libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

Added view roles, including updating console to make forms read-only

Browse source
This commit is contained in:
Stian Thorgersen 2014-02-26 14:21:57 +00:00
parent d0ca9a655d
commit ae1b98e38f
38 changed files with 454 additions and 201 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
admin-ui/src/main/resources/META-INF/resources/admin/js/app.js
View file

@ -521,6 +521,8 @@ module.factory('errorInterceptor', function($q, $window, $rootScope, $location,
console.log('session timeout?'); console.log('session timeout?');
Auth.loggedIn = false; Auth.loggedIn = false;
window.location = '/auth/rest/admin/login?path=' + $location.path(); window.location = '/auth/rest/admin/login?path=' + $location.path();
} else if (response.status == 403) {
Notifications.error("Forbidden");
} else if (response.status == 404) { } else if (response.status == 404) {
Notifications.error("Not found"); Notifications.error("Not found");
} else if (response.status) { } else if (response.status) {
@ -785,6 +787,7 @@ module.directive('kcReadOnly', function() {
element.find('input').attr('disabled', 'disabled'); element.find('input').attr('disabled', 'disabled');
element.find('button').attr('disabled', 'disabled'); element.find('button').attr('disabled', 'disabled');
element.find('select').attr('disabled', 'disabled'); element.find('select').attr('disabled', 'disabled');
element.find('textarea').attr('disabled', 'disabled');
} }
} }
}; };

16
admin-ui/src/main/resources/META-INF/resources/admin/js/controllers/realm.js
View file

@ -22,6 +22,22 @@ module.controller('GlobalCtrl', function($scope, $http, Auth, Current, $location
$scope.access = { $scope.access = {
admin: data.admin, admin: data.admin,
get viewRealm() {
return getAccess(Current.realm.realm, 'view-realm') || this.viewRealm;
},
get viewApplications() {
return getAccess(Current.realm.realm, 'view-applications') || this.manageApplications;
},
get viewClients() {
return getAccess(Current.realm.realm, 'view-clients') || this.manageClients;
},
get viewUsers() {
return getAccess(Current.realm.realm, 'view-users') || this.manageClients;
},
get manageRealm() { get manageRealm() {
return getAccess(Current.realm.realm, 'manage-realm'); return getAccess(Current.realm.realm, 'manage-realm');
}, },

4
admin-ui/src/main/resources/META-INF/resources/admin/partials/application-credentials.html
View file

@ -16,7 +16,7 @@
<li class="active">Credentials</li> <li class="active">Credentials</li>
</ol> </ol>
<h2 data-ng-hide="create"><span>{{application.name}}</span> Credentials</h2> <h2 data-ng-hide="create"><span>{{application.name}}</span> Credentials</h2>
<form class="form-horizontal" name="credentialForm" novalidate> <form class="form-horizontal" name="credentialForm" novalidate kc-read-only="!access.manageApplications">
<fieldset > <fieldset >
<legend><span class="text">Client Secret</span></legend> <legend><span class="text">Client Secret</span></legend>
<div class="form-group"> <div class="form-group">
@ -27,7 +27,7 @@
</div> </div>
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions"> <div class="pull-right form-actions" data-ng-show="access.manageApplications">
<button type="submit" data-ng-click="changePassword()" class="btn btn-primary btn-lg">Regenerate Secret <button type="submit" data-ng-click="changePassword()" class="btn btn-primary btn-lg">Regenerate Secret
</button> </button>
</div> </div>

6
admin-ui/src/main/resources/META-INF/resources/admin/partials/application-detail.html
View file

@ -23,7 +23,7 @@
<li class="active">Settings</li> <li class="active">Settings</li>
</ol> </ol>
<h2 data-ng-hide="create"><span>{{application.name}}</span> Settings</h2> <h2 data-ng-hide="create"><span>{{application.name}}</span> Settings</h2>
<form class="form-horizontal" name="applicationForm" novalidate> <form class="form-horizontal" name="applicationForm" novalidate kc-read-only="!access.manageApplications">
<fieldset class="border-top"> <fieldset class="border-top">
<div class="form-group"> <div class="form-group">
<label class="col-sm-2 control-label" for="name">Name <span class="required" data-ng-show="create">*</span></label> <label class="col-sm-2 control-label" for="name">Name <span class="required" data-ng-show="create">*</span></label>
@ -108,11 +108,11 @@
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions" data-ng-show="create"> <div class="pull-right form-actions" data-ng-show="create && access.manageApplications">
<button kc-cancel data-ng-click="cancel()">Cancel</button> <button kc-cancel data-ng-click="cancel()">Cancel</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
</div> </div>
<div class="pull-right form-actions" data-ng-show="!create"> <div class="pull-right form-actions" data-ng-show="!create && access.manageApplications">
<button kc-reset data-ng-show="changed">Clear changes</button> <button kc-reset data-ng-show="changed">Clear changes</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
<button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button> <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>

6
admin-ui/src/main/resources/META-INF/resources/admin/partials/application-role-detail.html
View file

@ -29,7 +29,7 @@
<h2 data-ng-hide="create"><span>{{application.name}}</span> {{role.name}}</h2> <h2 data-ng-hide="create"><span>{{application.name}}</span> {{role.name}}</h2>
<h2 data-ng-show="create"><span>{{application.name}}</span> Add Role</h2> <h2 data-ng-show="create"><span>{{application.name}}</span> Add Role</h2>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageApplications">
<span class="fieldset-notice"><span class="required">*</span> Required fields</span> <span class="fieldset-notice"><span class="required">*</span> Required fields</span>
<fieldset class="border-top"> <fieldset class="border-top">
@ -134,11 +134,11 @@
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions" data-ng-show="create"> <div class="pull-right form-actions" data-ng-show="create && access.manageApplications">
<button kc-cancel data-ng-click="cancel()">Cancel</button> <button kc-cancel data-ng-click="cancel()">Cancel</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
</div> </div>
<div class="pull-right form-actions" data-ng-show="!create"> <div class="pull-right form-actions" data-ng-show="!create && access.manageApplications">
<button kc-reset data-ng-show="changed">Clear changes</button> <button kc-reset data-ng-show="changed">Clear changes</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
<button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button> <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>

2
admin-ui/src/main/resources/META-INF/resources/admin/partials/application-role-list.html
View file

@ -21,7 +21,7 @@
<table class="table"> <table class="table">
<thead> <thead>
<tr> <tr>
<th class="kc-table-actions" colspan="3"> <th class="kc-table-actions" colspan="3" data-ng-show="access.manageApplications">
<div class="pull-right"> <div class="pull-right">
<a class="btn btn-primary" href="#/create/role/{{realm.realm}}/applications/{{application.name}}">Add Role</a> <a class="btn btn-primary" href="#/create/role/{{realm.realm}}/applications/{{application.name}}">Add Role</a>
<!-- <button class="remove disabled">Remove</button> --> <!-- <button class="remove disabled">Remove</button> -->

4
admin-ui/src/main/resources/META-INF/resources/admin/partials/application-scope-mappings.html
View file

@ -19,7 +19,7 @@
</ol> </ol>
<h2><span>{{application.name}}</span> Scope Mappings</h2> <h2><span>{{application.name}}</span> Scope Mappings</h2>
<p class="subtitle"></p> <p class="subtitle"></p>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageApplications">
<fieldset> <fieldset>
<legend><span class="text">Realm Roles</span></legend> <legend><span class="text">Realm Roles</span></legend>
<div class="form-group col-sm-10"> <div class="form-group col-sm-10">
@ -59,7 +59,7 @@
<div class="col-sm-4"> <div class="col-sm-4">
<div class="input-group"> <div class="input-group">
<div class="select-kc"> <div class="select-kc">
<select id="applications" name="applications" ng-change="changeApplication()" ng-model="targetApp" ng-options="a.name for a in (applications|remove:application:'id')"> <select id="applications" name="applications" ng-change="changeApplication()" ng-model="targetApp" ng-options="a.name for a in (applications|remove:application:'id')" ng-disabled="false">
<option value="" selected> Select an Application </option> <option value="" selected> Select an Application </option>
</select> </select>
</div> </div>

4
admin-ui/src/main/resources/META-INF/resources/admin/partials/oauth-client-credentials.html
View file

@ -15,7 +15,7 @@
<li class="active">Credentials</li> <li class="active">Credentials</li>
</ol> </ol>
<h2 data-ng-hide="create"><span>{{oauth.name}}</span> Credentials</h2> <h2 data-ng-hide="create"><span>{{oauth.name}}</span> Credentials</h2>
<form class="form-horizontal" name="credentialForm" novalidate> <form class="form-horizontal" name="credentialForm" novalidate kc-read-only="!access.manageClients">
<fieldset > <fieldset >
<legend><span class="text">Client Secret</span></legend> <legend><span class="text">Client Secret</span></legend>
<div class="form-group"> <div class="form-group">
@ -26,7 +26,7 @@
</div> </div>
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions"> <div class="pull-right form-actions" data-ng-show="access.manageClients">
<button type="submit" data-ng-click="changePassword()" class="btn btn-primary btn-lg">Regenerate Secret <button type="submit" data-ng-click="changePassword()" class="btn btn-primary btn-lg">Regenerate Secret
</button> </button>
</div> </div>

6
admin-ui/src/main/resources/META-INF/resources/admin/partials/oauth-client-detail.html
View file

@ -21,7 +21,7 @@
<li class="active">Settings</li> <li class="active">Settings</li>
</ol> </ol>
<h2 data-ng-hide="create"><span>{{oauth.name}}</span> Settings</h2> <h2 data-ng-hide="create"><span>{{oauth.name}}</span> Settings</h2>
<form class="form-horizontal" name="oauthForm" novalidate> <form class="form-horizontal" name="oauthForm" novalidate kc-read-only="!access.manageClients">
<fieldset class="border-top"> <fieldset class="border-top">
<div class="form-group"> <div class="form-group">
@ -90,11 +90,11 @@
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions" data-ng-show="create"> <div class="pull-right form-actions" data-ng-show="create && access.manageClients">
<button kc-cancel data-ng-click="cancel()">Cancel</button> <button kc-cancel data-ng-click="cancel()">Cancel</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
</div> </div>
<div class="pull-right form-actions" data-ng-show="!create"> <div class="pull-right form-actions" data-ng-show="!create && access.manageClients">
<button kc-reset data-ng-show="changed">Clear changes</button> <button kc-reset data-ng-show="changed">Clear changes</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
<button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button> <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>

4
admin-ui/src/main/resources/META-INF/resources/admin/partials/oauth-client-scope-mappings.html
View file

@ -17,7 +17,7 @@
</ol> </ol>
<h2><span>{{oauth.name}}</span> Scope Mappings</h2> <h2><span>{{oauth.name}}</span> Scope Mappings</h2>
<p class="subtitle"></p> <p class="subtitle"></p>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageClients">
<fieldset> <fieldset>
<legend><span class="text">Realm Roles</span></legend> <legend><span class="text">Realm Roles</span></legend>
<div class="form-group col-sm-10"> <div class="form-group col-sm-10">
@ -57,7 +57,7 @@
<div class="col-sm-4"> <div class="col-sm-4">
<div class="input-group"> <div class="input-group">
<div class="select-kc"> <div class="select-kc">
<select id="applications" name="applications" ng-change="changeApplication()" ng-model="targetApp" ng-options="a.name for a in (applications)"> <select id="applications" name="applications" ng-change="changeApplication()" ng-model="targetApp" ng-options="a.name for a in (applications)" ng-disabled="false">
<option value="" selected> Select an Application </option> <option value="" selected> Select an Application </option>
</select> </select>
</div> </div>

8
admin-ui/src/main/resources/META-INF/resources/admin/partials/realm-credentials.html
View file

@ -9,9 +9,9 @@
<li class="active">Required Credentials</li> <li class="active">Required Credentials</li>
</ol> </ol>
<h2><span>{{realm.realm}}</span> Credentials</h2> <h2><span>{{realm.realm}}</span> Credentials</h2>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
<fieldset class="border-top"> <fieldset class="border-top">
<legend uncollapsed><span class="text">Realm Credentials Settings</span></legend> <legend><span class="text">Realm Credentials Settings</span></legend>
<div class="form-group"> <div class="form-group">
<label class="col-sm-2 control-label" for="user" class="control-label two-lines">Required User Credentials</label> <label class="col-sm-2 control-label" for="user" class="control-label two-lines">Required User Credentials</label>
@ -21,7 +21,7 @@
</div> </div>
</fieldset> </fieldset>
<fieldset class="border-top"> <fieldset class="border-top">
<legend uncollapsed><span class="text">Realm Password Policy</span></legend> <legend><span class="text">Realm Password Policy</span></legend>
<table class="table"> <table class="table">
<caption class="hidden">Table of Password Policies</caption> <caption class="hidden">Table of Password Policies</caption>
<thead> <thead>
@ -63,7 +63,7 @@
</tbody> </tbody>
</table> </table>
</fieldset> </fieldset>
<div class="pull-right form-actions"> <div class="pull-right form-actions" data-ng-show="access.manageRealm">
<button kc-reset data-ng-show="changed">Clear changes</button> <button kc-reset data-ng-show="changed">Clear changes</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
</div> </div>

