services/src/main/java/org/keycloak/authorization/protection/permission/AbstractPermissionService.java
View file

@ -74,7 +74,7 @@ public class AbstractPermissionService {
throw new ErrorResponseException("invalid_resource_id", "Resource id or name not provided.", Response.Status.BAD_REQUEST); throw new ErrorResponseException("invalid_resource_id", "Resource id or name not provided.", Response.Status.BAD_REQUEST);
} }
} else { } else {
Resource resource = resourceStore.findById(resourceServer.getRealm(), resourceServer, resourceSetId); Resource resource = resourceStore.findById(resourceServer, resourceSetId);
if (resource != null) { if (resource != null) {
resources.add(resource); resources.add(resource);

16
services/src/main/java/org/keycloak/authorization/protection/permission/PermissionTicketService.java
View file

@ -82,7 +82,7 @@ public class PermissionTicketService {
throw new ErrorResponseException("invalid_permission", "created permissions should have requester or requesterName", Response.Status.BAD_REQUEST); throw new ErrorResponseException("invalid_permission", "created permissions should have requester or requesterName", Response.Status.BAD_REQUEST);
ResourceStore rstore = this.authorization.getStoreFactory().getResourceStore(); ResourceStore rstore = this.authorization.getStoreFactory().getResourceStore();
Resource resource = rstore.findById(resourceServer.getRealm(), resourceServer, representation.getResource()); Resource resource = rstore.findById(resourceServer, representation.getResource());
if (resource == null ) throw new ErrorResponseException("invalid_resource_id", "Resource set with id [" + representation.getResource() + "] does not exists in this server.", Response.Status.BAD_REQUEST); if (resource == null ) throw new ErrorResponseException("invalid_resource_id", "Resource set with id [" + representation.getResource() + "] does not exists in this server.", Response.Status.BAD_REQUEST);
if (!resource.getOwner().equals(this.identity.getId())) if (!resource.getOwner().equals(this.identity.getId()))
@ -105,7 +105,7 @@ public class PermissionTicketService {
if(representation.getScopeName() != null) if(representation.getScopeName() != null)
scope = sstore.findByName(resourceServer, representation.getScopeName()); scope = sstore.findByName(resourceServer, representation.getScopeName());
else else
scope = sstore.findById(resourceServer.getRealm(), resourceServer, representation.getScope()); scope = sstore.findById(resourceServer, representation.getScope());
if (scope == null && representation.getScope() !=null ) if (scope == null && representation.getScope() !=null )
throw new ErrorResponseException("invalid_scope", "Scope [" + representation.getScope() + "] is invalid", Response.Status.BAD_REQUEST); throw new ErrorResponseException("invalid_scope", "Scope [" + representation.getScope() + "] is invalid", Response.Status.BAD_REQUEST);
@ -122,7 +122,7 @@ public class PermissionTicketService {
attributes.put(PermissionTicket.FilterOption.SCOPE_ID, scope.getId()); attributes.put(PermissionTicket.FilterOption.SCOPE_ID, scope.getId());
attributes.put(PermissionTicket.FilterOption.REQUESTER, user.getId()); attributes.put(PermissionTicket.FilterOption.REQUESTER, user.getId());
if (!ticketStore.find(resourceServer.getRealm(), resourceServer, attributes, null, null).isEmpty()) if (!ticketStore.find(resourceServer, attributes, null, null).isEmpty())
throw new ErrorResponseException("invalid_permission", "Permission already exists", Response.Status.BAD_REQUEST); throw new ErrorResponseException("invalid_permission", "Permission already exists", Response.Status.BAD_REQUEST);
PermissionTicket ticket = ticketStore.create(resourceServer, resource, scope, user.getId()); PermissionTicket ticket = ticketStore.create(resourceServer, resource, scope, user.getId());
@ -140,7 +140,7 @@ public class PermissionTicketService {
} }
PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore(); PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore();
PermissionTicket ticket = ticketStore.findById(resourceServer.getRealm(), resourceServer, representation.getId()); PermissionTicket ticket = ticketStore.findById(resourceServer, representation.getId());
if (ticket == null) { if (ticket == null) {
throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "invalid_ticket", Response.Status.BAD_REQUEST); throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "invalid_ticket", Response.Status.BAD_REQUEST);
@ -164,7 +164,7 @@ public class PermissionTicketService {
} }
PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore(); PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore();
PermissionTicket ticket = ticketStore.findById(resourceServer.getRealm(), resourceServer, id); PermissionTicket ticket = ticketStore.findById(resourceServer, id);
if (ticket == null) { if (ticket == null) {
throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "invalid_ticket", Response.Status.BAD_REQUEST); throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "invalid_ticket", Response.Status.BAD_REQUEST);
@ -173,7 +173,7 @@ public class PermissionTicketService {
if (!ticket.getOwner().equals(this.identity.getId()) && !this.identity.isResourceServer() && !ticket.getRequester().equals(this.identity.getId())) if (!ticket.getOwner().equals(this.identity.getId()) && !this.identity.isResourceServer() && !ticket.getRequester().equals(this.identity.getId()))
throw new ErrorResponseException("not_authorised", "permissions for [" + ticket.getResource() + "] can be deleted only by the owner, the requester, or the resource server", Response.Status.FORBIDDEN); throw new ErrorResponseException("not_authorised", "permissions for [" + ticket.getResource() + "] can be deleted only by the owner, the requester, or the resource server", Response.Status.FORBIDDEN);
ticketStore.delete(resourceServer.getRealm(), id); ticketStore.delete(id);
return Response.noContent().build(); return Response.noContent().build();
} }
@ -193,7 +193,7 @@ public class PermissionTicketService {
Map<PermissionTicket.FilterOption, String> filters = getFilters(storeFactory, resourceId, scopeId, owner, requester, granted); Map<PermissionTicket.FilterOption, String> filters = getFilters(storeFactory, resourceId, scopeId, owner, requester, granted);
return Response.ok().entity(permissionTicketStore.find(resourceServer.getRealm(), resourceServer, filters, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS) return Response.ok().entity(permissionTicketStore.find(resourceServer, filters, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS)
.stream() .stream()
.map(permissionTicket -> ModelToRepresentation.toRepresentation(permissionTicket, authorization, returnNames == null ? false : returnNames)) .map(permissionTicket -> ModelToRepresentation.toRepresentation(permissionTicket, authorization, returnNames == null ? false : returnNames))
.collect(Collectors.toList())) .collect(Collectors.toList()))
@ -231,7 +231,7 @@ public class PermissionTicketService {
if (scopeId != null) { if (scopeId != null) {
ScopeStore scopeStore = storeFactory.getScopeStore(); ScopeStore scopeStore = storeFactory.getScopeStore();
Scope scope = scopeStore.findById(resourceServer.getRealm(), resourceServer, scopeId); Scope scope = scopeStore.findById(resourceServer, scopeId);
if (scope == null) { if (scope == null) {
scope = scopeStore.findByName(resourceServer, scopeId); scope = scopeStore.findByName(resourceServer, scopeId);

