keycloak-scim/examples/authz/photoz/photoz-restful-api-authz-service.json

{
  "allowRemoteResourceManagement": true,
  "policyEnforcementMode": "ENFORCING",
  "resources": [
    {
      "name": "User Profile Resource",
      "uri": "/profile",
      "type": "http://photoz.com/profile",
      "scopes": [
        {
          "name": "urn:photoz.com:scopes:profile:view"
        }
      ]
    },
    {
      "name": "Album Resource",
      "uri": "/album/*",
      "type": "http://photoz.com/album",
      "scopes": [
        {
          "name": "urn:photoz.com:scopes:album:view"
        },
        {
          "name": "urn:photoz.com:scopes:album:create"
        },
        {
          "name": "urn:photoz.com:scopes:album:delete"
        }
      ]
    },
    {
      "name": "Admin Resources",
      "uri": "/admin/*",
      "type": "http://photoz.com/admin",
      "scopes": [
        {
          "name": "urn:photoz.com:scopes:album:admin:manage"
        }
      ]
    }
  ],
  "policies": [
    {
      "name": "Only Owner Policy",
      "description": "Defines that only the resource owner is allowed to do something",
      "type": "drools",
      "config": {
        "mavenArtifactVersion": "2.0.0.CR1-SNAPSHOT",
        "mavenArtifactId": "photoz-authz-policy",
        "sessionName": "MainOwnerSession",
        "mavenArtifactGroupId": "org.keycloak",
        "moduleName": "PhotozAuthzOwnerPolicy",
        "scannerPeriod": "1",
        "scannerPeriodUnit": "Hours"
      }
    },
    {
      "name": "Any Admin Policy",
      "description": "Defines that adminsitrators can do something",
      "type": "role",
      "config": {
        "roles": "[\"admin\"]"
      }
    },
    {
      "name": "Any User Policy",
      "description": "Defines that any user can do something",
      "type": "role",
      "config": {
        "roles": "[\"user\"]"
      }
    },
    {
      "name": "Only From a Specific Client Address",
      "description": "Defines that only clients from a specific address can do something",
      "type": "js",
      "logic": "POSITIVE",
      "decisionStrategy": "UNANIMOUS",
      "config": {
        "code": "var contextAttributes = $evaluation.getContext().getAttributes();\n\nif (contextAttributes.containsValue('kc.client.network.ip_address', '127.0.0.1')) {\n    $evaluation.grant();\n}"
      }
    },
    {
      "name": "Administration Policy",
      "description": "Defines that only administrators from a specific network address can do something.",
      "type": "aggregate",
      "config": {
        "applyPolicies": "[\"Any Admin Policy\",\"Only From a Specific Client Address\"]"
      }
    },
    {
      "name": "Only Owner and Administrators Policy",
      "description": "Defines that only the resource owner and administrators can do something",
      "type": "aggregate",
      "decisionStrategy": "AFFIRMATIVE",
      "config": {
        "applyPolicies": "[\"Administration Policy\",\"Only Owner Policy\"]"
      }
    },
    {
      "name": "Only From @keycloak.org or Admin",
      "description": "Defines that only users from @keycloak.org",
      "type": "js",
      "config": {
        "applyPolicies": "[]",
        "code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRole('admin') || email.endsWith('@keycloak.org')) {\n    $evaluation.grant();\n}"
      }
    },
    {
      "name": "Only in the Period",
      "description": "Access granted only during the morning",
      "type": "time",
      "config": {
        "noa": "2016-01-03 23:59:59",
        "expirationUnit": "Minutes",
        "nbf": "2016-01-01 00:00:00",
        "expirationTime": "1"
      }
    },
    {
      "name": "Album Resource Permission",
      "description": "General policies that apply to all album resources.",
      "type": "resource",
      "decisionStrategy": "AFFIRMATIVE",
      "config": {
        "defaultResourceType": "http://photoz.com/album",
        "default": "true",
        "applyPolicies": "[\"Any User Policy\",\"Administration Policy\"]"
      }
    },
    {
      "name": "Admin Resource Permission",
      "description": "General policy for any administrative resource.",
      "type": "resource",
      "logic": "POSITIVE",
      "decisionStrategy": "UNANIMOUS",
      "config": {
        "defaultResourceType": "http://photoz.com/admin",
        "default": "true",
        "applyPolicies": "[\"Administration Policy\"]"
      }
    },
    {
      "name": "View User Permission",
      "description": "Defines who is allowed to view an user profile",
      "type": "scope",
      "logic": "POSITIVE",
      "decisionStrategy": "UNANIMOUS",
      "config": {
        "applyPolicies": "[\"Only From @keycloak.org or Admin\"]",
        "scopes": "[\"urn:photoz.com:scopes:profile:view\"]"
      }
    },
    {
      "name": "Delete Album Policy",
      "description": "A policy that only allows the owner to delete his albums.",
      "type": "scope",
      "logic": "POSITIVE",
      "decisionStrategy": "UNANIMOUS",
      "config": {
        "applyPolicies": "[\"Only Owner and Administrators Policy\"]",
        "scopes": "[\"urn:photoz.com:scopes:album:delete\"]"
      }
    }
  ],
  "scopes": [
    {
      "name": "urn:photoz.com:scopes:profile:view"
    },
    {
      "name": "urn:photoz.com:scopes:album:view"
    },
    {
      "name": "urn:photoz.com:scopes:album:create"
    },
    {
      "name": "urn:photoz.com:scopes:album:delete"
    },
    {
      "name": "urn:photoz.com:scopes:album:admin:manage"
    }
  ]
}