4
admin-ui/src/main/resources/META-INF/resources/admin/partials/realm-default-roles.html
View file

@ -8,7 +8,7 @@
<li class="active">Registration</li> <li class="active">Registration</li>
</ol> </ol>
<h2><span>{{realm.realm}}</span> Default Roles</h2> <h2><span>{{realm.realm}}</span> Default Roles</h2>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
<fieldset> <fieldset>
<legend><span class="text">Realm Default Roles</span> </legend> <legend><span class="text">Realm Default Roles</span> </legend>
<div class="form-group"> <div class="form-group">
@ -48,7 +48,7 @@
<div class="col-sm-4"> <div class="col-sm-4">
<div class="input-group"> <div class="input-group">
<div class="select-kc"> <div class="select-kc">
<select id="applications" name="applications" ng-change="changeApplication()" ng-model="application" ng-options="a.name for a in applications"> <select id="applications" name="applications" ng-change="changeApplication()" ng-model="application" ng-options="a.name for a in applications" ng-disabled="false">
<option value="" selected> Select an Application...</option> <option value="" selected> Select an Application...</option>
</select> </select>
</div> </div>

10
admin-ui/src/main/resources/META-INF/resources/admin/partials/realm-detail.html
View file

@ -7,11 +7,11 @@
<li><a href="#/realms/{{realm.realm}}">Settings</a></li> <li><a href="#/realms/{{realm.realm}}">Settings</a></li>
<li class="active">General</li> <li class="active">General</li>
</ol> </ol>
<div data-ng-show="access.manageRealm"> <div data-ng-show="access.viewRealm">
<h2 class="pull-left" data-ng-show="createRealm">Add Realm</h2> <h2 class="pull-left" data-ng-show="createRealm">Add Realm</h2>
<h2 data-ng-hide="createRealm"><span>{{realm.realm}}</span> General Settings</h2> <h2 data-ng-hide="createRealm"><span>{{realm.realm}}</span> General Settings</h2>
<p class="subtitle" data-ng-show="createRealm"><span class="required">*</span> Required fields</p> <p class="subtitle" data-ng-show="createRealm"><span class="required">*</span> Required fields</p>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
<fieldset> <fieldset>
<legend class="aj-collapse open"><span class="text">Required Settings</span></legend> <legend class="aj-collapse open"><span class="text">Required Settings</span></legend>
<div class="form-group"> <div class="form-group">
@ -91,18 +91,18 @@
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions" data-ng-show="createRealm"> <div class="pull-right form-actions" data-ng-show="createRealm && access.manageRealm">
<button kc-cancel data-ng-click="cancel()">Cancel</button> <button kc-cancel data-ng-click="cancel()">Cancel</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
</div> </div>
<div class="pull-right form-actions" data-ng-show="!createRealm"> <div class="pull-right form-actions" data-ng-show="!createRealm && access.manageRealm">
<button kc-reset data-ng-show="changed">Clear changes</button> <button kc-reset data-ng-show="changed">Clear changes</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
<button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button> <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>
</div> </div>
</form> </form>
</div> </div>
<div data-ng-hide="access.manageRealm"> <div data-ng-hide="access.viewRealm">
<h2 ><span>{{realm.realm}}</span></h2> <h2 ><span>{{realm.realm}}</span></h2>
</div> </div>

4
admin-ui/src/main/resources/META-INF/resources/admin/partials/realm-keys.html
View file

@ -8,7 +8,7 @@
<li class="active">Keys</li> <li class="active">Keys</li>
</ol> </ol>
<h2><span>{{realm.realm}}</span> Keys</h2> <h2><span>{{realm.realm}}</span> Keys</h2>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
<fieldset class="border-top"> <fieldset class="border-top">
<div class="form-group"> <div class="form-group">
<label class="col-sm-2 control-label" for="publicKey">Public key</label> <label class="col-sm-2 control-label" for="publicKey">Public key</label>
@ -19,7 +19,7 @@
</div> </div>
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions"> <div class="pull-right form-actions" data-ng-show="access.manageRealm">
<button class="btn btn-primary btn-lg" type="submit" data-ng-click="generate()">Generate new keys</button> <button class="btn btn-primary btn-lg" type="submit" data-ng-click="generate()">Generate new keys</button>
</div> </div>
</form> </form>

8
admin-ui/src/main/resources/META-INF/resources/admin/partials/realm-menu.html
View file

@ -1,9 +1,9 @@
<ul data-ng-hide="createRealm"> <ul data-ng-hide="createRealm">
<li data-ng-show="access.manageRealm" data-ng-class="((!path[2] || path[1] == 'role' || path[2] == 'roles' || path[2] == 'token-settings' || <li data-ng-show="access.viewRealm" data-ng-class="((!path[2] || path[1] == 'role' || path[2] == 'roles' || path[2] == 'token-settings' ||
path[2] == 'social-settings' || path[2] == 'required-credentials' || path[2] == 'default-roles' || path[2] == 'registration-settings' || path[2] == 'social-settings' || path[2] == 'required-credentials' || path[2] == 'default-roles' || path[2] == 'registration-settings' ||
path[2] == 'keys-settings' || path[2] == 'smtp-settings') && path[3] != 'applications') && 'active'"><a href="#/realms/{{realm.realm}}">Settings</a></li> path[2] == 'keys-settings' || path[2] == 'smtp-settings') && path[3] != 'applications') && 'active'"><a href="#/realms/{{realm.realm}}">Settings</a></li>
<li data-ng-show="access.manageUsers" data-ng-class="(path[2] == 'users' || path[1] == 'user') && 'active'"><a href="#/realms/{{realm.realm}}/users">Users</a> <li data-ng-show="access.viewUsers" data-ng-class="(path[2] == 'users' || path[1] == 'user') && 'active'"><a href="#/realms/{{realm.realm}}/users">Users</a>
</li> </li>
<li data-ng-show="access.manageApplications" data-ng-class="(path[2] == 'applications' || path[1] == 'application' || path[3] == 'applications') && 'active'"><a href="#/realms/{{realm.realm}}/applications">Applications</a></li> <li data-ng-show="access.viewApplications" data-ng-class="(path[2] == 'applications' || path[1] == 'application' || path[3] == 'applications') && 'active'"><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
<li data-ng-show="access.manageClients" data-ng-class="(path[2] == 'oauth-clients' || path[1] == 'oauth-client') && 'active'"><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li> <li data-ng-show="access.viewClients" data-ng-class="(path[2] == 'oauth-clients' || path[1] == 'oauth-client') && 'active'"><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
</ul> </ul>

8
admin-ui/src/main/resources/META-INF/resources/admin/partials/realm-smtp.html
View file

@ -8,10 +8,10 @@
<li class="active">SMTP Configuration</li> <li class="active">SMTP Configuration</li>
</ol> </ol>
<h2><span>{{realm.realm}}</span> Email Server Settings</h2> <h2><span>{{realm.realm}}</span> Email Server Settings</h2>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
<span class="fieldset-notice"><span class="required">*</span> Required fields</span> <span class="fieldset-notice"><span class="required">*</span> Required fields</span>
<fieldset> <fieldset>
<legend uncollapsed><span class="text">Required Settings</span></legend> <legend><span class="text">Required Settings</span></legend>
<div class="form-group clearfix"> <div class="form-group clearfix">
<label class="col-sm-2 control-label" for="smtpHost">Host <span class="required">*</span></label> <label class="col-sm-2 control-label" for="smtpHost">Host <span class="required">*</span></label>
<div class="col-sm-4"> <div class="col-sm-4">
@ -44,7 +44,7 @@
</div> </div>
</fieldset> </fieldset>
<fieldset> <fieldset>
<legend uncollapsed><span class="text">Authentication</span></legend> <legend><span class="text">Authentication</span></legend>
<div class="form-group clearfix"> <div class="form-group clearfix">
<label class="col-sm-2 control-label" for="smtpAuth">Enable Authentication</label> <label class="col-sm-2 control-label" for="smtpAuth">Enable Authentication</label>
<div class="col-sm-4"> <div class="col-sm-4">
@ -65,7 +65,7 @@
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions"> <div class="pull-right form-actions" data-ng-show="access.manageRealm">
<button data-kc-reset data-ng-show="changed">Clear changes</button> <button data-kc-reset data-ng-show="changed">Clear changes</button>
<button data-kc-save data-ng-show="changed">Save</button> <button data-kc-save data-ng-show="changed">Save</button>
</div> </div>

4
admin-ui/src/main/resources/META-INF/resources/admin/partials/realm-tokens.html
View file

@ -8,7 +8,7 @@
<li class="active">Token</li> <li class="active">Token</li>
</ol> </ol>
<h2><span>{{realm.realm}}</span> Token Settings</h2> <h2><span>{{realm.realm}}</span> Token Settings</h2>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
<fieldset class="border-top"> <fieldset class="border-top">
<div class="form-group"> <div class="form-group">
<label class="col-sm-2 control-label" for="rememberMe">Remember Me</label> <label class="col-sm-2 control-label" for="rememberMe">Remember Me</label>
@ -113,7 +113,7 @@
</div> </div>
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions"> <div class="pull-right form-actions" data-ng-show="access.manageRealm">
<button kc-reset data-ng-show="changed">Clear changes</button> <button kc-reset data-ng-show="changed">Clear changes</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
</div> </div>

6
admin-ui/src/main/resources/META-INF/resources/admin/partials/role-detail.html
View file

@ -28,7 +28,7 @@
</ol> </ol>
<h2 data-ng-show="create"><span>{{realm.realm}}</span> Add Role</h2> <h2 data-ng-show="create"><span>{{realm.realm}}</span> Add Role</h2>
<p class="subtitle" data-ng-show="create"><span class="required">*</span> Required fields</p> <p class="subtitle" data-ng-show="create"><span class="required">*</span> Required fields</p>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
<fieldset> <fieldset>
<div class="form-group"> <div class="form-group">
<label class="col-sm-2 control-label" for="name">Role name <span class="required" data-ng-show="create">*</span></label> <label class="col-sm-2 control-label" for="name">Role name <span class="required" data-ng-show="create">*</span></label>
@ -96,7 +96,7 @@
<div class="col-sm-4"> <div class="col-sm-4">
<div class="input-group"> <div class="input-group">
<div class="select-kc"> <div class="select-kc">
<select id="applications" name="applications" ng-change="changeApplication()" ng-model="compositeApp" ng-options="a.name for a in applications"> <select id="applications" name="applications" ng-change="changeApplication()" ng-model="compositeApp" ng-options="a.name for a in applications" ng-disabled="false">
<option value="" selected> Select an Application...</option> <option value="" selected> Select an Application...</option>
</select> </select>
</div> </div>
@ -133,7 +133,7 @@
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions" data-ng-show="!create"> <div class="pull-right form-actions" data-ng-show="!create && access.manageRealm">
<button kc-reset data-ng-show="changed">Clear changes</button> <button kc-reset data-ng-show="changed">Clear changes</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
<button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button> <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>

2
admin-ui/src/main/resources/META-INF/resources/admin/partials/role-list.html
View file

@ -13,7 +13,7 @@
<table class="table"> <table class="table">
<thead> <thead>
<tr> <tr>
<th class="kc-table-actions" colspan="3"> <th class="kc-table-actions" colspan="3" data-ng-show="access.manageRealm">
<div class="pull-right"> <div class="pull-right">
<a class="btn btn-primary" href="#/create/role/{{realm.realm}}">Add Role</a> <a class="btn btn-primary" href="#/create/role/{{realm.realm}}">Add Role</a>
<!-- <button class="remove disabled">Remove</button> --> <!-- <button class="remove disabled">Remove</button> -->

6
admin-ui/src/main/resources/META-INF/resources/admin/partials/role-mappings.html
View file