4
services/src/main/java/org/keycloak/authorization/protection/policy/UserManagedPermissionService.java
View file

@ -128,7 +128,7 @@ public class UserManagedPermissionService {
} }
private Policy getPolicy(@PathParam("policyId") String policyId) { private Policy getPolicy(@PathParam("policyId") String policyId) {
Policy existing = authorization.getStoreFactory().getPolicyStore().findById(resourceServer.getRealm(), resourceServer, policyId); Policy existing = authorization.getStoreFactory().getPolicyStore().findById(resourceServer, policyId);
if (existing == null) { if (existing == null) {
throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "Policy with [" + policyId + "] does not exist", Status.NOT_FOUND); throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "Policy with [" + policyId + "] does not exist", Status.NOT_FOUND);
@ -139,7 +139,7 @@ public class UserManagedPermissionService {
private void checkRequest(String resourceId, UmaPermissionRepresentation representation) { private void checkRequest(String resourceId, UmaPermissionRepresentation representation) {
ResourceStore resourceStore = this.authorization.getStoreFactory().getResourceStore(); ResourceStore resourceStore = this.authorization.getStoreFactory().getResourceStore();
Resource resource = resourceStore.findById(resourceServer.getRealm(), resourceServer, resourceId); Resource resource = resourceStore.findById(resourceServer, resourceId);
if (resource == null) { if (resource == null) {
throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "Resource [" + resourceId + "] cannot be found", Response.Status.BAD_REQUEST); throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "Resource [" + resourceId + "] cannot be found", Response.Status.BAD_REQUEST);

