Make sure there is always Realm or ResourceServer when searching for authz entities

Closes #11817
This commit is contained in:
Michal Hajas 2022-04-05 14:47:24 +02:00 committed by Pedro Igor
parent bfab03b837
commit d3b43a9f59
65 changed files with 848 additions and 913 deletions

View file

@ -1,3 +1,20 @@
/*
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.authorization.policy.provider.client;
import java.io.IOException;
@ -123,7 +140,7 @@ public class ClientPolicyProviderFactory implements PolicyProviderFactory<Client
try {
if (clients.isEmpty()) {
policyStore.delete(policy.getId());
policyStore.delete(removedClient.getRealm(), policy.getId());
} else {
policy.putConfig("clients", JsonSerialization.writeValueAsString(clients));
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2021 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -13,7 +13,6 @@
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package org.keycloak.authorization.policy.provider.clientscope;
@ -69,12 +68,13 @@ public class ClientScopePolicyProviderFactory implements PolicyProviderFactory<C
StoreFactory storeFactory = provider.getStoreFactory();
PolicyStore policyStore = storeFactory.getPolicyStore();
ClientScopeModel removedClientScope = ((ClientScopeRemovedEvent) event).getClientScope();
RealmModel realm = ((ClientScopeRemovedEvent) event).getClientScope().getRealm();
Map<Policy.FilterOption, String[]> filters = new HashMap<>();
filters.put(Policy.FilterOption.TYPE, new String[] { getId() });
policyStore.findByResourceServer(null, filters, null, null).forEach(new Consumer<Policy>() {
policyStore.find(realm, null, filters, null, null).forEach(new Consumer<Policy>() {
@Override
public void accept(Policy policy) {
@ -93,7 +93,7 @@ public class ClientScopePolicyProviderFactory implements PolicyProviderFactory<C
}
if (clientScopes.isEmpty()) {
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
} else {
try {
policy.putConfig("clientScopes", JsonSerialization.writeValueAsString(clientScopes));

View file

@ -1,5 +1,5 @@
/*
* Copyright 2018 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -125,6 +125,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
public void onUpdate(Policy policy, UmaPermissionRepresentation representation, AuthorizationProvider authorization) {
PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore();
Set<Policy> associatedPolicies = policy.getAssociatedPolicies();
RealmModel realm = policy.getResourceServer().getRealm();
for (Policy associatedPolicy : associatedPolicies) {
AbstractPolicyRepresentation associatedRep = ModelToRepresentation.toRepresentation(associatedPolicy, authorization, false, false);
@ -143,7 +144,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
}
if (rep.getRoles().isEmpty()) {
policyStore.delete(associatedPolicy.getId());
policyStore.delete(realm, associatedPolicy.getId());
} else {
RepresentationToModel.toModel(rep, authorization, associatedPolicy);
}
@ -154,7 +155,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
rep.setType(representation.getCondition());
RepresentationToModel.toModel(rep, authorization, associatedPolicy);
} else {
policyStore.delete(associatedPolicy.getId());
policyStore.delete(realm, associatedPolicy.getId());
}
} else if ("group".equals(associatedRep.getType())) {
GroupPolicyRepresentation rep = GroupPolicyRepresentation.class.cast(associatedRep);
@ -170,7 +171,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
}
if (rep.getGroups().isEmpty()) {
policyStore.delete(associatedPolicy.getId());
policyStore.delete(realm, associatedPolicy.getId());
} else {
RepresentationToModel.toModel(rep, authorization, associatedPolicy);
}
@ -188,7 +189,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
}
if (rep.getClients().isEmpty()) {
policyStore.delete(associatedPolicy.getId());
policyStore.delete(realm, associatedPolicy.getId());
} else {
RepresentationToModel.toModel(rep, authorization, associatedPolicy);
}
@ -206,7 +207,7 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
}
if (rep.getUsers().isEmpty()) {
policyStore.delete(associatedPolicy.getId());
policyStore.delete(realm, associatedPolicy.getId());
} else {
RepresentationToModel.toModel(rep, authorization, associatedPolicy);
}
@ -364,9 +365,10 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
@Override
public void onRemove(Policy policy, AuthorizationProvider authorization) {
PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore();
RealmModel realm = policy.getResourceServer().getRealm();
for (Policy associatedPolicy : policy.getAssociatedPolicies()) {
policyStore.delete(associatedPolicy.getId());
policyStore.delete(realm, associatedPolicy.getId());
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -13,7 +13,6 @@
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package org.keycloak.authorization.policy.provider.role;
@ -140,11 +139,10 @@ public class RolePolicyProviderFactory implements PolicyProviderFactory<RolePoli
}
private void updateRoles(Policy policy, AuthorizationProvider authorization, Set<RolePolicyRepresentation.RoleDefinition> roles) {
KeycloakSession session = authorization.getKeycloakSession();
RealmModel realm = authorization.getRealm();
Set<RolePolicyRepresentation.RoleDefinition> updatedRoles = new HashSet<>();
if (roles != null) {
RealmModel realm = authorization.getRealm();
for (RolePolicyRepresentation.RoleDefinition definition : roles) {
String roleName = definition.getId();
String clientId = null;
@ -240,7 +238,7 @@ public class RolePolicyProviderFactory implements PolicyProviderFactory<RolePoli
try {
if (roles.isEmpty()) {
policyStore.delete(policy.getId());
policyStore.delete(clientModel.getRealm(), policy.getId());
} else {
policy.putConfig("roles", JsonSerialization.writeValueAsString(roles));
}

View file

@ -27,6 +27,7 @@ import org.keycloak.cluster.ClusterProvider;
import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.cache.authorization.CachedStoreFactoryProvider;
import org.keycloak.models.cache.authorization.CachedStoreProviderFactory;
import org.keycloak.models.cache.infinispan.entities.Revisioned;
@ -44,6 +45,15 @@ public class InfinispanCacheStoreFactoryProviderFactory implements CachedStorePr
protected volatile StoreFactoryCacheManager storeCache;
/**
* Legacy store doesn't store realm id for any entity and no method there is using new introduced RealmModel parameter.
* The parameter was introduced for usage only in the new storage. Therefore, in some cases we may break our rule specified in JavaDoc
* and use {@code null} value as parameter that otherwise cannot be {@code null}. We need to be careful and place such value only to a method call
* that cannot end up in the new store because it would end with {@link NullPointerException}. To mark all places where we do this,
* we use this variable so it is easily searchable.
*/
public static final RealmModel NULL_REALM = null;
@Override
public CachedStoreFactoryProvider create(KeycloakSession session) {
lazyInit(session);

View file

@ -1,5 +1,5 @@
/*
* Copyright 2017 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -22,6 +22,7 @@ import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.models.cache.infinispan.authorization.entities.CachedPermissionTicket;
/**
@ -42,8 +43,8 @@ public class PermissionTicketAdapter implements PermissionTicket, CachedModel<Pe
@Override
public PermissionTicket getDelegateForUpdate() {
if (updated == null) {
ResourceServer resourceServer = cacheSession.getResourceServerStoreDelegate().findById(null, cached.getResourceServerId());
updated = cacheSession.getPermissionTicketStoreDelegate().findById(resourceServer, cached.getId());
ResourceServer resourceServer = cacheSession.getResourceServerStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId());
updated = cacheSession.getPermissionTicketStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database");
cacheSession.registerPermissionTicketInvalidation(cached.getId(), cached.getOwner(), cached.getRequester(), cached.getResourceId(), updated.getResource().getName(), cached.getScopeId(), cached.getResourceServerId());
}
@ -70,8 +71,8 @@ public class PermissionTicketAdapter implements PermissionTicket, CachedModel<Pe
protected boolean isUpdated() {
if (updated != null) return true;
if (!invalidated) return false;
ResourceServer resourceServer = cacheSession.getResourceServerStoreDelegate().findById(null, cached.getResourceServerId());
updated = cacheSession.getPermissionTicketStoreDelegate().findById(resourceServer, cached.getId());
ResourceServer resourceServer = cacheSession.getResourceServerStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId());
updated = cacheSession.getPermissionTicketStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database");
return true;
}
@ -122,13 +123,13 @@ public class PermissionTicketAdapter implements PermissionTicket, CachedModel<Pe
@Override
public ResourceServer getResourceServer() {
return cacheSession.getResourceServerStore().findById(null, cached.getResourceServerId());
return cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId());
}
@Override
public Policy getPolicy() {
if (isUpdated()) return updated.getPolicy();
return cacheSession.getPolicyStore().findById(cacheSession.getResourceServerStore().findById(null, cached.getResourceServerId()), cached.getPolicy());
return cacheSession.getPolicyStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()), cached.getPolicy());
}
@Override
@ -140,12 +141,12 @@ public class PermissionTicketAdapter implements PermissionTicket, CachedModel<Pe
@Override
public Resource getResource() {
return cacheSession.getResourceStore().findById(getResourceServer(), cached.getResourceId());
return cacheSession.getResourceStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getResourceId());
}
@Override
public Scope getScope() {
return cacheSession.getScopeStore().findById(getResourceServer(), cached.getScopeId());
return cacheSession.getScopeStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getScopeId());
}
@Override

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -21,6 +21,7 @@ import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.authorization.store.ScopeStore;
@ -85,7 +86,7 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
protected boolean isUpdated() {
if (updated != null) return true;
if (!invalidated) return false;
updated = cacheSession.getPolicyStoreDelegate().findById(cacheSession.getResourceServerStore().findById(null, cached.getResourceServerId()), cached.getId());
updated = cacheSession.getPolicyStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()), cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database");
return true;
}
@ -112,7 +113,7 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
@Override
public ResourceServer getResourceServer() {
return cacheSession.getResourceServerStore().findById(null, cached.getResourceServerId());
return cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId());
}
@Override
@ -208,7 +209,7 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
PolicyStore policyStore = cacheSession.getPolicyStore();
String resourceServerId = cached.getResourceServerId();
for (String id : cached.getAssociatedPoliciesIds(modelSupplier)) {
Policy policy = policyStore.findById(cacheSession.getResourceServerStore().findById(null, resourceServerId), id);
Policy policy = policyStore.findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServerId), id);
cacheSession.cachePolicy(policy);
associatedPolicies.add(policy);
}
@ -225,7 +226,7 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
ResourceStore resourceStore = cacheSession.getResourceStore();
ResourceServer resourceServer = getResourceServer();
for (String resourceId : cached.getResourcesIds(modelSupplier)) {
Resource resource = resourceStore.findById(resourceServer, resourceId);
Resource resource = resourceStore.findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId);
cacheSession.cacheResource(resource);
resources.add(resource);
}
@ -290,7 +291,7 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
ResourceServer resourceServer = getResourceServer();
ScopeStore scopeStore = cacheSession.getScopeStore();
for (String scopeId : cached.getScopesIds(modelSupplier)) {
Scope scope = scopeStore.findById(resourceServer, scopeId);
Scope scope = scopeStore.findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, scopeId);
cacheSession.cacheScope(scope);
scopes.add(scope);
}
@ -325,6 +326,6 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
}
private Policy getPolicyModel() {
return cacheSession.getPolicyStoreDelegate().findById(cacheSession.getResourceServerStore().findById(null, cached.getResourceServerId()), cached.getId());
return cacheSession.getPolicyStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId()), cached.getId());
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -81,7 +81,7 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
protected boolean isUpdated() {
if (updated != null) return true;
if (!invalidated) return false;
updated = cacheSession.getResourceStoreDelegate().findById(getResourceServer(), cached.getId());
updated = cacheSession.getResourceStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database");
return true;
}
@ -134,7 +134,7 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
@Override
public ResourceServer getResourceServer() {
return cacheSession.getResourceServerStoreDelegate().findById(null, cached.getResourceServerId());
return cacheSession.getResourceServerStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId());
}
@Override
@ -172,7 +172,7 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
if (scopes != null) return scopes;
scopes = new LinkedList<>();
for (String scopeId : cached.getScopesIds(modelSupplier)) {
scopes.add(cacheSession.getScopeStore().findById(getResourceServer(), scopeId));
scopes.add(cacheSession.getScopeStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), scopeId));
}
return scopes = Collections.unmodifiableList(scopes);
}
@ -206,7 +206,7 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
List<PermissionTicket> permissions = permissionStore.findByScope(getResourceServer(), scope);
for (PermissionTicket permission : permissions) {
permissionStore.delete(permission.getId());
permissionStore.delete(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, permission.getId());
}
}
}
@ -282,6 +282,6 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
}
private Resource getResourceModel() {
return cacheSession.getResourceStoreDelegate().findById(getResourceServer(), cached.getId());
return cacheSession.getResourceStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getId());
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -18,6 +18,7 @@ package org.keycloak.models.cache.infinispan.authorization;
import org.keycloak.authorization.model.CachedModel;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.models.ClientModel;
import org.keycloak.models.RealmModel;
import org.keycloak.models.cache.infinispan.authorization.entities.CachedResourceServer;
@ -42,7 +43,7 @@ public class ResourceServerAdapter implements ResourceServer, CachedModel<Resour
public ResourceServer getDelegateForUpdate() {
if (updated == null) {
cacheSession.registerResourceServerInvalidation(cached.getId());
updated = cacheSession.getResourceServerStoreDelegate().findById(null, cached.getId());
updated = cacheSession.getResourceServerStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database");
}
return updated;
@ -69,7 +70,7 @@ public class ResourceServerAdapter implements ResourceServer, CachedModel<Resour
protected boolean isUpdated() {
if (updated != null) return true;
if (!invalidated) return false;
updated = cacheSession.getResourceServerStoreDelegate().findById(null, cached.getId());
updated = cacheSession.getResourceServerStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database");
return true;
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -19,6 +19,7 @@ package org.keycloak.models.cache.infinispan.authorization;
import org.keycloak.authorization.model.CachedModel;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.models.cache.infinispan.authorization.entities.CachedScope;
/**
@ -39,7 +40,7 @@ public class ScopeAdapter implements Scope, CachedModel<Scope> {
public Scope getDelegateForUpdate() {
if (updated == null) {
cacheSession.registerScopeInvalidation(cached.getId(), cached.getName(), cached.getResourceServerId());
updated = cacheSession.getScopeStoreDelegate().findById(getResourceServer(), cached.getId());
updated = cacheSession.getScopeStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database");
}
return updated;
@ -66,7 +67,7 @@ public class ScopeAdapter implements Scope, CachedModel<Scope> {
protected boolean isUpdated() {
if (updated != null) return true;
if (!invalidated) return false;
updated = cacheSession.getScopeStoreDelegate().findById(getResourceServer(), cached.getId());
updated = cacheSession.getScopeStoreDelegate().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, getResourceServer(), cached.getId());
if (updated == null) throw new IllegalStateException("Not found in database");
return true;
}
@ -118,7 +119,7 @@ public class ScopeAdapter implements Scope, CachedModel<Scope> {
@Override
public ResourceServer getResourceServer() {
return cacheSession.getResourceServerStore().findById(null, cached.getResourceServerId());
return cacheSession.getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, cached.getResourceServerId());
}
@Override