@ -2,7 +2,7 @@
<div id="content-area" class="col-md-9" role="main"> <div id="content-area" class="col-md-9" role="main">
<ul class="nav nav-tabs nav-tabs-pf" data-ng-show="!create"> <ul class="nav nav-tabs nav-tabs-pf" data-ng-show="!create">
<li><a href="#/realms/{{realm.realm}}/users/{{user.username}}">Attributes</a></li> <li><a href="#/realms/{{realm.realm}}/users/{{user.username}}">Attributes</a></li>
<li><a href="#/realms/{{realm.realm}}/users/{{user.username}}/user-credentials">Credentials</a></li> <li data-ng-show="access.manageUsers"><a href="#/realms/{{realm.realm}}/users/{{user.username}}/user-credentials">Credentials</a></li>
<li class="active"><a href="#/realms/{{realm.realm}}/users/{{user.username}}/role-mappings">Role Mappings</a></li> <li class="active"><a href="#/realms/{{realm.realm}}/users/{{user.username}}/role-mappings">Role Mappings</a></li>
</ul> </ul>
<div id="content"> <div id="content">
@ -13,7 +13,7 @@
<li class="active">Role Mappings</li> <li class="active">Role Mappings</li>
</ol> </ol>
<h2><span>{{user.username}}'s</span> Role Mappings</h2> <h2><span>{{user.username}}'s</span> Role Mappings</h2>
<form class="form-horizontal" name="realmForm" novalidate> <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageUsers">
<fieldset> <fieldset>
<legend><span class="text">Realm Roles</span> </legend> <legend><span class="text">Realm Roles</span> </legend>
@ -54,7 +54,7 @@
<div class="col-sm-4"> <div class="col-sm-4">
<div class="input-group"> <div class="input-group">
<div class="select-kc"> <div class="select-kc">
<select id="applications" name="applications" ng-change="changeApplication()" ng-model="application" ng-options="a.name for a in applications"> <select id="applications" name="applications" ng-change="changeApplication()" ng-model="application" ng-options="a.name for a in applications" ng-disabled="false">
<option value="" selected> Select an Application...</option> <option value="" selected> Select an Application...</option>
</select> </select>
</div> </div>

8
admin-ui/src/main/resources/META-INF/resources/admin/partials/user-detail.html
View file

@ -3,7 +3,7 @@
<ul class="nav nav-tabs nav-tabs-pf" data-ng-show="!create"> <ul class="nav nav-tabs nav-tabs-pf" data-ng-show="!create">
<li class="active"><a href="#/realms/{{realm.realm}}/users/{{user.username}}">Attributes</a></li> <li class="active"><a href="#/realms/{{realm.realm}}/users/{{user.username}}">Attributes</a></li>
<li><a href="#/realms/{{realm.realm}}/users/{{user.username}}/user-credentials">Credentials</a></li> <li data-ng-show="access.manageUsers"><a href="#/realms/{{realm.realm}}/users/{{user.username}}/user-credentials">Credentials</a></li>
<li><a href="#/realms/{{realm.realm}}/users/{{user.username}}/role-mappings">Role Mappings</a></li> <li><a href="#/realms/{{realm.realm}}/users/{{user.username}}/role-mappings">Role Mappings</a></li>
</ul> </ul>
@ -22,7 +22,7 @@
</ol> </ol>
<h2 data-ng-hide="create"><span>{{user.username}}'s</span> Attributes</h2> <h2 data-ng-hide="create"><span>{{user.username}}'s</span> Attributes</h2>
<form class="form-horizontal" name="userForm" novalidate> <form class="form-horizontal" name="userForm" novalidate kc-read-only="!access.manageUsers">
<span class="fieldset-notice"><span class="required">*</span> Required fields</span> <span class="fieldset-notice"><span class="required">*</span> Required fields</span>
<fieldset class="border-top"> <fieldset class="border-top">
<div class="form-group"> <div class="form-group">
@ -79,12 +79,12 @@
</div> </div>
</div> </div>
</fieldset> </fieldset>
<div class="pull-right form-actions" data-ng-show="create"> <div class="pull-right form-actions" data-ng-show="create && access.manageUsers">
<button kc-cancel data-ng-click="cancel()">Cancel</button> <button kc-cancel data-ng-click="cancel()">Cancel</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
</div> </div>
<div class="pull-right form-actions" data-ng-show="!create"> <div class="pull-right form-actions" data-ng-show="!create && access.manageUsers">
<button kc-reset data-ng-show="changed">Clear changes</button> <button kc-reset data-ng-show="changed">Clear changes</button>
<button kc-save data-ng-show="changed">Save</button> <button kc-save data-ng-show="changed">Save</button>
<button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button> <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>

14
admin-ui/src/main/resources/META-INF/resources/admin/templates/kc-navigation.html
View file

@ -1,10 +1,10 @@
<ul class="nav nav-tabs nav-tabs-pf"> <ul class="nav nav-tabs nav-tabs-pf">
<li ng-class="{active: !path[2]}"><a href="#/realms/{{realm.realm}}">General</a></li> <li ng-class="{active: !path[2]}"><a href="#/realms/{{realm.realm}}">General</a></li>
<li ng-class="{active: path[2] == 'social'}" data-ng-show="kcSocial && auth.hasAccess(realm.realm, 'manage-realm')"><a href="#/realms/{{realm.realm}}/social-settings">Social</a></li> <li ng-class="{active: path[2] == 'social'}" data-ng-show="kcSocial && access.viewRealm"><a href="#/realms/{{realm.realm}}/social-settings">Social</a></li>
<li ng-class="{active: path[2] == 'roles'}" data-ng-show="access.manageRealm"><a href="#/realms/{{realm.realm}}/roles">Roles</a></li> <li ng-class="{active: path[2] == 'roles'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/roles">Roles</a></li>
<li ng-class="{active: path[2] == 'default-roles'}" data-ng-show="access.manageRealm"><a href="#/realms/{{realm.realm}}/default-roles">Default Roles</a></li> <li ng-class="{active: path[2] == 'default-roles'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/default-roles">Default Roles</a></li>
<li ng-class="{active: path[2] == 'required-credentials'}" data-ng-show="access.manageRealm"><a href="#/realms/{{realm.realm}}/required-credentials">Credentials</a></li> <li ng-class="{active: path[2] == 'required-credentials'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/required-credentials">Credentials</a></li>
<li ng-class="{active: path[2] == 'token-settings'}" data-ng-show="access.manageRealm"><a href="#/realms/{{realm.realm}}/token-settings">Token</a></li> <li ng-class="{active: path[2] == 'token-settings'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/token-settings">Token</a></li>
<li ng-class="{active: path[2] == 'keys-settings'}" data-ng-show="access.manageRealm"><a href="#/realms/{{realm.realm}}/keys-settings">Keys</a></li> <li ng-class="{active: path[2] == 'keys-settings'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/keys-settings">Keys</a></li>
<li ng-class="{active: path[2] == 'smtp-settings'}" data-ng-show="access.manageRealm"><a href="#/realms/{{realm.realm}}/smtp-settings">Email</a></li> <li ng-class="{active: path[2] == 'smtp-settings'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/smtp-settings">Email</a></li>
</ul> </ul>

7
model/api/src/main/java/org/keycloak/models/AdminRoles.java
View file

@ -9,12 +9,17 @@ public class AdminRoles {
public static String ADMIN = "admin"; public static String ADMIN = "admin";
public static String VIEW_REALM = "view-realm";
public static String VIEW_USERS = "view-users";
public static String VIEW_APPLICATIONS = "view-applications";
public static String VIEW_CLIENTS = "view-clients";
public static String MANAGE_REALM = "manage-realm"; public static String MANAGE_REALM = "manage-realm";
public static String MANAGE_USERS = "manage-users"; public static String MANAGE_USERS = "manage-users";
public static String MANAGE_APPLICATIONS = "manage-applications"; public static String MANAGE_APPLICATIONS = "manage-applications";
public static String MANAGE_CLIENTS = "manage-clients"; public static String MANAGE_CLIENTS = "manage-clients";
public static String[] ALL_REALM_ROLES = {MANAGE_REALM, MANAGE_USERS, MANAGE_APPLICATIONS, MANAGE_CLIENTS}; public static String[] ALL_REALM_ROLES = {VIEW_REALM, VIEW_USERS, VIEW_APPLICATIONS, VIEW_CLIENTS, MANAGE_REALM, MANAGE_USERS, MANAGE_APPLICATIONS, MANAGE_CLIENTS};
public static String getAdminApp(RealmModel realm) { public static String getAdminApp(RealmModel realm) {
return realm.getName() + APP_SUFFIX; return realm.getName() + APP_SUFFIX;

80
services/src/main/java/org/keycloak/services/managers/Auth.java
View file

@ -1,23 +1,14 @@
package org.keycloak.services.managers; package org.keycloak.services.managers;
import org.keycloak.models.ApplicationModel;
import org.keycloak.models.Constants;
import org.keycloak.models.RealmModel; import org.keycloak.models.RealmModel;
import org.keycloak.models.RoleModel;
import org.keycloak.models.UserModel; import org.keycloak.models.UserModel;
import org.keycloak.representations.AccessToken; import org.keycloak.representations.AccessToken;
import javax.ws.rs.ForbiddenException;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
/** /**
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a> * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
*/ */
public class Auth { public class Auth {
private final boolean cookie; private final boolean cookie;
private final RealmModel realm; private final RealmModel realm;
private final AccessToken token; private final AccessToken token;
@ -62,45 +53,25 @@ public class Auth {
return token; return token;
} }
public void require(String role) { public boolean hasRealmRole(String role) {
if (!has(role)) { if (cookie) {
throw new ForbiddenException();
}
}
public void require(String app, String role) {
if (!has(app, role)) {
throw new ForbiddenException();
}
}
public void require(ApplicationModel app, String role) {
if (!has(app, role)) {
throw new ForbiddenException();
}
}
public void requireOneOf(String app, String... roles) {
if(!hasOneOf(app, roles)) {
throw new ForbiddenException();
}
}
public void requireOneOf(ApplicationModel app, String... roles) {
if(!hasOneOf(app, roles)) {
throw new ForbiddenException();
}
}
public boolean has(String role) {
if (cookie) {
return realm.hasRole(user, realm.getRole(role)); return realm.hasRole(user, realm.getRole(role));
} else { } else {
return token.getRealmAccess() != null && token.getRealmAccess().isUserInRole(role); AccessToken.Access access = token.getRealmAccess();
return access != null && access.isUserInRole(role);
} }
} }
public boolean has(String app, String role) { public boolean hasOneOfRealmRole(String... roles) {
for (String r : roles) {
if (hasRealmRole(r)) {
return true;
}
}
return false;
}
public boolean hasAppRole(String app, String role) {
if (cookie) { if (cookie) {
return realm.hasRole(user, realm.getApplicationByName(app).getRole(role)); return realm.hasRole(user, realm.getApplicationByName(app).getRole(role));
} else { } else {
@ -109,30 +80,13 @@ public class Auth {
} }
} }
public boolean has(ApplicationModel app, String role) { public boolean hasOneOfAppRole(String app, String... roles) {
if (cookie) {
return realm.hasRole(user, app.getRole(role));
} else {
AccessToken.Access access = token.getResourceAccess(app.getName());
return access != null && access.isUserInRole(role);
}
}
public boolean hasOneOf(String app, String... roles) {
for (String r : roles) { for (String r : roles) {
if (has(app, r)) { if (hasAppRole(app, r)) {
return true; return true;
} }
} }
return false; return false;
} }
public boolean hasOneOf(ApplicationModel app, String... roles) {
for (String r : roles) {
if (has(app, r)) {
return true;
}
}
return false;
}
} }

24
services/src/main/java/org/keycloak/services/resources/AccountService.java
View file

