From fa6d5f0ee204fe0c3dad66a421d7cc4f049c47ab Mon Sep 17 00:00:00 2001 From: Pedro Igor Date: Fri, 1 Sep 2017 16:08:34 -0300 Subject: [PATCH] [KEYCLOAK-4653] - Identity.hasClientRole(String) and Identity.hasRole(String) break role namespaces and should be removed --- .../com.photoz.authz.policy.admin/Main.drl | 2 +- .../com.photoz.authz.policy.user/Main.drl | 2 +- .../photoz-restful-api-authz-service.json | 2 +- .../authorization/identity/Identity.java | 28 ------------------- .../common/ClientModelIdentity.java | 10 ------- .../common/UserModelIdentity.java | 10 ------- .../com.photoz.authz.policy.admin/Main.drl | 2 +- .../com.photoz.authz.policy.user/Main.drl | 2 +- .../photoz-restful-api-authz-service.json | 2 +- ...port-authorization-unordered-settings.json | 2 +- 10 files changed, 7 insertions(+), 55 deletions(-) diff --git a/examples/authz/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.admin/Main.drl b/examples/authz/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.admin/Main.drl index deb1c84757..c807f9b7ab 100644 --- a/examples/authz/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.admin/Main.drl +++ b/examples/authz/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.admin/Main.drl @@ -7,7 +7,7 @@ rule "Authorize Admin Resources" when $evaluation : Evaluation( $identity : context.identity, - $identity.hasRole("admin") + $identity.hasRealmRole("admin") ) then $evaluation.grant(); diff --git a/examples/authz/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.user/Main.drl b/examples/authz/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.user/Main.drl index 9b1677edca..2ebc457ea4 100644 --- a/examples/authz/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.user/Main.drl +++ b/examples/authz/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.user/Main.drl @@ -7,7 +7,7 @@ rule "Authorize View User Album" when $evaluation : Evaluation( $identity : context.identity, - $identity.hasRole("user") + $identity.hasRealmRole("user") ) then $evaluation.grant(); diff --git a/examples/authz/photoz/photoz-restful-api/src/main/resources/photoz-restful-api-authz-service.json b/examples/authz/photoz/photoz-restful-api/src/main/resources/photoz-restful-api-authz-service.json index b6a93bc4f0..28b87bc579 100644 --- a/examples/authz/photoz/photoz-restful-api/src/main/resources/photoz-restful-api-authz-service.json +++ b/examples/authz/photoz/photoz-restful-api/src/main/resources/photoz-restful-api-authz-service.json @@ -113,7 +113,7 @@ "logic": "POSITIVE", "decisionStrategy": "UNANIMOUS", "config": { - "code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}" + "code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRealmRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}" } }, { diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/identity/Identity.java b/server-spi-private/src/main/java/org/keycloak/authorization/identity/Identity.java index ad7057b457..e203dfe4a3 100644 --- a/server-spi-private/src/main/java/org/keycloak/authorization/identity/Identity.java +++ b/server-spi-private/src/main/java/org/keycloak/authorization/identity/Identity.java @@ -44,17 +44,6 @@ public interface Identity { */ Attributes getAttributes(); - /** - * Indicates if this identity is granted with a role (realm or client) with the given roleName. - * - * @param roleName the name of the role - * - * @return true if the identity has the given role. Otherwise, it returns false. - */ - default boolean hasRole(String roleName) { - return hasRealmRole(roleName) || hasClientRole(roleName); - } - /** * Indicates if this identity is granted with a realm role with the given roleName. * @@ -77,21 +66,4 @@ public interface Identity { default boolean hasClientRole(String clientId, String roleName) { return getAttributes().containsValue("kc.client." + clientId + ".roles", roleName); } - - /** - * Indicates if this identity is granted with a client role with the given roleName. - * - * @param roleName the name of the role - * - * @return true if the identity has the given role. Otherwise, it returns false. - */ - default boolean hasClientRole(String roleName) { - return getAttributes().toMap().entrySet().stream().filter(entry -> { - String key = entry.getKey(); - if (key.startsWith("kc.client") && key.endsWith(".roles")) { - return getAttributes().containsValue(key, roleName); - } - return false; - }).findFirst().isPresent(); - } } diff --git a/services/src/main/java/org/keycloak/authorization/common/ClientModelIdentity.java