11
services/src/main/java/org/keycloak/services/resources/account/resources/ResourceService.java
View file

@ -88,7 +88,7 @@ public class ResourceService extends AbstractResourceService {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString()); filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId()); filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId());
Collection<ResourcePermission> resources = toPermissions(ticketStore.find(resourceServer.getRealm(), resourceServer, filters, null, null)); Collection<ResourcePermission> resources = toPermissions(ticketStore.find(resourceServer, filters, null, null));
Collection<Permission> permissions = Collections.EMPTY_LIST; Collection<Permission> permissions = Collections.EMPTY_LIST;
if (!resources.isEmpty()) { if (!resources.isEmpty()) {
@ -128,7 +128,6 @@ public class ResourceService extends AbstractResourceService {
} }
Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class); Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
RealmModel realm = resourceServer.getRealm();
filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId()); filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId());
@ -138,7 +137,7 @@ public class ResourceService extends AbstractResourceService {
filters.put(PermissionTicket.FilterOption.REQUESTER, user.getId()); filters.put(PermissionTicket.FilterOption.REQUESTER, user.getId());
List<PermissionTicket> tickets = ticketStore.find(realm, resourceServer, filters, null, null); List<PermissionTicket> tickets = ticketStore.find(resourceServer, filters, null, null);
// grants all requested permissions // grants all requested permissions
if (tickets.isEmpty()) { if (tickets.isEmpty()) {
@ -174,7 +173,7 @@ public class ResourceService extends AbstractResourceService {
// remove all tickets that are not within the requested permissions // remove all tickets that are not within the requested permissions
for (PermissionTicket ticket : tickets) { for (PermissionTicket ticket : tickets) {
ticketStore.delete(realm, ticket.getId()); ticketStore.delete(ticket.getId());
} }
} }
} }
@ -199,7 +198,7 @@ public class ResourceService extends AbstractResourceService {
Map<String, Permission> requests = new HashMap<>(); Map<String, Permission> requests = new HashMap<>();
for (PermissionTicket ticket : ticketStore.find(resourceServer.getRealm(), resourceServer, filters, null, null)) { for (PermissionTicket ticket : ticketStore.find(resourceServer, filters, null, null)) {
requests.computeIfAbsent(ticket.getRequester(), requester -> new Permission(ticket, provider)).addScope(ticket.getScope().getName()); requests.computeIfAbsent(ticket.getRequester(), requester -> new Permission(ticket, provider)).addScope(ticket.getScope().getName());
} }
@ -216,7 +215,7 @@ public class ResourceService extends AbstractResourceService {
org.keycloak.authorization.model.Scope scope = scopeStore.findByName(resourceServer, scopeId); org.keycloak.authorization.model.Scope scope = scopeStore.findByName(resourceServer, scopeId);
if (scope == null) { if (scope == null) {
scope = scopeStore.findById(resourceServer.getRealm(), resourceServer, scopeId); scope = scopeStore.findById(resourceServer, scopeId);
} }
return scope; return scope;

12
services/src/main/java/org/keycloak/services/resources/account/resources/ResourcesService.java
View file