@ -81,7 +81,7 @@ public class AccountService {
Auth auth = getAuth(false); Auth auth = getAuth(false);
if (auth != null) { if (auth != null) {
try { try {
auth.require(application, AccountRoles.MANAGE_ACCOUNT); require(auth, AccountRoles.MANAGE_ACCOUNT);
} catch (ForbiddenException e) { } catch (ForbiddenException e) {
return Flows.forms(realm, request, uriInfo).setError("No access").createErrorPage(); return Flows.forms(realm, request, uriInfo).setError("No access").createErrorPage();
} }
@ -113,7 +113,7 @@ public class AccountService {
return forwardToPage(null, AccountPages.ACCOUNT); return forwardToPage(null, AccountPages.ACCOUNT);
} else if (types.contains(MediaType.APPLICATION_JSON_TYPE)) { } else if (types.contains(MediaType.APPLICATION_JSON_TYPE)) {
Auth auth = getAuth(true); Auth auth = getAuth(true);
auth.requireOneOf(application, AccountRoles.MANAGE_ACCOUNT, AccountRoles.VIEW_PROFILE); requireOneOf(auth, AccountRoles.MANAGE_ACCOUNT, AccountRoles.VIEW_PROFILE);
return Cors.add(request, Response.ok(ModelToRepresentation.toRepresentation(auth.getUser()))).auth().allowedOrigins(auth.getClient()).build(); return Cors.add(request, Response.ok(ModelToRepresentation.toRepresentation(auth.getUser()))).auth().allowedOrigins(auth.getClient()).build();
} else { } else {
@ -138,7 +138,7 @@ public class AccountService {
@Consumes(MediaType.APPLICATION_FORM_URLENCODED) @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
public Response processAccountUpdate(final MultivaluedMap<String, String> formData) { public Response processAccountUpdate(final MultivaluedMap<String, String> formData) {
Auth auth = getAuth(true); Auth auth = getAuth(true);
auth.require(application, AccountRoles.MANAGE_ACCOUNT); require(auth, AccountRoles.MANAGE_ACCOUNT);
UserModel user = auth.getUser(); UserModel user = auth.getUser();
@ -160,7 +160,7 @@ public class AccountService {
@GET @GET
public Response processTotpRemove() { public Response processTotpRemove() {
Auth auth = getAuth(true); Auth auth = getAuth(true);
auth.require(application, AccountRoles.MANAGE_ACCOUNT); require(auth, AccountRoles.MANAGE_ACCOUNT);
UserModel user = auth.getUser(); UserModel user = auth.getUser();
user.setTotp(false); user.setTotp(false);
@ -174,7 +174,7 @@ public class AccountService {
@Consumes(MediaType.APPLICATION_FORM_URLENCODED) @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
public Response processTotpUpdate(final MultivaluedMap<String, String> formData) { public Response processTotpUpdate(final MultivaluedMap<String, String> formData) {
Auth auth = getAuth(true); Auth auth = getAuth(true);
auth.require(application, AccountRoles.MANAGE_ACCOUNT); require(auth, AccountRoles.MANAGE_ACCOUNT);
UserModel user = auth.getUser(); UserModel user = auth.getUser();
@ -204,7 +204,7 @@ public class AccountService {
@Consumes(MediaType.APPLICATION_FORM_URLENCODED) @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
public Response processPasswordUpdate(final MultivaluedMap<String, String> formData) { public Response processPasswordUpdate(final MultivaluedMap<String, String> formData) {
Auth auth = getAuth(true); Auth auth = getAuth(true);
auth.require(application, AccountRoles.MANAGE_ACCOUNT); require(auth, AccountRoles.MANAGE_ACCOUNT);
UserModel user = auth.getUser(); UserModel user = auth.getUser();
@ -345,4 +345,16 @@ public class AccountService {
return null; return null;
} }
public void require(Auth auth, String role) {
if (!auth.hasAppRole(application.getName(), role)) {
throw new ForbiddenException();
}
}
public void requireOneOf(Auth auth, String... roles) {
if (!auth.hasOneOfAppRole(application.getName(), roles)) {
throw new ForbiddenException();
}
}
} }

1
services/src/main/java/org/keycloak/services/resources/admin/AdminService.java
View file

@ -234,6 +234,7 @@ public class AdminService {
if (auth == null) { if (auth == null) {
throw new NotAuthorizedException("Bearer"); throw new NotAuthorizedException("Bearer");
} }
RealmsAdminResource adminResource = new RealmsAdminResource(auth, tokenManager); RealmsAdminResource adminResource = new RealmsAdminResource(auth, tokenManager);
resourceContext.initResource(adminResource); resourceContext.initResource(adminResource);
return adminResource; return adminResource;

36
services/src/main/java/org/keycloak/services/resources/admin/ApplicationResource.java
View file

@ -34,9 +34,10 @@ import java.util.Set;
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a> * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $ * @version $Revision: 1 $
*/ */
public class ApplicationResource extends RoleContainerResource { public class ApplicationResource {
protected static final Logger logger = Logger.getLogger(RealmAdminResource.class); protected static final Logger logger = Logger.getLogger(RealmAdminResource.class);
protected RealmModel realm; protected RealmModel realm;
private RealmAuth auth;
protected ApplicationModel application; protected ApplicationModel application;
protected KeycloakSession session; protected KeycloakSession session;
@Context @Context
@ -49,16 +50,20 @@ public class ApplicationResource extends RoleContainerResource {
return (KeycloakApplication)keycloak; return (KeycloakApplication)keycloak;
} }
public ApplicationResource(RealmModel realm, ApplicationModel applicationModel, KeycloakSession session) { public ApplicationResource(RealmModel realm, RealmAuth auth, ApplicationModel applicationModel, KeycloakSession session) {
super(realm, applicationModel);
this.realm = realm; this.realm = realm;
this.auth = auth;
this.application = applicationModel; this.application = applicationModel;
this.session = session; this.session = session;
auth.init(RealmAuth.Resource.APPLICATION);
} }
@PUT @PUT
@Consumes(MediaType.APPLICATION_JSON) @Consumes(MediaType.APPLICATION_JSON)
public void update(final ApplicationRepresentation rep) { public void update(final ApplicationRepresentation rep) {
auth.requireManage();
ApplicationManager applicationManager = new ApplicationManager(new RealmManager(session)); ApplicationManager applicationManager = new ApplicationManager(new RealmManager(session));
applicationManager.updateApplication(rep, application); applicationManager.updateApplication(rep, application);
} }
@ -68,6 +73,8 @@ public class ApplicationResource extends RoleContainerResource {
@NoCache @NoCache
@Produces(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON)
public ApplicationRepresentation getApplication() { public ApplicationRepresentation getApplication() {
auth.requireView();
ApplicationManager applicationManager = new ApplicationManager(new RealmManager(session)); ApplicationManager applicationManager = new ApplicationManager(new RealmManager(session));
return applicationManager.toRepresentation(application); return applicationManager.toRepresentation(application);
} }
@ -78,6 +85,8 @@ public class ApplicationResource extends RoleContainerResource {
@Path("installation/json") @Path("installation/json")
@Produces(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON)
public String getInstallation() throws IOException { public String getInstallation() throws IOException {
auth.requireView();
ApplicationManager applicationManager = new ApplicationManager(new RealmManager(session)); ApplicationManager applicationManager = new ApplicationManager(new RealmManager(session));
Object rep = applicationManager.toInstallationRepresentation(realm, application, getKeycloakApplication().getBaseUri(uriInfo)); Object rep = applicationManager.toInstallationRepresentation(realm, application, getKeycloakApplication().getBaseUri(uriInfo));
@ -90,6 +99,8 @@ public class ApplicationResource extends RoleContainerResource {
@Path("installation/jboss") @Path("installation/jboss")
@Produces(MediaType.TEXT_PLAIN) @Produces(MediaType.TEXT_PLAIN)
public String getJBossInstallation() throws IOException { public String getJBossInstallation() throws IOException {
auth.requireView();
ApplicationManager applicationManager = new ApplicationManager(new RealmManager(session)); ApplicationManager applicationManager = new ApplicationManager(new RealmManager(session));
return applicationManager.toJBossSubsystemConfig(realm, application, getKeycloakApplication().getBaseUri(uriInfo)); return applicationManager.toJBossSubsystemConfig(realm, application, getKeycloakApplication().getBaseUri(uriInfo));
} }
@ -97,6 +108,8 @@ public class ApplicationResource extends RoleContainerResource {
@DELETE @DELETE
@NoCache @NoCache
public void deleteApplication() { public void deleteApplication() {
auth.requireManage();
realm.removeApplication(application.getId()); realm.removeApplication(application.getId());
} }
@ -105,6 +118,8 @@ public class ApplicationResource extends RoleContainerResource {
@Produces("application/json") @Produces("application/json")
@Consumes("application/json") @Consumes("application/json")
public CredentialRepresentation regenerateSecret() { public CredentialRepresentation regenerateSecret() {
auth.requireManage();
logger.debug("regenerateSecret"); logger.debug("regenerateSecret");
UserCredentialModel cred = new ApplicationManager().generateSecret(realm, application); UserCredentialModel cred = new ApplicationManager().generateSecret(realm, application);
CredentialRepresentation rep = ModelToRepresentation.toRepresentation(cred); CredentialRepresentation rep = ModelToRepresentation.toRepresentation(cred);
@ -115,6 +130,8 @@ public class ApplicationResource extends RoleContainerResource {
@GET @GET
@Produces("application/json") @Produces("application/json")
public CredentialRepresentation getClientSecret() { public CredentialRepresentation getClientSecret() {
auth.requireView();
logger.debug("getClientSecret"); logger.debug("getClientSecret");
UserCredentialModel model = realm.getSecret(application.getApplicationUser()); UserCredentialModel model = realm.getSecret(application.getApplicationUser());
if (model == null) throw new NotFoundException("Application does not have a secret"); if (model == null) throw new NotFoundException("Application does not have a secret");
@ -124,7 +141,12 @@ public class ApplicationResource extends RoleContainerResource {
@Path("scope-mappings") @Path("scope-mappings")
public ScopeMappedResource getScopeMappedResource() { public ScopeMappedResource getScopeMappedResource() {
return new ScopeMappedResource(realm, application.getApplicationUser(), session); return new ScopeMappedResource(realm, auth, application.getApplicationUser(), session);
}
@Path("roles")
public RoleContainerResource getRoleContainerResource() {
return new RoleContainerResource(realm, auth, application);
} }
@Path("allowed-origins") @Path("allowed-origins")
@ -132,6 +154,8 @@ public class ApplicationResource extends RoleContainerResource {
@Produces("application/json") @Produces("application/json")
public Set<String> getAllowedOrigins() public Set<String> getAllowedOrigins()
{ {
auth.requireView();
return application.getApplicationUser().getWebOrigins(); return application.getApplicationUser().getWebOrigins();
} }
@ -140,6 +164,8 @@ public class ApplicationResource extends RoleContainerResource {
@Consumes("application/json") @Consumes("application/json")
public void updateAllowedOrigins(Set<String> allowedOrigins) public void updateAllowedOrigins(Set<String> allowedOrigins)
{ {
auth.requireManage();
application.getApplicationUser().setWebOrigins(allowedOrigins); application.getApplicationUser().setWebOrigins(allowedOrigins);
} }
@ -148,6 +174,8 @@ public class ApplicationResource extends RoleContainerResource {
@Consumes("application/json") @Consumes("application/json")
public void deleteAllowedOrigins(Set<String> allowedOrigins) public void deleteAllowedOrigins(Set<String> allowedOrigins)
{ {
auth.requireManage();
for (String origin : allowedOrigins) { for (String origin : allowedOrigins) {
application.getApplicationUser().removeWebOrigin(origin); application.getApplicationUser().removeWebOrigin(origin);
} }

22
services/src/main/java/org/keycloak/services/resources/admin/ApplicationsResource.java
View file

@ -32,6 +32,7 @@ import java.util.List;
public class ApplicationsResource { public class ApplicationsResource {
protected static final Logger logger = Logger.getLogger(RealmAdminResource.class); protected static final Logger logger = Logger.getLogger(RealmAdminResource.class);
protected RealmModel realm; protected RealmModel realm;
private RealmAuth auth;
@Context @Context
protected ResourceContext resourceContext; protected ResourceContext resourceContext;
@ -39,19 +40,32 @@ public class ApplicationsResource {
@Context @Context
protected KeycloakSession session; protected KeycloakSession session;
public ApplicationsResource(RealmModel realm) { public ApplicationsResource(RealmModel realm, RealmAuth auth) {
this.realm = realm; this.realm = realm;
this.auth = auth;
auth.init(RealmAuth.Resource.APPLICATION);
} }
@GET @GET
@Produces(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON)
@NoCache @NoCache
public List<ApplicationRepresentation> getApplications() { public List<ApplicationRepresentation> getApplications() {
auth.requireAny();
List<ApplicationRepresentation> rep = new ArrayList<ApplicationRepresentation>(); List<ApplicationRepresentation> rep = new ArrayList<ApplicationRepresentation>();
List<ApplicationModel> applicationModels = realm.getApplications(); List<ApplicationModel> applicationModels = realm.getApplications();
ApplicationManager resourceManager = new ApplicationManager(new RealmManager(session)); ApplicationManager resourceManager = new ApplicationManager(new RealmManager(session));
boolean view = auth.hasView();
for (ApplicationModel applicationModel : applicationModels) { for (ApplicationModel applicationModel : applicationModels) {
rep.add(resourceManager.toRepresentation(applicationModel)); if (view) {
rep.add(resourceManager.toRepresentation(applicationModel));
} else {
ApplicationRepresentation app = new ApplicationRepresentation();
app.setName(applicationModel.getName());
rep.add(app);
}
} }
return rep; return rep;
} }
@ -59,6 +73,8 @@ public class ApplicationsResource {
@POST @POST
@Consumes(MediaType.APPLICATION_JSON) @Consumes(MediaType.APPLICATION_JSON)
public Response createApplication(final @Context UriInfo uriInfo, final ApplicationRepresentation rep) { public Response createApplication(final @Context UriInfo uriInfo, final ApplicationRepresentation rep) {
auth.requireManage();
if (realm.getApplicationNameMap().containsKey(rep.getName())) { if (realm.getApplicationNameMap().containsKey(rep.getName())) {
return Flows.errors().exists("Application " + rep.getName() + " already exists"); return Flows.errors().exists("Application " + rep.getName() + " already exists");
} }
@ -73,7 +89,7 @@ public class ApplicationsResource {
if (applicationModel == null) { if (applicationModel == null) {
throw new NotFoundException("Could not find application: " + name); throw new NotFoundException("Could not find application: " + name);
} }
ApplicationResource applicationResource = new ApplicationResource(realm, applicationModel, session); ApplicationResource applicationResource = new ApplicationResource(realm, auth, applicationModel, session);
resourceContext.initResource(applicationResource); resourceContext.initResource(applicationResource);
return applicationResource; return applicationResource;
} }