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -310,9 +310,9 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
return Collections.emptySet();
}
ResourceServer resourceServer = getResourceServerStore().findById(null, serverId);
ResourceServer resourceServer = getResourceServerStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, serverId);
return resources.stream().map(resourceId -> {
Resource resource = getResourceStore().findById(resourceServer, resourceId);
Resource resource = getResourceStore().findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId);
String type = resource.getType();
if (type != null) {
@ -451,7 +451,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
public void delete(ClientModel client) {
String id = client.getId();
if (id == null) return;
ResourceServer server = findById(null, id);
ResourceServer server = findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, id);
if (server == null) return;
cache.invalidateObject(id);
@ -492,7 +492,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
@Override
public ResourceServer findByClient(ClientModel client) {
return findById(null, client.getId());
return findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, client.getId());
}
}
@ -510,19 +510,19 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
if (id == null) return;
Scope scope = findById(null, id);
Scope scope = findById(realm, null, id);
if (scope == null) return;
cache.invalidateObject(id);
invalidationEvents.add(ScopeRemovedEvent.create(id, scope.getName(), scope.getResourceServer().getId()));
cache.scopeRemoval(id, scope.getName(), scope.getResourceServer().getId(), invalidations);
getScopeStoreDelegate().delete(id);
getScopeStoreDelegate().delete(realm, id);
}
@Override
public Scope findById(ResourceServer resourceServer, String id) {
public Scope findById(RealmModel realm, ResourceServer resourceServer, String id) {
if (id == null) return null;
CachedScope cached = cache.get(id, CachedScope.class);
if (cached != null) {
@ -531,7 +531,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (cached == null) {
Long loaded = cache.getCurrentRevision(id);
if (! modelMightExist(id)) return null;
Scope model = getScopeStoreDelegate().findById(resourceServer, id);
Scope model = getScopeStoreDelegate().findById(realm, resourceServer, id);
if (model == null) {
setModelDoesNotExists(id, loaded);
return null;
@ -540,7 +540,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
cached = new CachedScope(loaded, model);
cache.addRevisioned(cached, startupRevision);
} else if (invalidations.contains(id)) {
return getScopeStoreDelegate().findById(resourceServer, id);
return getScopeStoreDelegate().findById(realm, resourceServer, id);
} else if (managedScopes.containsKey(id)) {
return managedScopes.get(id);
}
@ -573,7 +573,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (invalidations.contains(id)) {
return getScopeStoreDelegate().findByName(resourceServer, name);
}
return findById(resourceServer, id);
return findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, id);
}
}
@ -593,29 +593,29 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
@Override
public Resource create(ResourceServer resourceServer, String id, String name, String owner) {
Resource resource = getResourceStoreDelegate().create(resourceServer, id, name, owner);
Resource cached = findById(resourceServer, resource.getId());
Resource cached = findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resource.getId());
registerResourceInvalidation(resource.getId(), resource.getName(), resource.getType(), resource.getUris(), resource.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()), resourceServer.getId(), resource.getOwner());
if (cached == null) {
cached = findById(resourceServer, resource.getId());
cached = findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resource.getId());
}
return cached;
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
if (id == null) return;
Resource resource = findById(null, id);
Resource resource = findById(realm, null, id);
if (resource == null) return;
cache.invalidateObject(id);
invalidationEvents.add(ResourceRemovedEvent.create(id, resource.getName(), resource.getType(), resource.getUris(), resource.getOwner(), resource.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()), resource.getResourceServer().getId()));
cache.resourceRemoval(id, resource.getName(), resource.getType(), resource.getUris(), resource.getOwner(), resource.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()), resource.getResourceServer().getId(), invalidations);
getResourceStoreDelegate().delete(id);
getResourceStoreDelegate().delete(realm, id);
}
@Override
public Resource findById(ResourceServer resourceServer, String id) {
public Resource findById(RealmModel realm, ResourceServer resourceServer, String id) {
if (id == null) return null;
CachedResource cached = cache.get(id, CachedResource.class);
if (cached != null) {
@ -624,7 +624,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (cached == null) {
Long loaded = cache.getCurrentRevision(id);
if (! modelMightExist(id)) return null;
Resource model = getResourceStoreDelegate().findById(resourceServer, id);
Resource model = getResourceStoreDelegate().findById(realm, resourceServer, id);
if (model == null) {
setModelDoesNotExists(id, loaded);
return null;
@ -633,7 +633,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
cached = new CachedResource(loaded, model);
cache.addRevisioned(cached, startupRevision);
} else if (invalidations.contains(id)) {
return getResourceStoreDelegate().findById(resourceServer, id);
return getResourceStoreDelegate().findById(realm, resourceServer, id);
} else if (managedResources.containsKey(id)) {
return managedResources.get(id);
}
@ -666,20 +666,20 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
}
@Override
public List<Resource> findByOwner(ResourceServer resourceServer, String ownerId) {
public List<Resource> findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId) {
String resourceServerId = resourceServer == null ? null : resourceServer.getId();
String cacheKey = getResourceByOwnerCacheKey(ownerId, resourceServerId);
return cacheQuery(cacheKey, ResourceListQuery.class, () -> getResourceStoreDelegate().findByOwner(resourceServer, ownerId),
return cacheQuery(cacheKey, ResourceListQuery.class, () -> getResourceStoreDelegate().findByOwner(realm, resourceServer, ownerId),
(revision, resources) -> new ResourceListQuery(revision, cacheKey, resources.stream().map(Resource::getId).collect(Collectors.toSet()), resourceServerId), resourceServer);
}
@Override
public void findByOwner(ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
public void findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
String resourceServerId = resourceServer == null ? null : resourceServer.getId();
String cacheKey = getResourceByOwnerCacheKey(ownerId, resourceServerId);
cacheQuery(cacheKey, ResourceListQuery.class, () -> {
List<Resource> resources = new ArrayList<>();
getResourceStoreDelegate().findByOwner(resourceServer, ownerId, new Consumer<Resource>() {
getResourceStoreDelegate().findByOwner(realm, resourceServer, ownerId, new Consumer<Resource>() {
@Override
public void accept(Resource resource) {
consumer.andThen(resources::add)
@ -692,28 +692,14 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
(revision, resources) -> new ResourceListQuery(revision, cacheKey, resources.stream().map(Resource::getId).collect(Collectors.toSet()), resourceServerId), resourceServer, consumer);
}
@Override
public List<Resource> findByOwner(ResourceServer resourceServer, String ownerId, Integer firstResult, Integer maxResults) {
return getResourceStoreDelegate().findByOwner(resourceServer, ownerId, firstResult, maxResults);
}
@Override
public List<Resource> findByUri(ResourceServer resourceServer, String uri) {
if (uri == null) return null;
String resourceServerId = resourceServer == null ? null : resourceServer.getId();
String cacheKey = getResourceByUriCacheKey(uri, resourceServerId);
return cacheQuery(cacheKey, ResourceListQuery.class, () -> getResourceStoreDelegate().findByUri(resourceServer, uri),
(revision, resources) -> new ResourceListQuery(revision, cacheKey, resources.stream().map(Resource::getId).collect(Collectors.toSet()), resourceServerId), resourceServer);
}
@Override
public List<Resource> findByResourceServer(ResourceServer resourceServer) {
return getResourceStoreDelegate().findByResourceServer(resourceServer);
}
@Override
public List<Resource> findByResourceServer(ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return getResourceStoreDelegate().findByResourceServer(resourceServer, attributes, firstResult, maxResults);
public List<Resource> find(RealmModel realm, ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return getResourceStoreDelegate().find(realm, resourceServer, attributes, firstResult, maxResults);
}
@Override
@ -782,19 +768,6 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
(revision, resources) -> new ResourceListQuery(revision, cacheKey, resources.stream().map(Resource::getId).collect(Collectors.toSet()), resourceServerId), resourceServer, consumer);
}
@Override
public List<Resource> findByType(ResourceServer resourceServer, String type, String owner) {
if (resourceServer != null && resourceServer.getId().equals(owner)) {
return findByType(resourceServer, type);
} else {
if (type == null) return Collections.emptyList();
String resourceServerId = resourceServer == null ? null : resourceServer.getId();
String cacheKey = getResourceByTypeCacheKey(type, owner, resourceServerId);
return cacheQuery(cacheKey, ResourceListQuery.class, () -> getResourceStoreDelegate().findByType(resourceServer, type, owner),
(revision, resources) -> new ResourceListQuery(revision, cacheKey, resources.stream().map(Resource::getId).collect(Collectors.toSet()), resourceServerId), resourceServer);
}
}
@Override
public void findByType(ResourceServer resourceServer, String type, String owner, Consumer<Resource> consumer) {
if (type == null) return;
@ -815,15 +788,6 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
(revision, resources) -> new ResourceListQuery(revision, cacheKey, resources.stream().map(Resource::getId).collect(Collectors.toSet()), resourceServerId), resourceServer, consumer);
}
@Override
public List<Resource> findByTypeInstance(ResourceServer resourceServer, String type) {
if (type == null) return Collections.emptyList();
String resourceServerId = resourceServer == null ? null : resourceServer.getId();
String cacheKey = getResourceByTypeInstanceCacheKey(type, resourceServerId);
return cacheQuery(cacheKey, ResourceListQuery.class, () -> getResourceStoreDelegate().findByTypeInstance(resourceServer, type),
(revision, resources) -> new ResourceListQuery(revision, cacheKey, resources.stream().map(Resource::getId).collect(Collectors.toSet()), resourceServerId), resourceServer);
}
@Override
public void findByTypeInstance(ResourceServer resourceServer, String type, Consumer<Resource> consumer) {
if (type == null) return;
@ -873,9 +837,9 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
Set<String> resources = query.getResources();
if (consumer != null) {
resources.stream().map(resourceId -> (R) findById(resourceServer, resourceId)).forEach(consumer);
resources.stream().map(resourceId -> (R) findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId)).forEach(consumer);
} else {
model = resources.stream().map(resourceId -> (R) findById(resourceServer, resourceId)).collect(Collectors.toList());
model = resources.stream().map(resourceId -> (R) findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId)).collect(Collectors.toList());
}
}
@ -891,18 +855,18 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
@Override
public Policy create(ResourceServer resourceServer, AbstractPolicyRepresentation representation) {
Policy policy = getPolicyStoreDelegate().create(resourceServer, representation);
Policy cached = findById(resourceServer, policy.getId());
Policy cached = findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, policy.getId());
registerPolicyInvalidation(policy.getId(), representation.getName(), representation.getResources(), representation.getScopes(), null, resourceServer.getId());
if (cached == null) {
cached = findById(resourceServer, policy.getId());
cached = findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, policy.getId());
}
return cached;
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
if (id == null) return;
Policy policy = findById(null, id);
Policy policy = findById(realm, null, id);
if (policy == null) return;
cache.invalidateObject(id);
@ -916,12 +880,12 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
Set<String> scopes = policy.getScopes().stream().map(Scope::getId).collect(Collectors.toSet());
invalidationEvents.add(PolicyRemovedEvent.create(id, policy.getName(), resources, resourceTypes, scopes, resourceServer.getId()));
cache.policyRemoval(id, policy.getName(), resources, resourceTypes, scopes, resourceServer.getId(), invalidations);
getPolicyStoreDelegate().delete(id);
getPolicyStoreDelegate().delete(realm, id);
}
@Override
public Policy findById(ResourceServer resourceServer, String id) {
public Policy findById(RealmModel realm, ResourceServer resourceServer, String id) {
if (id == null) return null;
CachedPolicy cached = cache.get(id, CachedPolicy.class);
@ -930,7 +894,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
}
if (cached == null) {
if (! modelMightExist(id)) return null;
Policy model = getPolicyStoreDelegate().findById(resourceServer, id);
Policy model = getPolicyStoreDelegate().findById(realm, resourceServer, id);
Long loaded = cache.getCurrentRevision(id);
if (model == null) {
setModelDoesNotExists(id, loaded);
@ -940,7 +904,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
cached = new CachedPolicy(loaded, model);
cache.addRevisioned(cached, startupRevision);
} else if (invalidations.contains(id)) {
return getPolicyStoreDelegate().findById(resourceServer, id);
return getPolicyStoreDelegate().findById(realm, resourceServer, id);
} else if (managedPolicies.containsKey(id)) {
return managedPolicies.get(id);
}
@ -977,8 +941,8 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
}
@Override
public List<Policy> findByResourceServer(ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return getPolicyStoreDelegate().findByResourceServer(resourceServer, attributes, firstResult, maxResults);
public List<Policy> find(RealmModel realm, ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return getPolicyStoreDelegate().find(realm, resourceServer, attributes, firstResult, maxResults);
}
@Override
@ -1122,10 +1086,10 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (consumer != null) {
for (String id : policies) {
consumer.accept((R) findById(resourceServer, id));
consumer.accept((R) findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, id));
}
} else {
model = policies.stream().map(resourceId -> (R) findById(resourceServer, resourceId))
model = policies.stream().map(resourceId -> (R) findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId))
.filter(Objects::nonNull).collect(Collectors.toList());
}
}
@ -1150,9 +1114,9 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
if (id == null) return;
PermissionTicket permission = findById(null, id);
PermissionTicket permission = findById(realm, null, id);
if (permission == null) return;
cache.invalidateObject(id);
@ -1162,13 +1126,13 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
}
invalidationEvents.add(PermissionTicketRemovedEvent.create(id, permission.getOwner(), permission.getRequester(), permission.getResource().getId(), permission.getResource().getName(), scopeId, permission.getResourceServer().getId()));
cache.permissionTicketRemoval(id, permission.getOwner(), permission.getRequester(), permission.getResource().getId(), permission.getResource().getName(),scopeId, permission.getResourceServer().getId(), invalidations);
getPermissionTicketStoreDelegate().delete(id);
getPermissionTicketStoreDelegate().delete(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, id);
UserManagedPermissionUtil.removePolicy(permission, StoreFactoryCacheSession.this);
}
@Override
public PermissionTicket findById(ResourceServer resourceServer, String id) {
public PermissionTicket findById(RealmModel realm, ResourceServer resourceServer, String id) {
if (id == null) return null;
CachedPermissionTicket cached = cache.get(id, CachedPermissionTicket.class);
@ -1178,7 +1142,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
if (cached == null) {
Long loaded = cache.getCurrentRevision(id);
if (! modelMightExist(id)) return null;
PermissionTicket model = getPermissionTicketStoreDelegate().findById(resourceServer, id);
PermissionTicket model = getPermissionTicketStoreDelegate().findById(realm, resourceServer, id);
if (model == null) {
setModelDoesNotExists(id, loaded);
return null;
@ -1187,7 +1151,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
cached = new CachedPermissionTicket(loaded, model);
cache.addRevisioned(cached, startupRevision);
} else if (invalidations.contains(id)) {
return getPermissionTicketStoreDelegate().findById(resourceServer, id);
return getPermissionTicketStoreDelegate().findById(realm, resourceServer, id);
} else if (managedPermissionTickets.containsKey(id)) {
return managedPermissionTickets.get(id);
}
@ -1196,11 +1160,6 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
return adapter;
}
@Override
public List<PermissionTicket> findByResourceServer(ResourceServer resourceServer) {
return getPermissionTicketStoreDelegate().findByResourceServer(resourceServer);
}
@Override
public List<PermissionTicket> findByResource(ResourceServer resourceServer, Resource resource) {
String resourceServerId = resourceServer == null ? null : resourceServer.getId();
@ -1218,8 +1177,8 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
}
@Override
public List<PermissionTicket> find(ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResult) {
return getPermissionTicketStoreDelegate().find(resourceServer, attributes, firstResult, maxResult);
public List<PermissionTicket> find(RealmModel realm, ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResult) {
return getPermissionTicketStoreDelegate().find(realm, resourceServer, attributes, firstResult, maxResult);
}
@Override
@ -1248,14 +1207,6 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
return getPermissionTicketStoreDelegate().findGrantedOwnerResources(realm, owner, firstResult, maxResults);
}
@Override
public List<PermissionTicket> findByOwner(ResourceServer resourceServer, String owner) {
String resourceServerId = resourceServer == null ? null : resourceServer.getId();
String cacheKey = getPermissionTicketByOwner(owner, resourceServerId);
return cacheQuery(cacheKey, PermissionTicketListQuery.class, () -> getPermissionTicketStoreDelegate().findByOwner(resourceServer, owner),
(revision, permissions) -> new PermissionTicketListQuery(revision, cacheKey, permissions.stream().map(PermissionTicket::getId).collect(Collectors.toSet()), resourceServerId), resourceServer);
}
private <R, Q extends PermissionTicketQuery> List<R> cacheQuery(String cacheKey, Class<Q> queryType, Supplier<List<R>> resultSupplier, BiFunction<Long, List<R>, Q> querySupplier, ResourceServer resourceServer) {
Q query = cache.get(cacheKey, queryType);
if (query != null) {
@ -1272,7 +1223,7 @@ public class StoreFactoryCacheSession implements CachedStoreFactoryProvider {
} else if (query.isInvalid(invalidations)) {
return resultSupplier.get();
} else {
return query.getPermissions().stream().map(resourceId -> (R) findById(resourceServer, resourceId)).collect(Collectors.toList());
return query.getPermissions().stream().map(resourceId -> (R) findById(InfinispanCacheStoreFactoryProviderFactory.NULL_REALM, resourceServer, resourceId)).collect(Collectors.toList());
}
}
}

View file

@ -26,12 +26,24 @@ import org.keycloak.authorization.store.AuthorizationStoreFactory;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.connections.jpa.JpaConnectionProvider;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
import static org.keycloak.models.jpa.JpaRealmProviderFactory.PROVIDER_PRIORITY;
/**
* @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
*/
public class JPAAuthorizationStoreFactory implements AuthorizationStoreFactory {
/**
* Legacy store doesn't store realm id for any entity and no method there is using new introduced RealmModel parameter.
* The parameter was introduced for usage only in the new storage. Therefore, in some cases we may break our rule specified in JavaDoc
* and use {@code null} value as parameter that otherwise cannot be {@code null}. We need to be careful and place such value only to a method call
* that cannot end up in the new store because it would end with {@link NullPointerException}. To mark all places where we do this,
* we use this variable so it is easily searchable.
*/
public static final RealmModel NULL_REALM = null;
@Override
public StoreFactory create(KeycloakSession session) {
AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);

View file

@ -1,5 +1,5 @@
/*
* Copyright 2017 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -152,7 +152,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
PermissionTicketEntity policy = entityManager.find(PermissionTicketEntity.class, id, LockModeType.PESSIMISTIC_WRITE);
if (policy != null) {
this.entityManager.remove(policy);
@ -161,7 +161,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
@Override
public PermissionTicket findById(ResourceServer resourceServer, String id) {
public PermissionTicket findById(RealmModel realm, ResourceServer resourceServer, String id) {
if (id == null) {
return null;
}
@ -172,26 +172,6 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
return new PermissionTicketAdapter(entity, entityManager, provider.getStoreFactory());
}
@Override
public List<PermissionTicket> findByResourceServer(final ResourceServer resourceServer) {
TypedQuery<String> query = entityManager.createNamedQuery("findPolicyIdByServerId", String.class);
query.setParameter("serverId", resourceServer == null ? null : resourceServer.getId());
List<String> result = query.getResultList();
List<PermissionTicket> list = new LinkedList<>();
PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
for (String id : result) {
PermissionTicket ticket = ticketStore.findById(resourceServer, id);
if (Objects.nonNull(ticket)) {
list.add(ticket);
}
}
return list;
}
@Override
public List<PermissionTicket> findByResource(ResourceServer resourceServer, final Resource resource) {
TypedQuery<String> query = entityManager.createNamedQuery("findPermissionIdByResource", String.class);
@ -205,7 +185,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
for (String id : result) {
PermissionTicket ticket = ticketStore.findById(resourceServer, id);
PermissionTicket ticket = ticketStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id);
if (Objects.nonNull(ticket)) {
list.add(ticket);
}
@ -232,7 +212,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
for (String id : result) {
PermissionTicket ticket = ticketStore.findById(resourceServer, id);
PermissionTicket ticket = ticketStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id);
if (Objects.nonNull(ticket)) {
list.add(ticket);
}
@ -242,7 +222,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
}
@Override
public List<PermissionTicket> find(ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResult) {
public List<PermissionTicket> find(RealmModel realm, ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResult) {
CriteriaBuilder builder = entityManager.getCriteriaBuilder();
CriteriaQuery<PermissionTicketEntity> querybuilder = builder.createQuery(PermissionTicketEntity.class);
Root<PermissionTicketEntity> root = querybuilder.from(PermissionTicketEntity.class);
@ -260,7 +240,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
for (String id : result) {
PermissionTicket ticket = ticketStore.findById(resourceServer, id);
PermissionTicket ticket = ticketStore.findById(realm, resourceServer, id);
if (Objects.nonNull(ticket)) {
list.add(ticket);
}
@ -276,7 +256,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
filters.put(PermissionTicket.FilterOption.REQUESTER, userId);
return find(resourceServer, filters, null, null);
return find(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, filters, null, null);
}
@Override
@ -287,7 +267,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
filters.put(PermissionTicket.FilterOption.REQUESTER, userId);
return find(resourceServer, filters, null, null);
return find(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, filters, null, null);
}
@Override
@ -308,7 +288,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
for (String id : result) {
Resource resource = resourceStore.findById(null, id);
Resource resource = resourceStore.findById(realm, null, id);
if (Objects.nonNull(resource)) {
list.add(resource);
@ -330,7 +310,7 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
for (String id : result) {
Resource resource = resourceStore.findById(null, id);
Resource resource = resourceStore.findById(realm, null, id);
if (Objects.nonNull(resource)) {
list.add(resource);
@ -340,25 +320,4 @@ public class JPAPermissionTicketStore implements PermissionTicketStore {
return list;
}
@Override
public List<PermissionTicket> findByOwner(ResourceServer resourceServer, String owner) {
TypedQuery<String> query = entityManager.createNamedQuery("findPolicyIdByType", String.class);
query.setFlushMode(FlushModeType.COMMIT);
query.setParameter("serverId", resourceServer == null ? null : resourceServer.getId());
query.setParameter("owner", owner);
List<String> result = query.getResultList();
List<PermissionTicket> list = new LinkedList<>();
PermissionTicketStore ticketStore = provider.getStoreFactory().getPermissionTicketStore();
for (String id : result) {
PermissionTicket ticket = ticketStore.findById(resourceServer, id);
if (Objects.nonNull(ticket)) {
list.add(ticket);
}
}
return list;
}
}

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -41,8 +40,10 @@ import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.utils.KeycloakModelUtils;
import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
import javax.persistence.LockModeType;
@ -83,7 +84,7 @@ public class JPAPolicyStore implements PolicyStore {
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
PolicyEntity policy = entityManager.find(PolicyEntity.class, id, LockModeType.PESSIMISTIC_WRITE);
if (policy != null) {
this.entityManager.remove(policy);
@ -92,7 +93,7 @@ public class JPAPolicyStore implements PolicyStore {
@Override
public Policy findById(ResourceServer resourceServer, String id) {
public Policy findById(RealmModel realm, ResourceServer resourceServer, String id) {
if (id == null) {
return null;
}
@ -130,7 +131,7 @@ public class JPAPolicyStore implements PolicyStore {
List<String> result = query.getResultList();
List<Policy> list = new LinkedList<>();
for (String id : result) {
Policy policy = provider.getStoreFactory().getPolicyStore().findById(resourceServer, id);
Policy policy = provider.getStoreFactory().getPolicyStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id);
if (Objects.nonNull(policy)) {
list.add(policy);
}
@ -139,7 +140,7 @@ public class JPAPolicyStore implements PolicyStore {
}
@Override
public List<Policy> findByResourceServer(ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
public List<Policy> find(RealmModel realm, ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
CriteriaBuilder builder = entityManager.getCriteriaBuilder();
CriteriaQuery<PolicyEntity> querybuilder = builder.createQuery(PolicyEntity.class);
Root<PolicyEntity> root = querybuilder.from(PolicyEntity.class);
@ -199,7 +200,7 @@ public class JPAPolicyStore implements PolicyStore {
List<String> result = paginateQuery(query, firstResult, maxResults).getResultList();
List<Policy> list = new LinkedList<>();
for (String id : result) {
Policy policy = provider.getStoreFactory().getPolicyStore().findById(resourceServer, id);
Policy policy = provider.getStoreFactory().getPolicyStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id);
if (Objects.nonNull(policy)) {
list.add(policy);
}
@ -218,7 +219,7 @@ public class JPAPolicyStore implements PolicyStore {
PolicyStore storeFactory = provider.getStoreFactory().getPolicyStore();
closing(query.getResultStream()
.map(entity -> storeFactory.findById(resourceServer, entity.getId()))
.map(entity -> storeFactory.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, entity.getId()))
.filter(Objects::nonNull))
.forEach(consumer::accept);
}
@ -254,7 +255,7 @@ public class JPAPolicyStore implements PolicyStore {
PolicyStore storeFactory = provider.getStoreFactory().getPolicyStore();
for (PolicyEntity entity : query.getResultList()) {
list.add(storeFactory.findById(resourceServer, entity.getId()));
list.add(storeFactory.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, entity.getId()));
}
return list;
@ -295,7 +296,7 @@ public class JPAPolicyStore implements PolicyStore {
List<String> result = query.getResultList();
List<Policy> list = new LinkedList<>();
for (String id : result) {
Policy policy = provider.getStoreFactory().getPolicyStore().findById(resourceServer, id);
Policy policy = provider.getStoreFactory().getPolicyStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id);
if (Objects.nonNull(policy)) {
list.add(policy);
}
@ -315,7 +316,7 @@ public class JPAPolicyStore implements PolicyStore {
List<String> result = query.getResultList();
List<Policy> list = new LinkedList<>();
for (String id : result) {
Policy policy = provider.getStoreFactory().getPolicyStore().findById(resourceServer, id);
Policy policy = provider.getStoreFactory().getPolicyStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id);
if (Objects.nonNull(policy)) {
list.add(policy);
}

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -24,6 +23,7 @@ import org.keycloak.authorization.jpa.entities.ResourceEntity;
import org.keycloak.authorization.jpa.entities.ResourceServerEntity;
import org.keycloak.authorization.jpa.entities.ScopeEntity;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.ResourceServerStore;
import org.keycloak.models.ModelException;
import org.keycloak.models.RealmModel;
@ -131,6 +131,6 @@ public class JPAResourceServerStore implements ResourceServerStore {
@Override
public ResourceServer findByClient(ClientModel client) {
return findById(null, client.getId());
return findById(JPAAuthorizationStoreFactory.NULL_REALM, client.getId());
}
}

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -22,8 +21,10 @@ import org.keycloak.authorization.jpa.entities.ResourceEntity;
import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.utils.KeycloakModelUtils;
import javax.persistence.EntityManager;
@ -80,7 +81,7 @@ public class JPAResourceStore implements ResourceStore {
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
ResourceEntity resource = entityManager.getReference(ResourceEntity.class, id);
if (resource == null) return;
@ -89,7 +90,7 @@ public class JPAResourceStore implements ResourceStore {
}
@Override
public Resource findById(ResourceServer resourceServer, String id) {
public Resource findById(RealmModel realm, ResourceServer resourceServer, String id) {
if (id == null) {
return null;
}
@ -100,19 +101,10 @@ public class JPAResourceStore implements ResourceStore {
}
@Override
public void findByOwner(ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
public void findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
findByOwnerFilter(ownerId, resourceServer, consumer, -1, -1);
}
@Override
public List<Resource> findByOwner(ResourceServer resourceServer, String ownerId, Integer firstResult, Integer maxResults) {
List<Resource> list = new LinkedList<>();
findByOwnerFilter(ownerId, resourceServer, list::add, firstResult, maxResults);
return list;
}
private void findByOwnerFilter(String ownerId, ResourceServer resourceServer, Consumer<Resource> consumer, int firstResult, int maxResult) {
boolean pagination = firstResult > -1 && maxResult > -1;
String queryName = pagination ? "findResourceIdByOwnerOrdered" : "findResourceIdByOwner";
@ -136,30 +128,7 @@ public class JPAResourceStore implements ResourceStore {
}
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
closing(query.getResultStream().map(id -> resourceStore.findById(resourceServer, id.getId()))).forEach(consumer);
}
@Override
public List<Resource> findByUri(ResourceServer resourceServer, String uri) {
TypedQuery<String> query = entityManager.createNamedQuery("findResourceIdByUri", String.class);
query.setFlushMode(FlushModeType.COMMIT);
query.setParameter("uri", uri);
query.setParameter("serverId", resourceServer == null ? null : resourceServer.getId());
List<String> result = query.getResultList();
List<Resource> list = new LinkedList<>();
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
for (String id : result) {
Resource resource = resourceStore.findById(resourceServer, id);
if (resource != null) {
list.add(resource);
}
}
return list;
closing(query.getResultStream().map(id -> resourceStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id.getId()))).forEach(consumer);
}
@Override
@ -173,7 +142,7 @@ public class JPAResourceStore implements ResourceStore {
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
for (String id : result) {
Resource resource = resourceStore.findById(resourceServer, id);
Resource resource = resourceStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id);
if (resource != null) {
list.add(resource);
@ -184,7 +153,7 @@ public class JPAResourceStore implements ResourceStore {
}
@Override
public List<Resource> findByResourceServer(ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
public List<Resource> find(RealmModel realm, ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
CriteriaBuilder builder = entityManager.getCriteriaBuilder();
CriteriaQuery<ResourceEntity> querybuilder = builder.createQuery(ResourceEntity.class);
Root<ResourceEntity> root = querybuilder.from(ResourceEntity.class);
@ -237,7 +206,7 @@ public class JPAResourceStore implements ResourceStore {
ResourceStore resourceStore = provider.getStoreFactory().getResourceStore();
for (String id : result) {
Resource resource = resourceStore.findById(resourceServer, id);
Resource resource = resourceStore.findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id);
if (resource != null) {
list.add(resource);

