[KEYCLOAK-4555] - Fixes and improvements to evaluation code
This commit is contained in:
Pedro Igor committed
1 parent
45caea4dbd
commit
e7e6314146
12 files changed
+161
-93
No files matched your search
+12
-12
@@ -18,6 +18,17 @@
|
||||
|
||||
package org.keycloak.authorization.admin.representation;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.Comparator;
|
||||
import java.util.HashMap;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.function.Consumer;
|
||||
import java.util.function.Function;
|
||||
import java.util.stream.Collectors;
|
||||
import java.util.stream.Stream;
|
||||
|
||||
import org.keycloak.authorization.AuthorizationProvider;
|
||||
import org.keycloak.authorization.Decision.Effect;
|
||||
import org.keycloak.authorization.common.KeycloakIdentity;
|
||||
@@ -33,17 +44,6 @@ import org.keycloak.representations.idm.authorization.PolicyRepresentation;
|
||||
import org.keycloak.representations.idm.authorization.ResourceRepresentation;
|
||||
import org.keycloak.representations.idm.authorization.ScopeRepresentation;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.Comparator;
|
||||
import java.util.HashMap;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.function.Consumer;
|
||||
import java.util.function.Function;
|
||||
import java.util.stream.Collectors;
|
||||
import java.util.stream.Stream;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
|
||||
*/
|
||||
@@ -64,7 +64,7 @@ public class PolicyEvaluationResponse {
|
||||
AccessToken accessToken = identity.getAccessToken();
|
||||
AccessToken.Authorization authorizationData = new AccessToken.Authorization();
|
||||
|
||||
authorizationData.setPermissions(Permissions.allPermits(results, authorization, resourceServer));
|
||||
authorizationData.setPermissions(Permissions.permits(results, authorization, resourceServer.getId()));
|
||||
accessToken.setAuthorization(authorizationData);
|
||||
|
||||
response.rpt = accessToken;
|
||||
|
||||
+25
-24
@@ -17,6 +17,30 @@
|
||||
*/
|
||||
package org.keycloak.authorization.entitlement;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.HashMap;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
import java.util.function.Function;
|
||||
import java.util.stream.Collectors;
|
||||
import java.util.stream.Stream;
|
||||
|
||||
import javax.ws.rs.Consumes;
|
||||
import javax.ws.rs.GET;
|
||||
import javax.ws.rs.OPTIONS;
|
||||
import javax.ws.rs.POST;
|
||||
import javax.ws.rs.Path;
|
||||
import javax.ws.rs.PathParam;
|
||||
import javax.ws.rs.Produces;
|
||||
import javax.ws.rs.container.AsyncResponse;
|
||||
import javax.ws.rs.container.Suspended;
|
||||
import javax.ws.rs.core.Context;
|
||||
import javax.ws.rs.core.Response;
|
||||
import javax.ws.rs.core.Response.Status;
|
||||
|
||||
import org.jboss.resteasy.spi.HttpRequest;
|
||||
import org.keycloak.OAuth2Constants;
|
||||
import org.keycloak.OAuthErrorException;
|
||||
@@ -50,29 +74,6 @@ import org.keycloak.services.ErrorResponse;
|
||||
import org.keycloak.services.ErrorResponseException;
|
||||
import org.keycloak.services.resources.Cors;
|
||||
|
||||
import javax.ws.rs.Consumes;
|
||||
import javax.ws.rs.GET;
|
||||
import javax.ws.rs.OPTIONS;
|
||||
import javax.ws.rs.POST;
|
||||
import javax.ws.rs.Path;
|
||||
import javax.ws.rs.PathParam;
|
||||
import javax.ws.rs.Produces;
|
||||
import javax.ws.rs.container.AsyncResponse;
|
||||
import javax.ws.rs.container.Suspended;
|
||||
import javax.ws.rs.core.Context;
|
||||
import javax.ws.rs.core.Response;
|
||||
import javax.ws.rs.core.Response.Status;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.HashMap;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
import java.util.function.Function;
|
||||
import java.util.stream.Collectors;
|
||||
import java.util.stream.Stream;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
|
||||
*/
|
||||
@@ -126,7 +127,7 @@ public class EntitlementService {
|
||||
|
||||
@Override
|
||||
protected void onComplete(List<Result> results) {
|
||||
List<Permission> entitlements = Permissions.allPermits(results, authorization, resourceServer);
|
||||
List<Permission> entitlements = Permissions.permits(results, authorization, resourceServer.getId());
|
||||
|
||||
if (entitlements.isEmpty()) {
|
||||
HashMap<Object, Object> error = new HashMap<>();
|
||||
|
||||
@@ -134,54 +134,82 @@ public final class Permissions {
|
||||
return permissions;
|
||||
}
|
||||
|
||||
public static List<Permission> allPermits(List<Result> evaluation, AuthorizationProvider authorizationProvider, ResourceServer resourceServer) {
|
||||
public static List<Permission> permits(List<Result> evaluation, AuthorizationProvider authorizationProvider, String resourceServerId) {
|
||||
Map<String, Permission> permissions = new HashMap<>();
|
||||
|
||||
for (Result evaluationResult : evaluation) {
|
||||
ResourcePermission permission = evaluationResult.getPermission();
|
||||
for (Result result : evaluation) {
|
||||
