libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

[KEYCLOAK-4653] - Identity.hasClientRole(String) and Identity.hasRole(String) break role namespaces and should be removed

Browse source
This commit is contained in:
Pedro Igor 2017-09-01 16:08:34 -03:00
parent d62164f6f0
commit fa6d5f0ee2
10 changed files with 7 additions and 55 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
examples/authz/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.admin/Main.drl
View file

@ -7,7 +7,7 @@ rule "Authorize Admin Resources"
when
$evaluation : Evaluation(
$identity : context.identity,
$identity.hasRole("admin")
$identity.hasRealmRole("admin")
)
then
$evaluation.grant();

2
examples/authz/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.user/Main.drl
View file

@ -7,7 +7,7 @@ rule "Authorize View User Album"
when
$evaluation : Evaluation(
$identity : context.identity,
$identity.hasRole("user")
$identity.hasRealmRole("user")
)
then
$evaluation.grant();

2
examples/authz/photoz/photoz-restful-api/src/main/resources/photoz-restful-api-authz-service.json
View file

@ -113,7 +113,7 @@
"logic": "POSITIVE",
"decisionStrategy": "UNANIMOUS",
"config": {
"code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}"
"code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRealmRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}"
}
},
{

28
server-spi-private/src/main/java/org/keycloak/authorization/identity/Identity.java
View file

@ -44,17 +44,6 @@ public interface Identity {
*/
Attributes getAttributes();
/**
* Indicates if this identity is granted with a role (realm or client) with the given <code>roleName</code>.
*
* @param roleName the name of the role
*
* @return true if the identity has the given role. Otherwise, it returns false.
*/
default boolean hasRole(String roleName) {
return hasRealmRole(roleName) || hasClientRole(roleName);
}
/**
* Indicates if this identity is granted with a realm role with the given <code>roleName</code>.
*
@ -77,21 +66,4 @@ public interface Identity {
default boolean hasClientRole(String clientId, String roleName) {
return getAttributes().containsValue("kc.client." + clientId + ".roles", roleName);
}
/**
* Indicates if this identity is granted with a client role with the given <code>roleName</code>.
*
* @param roleName the name of the role
*
* @return true if the identity has the given role. Otherwise, it returns false.
*/
default boolean hasClientRole(String roleName) {
return getAttributes().toMap().entrySet().stream().filter(entry -> {
String key = entry.getKey();
if (key.startsWith("kc.client") && key.endsWith(".roles")) {
return getAttributes().containsValue(key, roleName);
}
return false;
}).findFirst().isPresent();
}
}

10
services/src/main/java/org/keycloak/authorization/common/ClientModelIdentity.java
View file

@ -70,14 +70,4 @@ public class ClientModelIdentity implements Identity {
if (role == null) return false;
return serviceAccount.hasRole(role);
}
@Override
public boolean hasRole(String roleName) {
throw new RuntimeException("Should not execute");
}
@Override
public boolean hasClientRole(String roleName) {
throw new RuntimeException("Should not execute");
}
}

10
services/src/main/java/org/keycloak/authorization/common/UserModelIdentity.java
View file

@ -64,14 +64,4 @@ public class UserModelIdentity implements Identity {
if (role == null) return false;
return user.hasRole(role);
}
@Override
public boolean hasRole(String roleName) {
throw new RuntimeException("Should not execute");
}
@Override
public boolean hasClientRole(String roleName) {
throw new RuntimeException("Should not execute");
}
}

2
testsuite/integration-arquillian/test-apps/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.admin/Main.drl
View file

@ -7,7 +7,7 @@ rule "Authorize Admin Resources"
when
$evaluation : Evaluation(
$identity : context.identity,
$identity.hasRole("admin")
$identity.hasRealmRole("admin")
)
then
$evaluation.grant();

2
testsuite/integration-arquillian/test-apps/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.user/Main.drl
View file

@ -7,7 +7,7 @@ rule "Authorize View User Album"
when
$evaluation : Evaluation(
$identity : context.identity,
$identity.hasRole("user")
$identity.hasRealmRole("user")
)
then
$evaluation.grant();

2
testsuite/integration-arquillian/test-apps/photoz/photoz-restful-api-authz-service.json
View file

@ -118,7 +118,7 @@
"decisionStrategy": "UNANIMOUS",
"config": {
"applyPolicies": "[]",
"code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}"
"code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRealmRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}"
}
},
{

2
testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/import-authorization-unordered-settings.json
View file

@ -159,7 +159,7 @@
"logic": "POSITIVE",
"decisionStrategy": "UNANIMOUS",
"config": {
"code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}"
"code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRealmRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}"
}
},
{