20
services/src/main/java/org/keycloak/services/resources/admin/OAuthClientResource.java
View file

@ -38,6 +38,7 @@ import java.util.List;
public class OAuthClientResource { public class OAuthClientResource {
protected static final Logger logger = Logger.getLogger(RealmAdminResource.class); protected static final Logger logger = Logger.getLogger(RealmAdminResource.class);
protected RealmModel realm; protected RealmModel realm;
private RealmAuth auth;
protected OAuthClientModel oauthClient; protected OAuthClientModel oauthClient;
protected KeycloakSession session; protected KeycloakSession session;
@Context @Context
@ -50,15 +51,20 @@ public class OAuthClientResource {
return (KeycloakApplication)application; return (KeycloakApplication)application;
} }
public OAuthClientResource(RealmModel realm, OAuthClientModel oauthClient, KeycloakSession session) { public OAuthClientResource(RealmModel realm, RealmAuth auth, OAuthClientModel oauthClient, KeycloakSession session) {
this.realm = realm; this.realm = realm;
this.auth = auth;
this.oauthClient = oauthClient; this.oauthClient = oauthClient;
this.session = session; this.session = session;
auth.init(RealmAuth.Resource.CLIENT);
} }
@PUT @PUT
@Consumes(MediaType.APPLICATION_JSON) @Consumes(MediaType.APPLICATION_JSON)
public void update(final OAuthClientRepresentation rep) { public void update(final OAuthClientRepresentation rep) {
auth.requireManage();
OAuthClientManager manager = new OAuthClientManager(realm); OAuthClientManager manager = new OAuthClientManager(realm);
manager.update(rep, oauthClient); manager.update(rep, oauthClient);
} }
@ -68,6 +74,8 @@ public class OAuthClientResource {
@NoCache @NoCache
@Produces(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON)
public OAuthClientRepresentation getOAuthClient() { public OAuthClientRepresentation getOAuthClient() {
auth.requireView();
return OAuthClientManager.toRepresentation(oauthClient); return OAuthClientManager.toRepresentation(oauthClient);
} }
@ -76,6 +84,8 @@ public class OAuthClientResource {
@Path("installation") @Path("installation")
@Produces(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON)
public String getInstallation() throws IOException { public String getInstallation() throws IOException {
auth.requireView();
OAuthClientManager manager = new OAuthClientManager(realm); OAuthClientManager manager = new OAuthClientManager(realm);
Object rep = manager.toInstallationRepresentation(realm, oauthClient, getApplication().getBaseUri(uriInfo)); Object rep = manager.toInstallationRepresentation(realm, oauthClient, getApplication().getBaseUri(uriInfo));
@ -86,6 +96,8 @@ public class OAuthClientResource {
@DELETE @DELETE
@NoCache @NoCache
public void deleteOAuthClient() { public void deleteOAuthClient() {
auth.requireManage();
realm.removeOAuthClient(oauthClient.getId()); realm.removeOAuthClient(oauthClient.getId());
} }
@ -94,6 +106,8 @@ public class OAuthClientResource {
@Produces("application/json") @Produces("application/json")
@Consumes("application/json") @Consumes("application/json")
public CredentialRepresentation regenerateSecret() { public CredentialRepresentation regenerateSecret() {
auth.requireManage();
logger.debug("regenerateSecret"); logger.debug("regenerateSecret");
UserCredentialModel cred = UserCredentialModel.generateSecret(); UserCredentialModel cred = UserCredentialModel.generateSecret();
realm.updateCredential(oauthClient.getOAuthAgent(), cred); realm.updateCredential(oauthClient.getOAuthAgent(), cred);
@ -105,6 +119,8 @@ public class OAuthClientResource {
@GET @GET
@Produces("application/json") @Produces("application/json")
public CredentialRepresentation getClientSecret() { public CredentialRepresentation getClientSecret() {
auth.requireView();
logger.debug("getClientSecret"); logger.debug("getClientSecret");
UserCredentialModel model = realm.getSecret(oauthClient.getOAuthAgent()); UserCredentialModel model = realm.getSecret(oauthClient.getOAuthAgent());
if (model == null) throw new NotFoundException("Application does not have a secret"); if (model == null) throw new NotFoundException("Application does not have a secret");
@ -113,7 +129,7 @@ public class OAuthClientResource {
@Path("scope-mappings") @Path("scope-mappings")
public ScopeMappedResource getScopeMappedResource() { public ScopeMappedResource getScopeMappedResource() {
return new ScopeMappedResource(realm, oauthClient.getOAuthAgent(), session); return new ScopeMappedResource(realm, auth, oauthClient.getOAuthAgent(), session);
} }

22
services/src/main/java/org/keycloak/services/resources/admin/OAuthClientsResource.java
View file

@ -35,10 +35,14 @@ public class OAuthClientsResource {
@Context @Context
protected ResourceContext resourceContext; protected ResourceContext resourceContext;
private RealmAuth auth;
public OAuthClientsResource(RealmModel realm, KeycloakSession session) { public OAuthClientsResource(RealmModel realm, RealmAuth auth, KeycloakSession session) {
this.auth = auth;
this.realm = realm; this.realm = realm;
this.session = session; this.session = session;
auth.init(RealmAuth.Resource.CLIENT);
} }
@GET @GET
@ -47,8 +51,16 @@ public class OAuthClientsResource {
public List<OAuthClientRepresentation> getOAuthClients() { public List<OAuthClientRepresentation> getOAuthClients() {
List<OAuthClientRepresentation> rep = new ArrayList<OAuthClientRepresentation>(); List<OAuthClientRepresentation> rep = new ArrayList<OAuthClientRepresentation>();
List<OAuthClientModel> oauthModels = realm.getOAuthClients(); List<OAuthClientModel> oauthModels = realm.getOAuthClients();
boolean view = auth.hasView();
for (OAuthClientModel oauth : oauthModels) { for (OAuthClientModel oauth : oauthModels) {
rep.add(OAuthClientManager.toRepresentation(oauth)); if (view) {
rep.add(OAuthClientManager.toRepresentation(oauth));
} else {
OAuthClientRepresentation client = new OAuthClientRepresentation();
client.setName(oauth.getOAuthAgent().getLoginName());
rep.add(client);
}
} }
return rep; return rep;
} }
@ -56,6 +68,8 @@ public class OAuthClientsResource {
@POST @POST
@Consumes(MediaType.APPLICATION_JSON) @Consumes(MediaType.APPLICATION_JSON)
public Response createOAuthClient(final @Context UriInfo uriInfo, final OAuthClientRepresentation rep) { public Response createOAuthClient(final @Context UriInfo uriInfo, final OAuthClientRepresentation rep) {
auth.requireManage();
OAuthClientManager resourceManager = new OAuthClientManager(realm); OAuthClientManager resourceManager = new OAuthClientManager(realm);
OAuthClientModel oauth = resourceManager.create(rep); OAuthClientModel oauth = resourceManager.create(rep);
return Response.created(uriInfo.getAbsolutePathBuilder().path(oauth.getId()).build()).build(); return Response.created(uriInfo.getAbsolutePathBuilder().path(oauth.getId()).build()).build();
@ -63,11 +77,13 @@ public class OAuthClientsResource {
@Path("{id}") @Path("{id}")
public OAuthClientResource getOAuthClient(final @PathParam("id") String id) { public OAuthClientResource getOAuthClient(final @PathParam("id") String id) {
auth.requireView();
OAuthClientModel oauth = realm.getOAuthClientById(id); OAuthClientModel oauth = realm.getOAuthClientById(id);
if (oauth == null) { if (oauth == null) {
throw new NotFoundException(); throw new NotFoundException();
} }
OAuthClientResource oAuthClientResource = new OAuthClientResource(realm, oauth, session); OAuthClientResource oAuthClientResource = new OAuthClientResource(realm, auth, oauth, session);
resourceContext.initResource(oAuthClientResource); resourceContext.initResource(oAuthClientResource);
return oAuthClientResource; return oAuthClientResource;
} }

42
services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
View file

@ -19,9 +19,9 @@ import javax.ws.rs.core.Context;
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a> * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $ * @version $Revision: 1 $
*/ */
public class RealmAdminResource extends RoleContainerResource { public class RealmAdminResource {
protected static final Logger logger = Logger.getLogger(RealmAdminResource.class); protected static final Logger logger = Logger.getLogger(RealmAdminResource.class);
protected Auth auth; protected RealmAuth auth;
protected RealmModel realm; protected RealmModel realm;
private TokenManager tokenManager; private TokenManager tokenManager;
@ -31,43 +31,43 @@ public class RealmAdminResource extends RoleContainerResource {
@Context @Context
protected KeycloakSession session; protected KeycloakSession session;
public RealmAdminResource(Auth auth, RealmModel realm, TokenManager tokenManager) { public RealmAdminResource(RealmAuth auth, RealmModel realm, TokenManager tokenManager) {
super(realm, realm);
this.auth = auth; this.auth = auth;
this.realm = realm; this.realm = realm;
this.tokenManager = tokenManager; this.tokenManager = tokenManager;
auth.init(RealmAuth.Resource.REALM);
} }
@Path("applications") @Path("applications")
public ApplicationsResource getApplications() { public ApplicationsResource getApplications() {
auth.require(AdminRoles.getAdminApp(realm), AdminRoles.MANAGE_APPLICATIONS); ApplicationsResource applicationsResource = new ApplicationsResource(realm, auth);
ApplicationsResource applicationsResource = new ApplicationsResource(realm);
resourceContext.initResource(applicationsResource); resourceContext.initResource(applicationsResource);
return applicationsResource; return applicationsResource;
} }
@Path("oauth-clients") @Path("oauth-clients")
public OAuthClientsResource getOAuthClients() { public OAuthClientsResource getOAuthClients() {
auth.require(AdminRoles.getAdminApp(realm), AdminRoles.MANAGE_CLIENTS); OAuthClientsResource oauth = new OAuthClientsResource(realm, auth, session);
OAuthClientsResource oauth = new OAuthClientsResource(realm, session);
resourceContext.initResource(oauth); resourceContext.initResource(oauth);
return oauth; return oauth;
} }
@Path("roles")
public RoleContainerResource getRoleContainerResource() {
return new RoleContainerResource(realm, auth, realm);
}
@GET @GET
@NoCache @NoCache
@Produces("application/json") @Produces("application/json")
public RealmRepresentation getRealm() { public RealmRepresentation getRealm() {
String realmAdminApp = AdminRoles.getAdminApp(realm); if (auth.hasView()) {
if (auth.has(realmAdminApp, AdminRoles.MANAGE_REALM)) {
return ModelToRepresentation.toRepresentation(realm); return ModelToRepresentation.toRepresentation(realm);
} else { } else {
auth.requireOneOf(AdminRoles.getAdminApp(realm), AdminRoles.ALL_REALM_ROLES); auth.requireAny();
RealmRepresentation rep = new RealmRepresentation(); RealmRepresentation rep = new RealmRepresentation();
rep.setId(realm.getId());
rep.setRealm(realm.getName()); rep.setRealm(realm.getName());
return rep; return rep;
@ -77,15 +77,15 @@ public class RealmAdminResource extends RoleContainerResource {
@PUT @PUT
@Consumes("application/json") @Consumes("application/json")
public void updateRealm(final RealmRepresentation rep) { public void updateRealm(final RealmRepresentation rep) {
auth.require(AdminRoles.getAdminApp(realm), AdminRoles.MANAGE_REALM); auth.requireManage();
logger.debug("updating realm: " + realm.getName()); logger.debug("updating realm: " + realm.getName());
new RealmManager(session).updateRealm(rep, realm); new RealmManager(session).updateRealm(rep, realm);
} }
@DELETE @DELETE
public void deleteRealms() { public void deleteRealm() {
auth.require(AdminRoles.getAdminApp(realm), AdminRoles.MANAGE_REALM); auth.requireManage();
if (!new RealmManager(session).removeRealm(realm)) { if (!new RealmManager(session).removeRealm(realm)) {
throw new NotFoundException(); throw new NotFoundException();
@ -94,18 +94,14 @@ public class RealmAdminResource extends RoleContainerResource {
@Path("users") @Path("users")
public UsersResource users() { public UsersResource users() {
auth.require(AdminRoles.getAdminApp(realm), AdminRoles.MANAGE_USERS); UsersResource users = new UsersResource(realm, auth, tokenManager);
UsersResource users = new UsersResource(realm, tokenManager);
resourceContext.initResource(users); resourceContext.initResource(users);
return users; return users;
} }
@Path("roles-by-id") @Path("roles-by-id")
public RoleByIdResource rolesById() { public RoleByIdResource rolesById() {
auth.require(AdminRoles.getAdminApp(realm), AdminRoles.MANAGE_REALM); RoleByIdResource resource = new RoleByIdResource(realm, auth);
RoleByIdResource resource = new RoleByIdResource(realm);
resourceContext.initResource(resource); resourceContext.initResource(resource);
return resource; return resource;
} }