Set<Scope> deniedScopes = new HashSet<>();
|
||||
Set<Scope> grantedScopes = new HashSet<>();
|
||||
boolean resourceDenied = false;
|
||||
ResourcePermission permission = result.getPermission();
|
||||
List<Result.PolicyResult> results = result.getResults();
|
||||
int deniedCount = results.size();
|
||||
|
||||
// if overall decision was a DENY, check for scope-based policies for a PERMIT
|
||||
if (evaluationResult.getEffect().equals(Effect.DENY)) {
|
||||
for (Result.PolicyResult result : evaluationResult.getResults()) {
|
||||
Policy policy = result.getPolicy();
|
||||
for (Result.PolicyResult policyResult : results) {
|
||||
Policy policy = policyResult.getPolicy();
|
||||
Set<Scope> policyScopes = policy.getScopes();
|
||||
|
||||
if ("scope".equals(policy.getType())) {
|
||||
Set<Resource> resources = policy.getResources();
|
||||
|
||||
if (Effect.PERMIT.equals(result.getStatus())) {
|
||||
List<Scope> scopes = policy.getScopes().stream().collect(Collectors.toList());
|
||||
|
||||
if (!resources.isEmpty()) {
|
||||
resources.forEach(resource -> grantPermission(authorizationProvider, permissions, new ResourcePermission(resource, scopes, policy.getResourceServer()), resourceServer.getId()));
|
||||
} else {
|
||||
grantPermission(authorizationProvider, permissions, new ResourcePermission(permission.getResource(), scopes, policy.getResourceServer()), resourceServer.getId());
|
||||
}
|
||||
}
|
||||
if (Effect.PERMIT.equals(policyResult.getStatus())) {
|
||||
if (isScopePermission(policy)) {
|
||||
// try to grant any scope from a scope-based permission
|
||||
grantedScopes.addAll(policyScopes);
|
||||
} else if (isResourcePermission(policy)) {
|
||||
// we assume that all requested scopes should be granted given that we are processing a resource-based permission.
|
||||
// Later they will be filtered based on any denied scope, if any.
|
||||
// TODO: we could probably provide a configuration option to let users decide whether or not a resource-based permission should grant all scopes associated with the resource.
|
||||
grantedScopes.addAll(permission.getScopes());
|
||||
}
|
||||
deniedCount--;
|
||||
} else {
|
||||
if (isScopePermission(policy)) {
|
||||
// store all scopes associated with the scope-based permission
|
||||
deniedScopes.addAll(policyScopes);
|
||||
} else if (isResourcePermission(policy)) {
|
||||
// we should not grant anything
|
||||
resourceDenied = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
continue;
|
||||
}
|
||||
|
||||
grantPermission(authorizationProvider, permissions, permission, resourceServer.getId());
|
||||
if (!resourceDenied) {
|
||||
// remove any scope denied from the list of granted scopes
|
||||
if (!deniedScopes.isEmpty()) {
|
||||
grantedScopes.removeAll(deniedScopes);
|
||||
}
|
||||
|
||||
// if there are no policy results is because the permission didn't match any policy.
|
||||
// In this case, if results is empty is because we are in permissive mode.
|
||||
if (!results.isEmpty()) {
|
||||
// update the current permission with the granted scopes
|
||||
permission.getScopes().clear();
|
||||
permission.getScopes().addAll(grantedScopes);
|
||||
}
|
||||
|
||||
if (deniedCount == 0) {
|
||||
result.setStatus(Effect.PERMIT);
|
||||
grantPermission(authorizationProvider, permissions, permission, resourceServerId);
|
||||
} else {
|
||||
// if a full deny or resource denied or the requested scopes were denied
|
||||
if (deniedCount == results.size() || resourceDenied || (!deniedScopes.isEmpty() && grantedScopes.isEmpty())) {
|
||||
result.setStatus(Effect.DENY);
|
||||
} else {
|
||||
result.setStatus(Effect.PERMIT);
|
||||
grantPermission(authorizationProvider, permissions, permission, resourceServerId);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return permissions.values().stream().collect(Collectors.toList());
|
||||
}
|
||||
|
||||
public static List<Permission> permits(List<Result> evaluation, AuthorizationProvider authorizationProvider, String resourceServer) {
|
||||
Map<String, Permission> permissions = new HashMap<>();
|
||||
private static boolean isResourcePermission(Policy policy) {
|
||||
return "resource".equals(policy.getType());
|
||||
}
|
||||
|
||||
for (Result evaluationResult : evaluation) {
|
||||
ResourcePermission permission = evaluationResult.getPermission();
|
||||
|
||||
if (evaluationResult.getEffect().equals(Effect.DENY)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
grantPermission(authorizationProvider, permissions, permission, resourceServer);
|
||||
}
|
||||
|
||||
return permissions.values().stream().collect(Collectors.toList());
|
||||
private static boolean isScopePermission(Policy policy) {
|
||||
return "scope".equals(policy.getType());
|
||||
}
|
||||
|
||||
private static void grantPermission(AuthorizationProvider authorizationProvider, Map<String, Permission> permissions, ResourcePermission permission, String resourceServer) {
|
||||
|
||||
Reference in new issue
Block a user