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -35,7 +34,9 @@ import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.jpa.entities.ScopeEntity;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.ScopeStore;
import org.keycloak.models.RealmModel;
import org.keycloak.models.utils.KeycloakModelUtils;
import javax.persistence.LockModeType;
@ -79,7 +80,7 @@ public class JPAScopeStore implements ScopeStore {
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
ScopeEntity scope = entityManager.find(ScopeEntity.class, id, LockModeType.PESSIMISTIC_WRITE);
if (scope != null) {
@ -88,7 +89,7 @@ public class JPAScopeStore implements ScopeStore {
}
@Override
public Scope findById(ResourceServer resourceServer, String id) {
public Scope findById(RealmModel realm, ResourceServer resourceServer, String id) {
if (id == null) {
return null;
}
@ -109,7 +110,7 @@ public class JPAScopeStore implements ScopeStore {
query.setParameter("name", name);
String id = query.getSingleResult();
return provider.getStoreFactory().getScopeStore().findById(resourceServer, id);
return provider.getStoreFactory().getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id);
} catch (NoResultException nre) {
return null;
}
@ -125,7 +126,7 @@ public class JPAScopeStore implements ScopeStore {
List<String> result = query.getResultList();
List<Scope> list = new LinkedList<>();
for (String id : result) {
list.add(provider.getStoreFactory().getScopeStore().findById(resourceServer, id));
list.add(provider.getStoreFactory().getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, id));
}
return list;
}
@ -160,7 +161,7 @@ public class JPAScopeStore implements ScopeStore {
List result = paginateQuery(query, firstResult, maxResults).getResultList();
List<Scope> list = new LinkedList<>();
for (Object id : result) {
list.add(provider.getStoreFactory().getScopeStore().findById(resourceServer, (String)id));
list.add(provider.getStoreFactory().getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, (String)id));
}
return list;

View file

@ -1,5 +1,5 @@
/*
* Copyright 2017 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -28,6 +28,7 @@ import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.jpa.JpaModel;
@ -90,7 +91,7 @@ public class PermissionTicketAdapter implements PermissionTicket, JpaModel<Permi
@Override
public ResourceServer getResourceServer() {
return storeFactory.getResourceServerStore().findById(null, entity.getResourceServer().getId());
return storeFactory.getResourceServerStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, entity.getResourceServer().getId());
}
@Override
@ -101,8 +102,8 @@ public class PermissionTicketAdapter implements PermissionTicket, JpaModel<Permi
return null;
}
ResourceServer resourceServer = storeFactory.getResourceServerStore().findById(null, entity.getResourceServer().getId());
return storeFactory.getPolicyStore().findById(resourceServer, policy.getId());
ResourceServer resourceServer = storeFactory.getResourceServerStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, entity.getResourceServer().getId());
return storeFactory.getPolicyStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, policy.getId());
}
@Override
@ -114,7 +115,7 @@ public class PermissionTicketAdapter implements PermissionTicket, JpaModel<Permi
@Override
public Resource getResource() {
return storeFactory.getResourceStore().findById(getResourceServer(), entity.getResource().getId());
return storeFactory.getResourceStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, getResourceServer(), entity.getResource().getId());
}
@Override
@ -125,7 +126,7 @@ public class PermissionTicketAdapter implements PermissionTicket, JpaModel<Permi
return null;
}
return storeFactory.getScopeStore().findById(getResourceServer(), scope.getId());
return storeFactory.getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, getResourceServer(), scope.getId());
}
@Override

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -24,6 +24,7 @@ import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.jpa.JpaModel;
import org.keycloak.representations.idm.authorization.DecisionStrategy;
@ -153,7 +154,7 @@ public class PolicyAdapter extends AbstractAuthorizationModel implements Policy,
@Override
public ResourceServer getResourceServer() {
return storeFactory.getResourceServerStore().findById(null, entity.getResourceServer().getId());
return storeFactory.getResourceServerStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, entity.getResourceServer().getId());
}
@Override
@ -170,7 +171,7 @@ public class PolicyAdapter extends AbstractAuthorizationModel implements Policy,
Set<Resource> set = new HashSet<>();
ResourceServer resourceServer = getResourceServer();
for (ResourceEntity res : entity.getResources()) {
set.add(storeFactory.getResourceStore().findById(resourceServer, res.getId()));
set.add(storeFactory.getResourceStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, res.getId()));
}
return Collections.unmodifiableSet(set);
}
@ -180,7 +181,7 @@ public class PolicyAdapter extends AbstractAuthorizationModel implements Policy,
Set<Scope> set = new HashSet<>();
ResourceServer resourceServer = getResourceServer();
for (ScopeEntity res : entity.getScopes()) {
set.add(storeFactory.getScopeStore().findById(resourceServer, res.getId()));
set.add(storeFactory.getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, res.getId()));
}
return Collections.unmodifiableSet(set);
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -23,6 +23,7 @@ import org.keycloak.authorization.model.AbstractAuthorizationModel;
import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.common.util.MultivaluedHashMap;
import org.keycloak.models.jpa.JpaModel;
@ -118,7 +119,7 @@ public class ResourceAdapter extends AbstractAuthorizationModel implements Resou
List<Scope> scopes = new LinkedList<>();
ResourceServer resourceServer = getResourceServer();
for (ScopeEntity scope : entity.getScopes()) {
scopes.add(storeFactory.getScopeStore().findById(resourceServer, scope.getId()));
scopes.add(storeFactory.getScopeStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, resourceServer, scope.getId()));
}
return Collections.unmodifiableList(scopes);
@ -138,7 +139,7 @@ public class ResourceAdapter extends AbstractAuthorizationModel implements Resou
@Override
public ResourceServer getResourceServer() {
return storeFactory.getResourceServerStore().findById(null, entity.getResourceServer());
return storeFactory.getResourceServerStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, entity.getResourceServer());
}
@Override

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -20,6 +20,7 @@ import org.keycloak.authorization.jpa.entities.ScopeEntity;
import org.keycloak.authorization.model.AbstractAuthorizationModel;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.jpa.JpaModel;
@ -88,7 +89,7 @@ public class ScopeAdapter extends AbstractAuthorizationModel implements Scope, J
@Override
public ResourceServer getResourceServer() {
return storeFactory.getResourceServerStore().findById(null, entity.getResourceServer().getId());
return storeFactory.getResourceServerStore().findById(JPAAuthorizationStoreFactory.NULL_REALM, entity.getResourceServer().getId());
}
public static ScopeEntity toEntity(EntityManager em, Scope scope) {

View file

@ -1,5 +1,5 @@
/*
* Copyright 2021 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -60,26 +60,20 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
private static final Logger LOG = Logger.getLogger(MapPermissionTicketStore.class);
private final AuthorizationProvider authorizationProvider;
final MapKeycloakTransaction<MapPermissionTicketEntity, PermissionTicket> tx;
private final KeycloakSession session;
public MapPermissionTicketStore(KeycloakSession session, MapStorage<MapPermissionTicketEntity, PermissionTicket> permissionTicketStore, AuthorizationProvider provider) {
this.authorizationProvider = provider;
this.tx = permissionTicketStore.createTransaction(session);
session.getTransactionManager().enlist(tx);
this.session = session;
}
private Function<MapPermissionTicketEntity, PermissionTicket> entityToAdapterFunc(ResourceServer resourceServer) {
return origEntity -> new MapPermissionTicketAdapter(resourceServer == null ? findResourceServer(origEntity) : resourceServer, origEntity, authorizationProvider.getStoreFactory());
private Function<MapPermissionTicketEntity, PermissionTicket> entityToAdapterFunc(RealmModel realm, ResourceServer resourceServer) {
return origEntity -> new MapPermissionTicketAdapter(realm, resourceServer, origEntity, authorizationProvider.getStoreFactory());
}
private ResourceServer findResourceServer(MapPermissionTicketEntity entity) {
RealmModel realm = session.realms().getRealm(entity.getRealmId());
return authorizationProvider.getStoreFactory().getResourceServerStore().findById(realm, entity.getResourceServerId());
}
private DefaultModelCriteria<PermissionTicket> forResourceServer(ResourceServer resourceServer) {
DefaultModelCriteria<PermissionTicket> mcb = criteria();
private DefaultModelCriteria<PermissionTicket> forRealmAndResourceServer(RealmModel realm, ResourceServer resourceServer) {
final DefaultModelCriteria<PermissionTicket> mcb = DefaultModelCriteria.<PermissionTicket>criteria()
.compare(PermissionTicket.SearchableFields.REALM_ID, Operator.EQ, realm.getId());
return resourceServer == null
? mcb
@ -89,7 +83,7 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
@Override
public long count(ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes) {
DefaultModelCriteria<PermissionTicket> mcb = forResourceServer(resourceServer).and(
DefaultModelCriteria<PermissionTicket> mcb = forRealmAndResourceServer(resourceServer.getRealm(), resourceServer).and(
attributes.entrySet().stream()
.map(this::filterEntryToDefaultModelCriteria)
.toArray(DefaultModelCriteria[]::new)
@ -101,11 +95,13 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
@Override
public PermissionTicket create(ResourceServer resourceServer, Resource resource, Scope scope, String requester) {
LOG.tracef("create(%s, %s, %s, %s)%s", resource, scope, requester, resourceServer, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
String owner = authorizationProvider.getStoreFactory().getResourceStore().findById(realm, resourceServer, resource.getId()).getOwner();
String owner = authorizationProvider.getStoreFactory().getResourceStore().findById(resourceServer, resource.getId()).getOwner();
// @UniqueConstraint(columnNames = {"OWNER", "REQUESTER", "RESOURCE_SERVER_ID", "RESOURCE_ID", "SCOPE_ID"})
DefaultModelCriteria<PermissionTicket> mcb = forResourceServer(resourceServer)
DefaultModelCriteria<PermissionTicket> mcb = forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.OWNER, Operator.EQ, owner)
.compare(SearchableFields.RESOURCE_ID, Operator.EQ, resource.getId())
.compare(SearchableFields.REQUESTER, Operator.EQ, requester);
@ -130,18 +126,18 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
entity.setOwner(owner);
entity.setResourceServerId(resourceServer.getId());
entity.setRealmId(resourceServer.getRealm().getId());
entity.setRealmId(realm.getId());
entity = tx.create(entity);
return entity == null ? null : entityToAdapterFunc(resourceServer).apply(entity);
return entity == null ? null : entityToAdapterFunc(realm, resourceServer).apply(entity);
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
LOG.tracef("delete(%s)%s", id, getShortStackTrace());
PermissionTicket permissionTicket = findById((ResourceServer) null, id);
PermissionTicket permissionTicket = findById(realm, null, id);
if (permissionTicket == null) return;
tx.delete(id);
@ -149,42 +145,25 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
}
@Override
public PermissionTicket findById(ResourceServer resourceServer, String id) {
public PermissionTicket findById(RealmModel realm, ResourceServer resourceServer, String id) {
LOG.tracef("findById(%s, %s)%s", id, resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.ID, Operator.EQ, id)))
.findFirst()
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.orElse(null);
}
@Override
public List<PermissionTicket> findByResourceServer(ResourceServer resourceServer) {
LOG.tracef("findByResourceServer(%s)%s", resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)))
.map(entityToAdapterFunc(resourceServer))
.collect(Collectors.toList());
}
@Override
public List<PermissionTicket> findByOwner(ResourceServer resourceServer, String owner) {
LOG.tracef("findByOwner(%s, %s)%s", owner, resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)
.compare(SearchableFields.OWNER, Operator.EQ, owner)))
.map(entityToAdapterFunc(resourceServer))
.collect(Collectors.toList());
}
@Override
public List<PermissionTicket> findByResource(ResourceServer resourceServer, Resource resource) {
LOG.tracef("findByResource(%s, %s)%s", resource, resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.RESOURCE_ID, Operator.EQ, resource.getId())))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@ -192,15 +171,17 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
public List<PermissionTicket> findByScope(ResourceServer resourceServer, Scope scope) {
LOG.tracef("findByScope(%s, %s)%s", scope, resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.SCOPE_ID, Operator.EQ, scope.getId())))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@Override
public List<PermissionTicket> find(ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResult) {
DefaultModelCriteria<PermissionTicket> mcb = forResourceServer(resourceServer);
public List<PermissionTicket> find(RealmModel realm, ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResult) {
DefaultModelCriteria<PermissionTicket> mcb = forRealmAndResourceServer(realm, resourceServer);
if (attributes.containsKey(PermissionTicket.FilterOption.RESOURCE_NAME)) {
String expectedResourceName = attributes.remove(PermissionTicket.FilterOption.RESOURCE_NAME);
@ -209,7 +190,7 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
filterOptionStringMap.put(Resource.FilterOption.EXACT_NAME, new String[]{expectedResourceName});
List<Resource> r = authorizationProvider.getStoreFactory().getResourceStore().findByResourceServer(resourceServer, filterOptionStringMap, null, null);
List<Resource> r = authorizationProvider.getStoreFactory().getResourceStore().find(realm, resourceServer, filterOptionStringMap, null, null);
if (r == null || r.isEmpty()) {
return Collections.emptyList();
}
@ -223,7 +204,7 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
);
return tx.read(withCriteria(mcb).pagination(firstResult, maxResult, SearchableFields.ID))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@ -264,7 +245,7 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
filters.put(PermissionTicket.FilterOption.REQUESTER, userId);
return find(resourceServer, filters, null, null);
return find(resourceServer.getRealm(), resourceServer, filters, null, null);
}
@Override
@ -275,7 +256,7 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
filters.put(PermissionTicket.FilterOption.REQUESTER, userId);
return find(resourceServer, filters, null, null);
return find(resourceServer.getRealm(), resourceServer, filters, null, null);
}
@Override
@ -296,13 +277,13 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
filterOptionMap.put(Resource.FilterOption.ID, new String[] {ticket.getResourceId()});
filterOptionMap.put(Resource.FilterOption.NAME, new String[] {name});
List<Resource> resource = resourceStore.findByResourceServer(resourceServerStore.findById(realm, ticket.getResourceServerId()), filterOptionMap, -1, 1);
List<Resource> resource = resourceStore.find(realm, resourceServerStore.findById(realm, ticket.getResourceServerId()), filterOptionMap, -1, 1);
return resource.isEmpty() ? null : resource.get(0);
};
} else {
ticketResourceMapper = ticket -> resourceStore
.findById(resourceServerStore.findById(realm, ticket.getResourceServerId()), ticket.getResourceId());
.findById(realm, resourceServerStore.findById(realm, ticket.getResourceServerId()), ticket.getResourceId());
}
return paginatedStream(tx.read(withCriteria(mcb).orderBy(SearchableFields.RESOURCE_ID, ASCENDING))
@ -323,7 +304,7 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
return paginatedStream(tx.read(withCriteria(mcb).orderBy(SearchableFields.RESOURCE_ID, ASCENDING))
.filter(distinctByKey(MapPermissionTicketEntity::getResourceId)), firstResult, maxResults)
.map(ticket -> resourceStore.findById(resourceServerStore.findById(realm, ticket.getResourceServerId()), ticket.getResourceId()))
.map(ticket -> resourceStore.findById(realm, resourceServerStore.findById(realm, ticket.getResourceServerId()), ticket.getResourceId()))
.collect(Collectors.toList());
}
@ -339,6 +320,6 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
public void preRemove(ResourceServer resourceServer) {
LOG.tracef("preRemove(%s)%s", resourceServer, getShortStackTrace());
tx.delete(withCriteria(forResourceServer(resourceServer)));
tx.delete(withCriteria(forRealmAndResourceServer(resourceServer.getRealm(), resourceServer)));
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2021 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -54,26 +54,20 @@ public class MapPolicyStore implements PolicyStore {
private static final Logger LOG = Logger.getLogger(MapPolicyStore.class);
private final AuthorizationProvider authorizationProvider;
final MapKeycloakTransaction<MapPolicyEntity, Policy> tx;
private final KeycloakSession session;
public MapPolicyStore(KeycloakSession session, MapStorage<MapPolicyEntity, Policy> policyStore, AuthorizationProvider provider) {
this.authorizationProvider = provider;
this.tx = policyStore.createTransaction(session);
session.getTransactionManager().enlist(tx);
this.session = session;
}
private Function<MapPolicyEntity, Policy> entityToAdapterFunc(ResourceServer resourceServer) {
return origEntity -> new MapPolicyAdapter(resourceServer == null ? findResourceServer(origEntity) : resourceServer, origEntity, authorizationProvider.getStoreFactory());
private Function<MapPolicyEntity, Policy> entityToAdapterFunc(RealmModel realm, ResourceServer resourceServer) {
return origEntity -> new MapPolicyAdapter(realm, resourceServer, origEntity, authorizationProvider.getStoreFactory());
}
private ResourceServer findResourceServer(MapPolicyEntity entity) {
RealmModel realm = session.realms().getRealm(entity.getRealmId());
return authorizationProvider.getStoreFactory().getResourceServerStore().findById(realm, entity.getResourceServerId());
}
private DefaultModelCriteria<Policy> forResourceServer(ResourceServer resourceServer) {
DefaultModelCriteria<Policy> mcb = criteria();
private DefaultModelCriteria<Policy> forRealmAndResourceServer(RealmModel realm, ResourceServer resourceServer) {
DefaultModelCriteria<Policy> mcb = DefaultModelCriteria.<Policy>criteria()
.compare(Policy.SearchableFields.REALM_ID, Operator.EQ, realm.getId());
return resourceServer == null
? mcb
@ -84,9 +78,10 @@ public class MapPolicyStore implements PolicyStore {
@Override
public Policy create(ResourceServer resourceServer, AbstractPolicyRepresentation representation) {
LOG.tracef("create(%s, %s, %s)%s", representation.getId(), resourceServer.getId(), resourceServer, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
// @UniqueConstraint(columnNames = {"NAME", "RESOURCE_SERVER_ID"})
DefaultModelCriteria<Policy> mcb = forResourceServer(resourceServer)
DefaultModelCriteria<Policy> mcb = forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.NAME, Operator.EQ, representation.getName());
if (tx.getCount(withCriteria(mcb)) > 0) {
@ -103,51 +98,57 @@ public class MapPolicyStore implements PolicyStore {
entity = tx.create(entity);
return entity == null ? null : entityToAdapterFunc(resourceServer).apply(entity);
return entity == null ? null : entityToAdapterFunc(realm, resourceServer).apply(entity);
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
LOG.tracef("delete(%s)%s", id, getShortStackTrace());
Policy policyEntity = findById(realm, null, id);
if (policyEntity == null) return;
tx.delete(id);
}
@Override
public Policy findById(ResourceServer resourceServer, String id) {
public Policy findById(RealmModel realm, ResourceServer resourceServer, String id) {
LOG.tracef("findById(%s, %s)%s", id, resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.ID, Operator.EQ, id)))
.findFirst()
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.orElse(null);
}
@Override
public Policy findByName(ResourceServer resourceServer, String name) {
LOG.tracef("findByName(%s, %s)%s", name, resourceServer, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forResourceServer(resourceServer)
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.NAME, Operator.EQ, name)))
.findFirst()
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.orElse(null);
}
@Override
public List<Policy> findByResourceServer(ResourceServer resourceServer) {
LOG.tracef("findByResourceServer(%s)%s", resourceServer, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forResourceServer(resourceServer)))
.map(entityToAdapterFunc(resourceServer))
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@Override
public List<Policy> findByResourceServer(ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
public List<Policy> find(RealmModel realm, ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
LOG.tracef("findByResourceServer(%s, %s, %d, %d)%s", attributes, resourceServer, firstResult, maxResults, getShortStackTrace());
DefaultModelCriteria<Policy> mcb = forResourceServer(resourceServer).and(
DefaultModelCriteria<Policy> mcb = forRealmAndResourceServer(realm, resourceServer).and(
attributes.entrySet().stream()
.map(this::filterEntryToDefaultModelCriteria)
.filter(Objects::nonNull)
@ -161,7 +162,7 @@ public class MapPolicyStore implements PolicyStore {
return tx.read(withCriteria(mcb).pagination(firstResult, maxResults, SearchableFields.NAME))
.map(MapPolicyEntity::getId)
// We need to go through cache
.map(id -> authorizationProvider.getStoreFactory().getPolicyStore().findById(resourceServer, id))
.map(id -> authorizationProvider.getStoreFactory().getPolicyStore().findById(realm, resourceServer, id))
.collect(Collectors.toList());
}
@ -206,32 +207,40 @@ public class MapPolicyStore implements PolicyStore {
@Override
public void findByResource(ResourceServer resourceServer, Resource resource, Consumer<Policy> consumer) {
LOG.tracef("findByResource(%s, %s, %s)%s", resourceServer, resource, consumer, getShortStackTrace());
tx.read(withCriteria(forResourceServer(resourceServer)
RealmModel realm = resourceServer.getRealm();
tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.RESOURCE_ID, Operator.EQ, resource.getId())))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.forEach(consumer);
}
@Override
public void findByResourceType(ResourceServer resourceServer, String type, Consumer<Policy> policyConsumer) {
tx.read(withCriteria(forResourceServer(resourceServer)
LOG.tracef("findByResourceType(%s, %s)%s", resourceServer, type, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.CONFIG, Operator.LIKE, (Object[]) new String[]{"defaultResourceType", type})))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.forEach(policyConsumer);
}
@Override
public List<Policy> findByScopes(ResourceServer resourceServer, List<Scope> scopes) {
return tx.read(withCriteria(forResourceServer(resourceServer)
LOG.tracef("findByScopes(%s, %s)%s", resourceServer, scopes, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.SCOPE_ID, Operator.IN, scopes.stream().map(Scope::getId))))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@Override
public void findByScopes(ResourceServer resourceServer, Resource resource, List<Scope> scopes, Consumer<Policy> consumer) {
DefaultModelCriteria<Policy> mcb = forResourceServer(resourceServer)
LOG.tracef("findByResourceType(%s, %s, %s)%s", resourceServer, resource, scopes, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
DefaultModelCriteria<Policy> mcb = forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.TYPE, Operator.EQ, "scope")
.compare(SearchableFields.SCOPE_ID, Operator.IN, scopes.stream().map(Scope::getId));
@ -243,22 +252,26 @@ public class MapPolicyStore implements PolicyStore {
.compare(SearchableFields.CONFIG, Operator.NOT_EXISTS, (Object[]) new String[] {"defaultResourceType"});
}
tx.read(withCriteria(mcb)).map(entityToAdapterFunc(resourceServer)).forEach(consumer);
tx.read(withCriteria(mcb)).map(entityToAdapterFunc(realm, resourceServer)).forEach(consumer);
}
@Override
public List<Policy> findByType(ResourceServer resourceServer, String type) {
return tx.read(withCriteria(forResourceServer(resourceServer)
LOG.tracef("findByType(%s, %s)%s", resourceServer, type, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.TYPE, Operator.EQ, type)))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@Override
public List<Policy> findDependentPolicies(ResourceServer resourceServer, String id) {
return tx.read(withCriteria(forResourceServer(resourceServer)
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.ASSOCIATED_POLICY_ID, Operator.EQ, id)))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@ -274,6 +287,6 @@ public class MapPolicyStore implements PolicyStore {
public void preRemove(ResourceServer resourceServer) {
LOG.tracef("preRemove(%s)%s", resourceServer, getShortStackTrace());
tx.delete(withCriteria(forResourceServer(resourceServer)));
tx.delete(withCriteria(forRealmAndResourceServer(resourceServer.getRealm(), resourceServer)));
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2021 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -36,7 +36,6 @@ import org.keycloak.models.map.storage.ModelCriteriaBuilder.Operator;
import org.keycloak.models.map.storage.criteria.DefaultModelCriteria;
import java.util.Arrays;
import java.util.LinkedList;
import java.util.List;
import java.util.Map;
import java.util.Set;
@ -62,17 +61,13 @@ public class MapResourceStore implements ResourceStore {
this.session = session;
}
private Function<MapResourceEntity, Resource> entityToAdapterFunc(final ResourceServer resourceServer) {
return origEntity -> new MapResourceAdapter(resourceServer == null ? findResourceServer(origEntity) : resourceServer, origEntity, authorizationProvider.getStoreFactory());
private Function<MapResourceEntity, Resource> entityToAdapterFunc(RealmModel realm, final ResourceServer resourceServer) {
return origEntity -> new MapResourceAdapter(realm, resourceServer, origEntity, authorizationProvider.getStoreFactory());
}
private ResourceServer findResourceServer(MapResourceEntity entity) {
RealmModel realm = session.realms().getRealm(entity.getRealmId());
return authorizationProvider.getStoreFactory().getResourceServerStore().findById(realm, entity.getResourceServerId());
}
private DefaultModelCriteria<Resource> forResourceServer(ResourceServer resourceServer) {
DefaultModelCriteria<Resource> mcb = criteria();
private DefaultModelCriteria<Resource> forRealmAndResourceServer(RealmModel realm, ResourceServer resourceServer) {
DefaultModelCriteria<Resource> mcb = DefaultModelCriteria.<Resource>criteria()
.compare(Resource.SearchableFields.REALM_ID, Operator.EQ, realm.getId());
return resourceServer == null
? mcb
@ -84,7 +79,9 @@ public class MapResourceStore implements ResourceStore {
public Resource create(ResourceServer resourceServer, String id, String name, String owner) {
LOG.tracef("create(%s, %s, %s, %s)%s", id, name, resourceServer, owner, getShortStackTrace());
// @UniqueConstraint(columnNames = {"NAME", "RESOURCE_SERVER_ID", "OWNER"})
DefaultModelCriteria<Resource> mcb = forResourceServer(resourceServer)
RealmModel realm = resourceServer.getRealm();
DefaultModelCriteria<Resource> mcb = forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.NAME, Operator.EQ, name)
.compare(SearchableFields.OWNER, Operator.EQ, owner);
@ -97,84 +94,64 @@ public class MapResourceStore implements ResourceStore {
entity.setName(name);
entity.setResourceServerId(resourceServer.getId());
entity.setOwner(owner);
entity.setRealmId(resourceServer.getRealm().getId());
entity.setRealmId(realm.getId());
entity = tx.create(entity);
return entity == null ? null : entityToAdapterFunc(resourceServer).apply(entity);
return entity == null ? null : entityToAdapterFunc(realm, resourceServer).apply(entity);
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
LOG.tracef("delete(%s)%s", id, getShortStackTrace());
Resource resource = findById(realm, null, id);
if (resource == null) return;
tx.delete(id);
}
@Override
public Resource findById(ResourceServer resourceServer, String id) {
public Resource findById(RealmModel realm, ResourceServer resourceServer, String id) {
LOG.tracef("findById(%s, %s)%s", id, resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.ID, Operator.EQ, id)))
.findFirst()
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.orElse(null);
}
@Override
public void findByOwner(ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
findByOwnerFilter(ownerId, resourceServer, consumer, -1, -1);
}
public void findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
LOG.tracef("findByOwner(%s, %s, %s)%s", realm, resourceServer, resourceServer, ownerId, getShortStackTrace());
private void findByOwnerFilter(String ownerId, ResourceServer resourceServer, Consumer<Resource> consumer, int firstResult, int maxResult) {
LOG.tracef("findByOwnerFilter(%s, %s, %s, %d, %d)%s", ownerId, resourceServer, consumer, firstResult, maxResult, getShortStackTrace());
tx.read(withCriteria(forResourceServer(resourceServer).compare(SearchableFields.OWNER, Operator.EQ, ownerId))
.pagination(firstResult, maxResult, SearchableFields.ID)
).map(entityToAdapterFunc(resourceServer))
tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.OWNER, Operator.EQ, ownerId)))
.map(entityToAdapterFunc(realm, resourceServer))
.forEach(consumer);
}
@Override
public List<Resource> findByOwner(ResourceServer resourceServer, String ownerId, Integer firstResult, Integer maxResults) {
List<Resource> resourceList = new LinkedList<>();
findByOwnerFilter(ownerId, resourceServer, resourceList::add, firstResult, maxResults);
return resourceList;
}
@Override
public List<Resource> findByUri(ResourceServer resourceServer, String uri) {
LOG.tracef("findByUri(%s, %s)%s", uri, resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)
.compare(SearchableFields.URI, Operator.EQ, uri)))
.map(entityToAdapterFunc(resourceServer))
.collect(Collectors.toList());
}
@Override
public List<Resource> findByResourceServer(ResourceServer resourceServer) {
LOG.tracef("findByResourceServer(%s)%s", resourceServer, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forResourceServer(resourceServer)))
.map(entityToAdapterFunc(resourceServer))
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@Override
public List<Resource> findByResourceServer(ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
LOG.tracef("findByResourceServer(%s, %s, %d, %d)%s", attributes, resourceServer, firstResult, maxResults, getShortStackTrace());
DefaultModelCriteria<Resource> mcb = forResourceServer(resourceServer).and(
public List<Resource> find(RealmModel realm, ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
LOG.tracef("findByResourceServer(%s, %s, %s, %d, %d)%s", realm, resourceServer, attributes, firstResult, maxResults, getShortStackTrace());
DefaultModelCriteria<Resource> mcb = forRealmAndResourceServer(realm, resourceServer).and(
attributes.entrySet().stream()
.map(this::filterEntryToDefaultModelCriteria)
.toArray(DefaultModelCriteria[]::new)
);
return tx.read(withCriteria(mcb).pagination(firstResult, maxResults, SearchableFields.NAME))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@ -208,38 +185,44 @@ public class MapResourceStore implements ResourceStore {
@Override
public void findByScopes(ResourceServer resourceServer, Set<Scope> scopes, Consumer<Resource> consumer) {
LOG.tracef("findByScope(%s, %s, %s)%s", scopes, resourceServer, consumer, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
tx.read(withCriteria(forResourceServer(resourceServer)
tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.SCOPE_ID, Operator.IN, scopes.stream().map(Scope::getId))))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.forEach(consumer);
}
@Override
public Resource findByName(ResourceServer resourceServer, String name, String ownerId) {
LOG.tracef("findByName(%s, %s, %s)%s", name, ownerId, resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.OWNER, Operator.EQ, ownerId)
.compare(SearchableFields.NAME, Operator.EQ, name)))
.findFirst()
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.orElse(null);
}
@Override
public void findByType(ResourceServer resourceServer, String type, Consumer<Resource> consumer) {
LOG.tracef("findByType(%s, %s, %s)%s", type, resourceServer, consumer, getShortStackTrace());
tx.read(withCriteria(forResourceServer(resourceServer)
RealmModel realm = authorizationProvider.getRealm();
tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.TYPE, Operator.EQ, type)))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.forEach(consumer);
}
@Override
public void findByType(ResourceServer resourceServer, String type, String owner, Consumer<Resource> consumer) {
LOG.tracef("findByType(%s, %s, %s, %s)%s", type, owner, resourceServer, consumer, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
DefaultModelCriteria<Resource> mcb = forResourceServer(resourceServer)
DefaultModelCriteria<Resource> mcb = forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.TYPE, Operator.EQ, type);
if (owner != null) {
@ -247,17 +230,18 @@ public class MapResourceStore implements ResourceStore {
}
tx.read(withCriteria(mcb))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.forEach(consumer);
}
@Override
public void findByTypeInstance(ResourceServer resourceServer, String type, Consumer<Resource> consumer) {
LOG.tracef("findByTypeInstance(%s, %s, %s)%s", type, resourceServer, consumer, getShortStackTrace());
tx.read(withCriteria(forResourceServer(resourceServer)
RealmModel realm = resourceServer.getRealm();
tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.OWNER, Operator.NE, resourceServer.getClientId())
.compare(SearchableFields.TYPE, Operator.EQ, type)))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.forEach(consumer);
}
@ -273,6 +257,6 @@ public class MapResourceStore implements ResourceStore {
public void preRemove(ResourceServer resourceServer) {
LOG.tracef("preRemove(%s)%s", resourceServer, getShortStackTrace());
tx.delete(withCriteria(forResourceServer(resourceServer)));
tx.delete(withCriteria(forRealmAndResourceServer(resourceServer.getRealm(), resourceServer)));
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2021 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -58,17 +58,13 @@ public class MapScopeStore implements ScopeStore {
this.session = session;
}
private Function<MapScopeEntity, Scope> entityToAdapterFunc(ResourceServer resourceServer) {
return origEntity -> new MapScopeAdapter(resourceServer == null ? findResourceServer(origEntity) : resourceServer, origEntity, authorizationProvider.getStoreFactory());
private Function<MapScopeEntity, Scope> entityToAdapterFunc(RealmModel realm, ResourceServer resourceServer) {
return origEntity -> new MapScopeAdapter(realm, resourceServer, origEntity, authorizationProvider.getStoreFactory());
}
private ResourceServer findResourceServer(MapScopeEntity entity) {
RealmModel realm = session.realms().getRealm(entity.getRealmId());
return authorizationProvider.getStoreFactory().getResourceServerStore().findById(realm, entity.getResourceServerId());
}
private DefaultModelCriteria<Scope> forResourceServer(ResourceServer resourceServer) {
DefaultModelCriteria<Scope> mcb = criteria();
private DefaultModelCriteria<Scope> forRealmAndResourceServer(RealmModel realm, ResourceServer resourceServer) {
DefaultModelCriteria<Scope> mcb = DefaultModelCriteria.<Scope>criteria()
.compare(Scope.SearchableFields.REALM_ID, Operator.EQ, realm.getId());
return resourceServer == null
? mcb
@ -80,9 +76,9 @@ public class MapScopeStore implements ScopeStore {
public Scope create(ResourceServer resourceServer, String id, String name) {
LOG.tracef("create(%s, %s, %s)%s", id, name, resourceServer, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
// @UniqueConstraint(columnNames = {"NAME", "RESOURCE_SERVER_ID"})
DefaultModelCriteria<Scope> mcb = forResourceServer(resourceServer)
DefaultModelCriteria<Scope> mcb = forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.NAME, Operator.EQ, name);
if (tx.getCount(withCriteria(mcb)) > 0) {
@ -97,49 +93,54 @@ public class MapScopeStore implements ScopeStore {
entity = tx.create(entity);
return entity == null ? null : entityToAdapterFunc(resourceServer).apply(entity);
return entity == null ? null : entityToAdapterFunc(realm, resourceServer).apply(entity);
}
@Override
public void delete(String id) {
public void delete(RealmModel realm, String id) {
LOG.tracef("delete(%s)%s", id, getShortStackTrace());
Scope scope = findById(realm, null, id);
if (scope == null) return;
tx.delete(id);
}
@Override
public Scope findById(ResourceServer resourceServer, String id) {
public Scope findById(RealmModel realm, ResourceServer resourceServer, String id) {
LOG.tracef("findById(%s, %s)%s", id, resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)
.compare(SearchableFields.ID, Operator.EQ, id)))
.findFirst()
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.orElse(null);
}
@Override
public Scope findByName(ResourceServer resourceServer, String name) {
LOG.tracef("findByName(%s, %s)%s", name, resourceServer, getShortStackTrace());
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forResourceServer(resourceServer).compare(SearchableFields.NAME,
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer).compare(SearchableFields.NAME,
Operator.EQ, name)))
.findFirst()
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.orElse(null);
}
@Override
public List<Scope> findByResourceServer(ResourceServer resourceServer) {
LOG.tracef("findByResourceServer(%s)%s", resourceServer, getShortStackTrace());
return tx.read(withCriteria(forResourceServer(resourceServer)))
.map(entityToAdapterFunc(resourceServer))
RealmModel realm = resourceServer.getRealm();
return tx.read(withCriteria(forRealmAndResourceServer(realm, resourceServer)))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@Override
public List<Scope> findByResourceServer(ResourceServer resourceServer, Map<Scope.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
DefaultModelCriteria<Scope> mcb = forResourceServer(resourceServer);
RealmModel realm = resourceServer.getRealm();
DefaultModelCriteria<Scope> mcb = forRealmAndResourceServer(realm, resourceServer);
for (Scope.FilterOption filterOption : attributes.keySet()) {
String[] value = attributes.get(filterOption);
@ -157,7 +158,7 @@ public class MapScopeStore implements ScopeStore {
}
return tx.read(withCriteria(mcb).pagination(firstResult, maxResults, SearchableFields.NAME))
.map(entityToAdapterFunc(resourceServer))
.map(entityToAdapterFunc(realm, resourceServer))
.collect(Collectors.toList());
}
@ -173,6 +174,6 @@ public class MapScopeStore implements ScopeStore {
public void preRemove(ResourceServer resourceServer) {
LOG.tracef("preRemove(%s)%s", resourceServer, getShortStackTrace());
tx.delete(withCriteria(forResourceServer(resourceServer)));
tx.delete(withCriteria(forRealmAndResourceServer(resourceServer.getRealm(), resourceServer)));
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2021 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -26,16 +26,21 @@ import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.map.authorization.entity.MapPermissionTicketEntity;
import static org.keycloak.authorization.UserManagedPermissionUtil.updatePolicy;
public class MapPermissionTicketAdapter extends AbstractPermissionTicketModel<MapPermissionTicketEntity> {
private final ResourceServer resourceServer;
private final RealmModel realm;
private ResourceServer resourceServer;
public MapPermissionTicketAdapter(ResourceServer resourceServer, MapPermissionTicketEntity entity, StoreFactory storeFactory) {
public MapPermissionTicketAdapter(RealmModel realm, ResourceServer resourceServer, MapPermissionTicketEntity entity, StoreFactory storeFactory) {
super(entity, storeFactory);
Objects.requireNonNull(resourceServer);
Objects.requireNonNull(realm, "realm");
this.realm = realm;
this.resourceServer = resourceServer;
}
@ -56,13 +61,13 @@ public class MapPermissionTicketAdapter extends AbstractPermissionTicketModel<Ma
@Override
public Resource getResource() {
return storeFactory.getResourceStore().findById(resourceServer, entity.getResourceId());
return storeFactory.getResourceStore().findById(realm, getResourceServer(), entity.getResourceId());
}
@Override
public Scope getScope() {
if (entity.getScopeId() == null) return null;
return storeFactory.getScopeStore().findById(resourceServer, entity.getScopeId());
return storeFactory.getScopeStore().findById(realm, getResourceServer(), entity.getScopeId());
}
@Override
@ -88,13 +93,16 @@ public class MapPermissionTicketAdapter extends AbstractPermissionTicketModel<Ma
@Override
public ResourceServer getResourceServer() {
if (resourceServer == null) {
resourceServer = storeFactory.getResourceServerStore().findById(realm, entity.getResourceServerId());
}
return resourceServer;
}
@Override
public Policy getPolicy() {
if (entity.getPolicyId() == null) return null;
return storeFactory.getPolicyStore().findById(resourceServer, entity.getPolicyId());
return storeFactory.getPolicyStore().findById(realm, getResourceServer(), entity.getPolicyId());
}
@Override

