diff --git a/authz/policy/drools/src/main/java/org/keycloak/authorization/policy/provider/drools/DroolsPolicyProviderFactory.java b/authz/policy/drools/src/main/java/org/keycloak/authorization/policy/provider/drools/DroolsPolicyProviderFactory.java index 1bb6efdb28..0d4da97224 100644 --- a/authz/policy/drools/src/main/java/org/keycloak/authorization/policy/provider/drools/DroolsPolicyProviderFactory.java +++ b/authz/policy/drools/src/main/java/org/keycloak/authorization/policy/provider/drools/DroolsPolicyProviderFactory.java @@ -11,18 +11,19 @@ import org.keycloak.authorization.model.ResourceServer; import org.keycloak.authorization.policy.provider.PolicyProvider; import org.keycloak.authorization.policy.provider.PolicyProviderAdminService; import org.keycloak.authorization.policy.provider.PolicyProviderFactory; +import org.keycloak.common.Profile; import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSessionFactory; +import org.keycloak.provider.EnvironmentDependentProviderFactory; import org.keycloak.representations.idm.authorization.PolicyRepresentation; import org.keycloak.representations.idm.authorization.RulePolicyRepresentation; import org.kie.api.KieServices; -import org.kie.api.KieServices.Factory; import org.kie.api.runtime.KieContainer; /** * @author Pedro Igor */ -public class DroolsPolicyProviderFactory implements PolicyProviderFactory { +public class DroolsPolicyProviderFactory implements PolicyProviderFactory, EnvironmentDependentProviderFactory { private KieServices ks; private final Map containers = Collections.synchronizedMap(new HashMap<>()); @@ -123,7 +124,6 @@ public class DroolsPolicyProviderFactory implements PolicyProviderFactory policies) { - policy.getAssociatedPolicies().forEach(associated -> { - policies.add(associated); - findAssociatedPolicies(associated, policies); - }); - } - private void audit(AbstractPolicyRepresentation resource, String id, OperationType operation, KeycloakSession session) { if (authorization.getRealm().isAdminEventsEnabled()) { if (id != null) { diff --git a/testsuite/integration-arquillian/test-apps/photoz/photoz-restful-api-authz-service.json b/testsuite/integration-arquillian/test-apps/photoz/photoz-restful-api-authz-service.json index ffb7126916..7453506ec1 100644 --- a/testsuite/integration-arquillian/test-apps/photoz/photoz-restful-api-authz-service.json +++ b/testsuite/integration-arquillian/test-apps/photoz/photoz-restful-api-authz-service.json @@ -55,18 +55,11 @@ { "name": "Only Owner Policy", "description": "Defines that only the resource owner is allowed to do something", - "type": "rules", + "type": "js", "logic": "POSITIVE", "decisionStrategy": "UNANIMOUS", "config": { - "mavenArtifactVersion": "2.5.0.Final-SNAPSHOT", - "mavenArtifactId": "photoz-authz-policy", - "sessionName": "MainOwnerSession", - "mavenArtifactGroupId": "org.keycloak.testsuite", - "moduleName": "PhotozAuthzOwnerPolicy", - "applyPolicies": "[]", - "scannerPeriod": "1", - "scannerPeriodUnit": "Hours" + "code": "var permission = $evaluation.getPermission();\nvar identity = $evaluation.getContext().getIdentity();\nvar resource = permission.getResource();\nif (resource) {\nif (resource.getOwner().equals(identity.getId())) {\n$evaluation.grant();\n}}" } }, { diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/authorization/GenericPolicyManagementTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/authorization/GenericPolicyManagementTest.java index 322492d5b8..f1ef32e07b 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/authorization/GenericPolicyManagementTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/authorization/GenericPolicyManagementTest.java @@ -26,6 +26,7 @@ import org.keycloak.admin.client.resource.ResourceResource; import org.keycloak.admin.client.resource.ResourceScopeResource; import org.keycloak.admin.client.resource.ResourceScopesResource; import org.keycloak.admin.client.resource.ResourcesResource; +import org.keycloak.common.Profile; import org.keycloak.representations.idm.authorization.DecisionStrategy; import org.keycloak.representations.idm.authorization.Logic; import org.keycloak.representations.idm.authorization.PolicyProviderRepresentation; @@ -34,6 +35,7 @@ import org.keycloak.representations.idm.authorization.ResourceRepresentation; import org.keycloak.representations.idm.authorization.ScopeRepresentation; import javax.ws.rs.core.Response; +import java.util.ArrayList; import java.util.Arrays; import java.util.HashMap; import java.util.List; @@ -142,7 +144,13 @@ public class GenericPolicyManagementTest extends AbstractAuthorizationTest { .policyProviders().stream().map(PolicyProviderRepresentation::getType).collect(Collectors.toList()); assertFalse(providers.isEmpty()); - assertTrue(providers.containsAll(Arrays.asList(EXPECTED_BUILTIN_POLICY_PROVIDERS))); + List expected = new ArrayList(Arrays.asList(EXPECTED_BUILTIN_POLICY_PROVIDERS)); + + if (!Profile.isFeatureEnabled(Profile.Feature.AUTHZ_DROOLS_POLICY)) { + expected.remove("rules"); + } + + assertTrue(providers.containsAll(expected)); } private PolicyResource createTestingPolicy() { diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/authorization/RulesPolicyManagementTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/authorization/RulesPolicyManagementTest.java