@ -73,7 +73,7 @@ public class ResourcesService extends AbstractResourceService {
filters.put(org.keycloak.authorization.model.Resource.FilterOption.NAME, new String[] { name }); filters.put(org.keycloak.authorization.model.Resource.FilterOption.NAME, new String[] { name });
} }
return queryResponse((f, m) -> resourceStore.find(auth.getRealm(), null, filters, f, m).stream() return queryResponse((f, m) -> resourceStore.find(null, filters, f, m).stream()
.map(resource -> new Resource(resource, user, provider)), first, max); .map(resource -> new Resource(resource, user, provider)), first, max);
} }
@ -90,7 +90,7 @@ public class ResourcesService extends AbstractResourceService {
public Response getSharedWithMe(@QueryParam("name") String name, public Response getSharedWithMe(@QueryParam("name") String name,
@QueryParam("first") Integer first, @QueryParam("first") Integer first,
@QueryParam("max") Integer max) { @QueryParam("max") Integer max) {
return queryResponse((f, m) -> toPermissions(ticketStore.findGrantedResources(auth.getRealm(), auth.getUser().getId(), name, f, m), false) return queryResponse((f, m) -> toPermissions(ticketStore.findGrantedResources(auth.getUser().getId(), name, f, m), false)
.stream(), first, max); .stream(), first, max);
} }
@ -108,7 +108,7 @@ public class ResourcesService extends AbstractResourceService {
@Produces(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON)
public Response getSharedWithOthers(@QueryParam("first") Integer first, @QueryParam("max") Integer max) { public Response getSharedWithOthers(@QueryParam("first") Integer first, @QueryParam("max") Integer max) {
return queryResponse( return queryResponse(
(f, m) -> toPermissions(ticketStore.findGrantedOwnerResources(auth.getRealm(), auth.getUser().getId(), f, m), true) (f, m) -> toPermissions(ticketStore.findGrantedOwnerResources(auth.getUser().getId(), f, m), true)
.stream(), first, max); .stream(), first, max);
} }
@ -123,7 +123,7 @@ public class ResourcesService extends AbstractResourceService {
filters.put(PermissionTicket.FilterOption.REQUESTER, user.getId()); filters.put(PermissionTicket.FilterOption.REQUESTER, user.getId());
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.FALSE.toString()); filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.FALSE.toString());
final List<PermissionTicket> permissionTickets = ticketStore.find(auth.getRealm(), null, filters, null, null); final List<PermissionTicket> permissionTickets = ticketStore.find(null, filters, null, null);
final List<ResourcePermission> resourceList = new ArrayList<>(permissionTickets.size()); final List<ResourcePermission> resourceList = new ArrayList<>(permissionTickets.size());
for (PermissionTicket ticket : permissionTickets) { for (PermissionTicket ticket : permissionTickets) {
@ -138,7 +138,7 @@ public class ResourcesService extends AbstractResourceService {
@Path("{id}") @Path("{id}")
public Object getResource(@PathParam("id") String id) { public Object getResource(@PathParam("id") String id) {
org.keycloak.authorization.model.Resource resource = resourceStore.findById(auth.getRealm(), null, id); org.keycloak.authorization.model.Resource resource = resourceStore.findById(null, id);
if (resource == null) { if (resource == null) {
throw new NotFoundException("resource_not_found"); throw new NotFoundException("resource_not_found");
@ -167,7 +167,7 @@ public class ResourcesService extends AbstractResourceService {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString()); filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId()); filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId());
tickets = ticketStore.find(auth.getRealm(), resource.getResourceServer(), filters, null, null); tickets = ticketStore.find(resource.getResourceServer(), filters, null, null);
} else { } else {
tickets = ticketStore.findGranted(resource.getResourceServer(), resource.getName(), user.getId()); tickets = ticketStore.findGranted(resource.getResourceServer(), resource.getName(), user.getId());
} }

4
services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissions.java
View file

@ -178,7 +178,7 @@ class ClientPermissions implements ClientPermissionEvaluator, ClientPermissionM
private void deletePolicy(String name, ResourceServer server) { private void deletePolicy(String name, ResourceServer server) {
Policy policy = authz.getStoreFactory().getPolicyStore().findByName(server, name); Policy policy = authz.getStoreFactory().getPolicyStore().findByName(server, name);
if (policy != null) { if (policy != null) {
authz.getStoreFactory().getPolicyStore().delete(server.getRealm(), policy.getId()); authz.getStoreFactory().getPolicyStore().delete(policy.getId());
} }
} }
@ -194,7 +194,7 @@ class ClientPermissions implements ClientPermissionEvaluator, ClientPermissionM
deletePolicy(getConfigurePermissionName(client), server); deletePolicy(getConfigurePermissionName(client), server);
deletePolicy(getExchangeToPermissionName(client), server); deletePolicy(getExchangeToPermissionName(client), server);
Resource resource = authz.getStoreFactory().getResourceStore().findByName(server, getResourceName(client));; Resource resource = authz.getStoreFactory().getResourceStore().findByName(server, getResourceName(client));;
if (resource != null) authz.getStoreFactory().getResourceStore().delete(server.getRealm(), resource.getId()); if (resource != null) authz.getStoreFactory().getResourceStore().delete(resource.getId());
} }
@Override @Override