View file

@ -1,5 +1,5 @@
/*
* Copyright 2021 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -22,6 +22,7 @@ import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.map.authorization.entity.MapPolicyEntity;
import org.keycloak.representations.idm.authorization.DecisionStrategy;
import org.keycloak.representations.idm.authorization.Logic;
@ -34,11 +35,13 @@ import java.util.stream.Collectors;
public class MapPolicyAdapter extends AbstractPolicyModel<MapPolicyEntity> {
private final ResourceServer resourceServer;
private final RealmModel realm;
private ResourceServer resourceServer;
public MapPolicyAdapter(ResourceServer resourceServer, MapPolicyEntity entity, StoreFactory storeFactory) {
public MapPolicyAdapter(RealmModel realm, ResourceServer resourceServer, MapPolicyEntity entity, StoreFactory storeFactory) {
super(entity, storeFactory);
Objects.requireNonNull(resourceServer);
Objects.requireNonNull(realm);
this.realm = realm;
this.resourceServer = resourceServer;
}
@ -124,14 +127,18 @@ public class MapPolicyAdapter extends AbstractPolicyModel<MapPolicyEntity> {
@Override
public ResourceServer getResourceServer() {
if (resourceServer == null) {
resourceServer = storeFactory.getResourceServerStore().findById(realm, entity.getResourceServerId());
}
return resourceServer;
}
@Override
public Set<Policy> getAssociatedPolicies() {
Set<String> ids = entity.getAssociatedPolicyIds();
ResourceServer resourceServer = getResourceServer();
return ids == null ? Collections.emptySet() : ids.stream()
.map(policyId -> storeFactory.getPolicyStore().findById(resourceServer, policyId))
.map(policyId -> storeFactory.getPolicyStore().findById(realm, resourceServer, policyId))
.collect(Collectors.toSet());
}
@ -139,7 +146,7 @@ public class MapPolicyAdapter extends AbstractPolicyModel<MapPolicyEntity> {
public Set<Resource> getResources() {
Set<String> ids = entity.getResourceIds();
return ids == null ? Collections.emptySet() : ids.stream()
.map(resourceId -> storeFactory.getResourceStore().findById(resourceServer, resourceId))
.map(resourceId -> storeFactory.getResourceStore().findById(realm, getResourceServer(), resourceId))
.collect(Collectors.toSet());
}
@ -147,7 +154,7 @@ public class MapPolicyAdapter extends AbstractPolicyModel<MapPolicyEntity> {
public Set<Scope> getScopes() {
Set<String> ids = entity.getScopeIds();
return ids == null ? Collections.emptySet() : ids.stream()
.map(scopeId -> storeFactory.getScopeStore().findById(resourceServer, scopeId))
.map(scopeId -> storeFactory.getScopeStore().findById(realm, getResourceServer(), scopeId))
.collect(Collectors.toSet());
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2021 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -24,6 +24,7 @@ import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.map.authorization.entity.MapResourceEntity;
import java.util.Collections;
import java.util.HashMap;
@ -35,11 +36,13 @@ import java.util.stream.Collectors;
public class MapResourceAdapter extends AbstractResourceModel<MapResourceEntity> {
private final ResourceServer resourceServer;
private final RealmModel realm;
private ResourceServer resourceServer;
public MapResourceAdapter(ResourceServer resourceServer, MapResourceEntity entity, StoreFactory storeFactory) {
public MapResourceAdapter(RealmModel realm, ResourceServer resourceServer, MapResourceEntity entity, StoreFactory storeFactory) {
super(entity, storeFactory);
Objects.requireNonNull(resourceServer);
Objects.requireNonNull(realm);
this.realm = realm;
this.resourceServer = resourceServer;
}
@ -99,7 +102,7 @@ public class MapResourceAdapter extends AbstractResourceModel<MapResourceEntity>
ResourceServer resourceServer = getResourceServer();
return ids == null ? Collections.emptyList() : ids.stream()
.map(id -> storeFactory
.getScopeStore().findById(resourceServer, id))
.getScopeStore().findById(realm, resourceServer, id))
.collect(Collectors.toList());
}
@ -116,6 +119,9 @@ public class MapResourceAdapter extends AbstractResourceModel<MapResourceEntity>
@Override
public ResourceServer getResourceServer() {
if (resourceServer == null) {
resourceServer = storeFactory.getResourceServerStore().findById(realm, entity.getResourceServerId());
}
return resourceServer;
}
@ -148,13 +154,13 @@ public class MapResourceAdapter extends AbstractResourceModel<MapResourceEntity>
// The scope^ was removed from the Resource
// Remove permission tickets based on the scope
List<PermissionTicket> permissions = permissionStore.findByScope(resourceServer, scope);
List<PermissionTicket> permissions = permissionStore.findByScope(getResourceServer(), scope);
for (PermissionTicket permission : permissions) {
permissionStore.delete(permission.getId());
permissionStore.delete(realm, permission.getId());
}
// Remove the scope from each Policy for this Resource
policyStore.findByResource(resourceServer, this, policy -> policy.removeScope(scope));
policyStore.findByResource(getResourceServer(), this, policy -> policy.removeScope(scope));
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2021 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -21,15 +21,18 @@ package org.keycloak.models.map.authorization.adapter;
import java.util.Objects;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.map.authorization.entity.MapScopeEntity;
public class MapScopeAdapter extends AbstractScopeModel<MapScopeEntity> {
private final ResourceServer resourceServer;
private final RealmModel realm;
private ResourceServer resourceServer;
public MapScopeAdapter(ResourceServer resourceServer, MapScopeEntity entity, StoreFactory storeFactory) {
public MapScopeAdapter(RealmModel realm, ResourceServer resourceServer, MapScopeEntity entity, StoreFactory storeFactory) {
super(entity, storeFactory);
Objects.requireNonNull(resourceServer);
Objects.requireNonNull(realm);
this.realm = realm;
this.resourceServer = resourceServer;
}
@ -73,6 +76,9 @@ public class MapScopeAdapter extends AbstractScopeModel<MapScopeEntity> {
@Override
public ResourceServer getResourceServer() {
if (resourceServer == null) {
resourceServer = storeFactory.getResourceServerStore().findById(realm, entity.getResourceServerId());
}
return resourceServer;
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2020 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -686,7 +686,7 @@ public class MapUserProvider implements UserProvider.Streams, UserCredentialStor
authorizedGroups.removeIf(id -> {
Map<Resource.FilterOption, String[]> values = new EnumMap<>(Resource.FilterOption.class);
values.put(Resource.FilterOption.EXACT_NAME, new String[] {"group.resource." + id});
return resourceStore.findByResourceServer(null, values, 0, 1).isEmpty();
return resourceStore.find(realm, null, values, 0, 1).isEmpty();
});
criteria = criteria.compare(SearchableFields.ASSIGNED_GROUP, Operator.IN, authorizedGroups);