88
services/src/main/java/org/keycloak/services/resources/admin/RealmAuth.java Normal file
View file

@ -0,0 +1,88 @@
package org.keycloak.services.resources.admin;
import org.keycloak.models.AdminRoles;
import org.keycloak.services.managers.Auth;
import javax.ws.rs.ForbiddenException;
/**
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
*/
public class RealmAuth {
private Resource resource;
public enum Resource {
APPLICATION, CLIENT, USER, REALM
}
private Auth auth;
private String realmAdminApp;
public RealmAuth(Auth auth, String realmAdminApp) {
this.auth = auth;
this.realmAdminApp = realmAdminApp;
}
public RealmAuth init(Resource resource) {
this.resource = resource;
return this;
}
public void requireAny() {
if (!auth.hasOneOfAppRole(realmAdminApp, AdminRoles.ALL_REALM_ROLES)) {
throw new ForbiddenException();
}
}
public boolean hasView() {
return auth.hasOneOfAppRole(realmAdminApp, getViewRole(resource), getManageRole(resource));
}
public boolean hasManage() {
return auth.hasOneOfAppRole(realmAdminApp, getManageRole(resource));
}
public void requireView() {
if (!hasView()) {
throw new ForbiddenException();
}
}
public void requireManage() {
if (!hasManage()) {
throw new ForbiddenException();
}
}
private String getViewRole(Resource resource) {
switch (resource) {
case APPLICATION:
return AdminRoles.VIEW_APPLICATIONS;
case CLIENT:
return AdminRoles.VIEW_CLIENTS;
case USER:
return AdminRoles.VIEW_USERS;
case REALM:
return AdminRoles.VIEW_REALM;
default:
throw new IllegalStateException();
}
}
private String getManageRole(Resource resource) {
switch (resource) {
case APPLICATION:
return AdminRoles.MANAGE_APPLICATIONS;
case CLIENT:
return AdminRoles.MANAGE_CLIENTS;
case USER:
return AdminRoles.MANAGE_USERS;
case REALM:
return AdminRoles.MANAGE_REALM;
default:
throw new IllegalStateException();
}
}
}

19
services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java
View file

@ -6,8 +6,6 @@ import org.jboss.resteasy.plugins.providers.multipart.InputPart;
import org.jboss.resteasy.plugins.providers.multipart.MultipartFormDataInput; import org.jboss.resteasy.plugins.providers.multipart.MultipartFormDataInput;
import org.jboss.resteasy.util.GenericType; import org.jboss.resteasy.util.GenericType;
import org.keycloak.models.AdminRoles; import org.keycloak.models.AdminRoles;
import org.keycloak.models.ApplicationModel;
import org.keycloak.models.Constants;
import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel; import org.keycloak.models.RealmModel;
import org.keycloak.representations.idm.RealmRepresentation; import org.keycloak.representations.idm.RealmRepresentation;
@ -67,11 +65,10 @@ public class RealmsAdminResource {
for (RealmModel realm : realms) { for (RealmModel realm : realms) {
String realmAdminApp = AdminRoles.getAdminApp(realm); String realmAdminApp = AdminRoles.getAdminApp(realm);
if (auth.has(realmAdminApp, AdminRoles.MANAGE_REALM)) { if (auth.hasAppRole(realmAdminApp, AdminRoles.MANAGE_REALM)) {
reps.add(ModelToRepresentation.toRepresentation(realm)); reps.add(ModelToRepresentation.toRepresentation(realm));
} else if (auth.hasOneOf(realmAdminApp, AdminRoles.ALL_REALM_ROLES)) { } else if (auth.hasOneOfAppRole(realmAdminApp, AdminRoles.ALL_REALM_ROLES)) {
RealmRepresentation rep = new RealmRepresentation(); RealmRepresentation rep = new RealmRepresentation();
rep.setId(realm.getId());
rep.setRealm(realm.getName()); rep.setRealm(realm.getName());
reps.add(rep); reps.add(rep);
} }
@ -90,7 +87,9 @@ public class RealmsAdminResource {
@POST @POST
@Consumes("application/json") @Consumes("application/json")
public Response importRealm(@Context final UriInfo uriInfo, final RealmRepresentation rep) { public Response importRealm(@Context final UriInfo uriInfo, final RealmRepresentation rep) {
auth.require(AdminRoles.ADMIN); if (!auth.hasRealmRole(AdminRoles.ADMIN)) {
throw new ForbiddenException();
}
logger.debug("importRealm: {0}", rep.getRealm()); logger.debug("importRealm: {0}", rep.getRealm());
RealmManager realmManager = new RealmManager(session); RealmManager realmManager = new RealmManager(session);
@ -107,7 +106,9 @@ public class RealmsAdminResource {
@POST @POST
@Consumes(MediaType.MULTIPART_FORM_DATA) @Consumes(MediaType.MULTIPART_FORM_DATA)
public Response uploadRealm(MultipartFormDataInput input) throws IOException { public Response uploadRealm(MultipartFormDataInput input) throws IOException {
auth.require(AdminRoles.ADMIN); if (!auth.hasRealmRole(AdminRoles.ADMIN)) {
throw new ForbiddenException();
}
Map<String, List<InputPart>> uploadForm = input.getFormDataMap(); Map<String, List<InputPart>> uploadForm = input.getFormDataMap();
List<InputPart> inputParts = uploadForm.get("file"); List<InputPart> inputParts = uploadForm.get("file");
@ -128,9 +129,9 @@ public class RealmsAdminResource {
RealmModel realm = realmManager.getRealmByName(name); RealmModel realm = realmManager.getRealmByName(name);
if (realm == null) throw new NotFoundException("{realm} = " + name); if (realm == null) throw new NotFoundException("{realm} = " + name);
auth.requireOneOf(AdminRoles.getAdminApp(realm), AdminRoles.ALL_REALM_ROLES); RealmAuth realmAuth = new RealmAuth(auth, AdminRoles.getAdminApp(realm));
RealmAdminResource adminResource = new RealmAdminResource(auth, realm, tokenManager); RealmAdminResource adminResource = new RealmAdminResource(realmAuth, realm, tokenManager);
resourceContext.initResource(adminResource); resourceContext.initResource(adminResource);
return adminResource; return adminResource;
} }

41
services/src/main/java/org/keycloak/services/resources/admin/RoleByIdResource.java
View file

@ -1,14 +1,13 @@
package org.keycloak.services.resources.admin; package org.keycloak.services.resources.admin;
import org.jboss.resteasy.annotations.cache.NoCache; import org.jboss.resteasy.annotations.cache.NoCache;
import org.keycloak.models.ApplicationModel;
import org.keycloak.models.Constants; import org.keycloak.models.Constants;
import org.keycloak.models.OAuthClientModel;
import org.keycloak.models.RealmModel; import org.keycloak.models.RealmModel;
import org.keycloak.models.RoleContainerModel;
import org.keycloak.models.RoleModel; import org.keycloak.models.RoleModel;
import org.keycloak.models.UserModel;
import org.keycloak.representations.idm.RoleRepresentation; import org.keycloak.representations.idm.RoleRepresentation;
import org.keycloak.services.managers.ModelToRepresentation;
import org.keycloak.services.resources.admin.RoleResource;
import org.keycloak.services.resources.flows.Flows;
import javax.ws.rs.Consumes; import javax.ws.rs.Consumes;
import javax.ws.rs.DELETE; import javax.ws.rs.DELETE;
@ -19,10 +18,6 @@ import javax.ws.rs.PUT;
import javax.ws.rs.Path; import javax.ws.rs.Path;
import javax.ws.rs.PathParam; import javax.ws.rs.PathParam;
import javax.ws.rs.Produces; import javax.ws.rs.Produces;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.UriInfo;
import java.util.ArrayList;
import java.util.List; import java.util.List;
import java.util.Set; import java.util.Set;
@ -33,8 +28,14 @@ import java.util.Set;
* @version $Revision: 1 $ * @version $Revision: 1 $
*/ */
public class RoleByIdResource extends RoleResource { public class RoleByIdResource extends RoleResource {
public RoleByIdResource(RealmModel realm) { private final RealmModel realm;
private final RealmAuth auth;
public RoleByIdResource(RealmModel realm, RealmAuth auth) {
super(realm); super(realm);
this.realm = realm;
this.auth = auth;
} }
@Path("{role-id}") @Path("{role-id}")
@ -43,6 +44,7 @@ public class RoleByIdResource extends RoleResource {
@Produces("application/json") @Produces("application/json")
public RoleRepresentation getRole(final @PathParam("role-id") String id) { public RoleRepresentation getRole(final @PathParam("role-id") String id) {
RoleModel roleModel = getRoleModel(id); RoleModel roleModel = getRoleModel(id);
auth.requireView();
return getRole(roleModel); return getRole(roleModel);
} }
@ -51,6 +53,19 @@ public class RoleByIdResource extends RoleResource {
if (roleModel == null || roleModel.getName().startsWith(Constants.INTERNAL_ROLE)) { if (roleModel == null || roleModel.getName().startsWith(Constants.INTERNAL_ROLE)) {
throw new NotFoundException("Could not find role with id: " + id); throw new NotFoundException("Could not find role with id: " + id);
} }
RealmAuth.Resource r = null;
if (roleModel.getContainer() instanceof RealmModel) {
r = RealmAuth.Resource.REALM;
} else if (roleModel.getContainer() instanceof ApplicationModel) {
r = RealmAuth.Resource.APPLICATION;
} else if (roleModel.getContainer() instanceof OAuthClientModel) {
r = RealmAuth.Resource.CLIENT;
} else if (roleModel.getContainer() instanceof UserModel) {
r = RealmAuth.Resource.USER;
}
auth.init(r);
return roleModel; return roleModel;
} }
@ -59,6 +74,7 @@ public class RoleByIdResource extends RoleResource {
@NoCache @NoCache
public void deleteRole(final @PathParam("role-id") String id) { public void deleteRole(final @PathParam("role-id") String id) {
RoleModel role = getRoleModel(id); RoleModel role = getRoleModel(id);
auth.requireManage();
deleteRole(role); deleteRole(role);
} }
@ -67,6 +83,7 @@ public class RoleByIdResource extends RoleResource {
@Consumes("application/json") @Consumes("application/json")
public void updateRole(final @PathParam("role-id") String id, final RoleRepresentation rep) { public void updateRole(final @PathParam("role-id") String id, final RoleRepresentation rep) {
RoleModel role = getRoleModel(id); RoleModel role = getRoleModel(id);
auth.requireManage();
updateRole(rep, role); updateRole(rep, role);
} }
@ -75,6 +92,7 @@ public class RoleByIdResource extends RoleResource {
@Consumes("application/json") @Consumes("application/json")
public void addComposites(final @PathParam("role-id") String id, List<RoleRepresentation> roles) { public void addComposites(final @PathParam("role-id") String id, List<RoleRepresentation> roles) {
RoleModel role = getRoleModel(id); RoleModel role = getRoleModel(id);
auth.requireManage();
addComposites(roles, role); addComposites(roles, role);
} }
@ -84,6 +102,7 @@ public class RoleByIdResource extends RoleResource {
@Produces("application/json") @Produces("application/json")
public Set<RoleRepresentation> getRoleComposites(final @PathParam("role-id") String id) { public Set<RoleRepresentation> getRoleComposites(final @PathParam("role-id") String id) {
RoleModel role = getRoleModel(id); RoleModel role = getRoleModel(id);
auth.requireView();
return getRoleComposites(role); return getRoleComposites(role);
} }
@ -93,6 +112,7 @@ public class RoleByIdResource extends RoleResource {
@Produces("application/json") @Produces("application/json")
public Set<RoleRepresentation> getRealmRoleComposites(final @PathParam("role-id") String id) { public Set<RoleRepresentation> getRealmRoleComposites(final @PathParam("role-id") String id) {
RoleModel role = getRoleModel(id); RoleModel role = getRoleModel(id);
auth.requireView();
return getRealmRoleComposites(role); return getRealmRoleComposites(role);
} }
@ -103,6 +123,7 @@ public class RoleByIdResource extends RoleResource {
public Set<RoleRepresentation> getApplicationRoleComposites(final @PathParam("role-id") String id, public Set<RoleRepresentation> getApplicationRoleComposites(final @PathParam("role-id") String id,
final @PathParam("app") String appName) { final @PathParam("app") String appName) {
RoleModel role = getRoleModel(id); RoleModel role = getRoleModel(id);
auth.requireView();
return getApplicationRoleComposites(appName, role); return getApplicationRoleComposites(appName, role);
} }
@ -112,8 +133,8 @@ public class RoleByIdResource extends RoleResource {
@Consumes("application/json") @Consumes("application/json")
public void deleteComposites(final @PathParam("role-id") String id, List<RoleRepresentation> roles) { public void deleteComposites(final @PathParam("role-id") String id, List<RoleRepresentation> roles) {
RoleModel role = getRoleModel(id); RoleModel role = getRoleModel(id);
auth.requireManage();
deleteComposites(roles, role); deleteComposites(roles, role);
} }
} }

