libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

Disable Authz caching for new storage tests

Browse source 
Closes #10500
This commit is contained in:
Michal Hajas 2022-03-01 09:33:04 +01:00 committed by Bruno Oliveira da Silva
parent f569db2e42
commit f77ce315bb
5 changed files with 40 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
model/map/src/main/java/org/keycloak/models/map/authorization/MapPermissionTicketStore.java
View file

@ -19,6 +19,7 @@ package org.keycloak.models.map.authorization;
import org.jboss.logging.Logger;
import org.keycloak.authorization.AuthorizationProvider;
import org.keycloak.authorization.UserManagedPermissionUtil;
import org.keycloak.authorization.model.PermissionTicket;
import org.keycloak.authorization.model.PermissionTicket.SearchableFields;
import org.keycloak.authorization.model.Resource;
@ -129,7 +130,12 @@ public class MapPermissionTicketStore implements PermissionTicketStore {
@Override
public void delete(String id) {
LOG.tracef("delete(%s)%s", id, getShortStackTrace());
PermissionTicket permissionTicket = findById(id, null);
if (permissionTicket == null) return;
tx.delete(id);
UserManagedPermissionUtil.removePolicy(permissionTicket, authorizationProvider.getStoreFactory());
}
@Override

22
model/map/src/main/java/org/keycloak/models/map/authorization/adapter/MapResourceAdapter.java
View file

@ -17,7 +17,10 @@
package org.keycloak.models.map.authorization.adapter;
import org.keycloak.authorization.model.PermissionTicket;
import org.keycloak.authorization.model.Scope;
import org.keycloak.authorization.store.PermissionTicketStore;
import org.keycloak.authorization.store.PolicyStore;
import org.keycloak.authorization.store.StoreFactory;
import org.keycloak.models.map.authorization.entity.MapResourceEntity;
@ -129,6 +132,25 @@ public class MapResourceAdapter extends AbstractResourceModel<MapResourceEntity>
@Override
public void updateScopes(Set<Scope> scopes) {
throwExceptionIfReadonly();
PermissionTicketStore permissionStore = storeFactory.getPermissionTicketStore();
PolicyStore policyStore = storeFactory.getPolicyStore();
for (Scope scope : getScopes()) {
if (!scopes.contains(scope)) {
// The scope^ was removed from the Resource
// Remove permission tickets based on the scope
List<PermissionTicket> permissions = permissionStore.findByScope(scope.getId(), getResourceServer());
for (PermissionTicket permission : permissions) {
permissionStore.delete(permission.getId());
}
// Remove the scope from each Policy for this Resource
policyStore.findByResource(getId(), getResourceServer(), policy -> policy.removeScope(scope));
}
}
entity.setScopeIds(scopes.stream().map(Scope::getId).collect(Collectors.toSet()));
}

11
services/src/main/java/org/keycloak/authorization/authorization/AuthorizationTokenService.java
View file

@ -494,15 +494,14 @@ public class AuthorizationTokenService {
}
}
resolvePreviousGrantedPermissions(ticket, request, resourceServer, permissionsToEvaluate, resourceStore, scopeStore, limit);
resolvePreviousGrantedPermissions(request, resourceServer, permissionsToEvaluate, resourceStore, scopeStore, limit);
return permissionsToEvaluate.values();
}
private void resolvePreviousGrantedPermissions(PermissionTicketToken ticket,
KeycloakAuthorizationRequest request, ResourceServer resourceServer,
Map<String, ResourcePermission> permissionsToEvaluate, ResourceStore resourceStore, ScopeStore scopeStore,
AtomicInteger limit) {
private void resolvePreviousGrantedPermissions(KeycloakAuthorizationRequest request, ResourceServer resourceServer,
Map<String, ResourcePermission> permissionsToEvaluate, ResourceStore resourceStore, ScopeStore scopeStore,
AtomicInteger limit) {
AccessToken rpt = request.getRpt();
if (rpt != null && rpt.isActive()) {
@ -517,7 +516,7 @@ public class AuthorizationTokenService {
break;
}
Resource resource = resourceStore.findById(grantedPermission.getResourceId(), ticket.getIssuedFor());
Resource resource = resourceStore.findById(grantedPermission.getResourceId(), resourceServer.getId());
if (resource != null) {
ResourcePermission permission = permissionsToEvaluate.get(resource.getId());

1
testsuite/integration-arquillian/tests/base/pom.xml
View file

@ -1134,6 +1134,7 @@
<keycloak.userSession.provider>map</keycloak.userSession.provider>
<keycloak.loginFailure.provider>map</keycloak.loginFailure.provider>
<keycloak.authorization.provider>map</keycloak.authorization.provider>
<keycloak.authorizationCache.enabled>false</keycloak.authorizationCache.enabled>
</systemPropertyVariables>
</configuration>
</plugin>

6
testsuite/integration-arquillian/tests/base/src/test/resources/META-INF/keycloak-server.json
View file

@ -167,6 +167,12 @@
}
},
"authorizationCache": {
"default": {
"enabled": "${keycloak.authorizationCache.enabled:true}"
}
},
"userCache": {
"provider": "${keycloak.user.cache.provider:default}",
"default" : {