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -251,21 +250,21 @@ public final class AuthorizationProvider implements Provider {
}
@Override
public void delete(String id) {
Scope scope = findById(null, id);
public void delete(RealmModel realm, String id) {
Scope scope = findById(realm, null, id);
PermissionTicketStore ticketStore = AuthorizationProvider.this.getStoreFactory().getPermissionTicketStore();
List<PermissionTicket> permissions = ticketStore.findByScope(scope.getResourceServer(), scope);
for (PermissionTicket permission : permissions) {
ticketStore.delete(permission.getId());
ticketStore.delete(realm, permission.getId());
}
delegate.delete(id);
delegate.delete(realm, id);
}
@Override
public Scope findById(ResourceServer resourceServer, String id) {
return delegate.findById(resourceServer, id);
public Scope findById(RealmModel realm, ResourceServer resourceServer, String id) {
return delegate.findById(realm, resourceServer, id);
}
@Override
@ -293,10 +292,11 @@ public final class AuthorizationProvider implements Provider {
@Override
public Policy create(ResourceServer resourceServer, AbstractPolicyRepresentation representation) {
Set<String> resources = representation.getResources();
RealmModel realm = resourceServer.getRealm();
if (resources != null) {
representation.setResources(resources.stream().map(id -> {
Resource resource = storeFactory.getResourceStore().findById(resourceServer, id);
Resource resource = storeFactory.getResourceStore().findById(realm, resourceServer, id);
if (resource == null) {
resource = storeFactory.getResourceStore().findByName(resourceServer, id);
@ -314,7 +314,7 @@ public final class AuthorizationProvider implements Provider {
if (scopes != null) {
representation.setScopes(scopes.stream().map(id -> {
Scope scope = storeFactory.getScopeStore().findById(resourceServer, id);
Scope scope = storeFactory.getScopeStore().findById(realm, resourceServer, id);
if (scope == null) {
scope = storeFactory.getScopeStore().findByName(resourceServer, id);
@ -333,7 +333,7 @@ public final class AuthorizationProvider implements Provider {
if (policies != null) {
representation.setPolicies(policies.stream().map(id -> {
Policy policy = storeFactory.getPolicyStore().findById(resourceServer, id);
Policy policy = storeFactory.getPolicyStore().findById(realm, resourceServer, id);
if (policy == null) {
policy = storeFactory.getPolicyStore().findByName(resourceServer, id);
@ -351,8 +351,8 @@ public final class AuthorizationProvider implements Provider {
}
@Override
public void delete(String id) {
Policy policy = findById(null, id);
public void delete(RealmModel realm, String id) {
Policy policy = findById(realm, null, id);
if (policy != null) {
ResourceServer resourceServer = policy.getResourceServer();
@ -363,7 +363,7 @@ public final class AuthorizationProvider implements Provider {
// only remove associated policies created from the policy being deleted
if (associatedPolicy.getOwner() != null) {
policy.removeAssociatedPolicy(associatedPolicy);
policyStore.delete(associatedPolicy.getId());
policyStore.delete(realm, associatedPolicy.getId());
}
}
}
@ -371,17 +371,17 @@ public final class AuthorizationProvider implements Provider {
findDependentPolicies(resourceServer, policy.getId()).forEach(dependentPolicy -> {
dependentPolicy.removeAssociatedPolicy(policy);
if (dependentPolicy.getAssociatedPolicies().isEmpty()) {
delete(dependentPolicy.getId());
delete(realm, dependentPolicy.getId());
}
});
policyStore.delete(id);
policyStore.delete(realm, id);
}
}
@Override
public Policy findById(ResourceServer resourceServer, String id) {
return policyStore.findById(resourceServer, id);
public Policy findById(RealmModel realm, ResourceServer resourceServer, String id) {
return policyStore.findById(realm, resourceServer, id);
}
@Override
@ -395,8 +395,8 @@ public final class AuthorizationProvider implements Provider {
}
@Override
public List<Policy> findByResourceServer(ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return policyStore.findByResourceServer(resourceServer, attributes, firstResult, maxResults);
public List<Policy> find(RealmModel realm, ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return policyStore.find(realm, resourceServer, attributes, firstResult, maxResults);
}
@Override
@ -461,14 +461,14 @@ public final class AuthorizationProvider implements Provider {
}
@Override
public void delete(String id) {
Resource resource = findById(null, id);
public void delete(RealmModel realm, String id) {
Resource resource = findById(realm, null, id);
StoreFactory storeFactory = AuthorizationProvider.this.getStoreFactory();
PermissionTicketStore ticketStore = storeFactory.getPermissionTicketStore();
List<PermissionTicket> permissions = ticketStore.findByResource(resource.getResourceServer(), resource);
for (PermissionTicket permission : permissions) {
ticketStore.delete(permission.getId());
ticketStore.delete(realm, permission.getId());
}
PolicyStore policyStore = storeFactory.getPolicyStore();
@ -476,38 +476,28 @@ public final class AuthorizationProvider implements Provider {
for (Policy policyModel : policies) {
if (policyModel.getResources().size() == 1) {
policyStore.delete(policyModel.getId());
policyStore.delete(realm, policyModel.getId());
} else {
policyModel.removeResource(resource);
}
}
delegate.delete(id);
delegate.delete(realm, id);
}
@Override
public Resource findById(ResourceServer resourceServer, String id) {
return delegate.findById(resourceServer, id);
public Resource findById(RealmModel realm, ResourceServer resourceServer, String id) {
return delegate.findById(realm, resourceServer, id);
}
@Override
public List<Resource> findByOwner(ResourceServer resourceServer, String ownerId) {
return delegate.findByOwner(resourceServer, ownerId);
public List<Resource> findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId) {
return delegate.findByOwner(realm, resourceServer, ownerId);
}
@Override
public void findByOwner(ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
delegate.findByOwner(resourceServer, ownerId, consumer);
}
@Override
public List<Resource> findByOwner(ResourceServer resourceServer, String ownerId, Integer firstResult, Integer maxResults) {
return delegate.findByOwner(resourceServer, ownerId, firstResult, maxResults);
}
@Override
public List<Resource> findByUri(ResourceServer resourceServer, String uri) {
return delegate.findByUri(resourceServer, uri);
public void findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer) {
delegate.findByOwner(realm, resourceServer, ownerId, consumer);
}
@Override
@ -516,8 +506,8 @@ public final class AuthorizationProvider implements Provider {
}
@Override
public List<Resource> findByResourceServer(ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return delegate.findByResourceServer(resourceServer, attributes, firstResult, maxResults);
public List<Resource> find(RealmModel realm, ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults) {
return delegate.find(realm, resourceServer, attributes, firstResult, maxResults);
}
@Override
@ -550,16 +540,6 @@ public final class AuthorizationProvider implements Provider {
delegate.findByType(resourceServer, type, owner, consumer);
}
@Override
public List<Resource> findByType(ResourceServer resourceServer, String type, String owner) {
return delegate.findByType(resourceServer, type);
}
@Override
public List<Resource> findByTypeInstance(ResourceServer resourceServer, String type) {
return delegate.findByTypeInstance(resourceServer, type);
}
@Override
public void findByTypeInstance(ResourceServer resourceServer, String type, Consumer<Resource> consumer) {
delegate.findByTypeInstance(resourceServer, type, consumer);

View file

@ -1,5 +1,5 @@
/*
* Copyright 2018 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -22,9 +22,11 @@ import java.util.Map;
import org.keycloak.authorization.model.PermissionTicket;
import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.utils.KeycloakModelUtils;
import org.keycloak.representations.idm.authorization.PolicyRepresentation;
import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
@ -37,6 +39,7 @@ public class UserManagedPermissionUtil {
public static void updatePolicy(PermissionTicket ticket, StoreFactory storeFactory) {
Scope scope = ticket.getScope();
Policy policy = ticket.getPolicy();
ResourceServer resourceServer = ticket.getResourceServer();
if (policy == null) {
Map<PermissionTicket.FilterOption, String> filter = new EnumMap<>(PermissionTicket.FilterOption.class);
@ -46,7 +49,7 @@ public class UserManagedPermissionUtil {
filter.put(PermissionTicket.FilterOption.RESOURCE_ID, ticket.getResource().getId());
filter.put(PermissionTicket.FilterOption.POLICY_IS_NOT_NULL, Boolean.TRUE.toString());
List<PermissionTicket> tickets = storeFactory.getPermissionTicketStore().find(ticket.getResourceServer(), filter, null, null);
List<PermissionTicket> tickets = storeFactory.getPermissionTicketStore().find(resourceServer.getRealm(), resourceServer, filter, null, null);
if (!tickets.isEmpty()) {
policy = tickets.iterator().next().getPolicy();
@ -71,6 +74,7 @@ public class UserManagedPermissionUtil {
public static void removePolicy(PermissionTicket ticket, StoreFactory storeFactory) {
Policy policy = ticket.getPolicy();
RealmModel realm = ticket.getResourceServer().getRealm();
if (policy != null) {
Map<PermissionTicket.FilterOption, String> filter = new EnumMap<>(PermissionTicket.FilterOption.class);
@ -80,16 +84,16 @@ public class UserManagedPermissionUtil {
filter.put(PermissionTicket.FilterOption.RESOURCE_ID, ticket.getResource().getId());
filter.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
List<PermissionTicket> tickets = storeFactory.getPermissionTicketStore().find(ticket.getResourceServer(), filter, null, null);
List<PermissionTicket> tickets = storeFactory.getPermissionTicketStore().find(realm, ticket.getResourceServer(), filter, null, null);
if (tickets.isEmpty()) {
PolicyStore policyStore = storeFactory.getPolicyStore();
for (Policy associatedPolicy : policy.getAssociatedPolicies()) {
policyStore.delete(associatedPolicy.getId());
policyStore.delete(realm, associatedPolicy.getId());
}
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
} else if (ticket.getScope() != null) {
policy.removeScope(ticket.getScope());
}

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -74,7 +73,7 @@ public final class Permissions {
}
// obtain all resources where owner is the resource server
resourceStore.findByOwner(resourceServer, resourceServer.getClientId(), resource -> {
resourceStore.findByOwner(resourceServer.getRealm(), resourceServer, resourceServer.getClientId(), resource -> {
if (limit.decrementAndGet() >= 0) {
evaluator.accept(createResourcePermissions(resource, resourceServer, resource.getScopes(), authorization, request));
}
@ -83,7 +82,7 @@ public final class Permissions {
// resource server isn't current user
if (!Objects.equals(resourceServer.getClientId(), identity.getId())) {
// obtain all resources where owner is the current user
resourceStore.findByOwner(resourceServer, identity.getId(), resource -> {
resourceStore.findByOwner(resourceServer.getRealm(), resourceServer, identity.getId(), resource -> {
if (limit.decrementAndGet() >= 0) {
evaluator.accept(createResourcePermissions(resource, resourceServer, resource.getScopes(), authorization, request));
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2017 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -32,6 +32,7 @@ import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.authorization.store.ScopeStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.representations.idm.authorization.AuthorizationRequest;
import org.keycloak.representations.idm.authorization.Permission;
import org.keycloak.representations.idm.authorization.PermissionTicketToken;
@ -90,10 +91,11 @@ public class PermissionTicketAwareDecisionResultCollector extends DecisionPermis
StoreFactory storeFactory = authorization.getStoreFactory();
ResourceStore resourceStore = storeFactory.getResourceStore();
List<Permission> permissions = ticket.getPermissions();
RealmModel realm = resourceServer.getRealm();
if (permissions != null) {
for (Permission permission : permissions) {
Resource resource = resourceStore.findById(resourceServer, permission.getResourceId());
Resource resource = resourceStore.findById(realm, resourceServer, permission.getResourceId());
if (resource == null) {
resource = resourceStore.findByName(resourceServer, permission.getResourceId(), identity.getId());
@ -116,7 +118,7 @@ public class PermissionTicketAwareDecisionResultCollector extends DecisionPermis
filters.put(PermissionTicket.FilterOption.REQUESTER, identity.getId());
filters.put(PermissionTicket.FilterOption.SCOPE_IS_NULL, Boolean.TRUE.toString());
List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(resource.getResourceServer(), filters, null, null);
List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(realm, resourceServer, filters, null, null);
if (tickets.isEmpty()) {
authorization.getStoreFactory().getPermissionTicketStore().create(resourceServer, resource, null, identity.getId());
@ -128,7 +130,7 @@ public class PermissionTicketAwareDecisionResultCollector extends DecisionPermis
Scope scope = scopeStore.findByName(resourceServer, scopeId);
if (scope == null) {
scope = scopeStore.findById(resourceServer, scopeId);
scope = scopeStore.findById(realm, resourceServer, scopeId);
}
Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
@ -137,7 +139,7 @@ public class PermissionTicketAwareDecisionResultCollector extends DecisionPermis
filters.put(PermissionTicket.FilterOption.REQUESTER, identity.getId());
filters.put(PermissionTicket.FilterOption.SCOPE_ID, scope.getId());
List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(resource.getResourceServer(), filters, null, null);
List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(realm, resourceServer, filters, null, null);
if (tickets.isEmpty()) {
authorization.getStoreFactory().getPermissionTicketStore().create(resourceServer, resource, scope, identity.getId());

View file

@ -1,5 +1,5 @@
/*
* Copyright 2017 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -36,7 +36,8 @@ public interface PermissionTicketStore {
/**
* Returns count of {@link PermissionTicket}, filtered by the given attributes.
*
* @param resourceServer the resource server
*
* @param resourceServer the resource server. Cannot be {@code null}.
* @param attributes permission tickets that do not match the attributes are not included with the count; possible filter options are given by {@link PermissionTicket.FilterOption}
* @return an integer indicating the amount of permission tickets
* @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map
@ -46,10 +47,10 @@ public interface PermissionTicketStore {
/**
* Creates a new {@link PermissionTicket} instance.
*
* @param resourceServer the resource server to which this policy belongs
* @param resource resource id
* @param scope scope id
* @param requester the policy representation
* @param resourceServer the resource server to which this permission ticket belongs. Cannot be {@code null}.
* @param resource resource. Cannot be {@code null}.
* @param scope scope. Cannot be {@code null}
* @param requester requester of the permission
* @return a new instance of {@link PermissionTicket}
*/
PermissionTicket create(ResourceServer resourceServer, Resource resource, Scope scope, String requester);
@ -57,61 +58,48 @@ public interface PermissionTicketStore {
/**
* Deletes a permission from the underlying persistence mechanism.
*
* @param realm realm. Cannot be {@code null}.
* @param id the id of the policy to delete
*/
void delete(String id);
void delete(RealmModel realm, String id);
/**
* Returns a {@link PermissionTicket} with the given <code>id</code>
*
* @param resourceServer the resource server
*
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the resource server. Ignored if {@code null}.
* @param id the identifier of the permission
* @return a permission with the given identifier.
*/
PermissionTicket findById(ResourceServer resourceServer, String id);
/**
* Returns a list of {@link PermissionTicket} associated with a {@link ResourceServer}.
*
* @param resourceServer the resource server
* @return a list of permissions belonging to the given resource server
*/
List<PermissionTicket> findByResourceServer(ResourceServer resourceServer);
/**
* Returns a list of {@link PermissionTicket} associated with the given <code>owner</code>.
*
* @param resourceServer the resource server
* @param owner the identifier of a resource server
* @return a list of permissions belonging to the given owner
*/
List<PermissionTicket> findByOwner(ResourceServer resourceServer, String owner);
PermissionTicket findById(RealmModel realm, ResourceServer resourceServer, String id);
/**
* Returns a list of {@link PermissionTicket} associated with the {@link org.keycloak.authorization.model.Resource resource}.
*
* @param resourceServer the resource server
* @param resource the resource
* @param resourceServer the resource server. Cannot be {@code null}.
* @param resource the resource. Cannot be {@code null}
* @return a list of permissions associated with the given resource
* TODO: maybe we can get rid of reosourceServer param here as resource has method getResourceServer()
*/
List<PermissionTicket> findByResource(ResourceServer resourceServer, Resource resource);
/**
* Returns a list of {@link PermissionTicket} associated with the {@link org.keycloak.authorization.model.Scope scope}.
*
* @param resourceServer the resource server
* @param scope the scope
* @return a list of permissions associated with the given scopes
*
* TODO: maybe we can get rid of reosourceServer param here as resource has method getResourceServer()
* @param resourceServer the resource server. Cannot be {@code null}.
* @param scope the scope. Cannot be {@code null}.
* @return a list of permissions associated with the given scopes
*/
List<PermissionTicket> findByScope(ResourceServer resourceServer, Scope scope);
/**
* Returns a list of {@link PermissionTicket}, filtered by the given attributes.
*
* @param resourceServer a resource server that resulting tickets should belong to. Ignored if {@code null}
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer a resource server that resulting tickets should belong to. Ignored if {@code null}.
* @param attributes a map of keys and values to filter on; possible filter options are given by {@link PermissionTicket.FilterOption}
* @param firstResult first result to return. Ignored if negative or {@code null}.
* @param maxResults maximum number of results to return. Ignored if negative or {@code null}.
@ -120,12 +108,12 @@ public interface PermissionTicketStore {
* @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map
*
*/
List<PermissionTicket> find(ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResults);
List<PermissionTicket> find(RealmModel realm, ResourceServer resourceServer, Map<PermissionTicket.FilterOption, String> attributes, Integer firstResult, Integer maxResults);
/**
* Returns a list of {@link PermissionTicket} granted to the given {@code userId}.
*
* @param resourceServer the resource server
* @param resourceServer the resource server. Cannot be {@code null}
* @param userId the user id
* @return a list of permissions granted for a particular user
*/
@ -134,7 +122,7 @@ public interface PermissionTicketStore {
/**
* Returns a list of {@link PermissionTicket} with name equal to {@code resourceName} granted to the given {@code userId}.
*
* @param resourceServer the resource server
* @param resourceServer the resource server. Cannot be {@code null}.
* @param resourceName the name of a resource
* @param userId the user id
* @return a list of permissions granted for a particular user
@ -147,7 +135,7 @@ public interface PermissionTicketStore {
* Returns a list of {@link Resource} granted to the given {@code requester}
*
*
* @param realm
* @param realm realm that is searched. Cannot be {@code null}
* @param requester the requester
* @param name the keyword to query resources by name or null if any resource
* @param firstResult first result to return. Ignored if negative or {@code null}.

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -27,6 +26,7 @@ import org.keycloak.authorization.model.Policy;
import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.models.RealmModel;
import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
/**
@ -40,7 +40,7 @@ public interface PolicyStore {
* Creates a new {@link Policy} instance. The new instance is not necessarily persisted though, which may require
* a call to the {#save} method to actually make it persistent.
*
* @param resourceServer the resource server to which this policy belongs
* @param resourceServer the resource server to which this policy belongs. Cannot be {@code null}.
* @param representation the policy representation
* @return a new instance of {@link Policy}
*/
@ -49,32 +49,35 @@ public interface PolicyStore {
/**
* Deletes a policy from the underlying persistence mechanism.
*
* @param realm the realm that the removed policy belongs to. Cannot be {@code null}
* @param id the id of the policy to delete
*/
void delete(String id);
void delete(RealmModel realm, String id);
/**
* Returns a {@link Policy} with the given <code>id</code>
*
* @param resourceServer the resource server
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the resource server. Ignored if {@code null}.
* @param id the identifier of the policy
* @return a policy with the given identifier.
*/
Policy findById(ResourceServer resourceServer, String id);
Policy findById(RealmModel realm, ResourceServer resourceServer, String id);
/**
* Returns a {@link Policy} with the given <code>name</code>
*
* @param resourceServer the resource server
* @param resourceServer the resource server. Cannot be {@code null}
* @param name the name of the policy
* @return a policy with the given name.
* @return a policy with the given name or {@code null} if no such policy exists.
*/
Policy findByName(ResourceServer resourceServer, String name);
/**
* Returns a list of {@link Policy} associated with a {@link ResourceServer} with the given <code>resourceServerId</code>.
* Returns a list of {@link Policy} associated with the {@link ResourceServer}
*
* @param resourceServer the identifier of a resource server
* @param resourceServer the resource server. Cannot be {@code null}.
* @return a list of policies that belong to the given resource server
*/
List<Policy> findByResourceServer(ResourceServer resourceServer);
@ -82,7 +85,9 @@ public interface PolicyStore {
/**
* Returns a list of {@link Policy} associated with a {@link ResourceServer} with the given <code>resourceServerId</code>.
*
* @param resourceServer the identifier of a resource server
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the identifier of a resource server. Ignored if {@code null}.
* @param attributes a map holding the attributes that will be used as a filter; possible filter options are given by {@link Policy.FilterOption}
* @param firstResult first result to return. Ignored if negative or {@code null}.
* @param maxResults maximum number of results to return. Ignored if negative or {@code null}.
@ -90,13 +95,13 @@ public interface PolicyStore {
*
* @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map
*/
List<Policy> findByResourceServer(ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults);
List<Policy> find(RealmModel realm, ResourceServer resourceServer, Map<Policy.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults);
/**
* Returns a list of {@link Policy} associated with a {@link org.keycloak.authorization.model.Resource} with the given <code>resourceId</code>.
* Returns a list of {@link Policy} associated with a {@link org.keycloak.authorization.model.Resource}
*
* @param resourceServer the resource server
* @param resource the resource
* @param resourceServer the resource server. Cannot be {@code null}.
* @param resource the resource. Cannot be {@code null}.
* @return a list of policies associated with the given resource
*/
default List<Policy> findByResource(ResourceServer resourceServer, Resource resource) {
@ -110,8 +115,8 @@ public interface PolicyStore {
/**
* Searches for all policies associated with the {@link org.keycloak.authorization.model.Resource} and passes the result to the {@code consumer}
*
* @param resourceServer the resourceServer
* @param resource the resource
* @param resourceServer the resourceServer. Cannot be {@code null}.
* @param resource the resource. Cannot be {@code null}.
* @param consumer consumer of policies resulted from the search
*/
void findByResource(ResourceServer resourceServer, Resource resource, Consumer<Policy> consumer);
@ -119,7 +124,7 @@ public interface PolicyStore {
/**
* Returns a list of {@link Policy} associated with a {@link org.keycloak.authorization.model.ResourceServer} with the given <code>type</code>.
*
* @param resourceServer the resource server id
* @param resourceServer the resource server id. Cannot be {@code null}.
* @param resourceType the type of a resource
* @return a list of policies associated with the given resource type
*/
@ -134,7 +139,7 @@ public interface PolicyStore {
/**
* Searches for policies associated with a {@link org.keycloak.authorization.model.ResourceServer} and passes the result to the consumer
*
* @param resourceServer the resourceServer
* @param resourceServer the resourceServer. Cannot be {@code null}.
* @param type the type of a resource
* @param policyConsumer consumer of policies resulted from the search
*/
@ -143,7 +148,7 @@ public interface PolicyStore {
/**
* Returns a list of {@link Policy} associated with a {@link org.keycloak.authorization.model.Scope} within the given <code>scope</code>.
*
* @param resourceServer the resource server
* @param resourceServer the resource server. Cannot be {@code null}.
* @param scopes the scopes
* @return a list of policies associated with the given scopes
*/
@ -152,7 +157,7 @@ public interface PolicyStore {
/**
* Returns a list of {@link Policy} associated with a {@link org.keycloak.authorization.model.Scope} with the given <code>resource</code> and <code>scopes</code>.
*
* @param resourceServer the resource server
* @param resourceServer the resource server. Cannot be {@code null}.
* @param resource the resource. Ignored if {@code null}.
* @param scopes the scopes
* @return a list of policies associated with the given scopes
@ -175,7 +180,7 @@ public interface PolicyStore {
/**
* Returns a list of {@link Policy} with the given <code>type</code>.
*
* @param resourceServer the resource server id
* @param resourceServer the resource server id. Cannot be {@code null}.
* @param type the type of the policy
* @return a list of policies with the given type
*/