59
services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java
View file

@ -1,7 +1,6 @@
package org.keycloak.services.resources.admin; package org.keycloak.services.resources.admin;
import org.jboss.resteasy.annotations.cache.NoCache; import org.jboss.resteasy.annotations.cache.NoCache;
import org.keycloak.models.ApplicationModel;
import org.keycloak.models.Constants; import org.keycloak.models.Constants;
import org.keycloak.models.RealmModel; import org.keycloak.models.RealmModel;
import org.keycloak.models.RoleContainerModel; import org.keycloak.models.RoleContainerModel;
@ -10,13 +9,19 @@ import org.keycloak.representations.idm.RoleRepresentation;
import org.keycloak.services.managers.ModelToRepresentation; import org.keycloak.services.managers.ModelToRepresentation;
import org.keycloak.services.resources.flows.Flows; import org.keycloak.services.resources.flows.Flows;
import javax.ws.rs.*; import javax.ws.rs.Consumes;
import javax.ws.rs.DELETE;
import javax.ws.rs.GET;
import javax.ws.rs.NotFoundException;
import javax.ws.rs.POST;
import javax.ws.rs.PUT;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.core.Context; import javax.ws.rs.core.Context;
import javax.ws.rs.core.Response; import javax.ws.rs.core.Response;
import javax.ws.rs.core.UriInfo; import javax.ws.rs.core.UriInfo;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Collections;
import java.util.HashSet;
import java.util.List; import java.util.List;
import java.util.Set; import java.util.Set;
@ -25,18 +30,24 @@ import java.util.Set;
* @version $Revision: 1 $ * @version $Revision: 1 $
*/ */
public class RoleContainerResource extends RoleResource { public class RoleContainerResource extends RoleResource {
private final RealmModel realm;
private final RealmAuth auth;
protected RoleContainerModel roleContainer; protected RoleContainerModel roleContainer;
public RoleContainerResource(RealmModel realm, RoleContainerModel roleContainer) { public RoleContainerResource(RealmModel realm, RealmAuth auth, RoleContainerModel roleContainer) {
super(realm); super(realm);
this.realm = realm;
this.auth = auth;
this.roleContainer = roleContainer; this.roleContainer = roleContainer;
} }
@Path("roles") @Path("")
@GET @GET
@NoCache @NoCache
@Produces("application/json") @Produces("application/json")
public List<RoleRepresentation> getRoles() { public List<RoleRepresentation> getRoles() {
auth.requireAny();
Set<RoleModel> roleModels = roleContainer.getRoles(); Set<RoleModel> roleModels = roleContainer.getRoles();
List<RoleRepresentation> roles = new ArrayList<RoleRepresentation>(); List<RoleRepresentation> roles = new ArrayList<RoleRepresentation>();
for (RoleModel roleModel : roleModels) { for (RoleModel roleModel : roleModels) {
@ -47,10 +58,12 @@ public class RoleContainerResource extends RoleResource {
return roles; return roles;
} }
@Path("roles") @Path("")
@POST @POST
@Consumes("application/json") @Consumes("application/json")
public Response createRole(final @Context UriInfo uriInfo, final RoleRepresentation rep) { public Response createRole(final @Context UriInfo uriInfo, final RoleRepresentation rep) {
auth.requireManage();
if (roleContainer.getRole(rep.getName()) != null || rep.getName().startsWith(Constants.INTERNAL_ROLE)) { if (roleContainer.getRole(rep.getName()) != null || rep.getName().startsWith(Constants.INTERNAL_ROLE)) {
return Flows.errors().exists("Role with name " + rep.getName() + " already exists"); return Flows.errors().exists("Role with name " + rep.getName() + " already exists");
} }
@ -62,11 +75,13 @@ public class RoleContainerResource extends RoleResource {
return Response.created(uriInfo.getAbsolutePathBuilder().path(role.getName()).build()).build(); return Response.created(uriInfo.getAbsolutePathBuilder().path(role.getName()).build()).build();
} }
@Path("roles/{role-name}") @Path("{role-name}")
@GET @GET
@NoCache @NoCache
@Produces("application/json") @Produces("application/json")
public RoleRepresentation getRole(final @PathParam("role-name") String roleName) { public RoleRepresentation getRole(final @PathParam("role-name") String roleName) {
auth.requireView();
RoleModel roleModel = roleContainer.getRole(roleName); RoleModel roleModel = roleContainer.getRole(roleName);
if (roleModel == null || roleModel.getName().startsWith(Constants.INTERNAL_ROLE)) { if (roleModel == null || roleModel.getName().startsWith(Constants.INTERNAL_ROLE)) {
throw new NotFoundException("Could not find role: " + roleName); throw new NotFoundException("Could not find role: " + roleName);
@ -74,10 +89,12 @@ public class RoleContainerResource extends RoleResource {
return getRole(roleModel); return getRole(roleModel);
} }
@Path("roles/{role-name}") @Path("{role-name}")
@DELETE @DELETE
@NoCache @NoCache
public void deleteRole(final @PathParam("role-name") String roleName) { public void deleteRole(final @PathParam("role-name") String roleName) {
auth.requireManage();
RoleModel role = roleContainer.getRole(roleName); RoleModel role = roleContainer.getRole(roleName);
if (role == null) { if (role == null) {
throw new NotFoundException("Could not find role: " + roleName); throw new NotFoundException("Could not find role: " + roleName);
@ -85,10 +102,12 @@ public class RoleContainerResource extends RoleResource {
deleteRole(role); deleteRole(role);
} }
@Path("roles/{role-name}") @Path("{role-name}")
@PUT @PUT
@Consumes("application/json") @Consumes("application/json")
public void updateRole(final @PathParam("role-name") String roleName, final RoleRepresentation rep) { public void updateRole(final @PathParam("role-name") String roleName, final RoleRepresentation rep) {
auth.requireManage();
RoleModel role = roleContainer.getRole(roleName); RoleModel role = roleContainer.getRole(roleName);
if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) { if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) {
throw new NotFoundException("Could not find role: " + roleName); throw new NotFoundException("Could not find role: " + roleName);
@ -96,10 +115,12 @@ public class RoleContainerResource extends RoleResource {
updateRole(rep, role); updateRole(rep, role);
} }
@Path("roles/{role-name}/composites") @Path("{role-name}/composites")
@POST @POST
@Consumes("application/json") @Consumes("application/json")
public void addComposites(final @PathParam("role-name") String roleName, List<RoleRepresentation> roles) { public void addComposites(final @PathParam("role-name") String roleName, List<RoleRepresentation> roles) {
auth.requireManage();
RoleModel role = roleContainer.getRole(roleName); RoleModel role = roleContainer.getRole(roleName);
if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) { if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) {
throw new NotFoundException("Could not find role: " + roleName); throw new NotFoundException("Could not find role: " + roleName);
@ -107,11 +128,13 @@ public class RoleContainerResource extends RoleResource {
addComposites(roles, role); addComposites(roles, role);
} }
@Path("roles/{role-name}/composites") @Path("{role-name}/composites")
@GET @GET
@NoCache @NoCache
@Produces("application/json") @Produces("application/json")
public Set<RoleRepresentation> getRoleComposites(final @PathParam("role-name") String roleName) { public Set<RoleRepresentation> getRoleComposites(final @PathParam("role-name") String roleName) {
auth.requireManage();
RoleModel role = roleContainer.getRole(roleName); RoleModel role = roleContainer.getRole(roleName);
if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) { if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) {
throw new NotFoundException("Could not find role: " + roleName); throw new NotFoundException("Could not find role: " + roleName);
@ -119,11 +142,13 @@ public class RoleContainerResource extends RoleResource {
return getRoleComposites(role); return getRoleComposites(role);
} }
@Path("roles/{role-name}/composites/realm") @Path("{role-name}/composites/realm")
@GET @GET
@NoCache @NoCache
@Produces("application/json") @Produces("application/json")
public Set<RoleRepresentation> getRealmRoleComposites(final @PathParam("role-name") String roleName) { public Set<RoleRepresentation> getRealmRoleComposites(final @PathParam("role-name") String roleName) {
auth.requireManage();
RoleModel role = roleContainer.getRole(roleName); RoleModel role = roleContainer.getRole(roleName);
if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) { if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) {
throw new NotFoundException("Could not find role: " + roleName); throw new NotFoundException("Could not find role: " + roleName);
@ -131,12 +156,14 @@ public class RoleContainerResource extends RoleResource {
return getRealmRoleComposites(role); return getRealmRoleComposites(role);
} }
@Path("roles/{role-name}/composites/application/{app}") @Path("{role-name}/composites/application/{app}")
@GET @GET
@NoCache @NoCache
@Produces("application/json") @Produces("application/json")
public Set<RoleRepresentation> getApplicationRoleComposites(final @PathParam("role-name") String roleName, public Set<RoleRepresentation> getApplicationRoleComposites(final @PathParam("role-name") String roleName,
final @PathParam("app") String appName) { final @PathParam("app") String appName) {
auth.requireManage();
RoleModel role = roleContainer.getRole(roleName); RoleModel role = roleContainer.getRole(roleName);
if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) { if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) {
throw new NotFoundException("Could not find role: " + roleName); throw new NotFoundException("Could not find role: " + roleName);
@ -145,10 +172,12 @@ public class RoleContainerResource extends RoleResource {
} }
@Path("roles/{role-name}/composites") @Path("{role-name}/composites")
@DELETE @DELETE
@Consumes("application/json") @Consumes("application/json")
public void deleteComposites(final @PathParam("role-name") String roleName, List<RoleRepresentation> roles) { public void deleteComposites(final @PathParam("role-name") String roleName, List<RoleRepresentation> roles) {
auth.requireManage();
RoleModel role = roleContainer.getRole(roleName); RoleModel role = roleContainer.getRole(roleName);
if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) { if (role == null || role.getName().startsWith(Constants.INTERNAL_ROLE)) {
throw new NotFoundException("Could not find role: " + roleName); throw new NotFoundException("Could not find role: " + roleName);

2
services/src/main/java/org/keycloak/services/resources/admin/RoleResource.java
View file

@ -16,7 +16,7 @@ import java.util.Set;
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a> * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @version $Revision: 1 $ * @version $Revision: 1 $
*/ */
public class RoleResource { public abstract class RoleResource {
protected RealmModel realm; protected RealmModel realm;
public RoleResource(RealmModel realm) { public RoleResource(RealmModel realm) {

18
services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedResource.java
View file