b/services/src/main/java/org/keycloak/authorization/common/ClientModelIdentity.java index d2c6b67672..f499a018f6 100644 --- a/services/src/main/java/org/keycloak/authorization/common/ClientModelIdentity.java +++ b/services/src/main/java/org/keycloak/authorization/common/ClientModelIdentity.java @@ -70,14 +70,4 @@ public class ClientModelIdentity implements Identity { if (role == null) return false; return serviceAccount.hasRole(role); } - - @Override - public boolean hasRole(String roleName) { - throw new RuntimeException("Should not execute"); - } - - @Override - public boolean hasClientRole(String roleName) { - throw new RuntimeException("Should not execute"); - } } diff --git a/services/src/main/java/org/keycloak/authorization/common/UserModelIdentity.java b/services/src/main/java/org/keycloak/authorization/common/UserModelIdentity.java index c54e4c0532..2726913b20 100644 --- a/services/src/main/java/org/keycloak/authorization/common/UserModelIdentity.java +++ b/services/src/main/java/org/keycloak/authorization/common/UserModelIdentity.java @@ -64,14 +64,4 @@ public class UserModelIdentity implements Identity { if (role == null) return false; return user.hasRole(role); } - - @Override - public boolean hasRole(String roleName) { - throw new RuntimeException("Should not execute"); - } - - @Override - public boolean hasClientRole(String roleName) { - throw new RuntimeException("Should not execute"); - } } diff --git a/testsuite/integration-arquillian/test-apps/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.admin/Main.drl b/testsuite/integration-arquillian/test-apps/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.admin/Main.drl index deb1c84757..c807f9b7ab 100644 --- a/testsuite/integration-arquillian/test-apps/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.admin/Main.drl +++ b/testsuite/integration-arquillian/test-apps/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.admin/Main.drl @@ -7,7 +7,7 @@ rule "Authorize Admin Resources" when $evaluation : Evaluation( $identity : context.identity, - $identity.hasRole("admin") + $identity.hasRealmRole("admin") ) then $evaluation.grant(); diff --git a/testsuite/integration-arquillian/test-apps/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.user/Main.drl b/testsuite/integration-arquillian/test-apps/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.user/Main.drl index 9b1677edca..2ebc457ea4 100644 --- a/testsuite/integration-arquillian/test-apps/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.user/Main.drl +++ b/testsuite/integration-arquillian/test-apps/photoz/photoz-authz-policy/src/main/resources/com.photoz.authz.policy.user/Main.drl @@ -7,7 +7,7 @@ rule "Authorize View User Album" when $evaluation : Evaluation( $identity : context.identity, - $identity.hasRole("user") + $identity.hasRealmRole("user") ) then $evaluation.grant(); diff --git a/testsuite/integration-arquillian/test-apps/photoz/photoz-restful-api-authz-service.json b/testsuite/integration-arquillian/test-apps/photoz/photoz-restful-api-authz-service.json index ab34c88edf..ba44208488 100644 --- a/testsuite/integration-arquillian/test-apps/photoz/photoz-restful-api-authz-service.json +++ b/testsuite/integration-arquillian/test-apps/photoz/photoz-restful-api-authz-service.json @@ -118,7 +118,7 @@ "decisionStrategy": "UNANIMOUS", "config": { "applyPolicies": "[]", - "code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}" + "code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRealmRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}" } }, { diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/import-authorization-unordered-settings.json b/testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/import-authorization-unordered-settings.json index 8bdb6352b1..1d6009023c 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/import-authorization-unordered-settings.json +++ b/testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/import-authorization-unordered-settings.json @@ -159,7 +159,7 @@ "logic": "POSITIVE", "decisionStrategy": "UNANIMOUS", "config": { - "code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}" + "code": "var context = $evaluation.getContext();\nvar identity = context.getIdentity();\nvar attributes = identity.getAttributes();\nvar email = attributes.getValue('email').asString(0);\n\nif (identity.hasRealmRole('admin') || email.endsWith('@keycloak.org')) {\n $evaluation.grant();\n}" } }, {