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -32,7 +31,7 @@ public interface ResourceServerStore {
/**
* <p>Creates a {@link ResourceServer} instance backed by this persistent storage implementation.
*
* @param client the client acting as a resource server
* @param client the client acting as a resource server. Cannot be {@code null}.
*
* @return an instance backed by the underlying storage implementation
*/
@ -41,7 +40,7 @@ public interface ResourceServerStore {
/**
* Removes a {@link ResourceServer} instance, with the given client from the persistent storage.
*
* @param client the client acting as a resource server
* @param client the client acting as a resource server. Cannot be {@code null}.
*/
void delete(ClientModel client);
@ -49,7 +48,7 @@ public interface ResourceServerStore {
* Returns a {@link ResourceServer} instance based on its identifier.
*
*
* @param realm
* @param realm the realm. Cannot be {@code null}.
* @param id the identifier of an existing resource server instance
*
* @return the resource server instance with the given identifier or null if no instance was found
@ -59,7 +58,7 @@ public interface ResourceServerStore {
/**
* Returns a {@link ResourceServer} instance based on a client.
*
* @param client the client acting as a resource server
* @param client the client acting as a resource server. Cannot be {@code null}.
*
* @return the resource server instance or null if no instance was found
*/

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -20,6 +19,7 @@ package org.keycloak.authorization.store;
import org.keycloak.authorization.model.Resource;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.models.RealmModel;
import java.util.ArrayList;
import java.util.LinkedList;
@ -38,7 +38,7 @@ public interface ResourceStore {
/**
* <p>Creates a {@link Resource} instance backed by this persistent storage implementation.
*
* @param resourceServer the resource server to where the given resource belongs to
* @param resourceServer the resource server to where the given resource belongs to. Cannot be {@code null}.
* @param name the name of this resource. It must be unique.
* @param owner the owner of this resource or null if the resource server is the owner
* @return an instance backed by the underlying storage implementation
@ -50,7 +50,7 @@ public interface ResourceStore {
/**
* <p>Creates a {@link Resource} instance backed by this persistent storage implementation.
*
* @param resourceServer the resource server to where the given resource belongs to
* @param resourceServer the resource server to where the given resource belongs to. Cannot be {@code null}.
* @param id the id of this resource. It must be unique. Will be randomly generated if null.
* @param name the name of this resource. It must be unique.
* @param owner the owner of this resource or null if the resource server is the owner
@ -61,53 +61,45 @@ public interface ResourceStore {
/**
* Removes a {@link Resource} instance, with the given {@code id} from the persistent storage.
*
* @param realm the realm. Cannot be {@code null}.
* @param id the identifier of an existing resource instance
*/
void delete(String id);
void delete(RealmModel realm, String id);
/**
* Returns a {@link Resource} instance based on its identifier.
*
* @param resourceServer the resource server
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the resource server. Ignored if {@code null}
* @param id the identifier of an existing resource instance
* @return the resource instance with the given identifier or null if no instance was found
*/
Resource findById(ResourceServer resourceServer, String id);
Resource findById(RealmModel realm, ResourceServer resourceServer, String id);
/**
* Finds all {@link Resource} instances with the given {@code ownerId}.
*
*
* @param resourceServer
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer resource server. Ignored if {@code null}
* @param ownerId the identifier of the owner
* @return a list with all resource instances owned by the given owner
*/
default List<Resource> findByOwner(ResourceServer resourceServer, String ownerId) {
default List<Resource> findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId) {
List<Resource> list = new LinkedList<>();
findByOwner(resourceServer, ownerId, list::add);
findByOwner(realm, resourceServer, ownerId, list::add);
return list;
}
void findByOwner(ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer);
List<Resource> findByOwner(ResourceServer resourceServer, String ownerId, Integer firstResult, Integer maxResults);
/**
* Finds all {@link Resource} instances with the given uri.
*
*
* @param resourceServer
* @param uri the identifier of the uri
* @return a list with all resource instances owned by the given owner
*/
List<Resource> findByUri(ResourceServer resourceServer, String uri);
void findByOwner(RealmModel realm, ResourceServer resourceServer, String ownerId, Consumer<Resource> consumer);
/**
* Finds all {@link Resource} instances associated with a given resource server.
*
* @param resourceServer the identifier of the resource server
* @param resourceServer the identifier of the resource server. Cannot be {@code null}.
* @return a list with all resources associated with the given resource server
*/
List<Resource> findByResourceServer(ResourceServer resourceServer);
@ -115,7 +107,9 @@ public interface ResourceStore {
/**
* Finds all {@link Resource} instances associated with a given resource server.
*
* @param resourceServer the identifier of the resource server
*
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the identifier of the resource server. Ignored if {@code null}.
* @param attributes a map holding the attributes that will be used as a filter; possible filter options are given by {@link Resource.FilterOption}
* @param firstResult first result to return. Ignored if negative or {@code null}.
* @param maxResults maximum number of results to return. Ignored if negative or {@code null}.
@ -123,13 +117,13 @@ public interface ResourceStore {
*
* @throws IllegalArgumentException when there is an unknown attribute in the {@code attributes} map
*/
List<Resource> findByResourceServer(ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults);
List<Resource> find(RealmModel realm, ResourceServer resourceServer, Map<Resource.FilterOption, String[]> attributes, Integer firstResult, Integer maxResults);
/**
* Finds all {@link Resource} associated with a given scope.
*
*
* @param resourceServer
* @param resourceServer the resource server. Cannot be {@code null}.
* @param scopes one or more scope identifiers
* @return a list of resources associated with the given scope(s)
*/
@ -140,13 +134,12 @@ public interface ResourceStore {
return result;
}
void findByScopes(ResourceServer resourceServer, Set<Scope> scopes, Consumer<Resource> consumer);
/**
* Find a {@link Resource} by its name where the owner is the resource server itself.
*
* @param resourceServer the resource server
* @param resourceServer the resource server. Cannot be {@code null}.
* @param name the name of the resource
* @return a resource with the given name
*/
@ -157,7 +150,7 @@ public interface ResourceStore {
/**
* Find a {@link Resource} by its name where the owner is the given <code>ownerId</code>.
*
* @param resourceServer the identifier of the resource server
* @param resourceServer the identifier of the resource server. Cannot be {@code null}.
* @param name the name of the resource
* @param ownerId the owner id
* @return a resource with the given name
@ -165,10 +158,10 @@ public interface ResourceStore {
Resource findByName(ResourceServer resourceServer, String name, String ownerId);
/**
* Finds all {@link Resource} with the given type.
* Finds all {@link Resource} from {@link ResourceServer} with the given type.
*
*
* @param resourceServer
* @param resourceServer the resource server. Cannot be {@code null}.
* @param type the type of the resource
* @return a list of resources with the given type
*/
@ -181,26 +174,9 @@ public interface ResourceStore {
}
/**
* Finds all {@link Resource} with the given type.
* Finds all {@link Resource} from {@link ResourceServer} with the given type.
*
*
* @param resourceServer
* @param type the type of the resource
* @param owner the resource owner or null for any resource with a given type
* @return a list of resources with the given type
*/
default List<Resource> findByType(ResourceServer resourceServer, String type, String owner) {
List<Resource> list = new LinkedList<>();
findByType(resourceServer, type, owner, list::add);
return list;
}
/**
* Finds all {@link Resource} with the given type.
*
* @param resourceServer the resource server id
* @param resourceServer the resource server id. Cannot be {@code null}.
* @param type the type of the resource
* @param consumer the result consumer
* @return a list of resources with the given type
@ -210,7 +186,7 @@ public interface ResourceStore {
/**
* Finds all {@link Resource} with the given type.
*
* @param resourceServer the resource server id
* @param resourceServer the resource server id. Cannot be {@code null}
* @param type the type of the resource
* @param owner the resource owner or null for any resource with a given type
* @param consumer the result consumer
@ -218,13 +194,12 @@ public interface ResourceStore {
*/
void findByType(ResourceServer resourceServer, String type, String owner, Consumer<Resource> consumer);
default List<Resource> findByTypeInstance(ResourceServer resourceServer, String type) {
List<Resource> list = new LinkedList<>();
findByTypeInstance(resourceServer, type, list::add);
return list;
}
void findByTypeInstance(ResourceServer resourceServerId, String type, Consumer<Resource> consumer);
/**
* Finds all {@link Resource} by type where client represented by the {@code resourceServer} is not the owner
*
* @param resourceServer the resourceServer. Cannot be {@code null}.
* @param type searched type
* @param consumer a consumer that will be fed with the resulting resources
*/
void findByTypeInstance(ResourceServer resourceServer, String type, Consumer<Resource> consumer);
}

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -20,6 +19,7 @@ package org.keycloak.authorization.store;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.authorization.model.Scope;
import org.keycloak.models.RealmModel;
import java.util.List;
import java.util.Map;
@ -35,8 +35,7 @@ public interface ScopeStore {
* Creates a new {@link Scope} instance. The new instance is not necessarily persisted though, which may require
* a call to the {#save} method to actually make it persistent.
*
* @param resourceServer the resource server to which this scope belongs
*
* @param resourceServer the resource server to which this scope belongs. Cannot be {@code null}.
* @param name the name of the scope
* @return a new instance of {@link Scope}
*/
@ -48,8 +47,7 @@ public interface ScopeStore {
* Creates a new {@link Scope} instance. The new instance is not necessarily persisted though, which may require
* a call to the {#save} method to actually make it persistent.
*
* @param resourceServer the resource server to which this scope belongs
*
* @param resourceServer the resource server to which this scope belongs. Cannot be {@code null}.
* @param id the id of the scope. Is generated randomly when null
* @param name the name of the scope
* @return a new instance of {@link Scope}
@ -59,23 +57,25 @@ public interface ScopeStore {
/**
* Deletes a scope from the underlying persistence mechanism.
*
* @param realm the realm. Cannot be {@code null}.
* @param id the id of the scope to delete
*/
void delete(String id);
void delete(RealmModel realm, String id);
/**
* Returns a {@link Scope} with the given <code>id</code>
*
* @param resourceServer the resource server id
* @param realm the realm. Cannot be {@code null}.
* @param resourceServer the resource server id. Ignored if {@code null}.
* @param id the identifier of the scope
* @return a scope with the given identifier.
*/
Scope findById(ResourceServer resourceServer, String id);
Scope findById(RealmModel realm, ResourceServer resourceServer, String id);
/**
* Returns a {@link Scope} with the given <code>name</code>
*
* @param resourceServer the resource server
* @param resourceServer the resource server. Cannot be {@code null}.
* @param name the name of the scope
*
* @return a scope with the given name.
@ -83,9 +83,9 @@ public interface ScopeStore {
Scope findByName(ResourceServer resourceServer, String name);
/**
* Returns a list of {@link Scope} associated with a {@link ResourceServer} with the given <code>resourceServer</code>.
* Returns a list of {@link Scope} associated with the {@link ResourceServer}.
*
* @param resourceServer the identifier of a resource server
* @param resourceServer the resource server. Cannot be {@code null}.
*
* @return a list of scopes that belong to the given resource server
*/
@ -94,7 +94,7 @@ public interface ScopeStore {
/**
* Returns a list of {@link Scope} associated with a {@link ResourceServer} with the given <code>resourceServerId</code>.
*
* @param resourceServer the resource server
* @param resourceServer the resource server. Cannot be {@code null}.
* @param attributes a map holding the attributes that will be used as a filter; possible filter options are given by {@link Scope.FilterOption}
* @param firstResult first result to return. Ignored if negative or {@code null}.
* @param maxResults maximum number of results to return. Ignored if negative or {@code null}.

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -31,6 +30,7 @@ import org.keycloak.authorization.store.ResourceServerStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.ClientModel.ClientRemovedEvent;
import org.keycloak.models.RealmModel;
import org.keycloak.provider.ProviderFactory;
import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
@ -51,6 +51,7 @@ public class ClientApplicationSynchronizer implements Synchronizer<ClientRemoved
StoreFactory storeFactory = authorizationProvider.getStoreFactory();
ResourceServerStore store = storeFactory.getResourceServerStore();
ResourceServer resourceServer = store.findByClient(event.getClient());
RealmModel realm = event.getClient().getRealm();
if (resourceServer != null) {
storeFactory.getResourceServerStore().delete(event.getClient());
@ -62,7 +63,7 @@ public class ClientApplicationSynchronizer implements Synchronizer<ClientRemoved
attributes.put(Policy.FilterOption.CONFIG, new String[] {"clients", event.getClient().getId()});
attributes.put(Policy.FilterOption.ANY_OWNER, Policy.FilterOption.EMPTY_FILTER);
List<Policy> search = storeFactory.getPolicyStore().findByResourceServer(null, attributes, null, null);
List<Policy> search = storeFactory.getPolicyStore().find(realm, null, attributes, null, null);
for (Policy policy : search) {
PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType());
@ -73,7 +74,7 @@ public class ClientApplicationSynchronizer implements Synchronizer<ClientRemoved
if (clients.isEmpty()) {
policyFactory.onRemove(policy, authorizationProvider);
authorizationProvider.getStoreFactory().getPolicyStore().delete(policy.getId());
authorizationProvider.getStoreFactory().getPolicyStore().delete(realm, policy.getId());
} else {
policyFactory.onUpdate(policy, representation, authorizationProvider);
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -29,6 +29,7 @@ import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.GroupModel;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.provider.ProviderFactory;
import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation;
@ -45,13 +46,14 @@ public class GroupSynchronizer implements Synchronizer<GroupModel.GroupRemovedEv
StoreFactory storeFactory = authorizationProvider.getStoreFactory();
PolicyStore policyStore = storeFactory.getPolicyStore();
GroupModel group = event.getGroup();
RealmModel realm = event.getRealm();
Map<Policy.FilterOption, String[]> attributes = new EnumMap<>(Policy.FilterOption.class);
attributes.put(Policy.FilterOption.TYPE, new String[] {"group"});
attributes.put(Policy.FilterOption.CONFIG, new String[] {"groups", group.getId()});
attributes.put(Policy.FilterOption.ANY_OWNER, Policy.FilterOption.EMPTY_FILTER);
List<Policy> search = policyStore.findByResourceServer(null, attributes, null, null);
List<Policy> search = policyStore.find(realm, null, attributes, null, null);
for (Policy policy : search) {
PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType());
@ -62,7 +64,7 @@ public class GroupSynchronizer implements Synchronizer<GroupModel.GroupRemovedEv
if (groups.isEmpty()) {
policyFactory.onRemove(policy, authorizationProvider);
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
} else {
policyFactory.onUpdate(policy, representation, authorizationProvider);
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -31,6 +31,7 @@ import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel;
import org.keycloak.models.UserModel.UserRemovedEvent;
import org.keycloak.provider.ProviderFactory;
@ -55,13 +56,14 @@ public class UserSynchronizer implements Synchronizer<UserRemovedEvent> {
StoreFactory storeFactory = authorizationProvider.getStoreFactory();
PolicyStore policyStore = storeFactory.getPolicyStore();
UserModel userModel = event.getUser();
RealmModel realm = event.getRealm();
Map<Policy.FilterOption, String[]> attributes = new EnumMap<>(Policy.FilterOption.class);
attributes.put(Policy.FilterOption.TYPE, new String[] {"user"});
attributes.put(Policy.FilterOption.CONFIG, new String[] {"users", userModel.getId()});
attributes.put(Policy.FilterOption.ANY_OWNER, new String[] {Boolean.TRUE.toString()});
List<Policy> search = policyStore.findByResourceServer(null, attributes, null, null);
List<Policy> search = policyStore.find(realm, null, attributes, null, null);
for (Policy policy : search) {
PolicyProviderFactory policyFactory = authorizationProvider.getProviderFactory(policy.getType());
@ -72,7 +74,7 @@ public class UserSynchronizer implements Synchronizer<UserRemovedEvent> {
if (users.isEmpty()) {
policyFactory.onRemove(policy, authorizationProvider);
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
} else {
policyFactory.onUpdate(policy, representation, authorizationProvider);
}
@ -84,17 +86,18 @@ public class UserSynchronizer implements Synchronizer<UserRemovedEvent> {
PolicyStore policyStore = storeFactory.getPolicyStore();
ResourceStore resourceStore = storeFactory.getResourceStore();
UserModel userModel = event.getUser();
RealmModel realm = event.getRealm();
resourceStore.findByOwner(null, userModel.getId(), resource -> {
resourceStore.findByOwner(realm, null, userModel.getId(), resource -> {
String resourceId = resource.getId();
policyStore.findByResource(resource.getResourceServer(), resource).forEach(policy -> {
if (policy.getResources().size() == 1) {
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
} else {
policy.removeResource(resource);
}
});
resourceStore.delete(resourceId);
resourceStore.delete(realm, resourceId);
});
}
@ -102,20 +105,21 @@ public class UserSynchronizer implements Synchronizer<UserRemovedEvent> {
StoreFactory storeFactory = authorizationProvider.getStoreFactory();
PermissionTicketStore ticketStore = storeFactory.getPermissionTicketStore();
UserModel userModel = event.getUser();
RealmModel realm = event.getRealm();
Map<PermissionTicket.FilterOption, String> attributes = new EnumMap<>(PermissionTicket.FilterOption.class);
attributes.put(PermissionTicket.FilterOption.OWNER, userModel.getId());
for (PermissionTicket ticket : ticketStore.find(null, attributes, null, null)) {
ticketStore.delete(ticket.getId());
for (PermissionTicket ticket : ticketStore.find(realm, null, attributes, null, null)) {
ticketStore.delete(realm, ticket.getId());
}
attributes.clear();
attributes.put(PermissionTicket.FilterOption.REQUESTER, userModel.getId());
for (PermissionTicket ticket : ticketStore.find(null, attributes, null, null)) {
ticketStore.delete(ticket.getId());
for (PermissionTicket ticket : ticketStore.find(realm, null, attributes, null, null)) {
ticketStore.delete(realm, ticket.getId());
}
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -2357,6 +2357,8 @@ public class RepresentationToModel {
private static Policy importPolicies(AuthorizationProvider authorization, ResourceServer resourceServer, List<PolicyRepresentation> policiesToImport, String parentPolicyName) {
StoreFactory storeFactory = authorization.getStoreFactory();
RealmModel realm = resourceServer.getRealm();
for (PolicyRepresentation policyRepresentation : policiesToImport) {
if (parentPolicyName != null && !parentPolicyName.equals(policyRepresentation.getName())) {
continue;
@ -2375,7 +2377,7 @@ public class RepresentationToModel {
Policy policy = policyStore.findByName(resourceServer, policyName);
if (policy == null) {
policy = policyStore.findById(resourceServer, policyName);
policy = policyStore.findById(realm, resourceServer, policyName);
}
if (policy == null) {
@ -2395,7 +2397,7 @@ public class RepresentationToModel {
}
PolicyStore policyStore = storeFactory.getPolicyStore();
Policy policy = policyStore.findById(resourceServer, policyRepresentation.getId());
Policy policy = policyStore.findById(realm, resourceServer, policyRepresentation.getId());
if (policy == null) {
policy = policyStore.findByName(resourceServer, policyRepresentation.getName());
@ -2501,6 +2503,8 @@ public class RepresentationToModel {
}
return;
}
ResourceServer resourceServer = policy.getResourceServer();
RealmModel realm = resourceServer.getRealm();
for (String scopeId : scopeIds) {
boolean hasScope = false;
@ -2510,8 +2514,7 @@ public class RepresentationToModel {
}
}
if (!hasScope) {
ResourceServer resourceServer = policy.getResourceServer();
Scope scope = storeFactory.getScopeStore().findById(resourceServer, scopeId);
Scope scope = storeFactory.getScopeStore().findById(realm, resourceServer, scopeId);
if (scope == null) {
scope = storeFactory.getScopeStore().findByName(resourceServer, scopeId);
@ -2543,6 +2546,7 @@ public class RepresentationToModel {
private static void updateAssociatedPolicies(Set<String> policyIds, Policy policy, StoreFactory storeFactory) {
ResourceServer resourceServer = policy.getResourceServer();
RealmModel realm = resourceServer.getRealm();
if (policyIds != null) {
if (policyIds.isEmpty()) {
@ -2564,7 +2568,7 @@ public class RepresentationToModel {
}
if (!hasPolicy) {
Policy associatedPolicy = policyStore.findById(resourceServer, policyId);
Policy associatedPolicy = policyStore.findById(realm, resourceServer, policyId);
if (associatedPolicy == null) {
associatedPolicy = policyStore.findByName(resourceServer, policyId);
@ -2601,6 +2605,9 @@ public class RepresentationToModel {
policy.removeResource(resource);
}
}
ResourceServer resourceServer = policy.getResourceServer();
RealmModel realm = resourceServer.getRealm();
for (String resourceId : resourceIds) {
boolean hasResource = false;
for (Resource resourceModel : new HashSet<>(policy.getResources())) {
@ -2609,10 +2616,10 @@ public class RepresentationToModel {
}
}
if (!hasResource && !"".equals(resourceId)) {
Resource resource = storeFactory.getResourceStore().findById(policy.getResourceServer(), resourceId);
Resource resource = storeFactory.getResourceStore().findById(realm, resourceServer, resourceId);
if (resource == null) {
resource = storeFactory.getResourceStore().findByName(policy.getResourceServer(), resourceId);
resource = storeFactory.getResourceStore().findByName(resourceServer, resourceId);
if (resource == null) {
throw new RuntimeException("Resource with id or name [" + resourceId + "] does not exist or is not owned by the resource server");
}
@ -2642,6 +2649,7 @@ public class RepresentationToModel {
public static Resource toModel(ResourceRepresentation resource, ResourceServer resourceServer, AuthorizationProvider authorization) {
ResourceStore resourceStore = authorization.getStoreFactory().getResourceStore();
RealmModel realm = authorization.getRealm();
ResourceOwnerRepresentation owner = resource.getOwner();
if (owner == null) {
@ -2656,7 +2664,6 @@ public class RepresentationToModel {
}
if (!resourceServer.getClientId().equals(ownerId)) {
RealmModel realm = authorization.getRealm();
KeycloakSession keycloakSession = authorization.getKeycloakSession();
UserProvider users = keycloakSession.users();
UserModel ownerModel = users.getUserById(realm, ownerId);
@ -2675,7 +2682,7 @@ public class RepresentationToModel {
Resource existing;
if (resource.getId() != null) {
existing = resourceStore.findById(resourceServer, resource.getId());
existing = resourceStore.findById(realm, resourceServer, resource.getId());
} else {
existing = resourceStore.findByName(resourceServer, resource.getName(), ownerId);
}
@ -2749,7 +2756,7 @@ public class RepresentationToModel {
Scope existing;
if (scope.getId() != null) {
existing = scopeStore.findById(resourceServer, scope.getId());
existing = scopeStore.findById(resourceServer.getRealm(), resourceServer, scope.getId());
} else {
existing = scopeStore.findByName(resourceServer, scope.getName());
}
@ -2775,13 +2782,13 @@ public class RepresentationToModel {
public static PermissionTicket toModel(PermissionTicketRepresentation representation, ResourceServer resourceServer, AuthorizationProvider authorization) {
PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore();
PermissionTicket ticket = ticketStore.findById(resourceServer, representation.getId());
PermissionTicket ticket = ticketStore.findById(resourceServer.getRealm(), resourceServer, representation.getId());
boolean granted = representation.isGranted();
if (granted && !ticket.isGranted()) {
ticket.setGrantedTimestamp(System.currentTimeMillis());
} else if (!granted) {
ticketStore.delete(ticket.getId());
ticketStore.delete(resourceServer.getRealm(), ticket.getId());
}
return ticket;

