libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

Use the response_permissions_limit value, if provided, to set the maximum number of results when retrieving resources by URI

Browse source 
Signed-off-by: BrunoSampaioDTx <bruno.sampaio@dtx-colab.pt>
This commit is contained in:
BrunoSampaioDTx 2024-10-29 16:24:31 +00:00 committed by Pedro Igor
parent cf2e2b692b
commit de973de800
2 changed files with 12 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
services/src/main/java/org/keycloak/authorization/authorization/AuthorizationTokenService.java
View file

@ -810,7 +810,7 @@ public class AuthorizationTokenService {
return clientConnection; return clientConnection;
} }
public void addPermissions(List<String> permissionList, String permissionResourceFormat, boolean matchingUri) { public void addPermissions(List<String> permissionList, String permissionResourceFormat, boolean matchingUri, Integer maxResults) {
if (permissionResourceFormat == null) { if (permissionResourceFormat == null) {
permissionResourceFormat = "id"; permissionResourceFormat = "id";
} }
@ -820,7 +820,7 @@ public class AuthorizationTokenService {
addPermissionsById(permissionList); addPermissionsById(permissionList);
break; break;
case "uri": case "uri":
addPermissionsByUri(permissionList, matchingUri); addPermissionsByUri(permissionList, matchingUri, maxResults);
break; break;
} }
@ -840,7 +840,7 @@ public class AuthorizationTokenService {
} }
} }
private void addPermissionsByUri(List<String> permissionList, boolean matchingUri) { private void addPermissionsByUri(List<String> permissionList, boolean matchingUri, Integer maxResults) {
StoreFactory storeFactory = authorization.getStoreFactory(); StoreFactory storeFactory = authorization.getStoreFactory();
for (String permission : permissionList) { for (String permission : permissionList) {
@ -856,7 +856,7 @@ public class AuthorizationTokenService {
throw invalidResourceException; throw invalidResourceException;
} }
List<Resource> resources = getResourceListByUri(uri, storeFactory, matchingUri); List<Resource> resources = getResourceListByUri(uri, storeFactory, matchingUri, maxResults);
if (resources == null || resources.isEmpty()) { if (resources == null || resources.isEmpty()) {
CorsErrorResponseException invalidResourceException = new CorsErrorResponseException(getCors(), CorsErrorResponseException invalidResourceException = new CorsErrorResponseException(getCors(),
@ -876,7 +876,7 @@ public class AuthorizationTokenService {
return; return;
} }
List<Resource> resources = getResourceListByUri(uri, storeFactory, matchingUri); List<Resource> resources = getResourceListByUri(uri, storeFactory, matchingUri, maxResults);
if (resources == null || resources.isEmpty()) { if (resources == null || resources.isEmpty()) {
CorsErrorResponseException invalidResourceException = new CorsErrorResponseException(getCors(), CorsErrorResponseException invalidResourceException = new CorsErrorResponseException(getCors(),
@ -890,13 +890,13 @@ public class AuthorizationTokenService {
} }
} }
private List<Resource> getResourceListByUri(String uri, StoreFactory storeFactory, boolean matchingUri) { private List<Resource> getResourceListByUri(String uri, StoreFactory storeFactory, boolean matchingUri, Integer maxResults) {
Map<Resource.FilterOption, String[]> search = new EnumMap<>(Resource.FilterOption.class); Map<Resource.FilterOption, String[]> search = new EnumMap<>(Resource.FilterOption.class);
search.put(Resource.FilterOption.URI, new String[] { uri }); search.put(Resource.FilterOption.URI, new String[] { uri });
ResourceServer resourceServer = storeFactory.getResourceServerStore() ResourceServer resourceServer = storeFactory.getResourceServerStore()
.findByClient(getRealm().getClientByClientId(getAudience())); .findByClient(getRealm().getClientByClientId(getAudience()));
List<Resource> resources = storeFactory.getResourceStore().find(resourceServer, search, -1,
Constants.DEFAULT_MAX_RESULTS); List<Resource> resources = storeFactory.getResourceStore().find(resourceServer, search, -1, maxResults);
if (!matchingUri || !resources.isEmpty()) { if (!matchingUri || !resources.isEmpty()) {
return resources; return resources;

8
services/src/main/java/org/keycloak/protocol/oidc/grants/PermissionGrantType.java
View file

@ -158,12 +158,14 @@ public class PermissionGrantType extends OAuth2GrantTypeBase {
// permissions have a format like RESOURCE#SCOPE1,SCOPE2 // permissions have a format like RESOURCE#SCOPE1,SCOPE2
List<String> permissions = formParams.get("permission"); List<String> permissions = formParams.get("permission");
String responsePermissionsLimit = formParams.getFirst("response_permissions_limit");
Integer maxResults = responsePermissionsLimit != null ? Integer.parseInt(responsePermissionsLimit) : null;
if (permissions != null) { if (permissions != null) {
event.detail(Details.PERMISSION, String.join("|", permissions)); event.detail(Details.PERMISSION, String.join("|", permissions));
String permissionResourceFormat = formParams.getFirst("permission_resource_format"); String permissionResourceFormat = formParams.getFirst("permission_resource_format");
boolean permissionResourceMatchingUri = Boolean.parseBoolean(formParams.getFirst("permission_resource_matching_uri")); boolean permissionResourceMatchingUri = Boolean.parseBoolean(formParams.getFirst("permission_resource_matching_uri"));
authorizationRequest.addPermissions(permissions, permissionResourceFormat, permissionResourceMatchingUri); authorizationRequest.addPermissions(permissions, permissionResourceFormat, permissionResourceMatchingUri, maxResults);
} }
AuthorizationRequest.Metadata metadata = new AuthorizationRequest.Metadata(); AuthorizationRequest.Metadata metadata = new AuthorizationRequest.Metadata();
@ -174,10 +176,8 @@ public class PermissionGrantType extends OAuth2GrantTypeBase {
metadata.setIncludeResourceName(Boolean.parseBoolean(responseIncludeResourceName)); metadata.setIncludeResourceName(Boolean.parseBoolean(responseIncludeResourceName));
} }
String responsePermissionsLimit = formParams.getFirst("response_permissions_limit");
if (responsePermissionsLimit != null) { if (responsePermissionsLimit != null) {
metadata.setLimit(Integer.parseInt(responsePermissionsLimit)); metadata.setLimit(maxResults);
} }
metadata.setResponseMode(formParams.getFirst("response_mode")); metadata.setResponseMode(formParams.getFirst("response_mode"));