16
services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissions.java
View file

@ -25,10 +25,8 @@ import org.keycloak.authorization.permission.ResourcePermission;
import org.keycloak.authorization.policy.evaluation.EvaluationContext; import org.keycloak.authorization.policy.evaluation.EvaluationContext;
import org.keycloak.authorization.store.PolicyStore; import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.ResourceStore; import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.common.Profile;
import org.keycloak.models.AdminRoles; import org.keycloak.models.AdminRoles;
import org.keycloak.models.GroupModel; import org.keycloak.models.GroupModel;
import org.keycloak.models.RealmModel;
import org.keycloak.representations.idm.authorization.Permission; import org.keycloak.representations.idm.authorization.Permission;
import org.keycloak.services.ForbiddenException; import org.keycloak.services.ForbiddenException;
@ -462,29 +460,27 @@ class GroupPermissions implements GroupPermissionEvaluator, GroupPermissionManag
ResourceServer server = root.realmResourceServer(); ResourceServer server = root.realmResourceServer();
if (server == null) return; if (server == null) return;
RealmModel realm = server.getRealm();
Policy managePermission = managePermission(group); Policy managePermission = managePermission(group);
if (managePermission != null) { if (managePermission != null) {
policyStore.delete(realm, managePermission.getId()); policyStore.delete(managePermission.getId());
} }
Policy viewPermission = viewPermission(group); Policy viewPermission = viewPermission(group);
if (viewPermission != null) { if (viewPermission != null) {
policyStore.delete(realm, viewPermission.getId()); policyStore.delete(viewPermission.getId());
} }
Policy manageMembersPermission = manageMembersPermission(group); Policy manageMembersPermission = manageMembersPermission(group);
if (manageMembersPermission != null) { if (manageMembersPermission != null) {
policyStore.delete(realm, manageMembersPermission.getId()); policyStore.delete(manageMembersPermission.getId());
} }
Policy viewMembersPermission = viewMembersPermission(group); Policy viewMembersPermission = viewMembersPermission(group);
if (viewMembersPermission != null) { if (viewMembersPermission != null) {
policyStore.delete(realm, viewMembersPermission.getId()); policyStore.delete(viewMembersPermission.getId());
} }
Policy manageMembershipPermission = manageMembershipPermission(group); Policy manageMembershipPermission = manageMembershipPermission(group);
if (manageMembershipPermission != null) { if (manageMembershipPermission != null) {
policyStore.delete(realm, manageMembershipPermission.getId()); policyStore.delete(manageMembershipPermission.getId());
} }
Resource resource = groupResource(group); Resource resource = groupResource(group);
if (resource != null) resourceStore.delete(realm, resource.getId()); if (resource != null) resourceStore.delete(resource.getId());
} }
} }

4
services/src/main/java/org/keycloak/services/resources/admin/permissions/IdentityProviderPermissions.java
View file

@ -92,7 +92,7 @@ class IdentityProviderPermissions implements IdentityProviderPermissionManageme
private void deletePolicy(String name, ResourceServer server) { private void deletePolicy(String name, ResourceServer server) {
Policy policy = authz.getStoreFactory().getPolicyStore().findByName(server, name); Policy policy = authz.getStoreFactory().getPolicyStore().findByName(server, name);
if (policy != null) { if (policy != null) {
authz.getStoreFactory().getPolicyStore().delete(server.getRealm(), policy.getId()); authz.getStoreFactory().getPolicyStore().delete(policy.getId());
} }
} }
@ -102,7 +102,7 @@ class IdentityProviderPermissions implements IdentityProviderPermissionManageme
if (server == null) return; if (server == null) return;
deletePolicy(getExchangeToPermissionName(idp), server); deletePolicy(getExchangeToPermissionName(idp), server);
Resource resource = authz.getStoreFactory().getResourceStore().findByName(server, getResourceName(idp));; Resource resource = authz.getStoreFactory().getResourceStore().findByName(server, getResourceName(idp));;
if (resource != null) authz.getStoreFactory().getResourceStore().delete(server.getRealm(), resource.getId()); if (resource != null) authz.getStoreFactory().getResourceStore().delete(resource.getId());
} }
@Override @Override