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -175,7 +174,7 @@ public class PolicyEvaluationService {
Set<Scope> scopes = givenScopes.stream().map(scopeRepresentation -> scopeStore.findByName(resourceServer, scopeRepresentation.getName())).collect(Collectors.toSet());
if (resource.getId() != null) {
Resource resourceModel = storeFactory.getResourceStore().findById(resourceServer, resource.getId());
Resource resourceModel = storeFactory.getResourceStore().findById(resourceServer.getRealm(), resourceServer, resource.getId());
return new ArrayList<>(Arrays.asList(
Permissions.createResourcePermissions(resourceModel, resourceServer, scopes, authorization, request))).stream();
} else if (resource.getType() != null) {

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -111,7 +111,7 @@ public class PolicyResourceService {
resource.onRemove(policy, authorization);
}
policyStore.delete(policy.getId());
policyStore.delete(resourceServer.getRealm(), policy.getId());
audit(toRepresentation(policy, authorization), OperationType.DELETE);

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -88,7 +87,7 @@ public class PolicyService {
return doCreatePolicyTypeResource(type);
}
Policy policy = authorization.getStoreFactory().getPolicyStore().findById(resourceServer, type);
Policy policy = authorization.getStoreFactory().getPolicyStore().findById(resourceServer.getRealm(), resourceServer, type);
return doCreatePolicyResource(policy);
}
@ -206,7 +205,7 @@ public class PolicyService {
if (resource != null && !"".equals(resource.trim())) {
ResourceStore resourceStore = storeFactory.getResourceStore();
Resource resourceModel = resourceStore.findById(resourceServer, resource);
Resource resourceModel = resourceStore.findById(resourceServer.getRealm(), resourceServer, resource);
if (resourceModel == null) {
Map<Resource.FilterOption, String[]> resourceFilters = new EnumMap<>(Resource.FilterOption.class);
@ -217,7 +216,7 @@ public class PolicyService {
resourceFilters.put(Resource.FilterOption.OWNER, new String[]{owner});
}
Set<String> resources = resourceStore.findByResourceServer(resourceServer, resourceFilters, -1, 1).stream().map(Resource::getId).collect(Collectors.toSet());
Set<String> resources = resourceStore.find(resourceServer.getRealm(), resourceServer, resourceFilters, -1, 1).stream().map(Resource::getId).collect(Collectors.toSet());
if (resources.isEmpty()) {
return Response.noContent().build();
@ -231,7 +230,7 @@ public class PolicyService {
if (scope != null && !"".equals(scope.trim())) {
ScopeStore scopeStore = storeFactory.getScopeStore();
Scope scopeModel = scopeStore.findById(resourceServer, scope);
Scope scopeModel = scopeStore.findById(resourceServer.getRealm(), resourceServer, scope);
if (scopeModel == null) {
Map<Scope.FilterOption, String[]> scopeFilters = new EnumMap<>(Scope.FilterOption.class);
@ -265,7 +264,7 @@ public class PolicyService {
protected List<Object> doSearch(Integer firstResult, Integer maxResult, String fields, Map<Policy.FilterOption, String[]> filters) {
PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore();
return policyStore.findByResourceServer(resourceServer, filters, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS).stream()
return policyStore.find(resourceServer.getRealm(), resourceServer, filters, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS).stream()
.map(policy -> toRepresentation(policy, fields, authorization))
.collect(Collectors.toList());
}

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -141,7 +140,7 @@ public class ResourceSetService {
resource.setId(id);
StoreFactory storeFactory = this.authorization.getStoreFactory();
ResourceStore resourceStore = storeFactory.getResourceStore();
Resource model = resourceStore.findById(resourceServer, resource.getId());
Resource model = resourceStore.findById(resourceServer.getRealm(), resourceServer, resource.getId());
if (model == null) {
return Response.status(Status.NOT_FOUND).build();
@ -159,13 +158,13 @@ public class ResourceSetService {
public Response delete(@PathParam("id") String id) {
requireManage();
StoreFactory storeFactory = authorization.getStoreFactory();
Resource resource = storeFactory.getResourceStore().findById(resourceServer, id);
Resource resource = storeFactory.getResourceStore().findById(resourceServer.getRealm(), resourceServer, id);
if (resource == null) {
return Response.status(Status.NOT_FOUND).build();
}
storeFactory.getResourceStore().delete(id);
storeFactory.getResourceStore().delete(resourceServer.getRealm(), id);
audit(toRepresentation(resource, resourceServer, authorization), OperationType.DELETE);
@ -183,7 +182,7 @@ public class ResourceSetService {
public Response findById(String id, Function<Resource, ? extends ResourceRepresentation> toRepresentation) {
requireView();
StoreFactory storeFactory = authorization.getStoreFactory();
Resource model = storeFactory.getResourceStore().findById(resourceServer, id);
Resource model = storeFactory.getResourceStore().findById(resourceServer.getRealm(), resourceServer, id);
if (model == null) {
return Response.status(Status.NOT_FOUND).build();
@ -199,7 +198,7 @@ public class ResourceSetService {
public Response getScopes(@PathParam("id") String id) {
requireView();
StoreFactory storeFactory = authorization.getStoreFactory();
Resource model = storeFactory.getResourceStore().findById(resourceServer, id);
Resource model = storeFactory.getResourceStore().findById(resourceServer.getRealm(), resourceServer, id);
if (model == null) {
return Response.status(Status.NOT_FOUND).build();
@ -243,7 +242,7 @@ public class ResourceSetService {
requireView();
StoreFactory storeFactory = authorization.getStoreFactory();
ResourceStore resourceStore = storeFactory.getResourceStore();
Resource model = resourceStore.findById(resourceServer, id);
Resource model = resourceStore.findById(resourceServer.getRealm(), resourceServer, id);
if (model == null) {
return Response.status(Status.NOT_FOUND).build();
@ -264,7 +263,7 @@ public class ResourceSetService {
resourceFilter.put(Resource.FilterOption.OWNER, new String[]{resourceServer.getClientId()});
resourceFilter.put(Resource.FilterOption.TYPE, new String[]{model.getType()});
for (Resource resourceType : resourceStore.findByResourceServer(resourceServer, resourceFilter, null, null)) {
for (Resource resourceType : resourceStore.find(resourceServer.getRealm(), resourceServer, resourceFilter, null, null)) {
policies.addAll(policyStore.findByResource(resourceServer, resourceType));
}
}
@ -300,7 +299,7 @@ public class ResourceSetService {
public Response getAttributes(@PathParam("id") String id) {
requireView();
StoreFactory storeFactory = authorization.getStoreFactory();
Resource model = storeFactory.getResourceStore().findById(resourceServer, id);
Resource model = storeFactory.getResourceStore().findById(resourceServer.getRealm(), resourceServer, id);
if (model == null) {
return Response.status(Status.NOT_FOUND).build();
@ -416,7 +415,7 @@ public class ResourceSetService {
search.put(Resource.FilterOption.SCOPE_ID, scopes.stream().map(Scope::getId).toArray(String[]::new));
}
List<Resource> resources = storeFactory.getResourceStore().findByResourceServer(this.resourceServer, search, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS);
List<Resource> resources = storeFactory.getResourceStore().find(resourceServer.getRealm(), this.resourceServer, search, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS);
if (matchingUri != null && matchingUri && resources.isEmpty()) {
Map<Resource.FilterOption, String[]> attributes = new EnumMap<>(Resource.FilterOption.class);
@ -424,7 +423,7 @@ public class ResourceSetService {
attributes.put(Resource.FilterOption.URI_NOT_NULL, new String[] {"true"});
attributes.put(Resource.FilterOption.OWNER, new String[] {resourceServer.getClientId()});
List<Resource> serverResources = storeFactory.getResourceStore().findByResourceServer(this.resourceServer, attributes, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : -1);
List<Resource> serverResources = storeFactory.getResourceStore().find(resourceServer.getRealm(), this.resourceServer, attributes, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : -1);
PathMatcher<Map.Entry<String, Resource>> pathMatcher = new PathMatcher<Map.Entry<String, Resource>>() {
@Override

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -29,6 +28,7 @@ import org.keycloak.events.admin.OperationType;
import org.keycloak.events.admin.ResourceType;
import org.keycloak.models.Constants;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
import org.keycloak.representations.idm.authorization.PolicyRepresentation;
import org.keycloak.representations.idm.authorization.ResourceRepresentation;
import org.keycloak.representations.idm.authorization.ScopeRepresentation;
@ -49,7 +49,6 @@ import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.Response.Status;
import java.util.Arrays;
import java.util.Collections;
import java.util.EnumMap;
import java.util.List;
@ -101,7 +100,7 @@ public class ScopeService {
this.auth.realm().requireManageAuthorization();
scope.setId(id);
StoreFactory storeFactory = authorization.getStoreFactory();
Scope model = storeFactory.getScopeStore().findById(resourceServer, scope.getId());
Scope model = storeFactory.getScopeStore().findById(resourceServer.getRealm(), resourceServer, scope.getId());
if (model == null) {
return Response.status(Status.NOT_FOUND).build();
@ -119,7 +118,8 @@ public class ScopeService {
public Response delete(@PathParam("id") String id) {
this.auth.realm().requireManageAuthorization();
StoreFactory storeFactory = authorization.getStoreFactory();
Scope scope = storeFactory.getScopeStore().findById(resourceServer, id);
RealmModel realm = resourceServer.getRealm();
Scope scope = storeFactory.getScopeStore().findById(realm, resourceServer, id);
if (scope == null) {
return Response.status(Status.NOT_FOUND).build();
}
@ -135,13 +135,13 @@ public class ScopeService {
for (Policy policyModel : policies) {
if (policyModel.getScopes().size() == 1) {
policyStore.delete(policyModel.getId());
policyStore.delete(realm, policyModel.getId());
} else {
policyModel.removeScope(scope);
}
}
storeFactory.getScopeStore().delete(id);
storeFactory.getScopeStore().delete(realm, id);
audit(toRepresentation(scope), OperationType.DELETE);
@ -154,7 +154,7 @@ public class ScopeService {
@Produces(MediaType.APPLICATION_JSON)
public Response findById(@PathParam("id") String id) {
this.auth.realm().requireViewAuthorization();
Scope model = this.authorization.getStoreFactory().getScopeStore().findById(resourceServer, id);
Scope model = this.authorization.getStoreFactory().getScopeStore().findById(resourceServer.getRealm(), resourceServer, id);
if (model == null) {
return Response.status(Status.NOT_FOUND).build();
@ -170,7 +170,7 @@ public class ScopeService {
public Response getResources(@PathParam("id") String id) {
this.auth.realm().requireViewAuthorization();
StoreFactory storeFactory = this.authorization.getStoreFactory();
Scope model = storeFactory.getScopeStore().findById(resourceServer, id);
Scope model = storeFactory.getScopeStore().findById(resourceServer.getRealm(), resourceServer, id);
if (model == null) {
return Response.status(Status.NOT_FOUND).build();
@ -193,7 +193,7 @@ public class ScopeService {
public Response getPermissions(@PathParam("id") String id) {
this.auth.realm().requireViewAuthorization();
StoreFactory storeFactory = this.authorization.getStoreFactory();
Scope model = storeFactory.getScopeStore().findById(resourceServer, id);
Scope model = storeFactory.getScopeStore().findById(resourceServer.getRealm(), resourceServer, id);
if (model == null) {
return Response.status(Status.NOT_FOUND).build();

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -182,6 +182,7 @@ public class PolicyEvaluationResponseBuilder {
PolicyRepresentation representation = new PolicyRepresentation();
Policy policy = result.getPolicy();
ResourceServer resourceServer = policy.getResourceServer();
representation.setId(policy.getId());
representation.setName(policy.getName());
@ -194,7 +195,7 @@ public class PolicyEvaluationResponseBuilder {
filters.put(PermissionTicket.FilterOption.POLICY_ID, policy.getId());
List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(policy.getResourceServer(), filters, -1, 1);
List<PermissionTicket> tickets = authorization.getStoreFactory().getPermissionTicketStore().find(resourceServer.getRealm(), resourceServer, filters, -1, 1);
if (!tickets.isEmpty()) {
KeycloakSession keycloakSession = authorization.getKeycloakSession();

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -503,6 +503,7 @@ public class AuthorizationTokenService {
Map<String, ResourcePermission> permissionsToEvaluate, ResourceStore resourceStore, ScopeStore scopeStore,
AtomicInteger limit) {
AccessToken rpt = request.getRpt();
RealmModel realm = resourceServer.getRealm();
if (rpt != null && rpt.isActive()) {
Authorization authorizationData = rpt.getAuthorization();
@ -516,7 +517,7 @@ public class AuthorizationTokenService {
break;
}
Resource resource = resourceStore.findById(resourceServer, grantedPermission.getResourceId());
Resource resource = resourceStore.findById(realm, resourceServer, grantedPermission.getResourceId());
if (resource != null) {
ResourcePermission permission = permissionsToEvaluate.get(resource.getId());
@ -600,7 +601,7 @@ public class AuthorizationTokenService {
Resource resource;
if (resourceId.indexOf('-') != -1) {
resource = resourceStore.findById(resourceServer, resourceId);
resource = resourceStore.findById(resourceServer.getRealm(), resourceServer, resourceId);
} else {
resource = null;
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -74,7 +74,7 @@ public class AbstractPermissionService {
throw new ErrorResponseException("invalid_resource_id", "Resource id or name not provided.", Response.Status.BAD_REQUEST);
}
} else {
Resource resource = resourceStore.findById(resourceServer, resourceSetId);
Resource resource = resourceStore.findById(resourceServer.getRealm(), resourceServer, resourceSetId);
if (resource != null) {
resources.add(resource);

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -83,7 +82,7 @@ public class PermissionTicketService {
throw new ErrorResponseException("invalid_permission", "created permissions should have requester or requesterName", Response.Status.BAD_REQUEST);
ResourceStore rstore = this.authorization.getStoreFactory().getResourceStore();
Resource resource = rstore.findById(resourceServer, representation.getResource());
Resource resource = rstore.findById(resourceServer.getRealm(), resourceServer, representation.getResource());
if (resource == null ) throw new ErrorResponseException("invalid_resource_id", "Resource set with id [" + representation.getResource() + "] does not exists in this server.", Response.Status.BAD_REQUEST);
if (!resource.getOwner().equals(this.identity.getId()))
@ -104,7 +103,7 @@ public class PermissionTicketService {
if(representation.getScopeName() != null)
scope = sstore.findByName(resourceServer, representation.getScopeName());
else
scope = sstore.findById(resourceServer, representation.getScope());
scope = sstore.findById(resourceServer.getRealm(), resourceServer, representation.getScope());
if (scope == null && representation.getScope() !=null )
throw new ErrorResponseException("invalid_scope", "Scope [" + representation.getScope() + "] is invalid", Response.Status.BAD_REQUEST);
@ -121,7 +120,7 @@ public class PermissionTicketService {
attributes.put(PermissionTicket.FilterOption.SCOPE_ID, scope.getId());
attributes.put(PermissionTicket.FilterOption.REQUESTER, user.getId());
if (!ticketStore.find(resourceServer, attributes, null, null).isEmpty())
if (!ticketStore.find(resourceServer.getRealm(), resourceServer, attributes, null, null).isEmpty())
throw new ErrorResponseException("invalid_permission", "Permission already exists", Response.Status.BAD_REQUEST);
PermissionTicket ticket = ticketStore.create(resourceServer, resource, scope, user.getId());
@ -139,7 +138,7 @@ public class PermissionTicketService {
}
PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore();
PermissionTicket ticket = ticketStore.findById(resourceServer, representation.getId());
PermissionTicket ticket = ticketStore.findById(resourceServer.getRealm(), resourceServer, representation.getId());
if (ticket == null) {
throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "invalid_ticket", Response.Status.BAD_REQUEST);
@ -163,7 +162,7 @@ public class PermissionTicketService {
}
PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore();
PermissionTicket ticket = ticketStore.findById(resourceServer, id);
PermissionTicket ticket = ticketStore.findById(resourceServer.getRealm(), resourceServer, id);
if (ticket == null) {
throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "invalid_ticket", Response.Status.BAD_REQUEST);
@ -172,7 +171,7 @@ public class PermissionTicketService {
if (!ticket.getOwner().equals(this.identity.getId()) && !this.identity.isResourceServer() && !ticket.getRequester().equals(this.identity.getId()))
throw new ErrorResponseException("not_authorised", "permissions for [" + ticket.getResource() + "] can be deleted only by the owner, the requester, or the resource server", Response.Status.FORBIDDEN);
ticketStore.delete(id);
ticketStore.delete(resourceServer.getRealm(), id);
return Response.noContent().build();
}
@ -192,7 +191,7 @@ public class PermissionTicketService {
Map<PermissionTicket.FilterOption, String> filters = getFilters(storeFactory, resourceId, scopeId, owner, requester, granted);
return Response.ok().entity(permissionTicketStore.find(resourceServer, filters, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS)
return Response.ok().entity(permissionTicketStore.find(resourceServer.getRealm(), resourceServer, filters, firstResult != null ? firstResult : -1, maxResult != null ? maxResult : Constants.DEFAULT_MAX_RESULTS)
.stream()
.map(permissionTicket -> ModelToRepresentation.toRepresentation(permissionTicket, authorization, returnNames == null ? false : returnNames))
.collect(Collectors.toList()))
@ -230,7 +229,7 @@ public class PermissionTicketService {
if (scopeId != null) {
ScopeStore scopeStore = storeFactory.getScopeStore();
Scope scope = scopeStore.findById(resourceServer, scopeId);
Scope scope = scopeStore.findById(resourceServer.getRealm(), resourceServer, scopeId);
if (scope == null) {
scope = scopeStore.findByName(resourceServer, scopeId);

View file

@ -1,7 +1,6 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2016 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -132,7 +131,7 @@ public class UserManagedPermissionService {
}
private Policy getPolicy(@PathParam("policyId") String policyId) {
Policy existing = authorization.getStoreFactory().getPolicyStore().findById(resourceServer, policyId);
Policy existing = authorization.getStoreFactory().getPolicyStore().findById(resourceServer.getRealm(), resourceServer, policyId);
if (existing == null) {
throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "Policy with [" + policyId + "] does not exist", Status.NOT_FOUND);
@ -143,7 +142,7 @@ public class UserManagedPermissionService {
private void checkRequest(String resourceId, UmaPermissionRepresentation representation) {
ResourceStore resourceStore = this.authorization.getStoreFactory().getResourceStore();
Resource resource = resourceStore.findById(resourceServer, resourceId);
Resource resource = resourceStore.findById(resourceServer.getRealm(), resourceServer, resourceId);
if (resource == null) {
throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "Resource [" + resourceId + "] cannot be found", Response.Status.BAD_REQUEST);

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -186,12 +186,12 @@ public class FreeMarkerAccountProvider implements AccountProvider {
if (!realm.isUserManagedAccessAllowed()) {
return Response.status(Status.FORBIDDEN).build();
}
attributes.put("authorization", new AuthorizationBean(session, user, uriInfo));
attributes.put("authorization", new AuthorizationBean(session, realm, user, uriInfo));
case RESOURCE_DETAIL:
if (!realm.isUserManagedAccessAllowed()) {
return Response.status(Status.FORBIDDEN).build();
}
attributes.put("authorization", new AuthorizationBean(session, user, uriInfo));
attributes.put("authorization", new AuthorizationBean(session, realm, user, uriInfo));
}
return processTemplate(theme, page, attributes, locale);

View file

@ -1,5 +1,5 @@
/*
* Copyright 2017 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -52,6 +52,7 @@ import org.keycloak.services.util.ResolveRelative;
public class AuthorizationBean {
private final KeycloakSession session;
private final RealmModel realm;
private final UserModel user;
private final AuthorizationProvider authorization;
private final UriInfo uriInfo;
@ -61,15 +62,16 @@ public class AuthorizationBean {
private Collection<ResourceBean> requestsWaitingPermission;
private Collection<ResourceBean> resourcesWaitingOthersApproval;
public AuthorizationBean(KeycloakSession session, UserModel user, UriInfo uriInfo) {
public AuthorizationBean(KeycloakSession session, RealmModel realm, UserModel user, UriInfo uriInfo) {
this.session = session;
this.realm = realm;
this.user = user;
this.uriInfo = uriInfo;
authorization = session.getProvider(AuthorizationProvider.class);
List<String> pathParameters = uriInfo.getPathParameters().get("resource_id");
if (pathParameters != null && !pathParameters.isEmpty()) {
Resource resource = authorization.getStoreFactory().getResourceStore().findById(null, pathParameters.get(0));
Resource resource = authorization.getStoreFactory().getResourceStore().findById(realm, null, pathParameters.get(0));
if (resource != null && !resource.getOwner().equals(user.getId())) {
throw new RuntimeException("User [" + user.getUsername() + "] can not access resource [" + resource.getId() + "]");
@ -105,7 +107,7 @@ public class AuthorizationBean {
public List<ResourceBean> getResources() {
if (resources == null) {
resources = authorization.getStoreFactory().getResourceStore().findByOwner(null, user.getId()).stream()
resources = authorization.getStoreFactory().getResourceStore().findByOwner(realm, null, user.getId()).stream()
.filter(Resource::isOwnerManagedAccess)
.map(ResourceBean::new)
.collect(Collectors.toList());
@ -122,7 +124,7 @@ public class AuthorizationBean {
PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore();
userSharedResources = toResourceRepresentation(ticketStore.find(null, filters, null, null));
userSharedResources = toResourceRepresentation(ticketStore.find(realm,null, filters, null, null));
}
return userSharedResources;
}
@ -140,7 +142,7 @@ public class AuthorizationBean {
}
private ResourceBean getResource(String id) {
return new ResourceBean(authorization.getStoreFactory().getResourceStore().findById(null, id));
return new ResourceBean(authorization.getStoreFactory().getResourceStore().findById(realm, null, id));
}
public static class RequesterBean {
@ -296,6 +298,8 @@ public class AuthorizationBean {
}
public Collection<ManagedPermissionBean> getPolicies() {
ResourceServer resourceServer = getResourceServer().getResourceServerModel();
RealmModel realm = resourceServer.getRealm();
Map<Policy.FilterOption, String[]> filters = new EnumMap<>(Policy.FilterOption.class);
filters.put(Policy.FilterOption.TYPE, new String[] {"uma"});
@ -306,7 +310,7 @@ public class AuthorizationBean {
filters.put(Policy.FilterOption.OWNER, new String[] {getClientOwner().getId()});
}
List<Policy> policies = authorization.getStoreFactory().getPolicyStore().findByResourceServer(getResourceServer().getResourceServerModel(), filters, null, null);
List<Policy> policies = authorization.getStoreFactory().getPolicyStore().find(realm, resourceServer, filters, null, null);
if (policies.isEmpty()) {
return Collections.emptyList();
@ -318,7 +322,7 @@ public class AuthorizationBean {
filters1.put(PermissionTicket.FilterOption.POLICY_ID, policy.getId());
return authorization.getStoreFactory().getPermissionTicketStore().find(resourceServer.getResourceServerModel(), filters1, -1, 1)
return authorization.getStoreFactory().getPermissionTicketStore().find(realm, resourceServer, filters1, -1, 1)
.isEmpty();
})
.map(ManagedPermissionBean::new).collect(Collectors.toList());
@ -370,7 +374,7 @@ public class AuthorizationBean {
}
private List<PermissionTicket> findPermissions(Map<PermissionTicket.FilterOption, String> filters) {
return authorization.getStoreFactory().getPermissionTicketStore().find(null, filters, null, null);
return authorization.getStoreFactory().getPermissionTicketStore().find(realm, null, filters, null, null);
}
public class ResourceServerBean {