index a784566550..c8635148f8 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/authorization/RulesPolicyManagementTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/authorization/RulesPolicyManagementTest.java @@ -28,10 +28,11 @@ import org.junit.Test; import org.keycloak.admin.client.resource.AuthorizationResource; import org.keycloak.admin.client.resource.RulePoliciesResource; import org.keycloak.admin.client.resource.RulePolicyResource; -import org.keycloak.common.Version; +import org.keycloak.common.Profile; import org.keycloak.representations.idm.authorization.DecisionStrategy; import org.keycloak.representations.idm.authorization.Logic; import org.keycloak.representations.idm.authorization.RulePolicyRepresentation; +import org.keycloak.testsuite.ProfileAssume; /** * @author Pedro Igor @@ -40,11 +41,13 @@ public class RulesPolicyManagementTest extends AbstractPolicyManagementTest { @Test public void testCreate() { + ProfileAssume.assumeFeatureEnabled(Profile.Feature.AUTHZ_DROOLS_POLICY); assertCreated(getClient().authorization(), createDefaultRepresentation("Rule Policy")); } @Test public void testUpdate() { + ProfileAssume.assumeFeatureEnabled(Profile.Feature.AUTHZ_DROOLS_POLICY); AuthorizationResource authorization = getClient().authorization(); RulePolicyRepresentation representation = createDefaultRepresentation("Update Rule Policy"); @@ -69,6 +72,7 @@ public class RulesPolicyManagementTest extends AbstractPolicyManagementTest { @Test public void testDelete() { + ProfileAssume.assumeFeatureEnabled(Profile.Feature.AUTHZ_DROOLS_POLICY); AuthorizationResource authorization = getClient().authorization(); RulePolicyRepresentation representation = createDefaultRepresentation("Delete Rule Policy"); diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/import-authorization-unordered-settings.json b/testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/import-authorization-unordered-settings.json index 5bc497693a..61dcbe2be7 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/import-authorization-unordered-settings.json +++ b/testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/import-authorization-unordered-settings.json @@ -54,17 +54,11 @@ { "name": "Only Owner Policy", "description": "Defines that only the resource owner is allowed to do something", - "type": "rules", + "type": "js", "logic": "POSITIVE", "decisionStrategy": "UNANIMOUS", "config": { - "mavenArtifactVersion": "${project.version}", - "mavenArtifactId": "photoz-authz-policy", - "sessionName": "MainOwnerSession", - "mavenArtifactGroupId": "org.keycloak.testsuite", - "moduleName": "PhotozAuthzOwnerPolicy", - "scannerPeriod": "1", - "scannerPeriodUnit": "Hours" + "code": "var permission = $evaluation.getPermission();\nvar identity = $evaluation.getContext().getIdentity();\nvar resource = permission.getResource();\nif (resource) {\nif (resource.getOwner().equals(identity.getId())) {\n$evaluation.grant();\n}}" } }, { diff --git a/testsuite/integration-arquillian/tests/other/console/src/test/java/org/keycloak/testsuite/console/authorization/RulePolicyManagementTest.java b/testsuite/integration-arquillian/tests/other/console/src/test/java/org/keycloak/testsuite/console/authorization/RulePolicyManagementTest.java index 0e6501f3fa..d7b160a56e 100644 --- a/testsuite/integration-arquillian/tests/other/console/src/test/java/org/keycloak/testsuite/console/authorization/RulePolicyManagementTest.java +++ b/testsuite/integration-arquillian/tests/other/console/src/test/java/org/keycloak/testsuite/console/authorization/RulePolicyManagementTest.java @@ -20,9 +20,11 @@ import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertNull; import org.junit.Test; +import org.keycloak.common.Profile; import org.keycloak.common.Version; import org.keycloak.representations.idm.authorization.Logic; import org.keycloak.representations.idm.authorization.RulePolicyRepresentation; +import org.keycloak.testsuite.ProfileAssume; import org.keycloak.testsuite.console.page.clients.authorization.policy.RulePolicy; /** @@ -31,7 +33,8 @@ import org.keycloak.testsuite.console.page.clients.authorization.policy.RulePoli public class RulePolicyManagementTest extends AbstractAuthorizationSettingsTest { @Test - public void testUpdate() throws InterruptedException { + public void testUpdate() { + ProfileAssume.assumeFeatureEnabled(Profile.Feature.AUTHZ_DROOLS_POLICY); authorizationPage.navigateTo(); RulePolicyRepresentation expected = createDefaultRepresentation("Test Rule Policy"); @@ -59,7 +62,8 @@ public class RulePolicyManagementTest extends AbstractAuthorizationSettingsTest } @Test - public void testDelete() throws InterruptedException { + public void testDelete() { + ProfileAssume.assumeFeatureEnabled(Profile.Feature.AUTHZ_DROOLS_POLICY); authorizationPage.navigateTo(); RulePolicyRepresentation expected =createDefaultRepresentation("Delete Rule Policy"); @@ -72,7 +76,8 @@ public class RulePolicyManagementTest extends AbstractAuthorizationSettingsTest } @Test - public void testDeleteFromList() throws InterruptedException { + public void testDeleteFromList() { + ProfileAssume.assumeFeatureEnabled(Profile.Feature.AUTHZ_DROOLS_POLICY); authorizationPage.navigateTo(); RulePolicyRepresentation expected =createDefaultRepresentation("Delete Rule Policy");