10
services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissions.java
View file

@ -86,17 +86,15 @@ class RolePermissions implements RolePermissionEvaluator, RolePermissionManageme
ResourceServer server = resourceServer(role); ResourceServer server = resourceServer(role);
if (server == null) return; if (server == null) return;
RealmModel realm = server.getRealm();
Policy policy = mapRolePermission(role); Policy policy = mapRolePermission(role);
if (policy != null) authz.getStoreFactory().getPolicyStore().delete(realm, policy.getId()); if (policy != null) authz.getStoreFactory().getPolicyStore().delete(policy.getId());
policy = mapClientScopePermission(role); policy = mapClientScopePermission(role);
if (policy != null) authz.getStoreFactory().getPolicyStore().delete(realm, policy.getId()); if (policy != null) authz.getStoreFactory().getPolicyStore().delete(policy.getId());
policy = mapCompositePermission(role); policy = mapCompositePermission(role);
if (policy != null) authz.getStoreFactory().getPolicyStore().delete(realm, policy.getId()); if (policy != null) authz.getStoreFactory().getPolicyStore().delete(policy.getId());
Resource resource = authz.getStoreFactory().getResourceStore().findByName(server, getRoleResourceName(role)); Resource resource = authz.getStoreFactory().getResourceStore().findByName(server, getRoleResourceName(role));
if (resource != null) authz.getStoreFactory().getResourceStore().delete(realm, resource.getId()); if (resource != null) authz.getStoreFactory().getResourceStore().delete(resource.getId());
} }
@Override @Override

18
services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissions.java
View file

@ -29,13 +29,11 @@ import org.keycloak.authorization.permission.ResourcePermission;
import org.keycloak.authorization.policy.evaluation.EvaluationContext; import org.keycloak.authorization.policy.evaluation.EvaluationContext;
import org.keycloak.authorization.store.PolicyStore; import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.ResourceStore; import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.common.Profile;
import org.keycloak.models.AdminRoles; import org.keycloak.models.AdminRoles;
import org.keycloak.models.ClientModel; import org.keycloak.models.ClientModel;
import org.keycloak.models.GroupModel; import org.keycloak.models.GroupModel;
import org.keycloak.models.ImpersonationConstants; import org.keycloak.models.ImpersonationConstants;
import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel; import org.keycloak.models.UserModel;
import org.keycloak.representations.idm.authorization.Permission; import org.keycloak.representations.idm.authorization.Permission;
import org.keycloak.services.ForbiddenException; import org.keycloak.services.ForbiddenException;
@ -529,41 +527,39 @@ class UserPermissions implements UserPermissionEvaluator, UserPermissionManageme
ResourceServer server = root.realmResourceServer(); ResourceServer server = root.realmResourceServer();
if (server == null) return; if (server == null) return;
RealmModel realm = server.getRealm();
Policy policy = managePermission(); Policy policy = managePermission();
if (policy != null) { if (policy != null) {
policyStore.delete(realm, policy.getId()); policyStore.delete(policy.getId());
} }
policy = viewPermission(); policy = viewPermission();
if (policy != null) { if (policy != null) {
policyStore.delete(realm, policy.getId()); policyStore.delete(policy.getId());
} }
policy = mapRolesPermission(); policy = mapRolesPermission();
if (policy != null) { if (policy != null) {
policyStore.delete(realm, policy.getId()); policyStore.delete(policy.getId());
} }
policy = manageGroupMembershipPermission(); policy = manageGroupMembershipPermission();
if (policy != null) { if (policy != null) {
policyStore.delete(realm, policy.getId()); policyStore.delete(policy.getId());
} }
policy = adminImpersonatingPermission(); policy = adminImpersonatingPermission();
if (policy != null) { if (policy != null) {
policyStore.delete(realm, policy.getId()); policyStore.delete(policy.getId());
} }
policy = userImpersonatedPermission(); policy = userImpersonatedPermission();
if (policy != null) { if (policy != null) {
policyStore.delete(realm, policy.getId()); policyStore.delete(policy.getId());
} }
Resource usersResource = resourceStore.findByName(server, USERS_RESOURCE); Resource usersResource = resourceStore.findByName(server, USERS_RESOURCE);
if (usersResource != null) { if (usersResource != null) {
resourceStore.delete(realm, usersResource.getId()); resourceStore.delete(usersResource.getId());
} }
} }