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -115,7 +115,6 @@ import java.util.Map;
import java.util.Objects;
import java.util.Set;
import java.util.UUID;
import java.util.function.Predicate;
import java.util.stream.Collectors;
/**
@ -772,7 +771,7 @@ public class AccountFormService extends AbstractSecuredLocalService {
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore();
Resource resource = authorization.getStoreFactory().getResourceStore().findById(null, resourceId);
Resource resource = authorization.getStoreFactory().getResourceStore().findById(realm, null, resourceId);
if (resource == null) {
return ErrorResponse.error("Invalid resource", Response.Status.BAD_REQUEST);
@ -799,7 +798,7 @@ public class AccountFormService extends AbstractSecuredLocalService {
String id = iterator.next();
if (!id.contains(":")) {
policy = policyStore.findById(resourceServer, id);
policy = policyStore.findById(realm, resourceServer, id);
iterator.remove();
break;
}
@ -813,7 +812,7 @@ public class AccountFormService extends AbstractSecuredLocalService {
}
} else {
for (String id : ids) {
scopesToKeep.add(authorization.getStoreFactory().getScopeStore().findById(resourceServer, id.split(":")[1]));
scopesToKeep.add(authorization.getStoreFactory().getScopeStore().findById(realm, resourceServer, id.split(":")[1]));
}
for (Scope scope : policy.getScopes()) {
@ -825,10 +824,10 @@ public class AccountFormService extends AbstractSecuredLocalService {
if (policy.getScopes().isEmpty()) {
for (Policy associated : policy.getAssociatedPolicies()) {
policyStore.delete(associated.getId());
policyStore.delete(realm, associated.getId());
}
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
}
} else {
Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
@ -842,7 +841,7 @@ public class AccountFormService extends AbstractSecuredLocalService {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.FALSE.toString());
}
List<PermissionTicket> tickets = ticketStore.find(resource.getResourceServer(), filters, null, null);
List<PermissionTicket> tickets = ticketStore.find(realm, resource.getResourceServer(), filters, null, null);
Iterator<PermissionTicket> iterator = tickets.iterator();
while (iterator.hasNext()) {
@ -865,7 +864,7 @@ public class AccountFormService extends AbstractSecuredLocalService {
}
for (PermissionTicket ticket : tickets) {
ticketStore.delete(ticket.getId());
ticketStore.delete(client.getRealm(), ticket.getId());
}
}
@ -898,7 +897,7 @@ public class AccountFormService extends AbstractSecuredLocalService {
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
PermissionTicketStore ticketStore = authorization.getStoreFactory().getPermissionTicketStore();
ScopeStore scopeStore = authorization.getStoreFactory().getScopeStore();
Resource resource = authorization.getStoreFactory().getResourceStore().findById(null, resourceId);
Resource resource = authorization.getStoreFactory().getResourceStore().findById(realm, null, resourceId);
ResourceServer resourceServer = resource.getResourceServer();
if (resource == null) {
@ -932,13 +931,13 @@ public class AccountFormService extends AbstractSecuredLocalService {
filters.put(PermissionTicket.FilterOption.OWNER, auth.getUser().getId());
filters.put(PermissionTicket.FilterOption.REQUESTER, user.getId());
List<PermissionTicket> tickets = ticketStore.find(resourceServer, filters, null, null);
List<PermissionTicket> tickets = ticketStore.find(realm, resourceServer, filters, null, null);
final String userId = user.getId();
if (tickets.isEmpty()) {
if (scopes != null && scopes.length > 0) {
for (String scopeId : scopes) {
Scope scope = scopeStore.findById(resourceServer, scopeId);
Scope scope = scopeStore.findById(realm, resourceServer, scopeId);
PermissionTicket ticket = ticketStore.create(resourceServer, resource, scope, userId);
ticket.setGrantedTimestamp(System.currentTimeMillis());
}
@ -963,7 +962,7 @@ public class AccountFormService extends AbstractSecuredLocalService {
grantScopes.removeIf(alreadyGrantedScopes::contains);
for (String scopeId : grantScopes) {
Scope scope = scopeStore.findById(resourceServer, scopeId);
Scope scope = scopeStore.findById(realm, resourceServer, scopeId);
PermissionTicket ticket = ticketStore.create(resourceServer, resource, scope, userId);
ticket.setGrantedTimestamp(System.currentTimeMillis());
}
@ -993,7 +992,7 @@ public class AccountFormService extends AbstractSecuredLocalService {
}
for (String resourceId : resourceIds) {
Resource resource = authorization.getStoreFactory().getResourceStore().findById(null, resourceId);
Resource resource = authorization.getStoreFactory().getResourceStore().findById(realm, null, resourceId);
if (resource == null) {
return ErrorResponse.error("Invalid resource", Response.Status.BAD_REQUEST);
@ -1010,8 +1009,9 @@ public class AccountFormService extends AbstractSecuredLocalService {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.FALSE.toString());
}
for (PermissionTicket ticket : ticketStore.find(resource.getResourceServer(), filters, null, null)) {
ticketStore.delete(ticket.getId());
RealmModel realm = resource.getResourceServer().getRealm();
for (PermissionTicket ticket : ticketStore.find(realm, resource.getResourceServer(), filters, null, null)) {
ticketStore.delete(realm, ticket.getId());
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -39,6 +39,7 @@ import org.keycloak.authorization.model.PermissionTicket;
import org.keycloak.authorization.model.ResourceServer;
import org.keycloak.models.AccountRoles;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel;
import org.keycloak.models.UserProvider;
import org.keycloak.services.managers.Auth;
@ -87,7 +88,7 @@ public class ResourceService extends AbstractResourceService {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId());
Collection<ResourcePermission> resources = toPermissions(ticketStore.find(null, filters, null, null));
Collection<ResourcePermission> resources = toPermissions(ticketStore.find(resourceServer.getRealm(), resourceServer, filters, null, null));
Collection<Permission> permissions = Collections.EMPTY_LIST;
if (!resources.isEmpty()) {
@ -127,15 +128,17 @@ public class ResourceService extends AbstractResourceService {
}
Map<PermissionTicket.FilterOption, String> filters = new EnumMap<>(PermissionTicket.FilterOption.class);
RealmModel realm = resourceServer.getRealm();
filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId());
for (Permission permission : permissions) {
UserModel user = getUser(permission.getUsername());
filters.put(PermissionTicket.FilterOption.REQUESTER, user.getId());
List<PermissionTicket> tickets = ticketStore.find(resource.getResourceServer(), filters, null, null);
List<PermissionTicket> tickets = ticketStore.find(realm, resourceServer, filters, null, null);
// grants all requested permissions
if (tickets.isEmpty()) {
@ -171,7 +174,7 @@ public class ResourceService extends AbstractResourceService {
// remove all tickets that are not within the requested permissions
for (PermissionTicket ticket : tickets) {
ticketStore.delete(ticket.getId());
ticketStore.delete(realm, ticket.getId());
}
}
}
@ -196,7 +199,7 @@ public class ResourceService extends AbstractResourceService {
Map<String, Permission> requests = new HashMap<>();
for (PermissionTicket ticket : ticketStore.find(null, filters, null, null)) {
for (PermissionTicket ticket : ticketStore.find(resourceServer.getRealm(), resourceServer, filters, null, null)) {
requests.computeIfAbsent(ticket.getRequester(), requester -> new Permission(ticket, provider)).addScope(ticket.getScope().getName());
}
@ -213,7 +216,7 @@ public class ResourceService extends AbstractResourceService {
org.keycloak.authorization.model.Scope scope = scopeStore.findByName(resourceServer, scopeId);
if (scope == null) {
scope = scopeStore.findById(resourceServer, scopeId);
scope = scopeStore.findById(resourceServer.getRealm(), resourceServer, scopeId);
}
return scope;

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -73,7 +73,7 @@ public class ResourcesService extends AbstractResourceService {
filters.put(org.keycloak.authorization.model.Resource.FilterOption.NAME, new String[] { name });
}
return queryResponse((f, m) -> resourceStore.findByResourceServer(null, filters, f, m).stream()
return queryResponse((f, m) -> resourceStore.find(auth.getRealm(), null, filters, f, m).stream()
.map(resource -> new Resource(resource, user, provider)), first, max);
}
@ -123,7 +123,7 @@ public class ResourcesService extends AbstractResourceService {
filters.put(PermissionTicket.FilterOption.REQUESTER, user.getId());
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.FALSE.toString());
final List<PermissionTicket> permissionTickets = ticketStore.find(null, filters, null, null);
final List<PermissionTicket> permissionTickets = ticketStore.find(auth.getRealm(), null, filters, null, null);
final List<ResourcePermission> resourceList = new ArrayList<>(permissionTickets.size());
for (PermissionTicket ticket : permissionTickets) {
@ -138,7 +138,7 @@ public class ResourcesService extends AbstractResourceService {
@Path("{id}")
public Object getResource(@PathParam("id") String id) {
org.keycloak.authorization.model.Resource resource = resourceStore.findById(null, id);
org.keycloak.authorization.model.Resource resource = resourceStore.findById(auth.getRealm(), null, id);
if (resource == null) {
throw new NotFoundException("resource_not_found");
@ -167,7 +167,7 @@ public class ResourcesService extends AbstractResourceService {
filters.put(PermissionTicket.FilterOption.GRANTED, Boolean.TRUE.toString());
filters.put(PermissionTicket.FilterOption.RESOURCE_ID, resource.getId());
tickets = ticketStore.find(resource.getResourceServer(), filters, null, null);
tickets = ticketStore.find(auth.getRealm(), resource.getResourceServer(), filters, null, null);
} else {
tickets = ticketStore.findGranted(resource.getResourceServer(), resource.getName(), user.getId());
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -165,7 +165,7 @@ class ClientPermissions implements ClientPermissionEvaluator, ClientPermissionM
private void deletePolicy(String name, ResourceServer server) {
Policy policy = authz.getStoreFactory().getPolicyStore().findByName(server, name);
if (policy != null) {
authz.getStoreFactory().getPolicyStore().delete(policy.getId());
authz.getStoreFactory().getPolicyStore().delete(server.getRealm(), policy.getId());
}
}
@ -181,7 +181,7 @@ class ClientPermissions implements ClientPermissionEvaluator, ClientPermissionM
deletePolicy(getConfigurePermissionName(client), server);
deletePolicy(getExchangeToPermissionName(client), server);
Resource resource = authz.getStoreFactory().getResourceStore().findByName(server, getResourceName(client));;
if (resource != null) authz.getStoreFactory().getResourceStore().delete(resource.getId());
if (resource != null) authz.getStoreFactory().getResourceStore().delete(server.getRealm(), resource.getId());
}
@Override

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -28,6 +28,7 @@ import org.keycloak.authorization.store.ResourceStore;
import org.keycloak.common.Profile;
import org.keycloak.models.AdminRoles;
import org.keycloak.models.GroupModel;
import org.keycloak.models.RealmModel;
import org.keycloak.representations.idm.authorization.Permission;
import org.keycloak.services.ForbiddenException;
@ -443,27 +444,30 @@ class GroupPermissions implements GroupPermissionEvaluator, GroupPermissionManag
private void deletePermissions(GroupModel group) {
ResourceServer server = root.realmResourceServer();
if (server == null) return;
RealmModel realm = server.getRealm();
Policy managePermission = managePermission(group);
if (managePermission != null) {
policyStore.delete(managePermission.getId());
policyStore.delete(realm, managePermission.getId());
}
Policy viewPermission = viewPermission(group);
if (viewPermission != null) {
policyStore.delete(viewPermission.getId());
policyStore.delete(realm, viewPermission.getId());
}
Policy manageMembersPermission = manageMembersPermission(group);
if (manageMembersPermission != null) {
policyStore.delete(manageMembersPermission.getId());
policyStore.delete(realm, manageMembersPermission.getId());
}
Policy viewMembersPermission = viewMembersPermission(group);
if (viewMembersPermission != null) {
policyStore.delete(viewMembersPermission.getId());
policyStore.delete(realm, viewMembersPermission.getId());
}
Policy manageMembershipPermission = manageMembershipPermission(group);
if (manageMembershipPermission != null) {
policyStore.delete(manageMembershipPermission.getId());
policyStore.delete(realm, manageMembershipPermission.getId());
}
Resource resource = groupResource(group);
if (resource != null) resourceStore.delete(resource.getId());
if (resource != null) resourceStore.delete(realm, resource.getId());
}
}

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -91,7 +91,7 @@ class IdentityProviderPermissions implements IdentityProviderPermissionManageme
private void deletePolicy(String name, ResourceServer server) {
Policy policy = authz.getStoreFactory().getPolicyStore().findByName(server, name);
if (policy != null) {
authz.getStoreFactory().getPolicyStore().delete(policy.getId());
authz.getStoreFactory().getPolicyStore().delete(server.getRealm(), policy.getId());
}
}
@ -101,7 +101,7 @@ class IdentityProviderPermissions implements IdentityProviderPermissionManageme
if (server == null) return;
deletePolicy(getExchangeToPermissionName(idp), server);
Resource resource = authz.getStoreFactory().getResourceStore().findByName(server, getResourceName(idp));;
if (resource != null) authz.getStoreFactory().getResourceStore().delete(resource.getId());
if (resource != null) authz.getStoreFactory().getResourceStore().delete(server.getRealm(), resource.getId());
}
@Override

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -74,15 +74,18 @@ class RolePermissions implements RolePermissionEvaluator, RolePermissionManageme
private void disablePermissions(RoleModel role) {
ResourceServer server = resourceServer(role);
if (server == null) return;
RealmModel realm = server.getRealm();
Policy policy = mapRolePermission(role);
if (policy != null) authz.getStoreFactory().getPolicyStore().delete(policy.getId());
if (policy != null) authz.getStoreFactory().getPolicyStore().delete(realm, policy.getId());
policy = mapClientScopePermission(role);
if (policy != null) authz.getStoreFactory().getPolicyStore().delete(policy.getId());
if (policy != null) authz.getStoreFactory().getPolicyStore().delete(realm, policy.getId());
policy = mapCompositePermission(role);
if (policy != null) authz.getStoreFactory().getPolicyStore().delete(policy.getId());
if (policy != null) authz.getStoreFactory().getPolicyStore().delete(realm, policy.getId());
Resource resource = authz.getStoreFactory().getResourceStore().findByName(server, getRoleResourceName(role));
if (resource != null) authz.getStoreFactory().getResourceStore().delete(resource.getId());
if (resource != null) authz.getStoreFactory().getResourceStore().delete(realm, resource.getId());
}
@Override

View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -35,6 +35,7 @@ import org.keycloak.models.ClientModel;
import org.keycloak.models.GroupModel;
import org.keycloak.models.ImpersonationConstants;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel;
import org.keycloak.representations.idm.authorization.Permission;
import org.keycloak.services.ForbiddenException;
@ -526,39 +527,42 @@ class UserPermissions implements UserPermissionEvaluator, UserPermissionManageme
private void deletePermissionSetup() {
ResourceServer server = root.realmResourceServer();
if (server == null) return;
RealmModel realm = server.getRealm();
Policy policy = managePermission();
if (policy != null) {
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
}
policy = viewPermission();
if (policy != null) {
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
}
policy = mapRolesPermission();
if (policy != null) {
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
}
policy = manageGroupMembershipPermission();
if (policy != null) {
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
}
policy = adminImpersonatingPermission();
if (policy != null) {
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
}
policy = userImpersonatedPermission();
if (policy != null) {
policyStore.delete(policy.getId());
policyStore.delete(realm, policy.getId());
}
Resource usersResource = resourceStore.findByName(server, USERS_RESOURCE);
if (usersResource != null) {
resourceStore.delete(usersResource.getId());
resourceStore.delete(realm, usersResource.getId());
}
}

View file

@ -1,3 +1,20 @@
/*
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.testsuite.authz;
import org.junit.Assert;
@ -9,6 +26,7 @@ import org.keycloak.forms.account.freemarker.model.AuthorizationBean;
import org.keycloak.forms.account.freemarker.model.AuthorizationBean.ResourceBean;
import org.keycloak.models.ClientModel;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel;
import org.keycloak.representations.idm.UserRepresentation;
import org.keycloak.representations.idm.authorization.*;
@ -134,10 +152,11 @@ public class UmaRepresentationTest extends AbstractResourceServerTest {
}
public static void testCanRepresentResourceBeanOfResourceOwnedByUser(KeycloakSession session) {
session.getContext().setRealm(session.realms().getRealmByName("authz-test"));
RealmModel realm = session.realms().getRealmByName("authz-test");
session.getContext().setRealm(realm);
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
AuthorizationBean authorizationBean = new AuthorizationBean(session, null, session.getContext().getUri());
AuthorizationBean authorizationBean = new AuthorizationBean(session, realm, null, session.getContext().getUri());
ClientModel client = session.getContext().getRealm().getClientByClientId("resource-server-test");
UserModel user = session.userStorageManager().getUserByUsername(session.getContext().getRealm(), "marta");
ResourceServer resourceServer = authorization.getStoreFactory().getResourceServerStore().findByClient(client);
@ -161,10 +180,11 @@ public class UmaRepresentationTest extends AbstractResourceServerTest {
}
public static void testCanRepresentResourceBeanOfResourceOwnedByClient(KeycloakSession session) {
session.getContext().setRealm(session.realms().getRealmByName("authz-test"));
RealmModel realm = session.realms().getRealmByName("authz-test");
session.getContext().setRealm(realm);
AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
AuthorizationBean authorizationBean = new AuthorizationBean(session, null, session.getContext().getUri());
AuthorizationBean authorizationBean = new AuthorizationBean(session, realm, null, session.getContext().getUri());
ClientModel client = session.getContext().getRealm().getClientByClientId("resource-server-test");
ResourceServer resourceServer = authorization.getStoreFactory().getResourceServerStore().findByClient(client);
ResourceBean resourceBean = authorizationBean.new ResourceBean(

View file

@ -1,5 +1,5 @@
/*
* Copyright 2018 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -580,11 +580,11 @@ public class UserManagedPermissionServiceTest extends AbstractResourceServerTest
PolicyStore policyStore = provider.getStoreFactory().getPolicyStore();
List<Policy> policies = policyStore
.findByResourceServer(resourceServer, filters, null, null);
.find(realm, resourceServer, filters, null, null);
assertTrue(policies.isEmpty());
policies = policyStore
.findByResourceServer(resourceServer, Collections.emptyMap(), null, null);
.find(realm, resourceServer, Collections.emptyMap(), null, null);
assertTrue(policies.isEmpty());
}
@ -1007,7 +1007,7 @@ public class UserManagedPermissionServiceTest extends AbstractResourceServerTest
filters.put(OWNER, new String[] {user.getId()});
List<Policy> policies = provider.getStoreFactory().getPolicyStore()
.findByResourceServer(resourceServer, filters, null, null);
.find(realm, resourceServer, filters, null, null);
assertEquals(1, policies.size());
Policy policy = policies.get(0);
@ -1016,13 +1016,13 @@ public class UserManagedPermissionServiceTest extends AbstractResourceServerTest
Resource resource = policy.getResources().iterator().next();
assertEquals("Resource A", resource.getName());
provider.getStoreFactory().getResourceStore().delete(resource.getId());
provider.getStoreFactory().getResourceStore().delete(realm, resource.getId());
filters = new HashMap<>();
filters.put(OWNER, new String[] {user.getId()});
policies = provider.getStoreFactory().getPolicyStore()
.findByResourceServer(resourceServer, filters, null, null);
.find(realm, resourceServer, filters, null, null);
assertTrue(policies.isEmpty());
}
@ -1061,7 +1061,7 @@ public class UserManagedPermissionServiceTest extends AbstractResourceServerTest
filters.put(OWNER, new String[] {user.getId()});
List<Policy> policies = provider.getStoreFactory().getPolicyStore()
.findByResourceServer(resourceServer, filters, null, null);
.find(realm, resourceServer, filters, null, null);
assertEquals(1, policies.size());
Policy policy = policies.get(0);
@ -1077,7 +1077,7 @@ public class UserManagedPermissionServiceTest extends AbstractResourceServerTest
filters.put(OWNER, new String[] {user.getId()});
policies = provider.getStoreFactory().getPolicyStore()
.findByResourceServer(resourceServer, filters, null, null);
.find(realm, resourceServer, filters, null, null);
assertTrue(policies.isEmpty());
}
@ -1116,7 +1116,7 @@ public class UserManagedPermissionServiceTest extends AbstractResourceServerTest
filters.put(OWNER, new String[] {user.getId()});
List<Policy> policies = provider.getStoreFactory().getPolicyStore()
.findByResourceServer(resourceServer, filters, null, null);
.find(realm, resourceServer, filters, null, null);
assertEquals(1, policies.size());
Policy policy = policies.get(0);
@ -1132,7 +1132,7 @@ public class UserManagedPermissionServiceTest extends AbstractResourceServerTest
filters.put(OWNER, new String[] {user.getId()});
policies = provider.getStoreFactory().getPolicyStore()
.findByResourceServer(resourceServer, filters, null, null);
.find(realm, resourceServer, filters, null, null);
assertTrue(policies.isEmpty());
}