@ -32,11 +32,13 @@ import java.util.Set;
*/ */
public class ScopeMappedResource { public class ScopeMappedResource {
protected RealmModel realm; protected RealmModel realm;
private RealmAuth auth;
protected UserModel agent; protected UserModel agent;
protected KeycloakSession session; protected KeycloakSession session;
public ScopeMappedResource(RealmModel realm, UserModel account, KeycloakSession session) { public ScopeMappedResource(RealmModel realm, RealmAuth auth, UserModel account, KeycloakSession session) {
this.realm = realm; this.realm = realm;
this.auth = auth;
this.agent = account; this.agent = account;
this.session = session; this.session = session;
} }
@ -45,6 +47,8 @@ public class ScopeMappedResource {
@Produces("application/json") @Produces("application/json")
@NoCache @NoCache
public MappingsRepresentation getScopeMappings() { public MappingsRepresentation getScopeMappings() {
auth.requireView();
MappingsRepresentation all = new MappingsRepresentation(); MappingsRepresentation all = new MappingsRepresentation();
Set<RoleModel> realmMappings = realm.getRealmScopeMappings(agent); Set<RoleModel> realmMappings = realm.getRealmScopeMappings(agent);
RealmManager manager = new RealmManager(session); RealmManager manager = new RealmManager(session);
@ -83,6 +87,8 @@ public class ScopeMappedResource {
@Produces("application/json") @Produces("application/json")
@NoCache @NoCache
public List<RoleRepresentation> getRealmScopeMappings() { public List<RoleRepresentation> getRealmScopeMappings() {
auth.requireView();
Set<RoleModel> realmMappings = realm.getRealmScopeMappings(agent); Set<RoleModel> realmMappings = realm.getRealmScopeMappings(agent);
List<RoleRepresentation> realmMappingsRep = new ArrayList<RoleRepresentation>(); List<RoleRepresentation> realmMappingsRep = new ArrayList<RoleRepresentation>();
RealmManager manager = new RealmManager(session); RealmManager manager = new RealmManager(session);
@ -96,6 +102,8 @@ public class ScopeMappedResource {
@POST @POST
@Consumes("application/json") @Consumes("application/json")
public void addRealmScopeMappings(List<RoleRepresentation> roles) { public void addRealmScopeMappings(List<RoleRepresentation> roles) {
auth.requireManage();
for (RoleRepresentation role : roles) { for (RoleRepresentation role : roles) {
RoleModel roleModel = realm.getRoleById(role.getId()); RoleModel roleModel = realm.getRoleById(role.getId());
if (roleModel == null) { if (roleModel == null) {
@ -111,6 +119,8 @@ public class ScopeMappedResource {
@DELETE @DELETE
@Consumes("application/json") @Consumes("application/json")
public void deleteRealmScopeMappings(List<RoleRepresentation> roles) { public void deleteRealmScopeMappings(List<RoleRepresentation> roles) {
auth.requireManage();
if (roles == null) { if (roles == null) {
Set<RoleModel> roleModels = realm.getRealmScopeMappings(agent); Set<RoleModel> roleModels = realm.getRealmScopeMappings(agent);
for (RoleModel roleModel : roleModels) { for (RoleModel roleModel : roleModels) {
@ -133,6 +143,8 @@ public class ScopeMappedResource {
@Produces("application/json") @Produces("application/json")
@NoCache @NoCache
public List<RoleRepresentation> getApplicationScopeMappings(@PathParam("app") String appName) { public List<RoleRepresentation> getApplicationScopeMappings(@PathParam("app") String appName) {
auth.requireView();
ApplicationModel app = realm.getApplicationByName(appName); ApplicationModel app = realm.getApplicationByName(appName);
if (app == null) { if (app == null) {
@ -151,6 +163,8 @@ public class ScopeMappedResource {
@POST @POST
@Consumes("application/json") @Consumes("application/json")
public void addApplicationScopeMapping(@PathParam("app") String appName, List<RoleRepresentation> roles) { public void addApplicationScopeMapping(@PathParam("app") String appName, List<RoleRepresentation> roles) {
auth.requireManage();
ApplicationModel app = realm.getApplicationByName(appName); ApplicationModel app = realm.getApplicationByName(appName);
if (app == null) { if (app == null) {
@ -171,6 +185,8 @@ public class ScopeMappedResource {
@DELETE @DELETE
@Consumes("application/json") @Consumes("application/json")
public void deleteApplicationScopeMapping(@PathParam("app") String appName, List<RoleRepresentation> roles) { public void deleteApplicationScopeMapping(@PathParam("app") String appName, List<RoleRepresentation> roles) {
auth.requireManage();
ApplicationModel app = realm.getApplicationByName(appName); ApplicationModel app = realm.getApplicationByName(appName);
if (app == null) { if (app == null) {

37
services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java
View file

@ -13,6 +13,7 @@ import org.keycloak.representations.idm.*;
import org.keycloak.services.email.EmailException; import org.keycloak.services.email.EmailException;
import org.keycloak.services.email.EmailSender; import org.keycloak.services.email.EmailSender;
import org.keycloak.services.managers.AccessCodeEntry; import org.keycloak.services.managers.AccessCodeEntry;
import org.keycloak.services.managers.Auth;
import org.keycloak.services.managers.ModelToRepresentation; import org.keycloak.services.managers.ModelToRepresentation;
import org.keycloak.services.managers.RealmManager; import org.keycloak.services.managers.RealmManager;
import org.keycloak.services.managers.TokenManager; import org.keycloak.services.managers.TokenManager;
@ -50,11 +51,15 @@ public class UsersResource {
protected RealmModel realm; protected RealmModel realm;
private RealmAuth auth;
private TokenManager tokenManager; private TokenManager tokenManager;
public UsersResource(RealmModel realm, TokenManager tokenManager) { public UsersResource(RealmModel realm, RealmAuth auth, TokenManager tokenManager) {
this.auth = auth;
this.realm = realm; this.realm = realm;
this.tokenManager = tokenManager; this.tokenManager = tokenManager;
auth.init(RealmAuth.Resource.USER);
} }
@Context @Context
@ -71,6 +76,8 @@ public class UsersResource {
@PUT @PUT
@Consumes("application/json") @Consumes("application/json")
public void updateUser(final @PathParam("username") String username, final UserRepresentation rep) { public void updateUser(final @PathParam("username") String username, final UserRepresentation rep) {
auth.requireManage();
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null) { if (user == null) {
throw new NotFoundException(); throw new NotFoundException();
@ -81,6 +88,8 @@ public class UsersResource {
@POST @POST
@Consumes("application/json") @Consumes("application/json")
public Response createUser(final @Context UriInfo uriInfo, final UserRepresentation rep) { public Response createUser(final @Context UriInfo uriInfo, final UserRepresentation rep) {
auth.requireManage();
if (realm.getUser(rep.getUsername()) != null) { if (realm.getUser(rep.getUsername()) != null) {
return Flows.errors().exists("User with username " + rep.getUsername() + " already exists"); return Flows.errors().exists("User with username " + rep.getUsername() + " already exists");
} }
@ -125,6 +134,8 @@ public class UsersResource {
@NoCache @NoCache
@Produces("application/json") @Produces("application/json")
public UserRepresentation getUser(final @PathParam("username") String username) { public UserRepresentation getUser(final @PathParam("username") String username) {
auth.requireView();
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null || !isUser(user)) { if (user == null || !isUser(user)) {
throw new NotFoundException(); throw new NotFoundException();
@ -136,6 +147,8 @@ public class UsersResource {
@DELETE @DELETE
@NoCache @NoCache
public void deleteUser(final @PathParam("username") String username) { public void deleteUser(final @PathParam("username") String username) {
auth.requireManage();
realm.removeUser(username); realm.removeUser(username);
} }
@ -147,6 +160,8 @@ public class UsersResource {
@QueryParam("firstName") String first, @QueryParam("firstName") String first,
@QueryParam("email") String email, @QueryParam("email") String email,
@QueryParam("username") String username) { @QueryParam("username") String username) {
auth.requireView();
RealmManager manager = new RealmManager(session); RealmManager manager = new RealmManager(session);
List<UserRepresentation> results = new ArrayList<UserRepresentation>(); List<UserRepresentation> results = new ArrayList<UserRepresentation>();
List<UserModel> userModels; List<UserModel> userModels;
@ -191,6 +206,8 @@ public class UsersResource {
@Produces("application/json") @Produces("application/json")
@NoCache @NoCache
public MappingsRepresentation getRoleMappings(@PathParam("username") String username) { public MappingsRepresentation getRoleMappings(@PathParam("username") String username) {
auth.requireView();
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null) { if (user == null) {
throw new NotFoundException(); throw new NotFoundException();
@ -234,6 +251,8 @@ public class UsersResource {
@Produces("application/json") @Produces("application/json")
@NoCache @NoCache
public List<RoleRepresentation> getRealmRoleMappings(@PathParam("username") String username) { public List<RoleRepresentation> getRealmRoleMappings(@PathParam("username") String username) {
auth.requireView();
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null) { if (user == null) {
throw new NotFoundException(); throw new NotFoundException();
@ -252,6 +271,8 @@ public class UsersResource {
@POST @POST
@Consumes("application/json") @Consumes("application/json")
public void addRealmRoleMappings(@PathParam("username") String username, List<RoleRepresentation> roles) { public void addRealmRoleMappings(@PathParam("username") String username, List<RoleRepresentation> roles) {
auth.requireManage();
logger.debug("** addRealmRoleMappings: {0}", roles); logger.debug("** addRealmRoleMappings: {0}", roles);
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null) { if (user == null) {
@ -273,6 +294,8 @@ public class UsersResource {
@DELETE @DELETE
@Consumes("application/json") @Consumes("application/json")
public void deleteRealmRoleMappings(@PathParam("username") String username, List<RoleRepresentation> roles) { public void deleteRealmRoleMappings(@PathParam("username") String username, List<RoleRepresentation> roles) {
auth.requireManage();
logger.debug("deleteRealmRoleMappings"); logger.debug("deleteRealmRoleMappings");
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null) { if (user == null) {
@ -301,6 +324,8 @@ public class UsersResource {
@Produces("application/json") @Produces("application/json")
@NoCache @NoCache
public List<RoleRepresentation> getApplicationRoleMappings(@PathParam("username") String username, @PathParam("app") String appName) { public List<RoleRepresentation> getApplicationRoleMappings(@PathParam("username") String username, @PathParam("app") String appName) {
auth.requireView();
logger.debug("getApplicationRoleMappings"); logger.debug("getApplicationRoleMappings");
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
@ -327,6 +352,8 @@ public class UsersResource {
@POST @POST
@Consumes("application/json") @Consumes("application/json")
public void addApplicationRoleMapping(@PathParam("username") String username, @PathParam("app") String appName, List<RoleRepresentation> roles) { public void addApplicationRoleMapping(@PathParam("username") String username, @PathParam("app") String appName, List<RoleRepresentation> roles) {
auth.requireManage();
logger.debug("addApplicationRoleMapping"); logger.debug("addApplicationRoleMapping");
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null) { if (user == null) {
@ -353,6 +380,8 @@ public class UsersResource {
@DELETE @DELETE
@Consumes("application/json") @Consumes("application/json")
public void deleteApplicationRoleMapping(@PathParam("username") String username, @PathParam("app") String appName, List<RoleRepresentation> roles) { public void deleteApplicationRoleMapping(@PathParam("username") String username, @PathParam("app") String appName, List<RoleRepresentation> roles) {
auth.requireManage();
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null) { if (user == null) {
throw new NotFoundException(); throw new NotFoundException();
@ -389,6 +418,8 @@ public class UsersResource {
@PUT @PUT
@Consumes("application/json") @Consumes("application/json")
public void resetPassword(@PathParam("username") String username, CredentialRepresentation pass) { public void resetPassword(@PathParam("username") String username, CredentialRepresentation pass) {
auth.requireManage();
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null) { if (user == null) {
throw new NotFoundException(); throw new NotFoundException();
@ -406,6 +437,8 @@ public class UsersResource {
@PUT @PUT
@Consumes("application/json") @Consumes("application/json")
public void removeTotp(@PathParam("username") String username) { public void removeTotp(@PathParam("username") String username) {
auth.requireManage();
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null) { if (user == null) {
throw new NotFoundException(); throw new NotFoundException();
@ -418,6 +451,8 @@ public class UsersResource {
@PUT @PUT
@Consumes("application/json") @Consumes("application/json")
public Response resetPasswordEmail(@PathParam("username") String username) { public Response resetPasswordEmail(@PathParam("username") String username) {
auth.requireManage();
UserModel user = realm.getUser(username); UserModel user = realm.getUser(username);
if (user == null) { if (user == null) {
throw new NotFoundException(); throw new NotFoundException();