10
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UserManagedPermissionServiceTest.java
View file

@ -537,11 +537,11 @@ public class UserManagedPermissionServiceTest extends AbstractResourceServerTest
PolicyStore policyStore = provider.getStoreFactory().getPolicyStore(); PolicyStore policyStore = provider.getStoreFactory().getPolicyStore();
List<Policy> policies = policyStore List<Policy> policies = policyStore
.find(realm, resourceServer, filters, null, null); .find(resourceServer, filters, null, null);
assertTrue(policies.isEmpty()); assertTrue(policies.isEmpty());
policies = policyStore policies = policyStore
.find(realm, resourceServer, Collections.emptyMap(), null, null); .find(resourceServer, Collections.emptyMap(), null, null);
assertTrue(policies.isEmpty()); assertTrue(policies.isEmpty());
} }
@ -964,7 +964,7 @@ public class UserManagedPermissionServiceTest extends AbstractResourceServerTest
filters.put(OWNER, new String[] {user.getId()}); filters.put(OWNER, new String[] {user.getId()});
List<Policy> policies = provider.getStoreFactory().getPolicyStore() List<Policy> policies = provider.getStoreFactory().getPolicyStore()
.find(realm, resourceServer, filters, null, null); .find(resourceServer, filters, null, null);
assertEquals(1, policies.size()); assertEquals(1, policies.size());
Policy policy = policies.get(0); Policy policy = policies.get(0);
@ -973,13 +973,13 @@ public class UserManagedPermissionServiceTest extends AbstractResourceServerTest
Resource resource = policy.getResources().iterator().next(); Resource resource = policy.getResources().iterator().next();
assertEquals("Resource A", resource.getName()); assertEquals("Resource A", resource.getName());
provider.getStoreFactory().getResourceStore().delete(realm, resource.getId()); provider.getStoreFactory().getResourceStore().delete(resource.getId());
filters = new HashMap<>(); filters = new HashMap<>();
filters.put(OWNER, new String[] {user.getId()}); filters.put(OWNER, new String[] {user.getId()});
policies = provider.getStoreFactory().getPolicyStore() policies = provider.getStoreFactory().getPolicyStore()
.find(realm, resourceServer, filters, null, null); .find(resourceServer, filters, null, null);
assertTrue(policies.isEmpty()); assertTrue(policies.isEmpty());
} }

20
testsuite/model/src/test/java/org/keycloak/testsuite/model/authz/ConcurrentAuthzTest.java
View file

@ -95,7 +95,7 @@ public class ConcurrentAuthzTest extends KeycloakModelTest {
String permissionId = withRealm(realmId, (session, realm) -> { String permissionId = withRealm(realmId, (session, realm) -> {
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class); AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
StoreFactory aStore = authorization.getStoreFactory(); StoreFactory aStore = authorization.getStoreFactory();
ResourceServer rs = aStore.getResourceServerStore().findById(realm, resourceServerId); ResourceServer rs = aStore.getResourceServerStore().findById(resourceServerId);
UserModel u = session.users().addUser(realm, "user" + index); UserModel u = session.users().addUser(realm, "user" + index);
@ -113,20 +113,20 @@ public class ConcurrentAuthzTest extends KeycloakModelTest {
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class); AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
StoreFactory aStore = authorization.getStoreFactory(); StoreFactory aStore = authorization.getStoreFactory();
aStore.getPolicyStore().delete(realm, permissionId); aStore.getPolicyStore().delete(permissionId);
return null; return null;
}); });
withRealm(realmId, (session, realm) -> { withRealm(realmId, (session, realm) -> {
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class); AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
StoreFactory aStore = authorization.getStoreFactory(); StoreFactory aStore = authorization.getStoreFactory();
ResourceServer rs = aStore.getResourceServerStore().findById(realm, resourceServerId); ResourceServer rs = aStore.getResourceServerStore().findById(resourceServerId);
Map<Policy.FilterOption, String[]> searchMap = new HashMap<>(); Map<Policy.FilterOption, String[]> searchMap = new HashMap<>();
searchMap.put(Policy.FilterOption.TYPE, new String[]{"uma"}); searchMap.put(Policy.FilterOption.TYPE, new String[]{"uma"});
searchMap.put(Policy.FilterOption.OWNER, new String[]{adminId}); searchMap.put(Policy.FilterOption.OWNER, new String[]{adminId});
searchMap.put(Policy.FilterOption.PERMISSION, new String[] {"true"}); searchMap.put(Policy.FilterOption.PERMISSION, new String[] {"true"});
Set<String> s = aStore.getPolicyStore().find(realm, rs, searchMap, 0, 500).stream().map(Policy::getId).collect(Collectors.toSet()); Set<String> s = aStore.getPolicyStore().find(rs, searchMap, 0, 500).stream().map(Policy::getId).collect(Collectors.toSet());
assertThat(s, not(contains(permissionId))); assertThat(s, not(contains(permissionId)));
return null; return null;
}); });
@ -140,7 +140,7 @@ public class ConcurrentAuthzTest extends KeycloakModelTest {
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class); AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
StoreFactory aStore = authorization.getStoreFactory(); StoreFactory aStore = authorization.getStoreFactory();
UserModel u = session.users().getUserById(realm, adminId); UserModel u = session.users().getUserById(realm, adminId);
ResourceServer rs = aStore.getResourceServerStore().findById(realm, resourceServerId); ResourceServer rs = aStore.getResourceServerStore().findById(resourceServerId);
UmaPermissionRepresentation permission = new UmaPermissionRepresentation(); UmaPermissionRepresentation permission = new UmaPermissionRepresentation();
@ -157,8 +157,8 @@ public class ConcurrentAuthzTest extends KeycloakModelTest {
String createdPolicyId = withRealm(realmId, (session, realm) -> { String createdPolicyId = withRealm(realmId, (session, realm) -> {
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class); AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
StoreFactory aStore = authorization.getStoreFactory(); StoreFactory aStore = authorization.getStoreFactory();
ResourceServer rs = aStore.getResourceServerStore().findById(realm, resourceServerId); ResourceServer rs = aStore.getResourceServerStore().findById(resourceServerId);
Policy permission = aStore.getPolicyStore().findById(realm, rs, permissionId); Policy permission = aStore.getPolicyStore().findById(rs, permissionId);
UserPolicyRepresentation userRep = new UserPolicyRepresentation(); UserPolicyRepresentation userRep = new UserPolicyRepresentation();
userRep.setName("isAdminUser" + index); userRep.setName("isAdminUser" + index);
@ -171,8 +171,8 @@ public class ConcurrentAuthzTest extends KeycloakModelTest {
withRealm(realmId, (session, realm) -> { withRealm(realmId, (session, realm) -> {
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class); AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
StoreFactory aStore = authorization.getStoreFactory(); StoreFactory aStore = authorization.getStoreFactory();
ResourceServer rs = aStore.getResourceServerStore().findById(realm, resourceServerId); ResourceServer rs = aStore.getResourceServerStore().findById(resourceServerId);
Policy permission = aStore.getPolicyStore().findById(realm, rs, permissionId); Policy permission = aStore.getPolicyStore().findById(rs, permissionId);
assertThat(permission.getAssociatedPolicies(), not(contains(nullValue()))); assertThat(permission.getAssociatedPolicies(), not(contains(nullValue())));
ModelToRepresentation.toRepresentation(permission, authorization); ModelToRepresentation.toRepresentation(permission, authorization);
@ -183,7 +183,7 @@ public class ConcurrentAuthzTest extends KeycloakModelTest {
withRealm(realmId, (session, realm) -> { withRealm(realmId, (session, realm) -> {
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class); AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
StoreFactory aStore = authorization.getStoreFactory(); StoreFactory aStore = authorization.getStoreFactory();
aStore.getPolicyStore().delete(realm, createdPolicyId); aStore.getPolicyStore().delete(createdPolicyId);
return null; return null;
}); });
}); });