org.keycloak.authorization.policy.evaluation.DefaultEvaluation クラス

org.keycloak.authorization.policy.evaluation.DefaultEvaluation の継承関係図

org.keycloak.authorization.policy.evaluation.DefaultEvaluation 連携図

公開メンバ関数
	DefaultEvaluation (ResourcePermission permission, EvaluationContext executionContext, Policy parentPolicy, Decision decision, AuthorizationProvider authorizationProvider, Map< Policy, Map< Object, Decision.Effect >> decisionCache)
	DefaultEvaluation (ResourcePermission permission, EvaluationContext executionContext, Decision decision, AuthorizationProvider authorizationProvider)
	DefaultEvaluation (ResourcePermission permission, EvaluationContext executionContext, Policy parentPolicy, Policy policy, Decision decision, AuthorizationProvider authorizationProvider, Map< Policy, Map< Object, Decision.Effect >> decisionCache)
ResourcePermission	getPermission ()
EvaluationContext	getContext ()
void	grant ()
void	deny ()
Policy	getPolicy ()
Realm	getRealm ()
AuthorizationProvider	getAuthorizationProvider ()
Policy	getParentPolicy ()
Effect	getEffect ()
Map< Policy, Map< Object, Effect > >	getDecisionCache ()
void	denyIfNoEffect ()
void	setPolicy (Policy policy)
void	setEffect (Effect effect)

非公開メンバ関数
Realm	createRealm ()

非公開変数類
final ResourcePermission	permission
final EvaluationContext	executionContext
final Decision	decision
Policy	policy
final Policy	parentPolicy
final AuthorizationProvider	authorizationProvider
Map< Policy, Map< Object, Effect > >	decisionCache
final Realm	realm
Effect	effect

詳解

著者

Pedro Igor

構築子と解体子

DefaultEvaluation() [1/3]

org.keycloak.authorization.policy.evaluation.DefaultEvaluation.DefaultEvaluation ( ResourcePermission  permission, EvaluationContext  executionContext, Policy  parentPolicy, Decision  decision, AuthorizationProvider  authorizationProvider, Map< Policy, Map< Object, Decision.Effect >>  decisionCache  )

inline

                                                                                                                                                                                                                                              {
        this(permission, executionContext, parentPolicy, null, decision, authorizationProvider, decisionCache);
    }

DefaultEvaluation() [2/3]

org.keycloak.authorization.policy.evaluation.DefaultEvaluation.DefaultEvaluation ( ResourcePermission  permission, EvaluationContext  executionContext, Decision  decision, AuthorizationProvider  authorizationProvider  )

inline

                                                                                                                                                                {
        this(permission, executionContext, null, null, decision, authorizationProvider, Collections.emptyMap());
    }

DefaultEvaluation() [3/3]

org.keycloak.authorization.policy.evaluation.DefaultEvaluation.DefaultEvaluation ( ResourcePermission  permission, EvaluationContext  executionContext, Policy  parentPolicy, Policy  policy, Decision  decision, AuthorizationProvider  authorizationProvider, Map< Policy, Map< Object, Decision.Effect >>  decisionCache  )

inline

                                                                                                                                                                                                                                                             {
        this.permission = permission;
        this.executionContext = executionContext;
        this.parentPolicy = parentPolicy;
        this.policy = policy;
        this.decision = decision;
        this.authorizationProvider = authorizationProvider;
        this.decisionCache = decisionCache;
        this.realm = createRealm();
    }

関数詳解

createRealm()

Realm org.keycloak.authorization.policy.evaluation.DefaultEvaluation.createRealm ( )

inlineprivate

                                {
        return new Realm() {

            @Override
            public boolean isUserInGroup(String id, String groupId, boolean checkParent) {
                KeycloakSession session = authorizationProvider.getKeycloakSession();
                UserModel user = getUser(id, session);

                if (Objects.isNull(user)) {
                    return false;
                }

                RealmModel realm = session.getContext().getRealm();
                GroupModel group = KeycloakModelUtils.findGroupByPath(realm, groupId);

                if (Objects.isNull(group)) {
                    return false;
                }

                if (checkParent) {
                    return RoleUtils.isMember(user.getGroups(), group);
                }

                return user.isMemberOf(group);
            }

            private UserModel getUser(String id, KeycloakSession session) {
                RealmModel realm = session.getContext().getRealm();
                UserModel user = session.users().getUserById(id, realm);

                if (Objects.isNull(user)) {
                    user = session.users().getUserByUsername(id, realm);

                    if (Objects.isNull(user)) {
                        user = session.users().getUserByEmail(id, realm);
                    }
                }

                return user;
            }

            @Override
            public boolean isUserInRealmRole(String id, String roleName) {
                KeycloakSession session = authorizationProvider.getKeycloakSession();
                UserModel user = getUser(id, session);

                if (Objects.isNull(user)) {
                    return false;
                }

                Set<RoleModel> roleMappings = user.getRoleMappings().stream()
                        .filter(role -> !role.isClientRole())
                        .collect(Collectors.toSet());

                return RoleUtils.hasRole(roleMappings, session.getContext().getRealm().getRole(roleName));
            }

            @Override
            public boolean isUserInClientRole(String id, String clientId, String roleName) {
                KeycloakSession session = authorizationProvider.getKeycloakSession();
                RealmModel realm = session.getContext().getRealm();
                UserModel user = getUser(id, session);

                if (Objects.isNull(user)) {
                    return false;
                }

                Set<RoleModel> roleMappings = user.getRoleMappings().stream()
                        .filter(role -> role.isClientRole() && ClientModel.class.cast(role.getContainer()).getClientId().equals(clientId))
                        .collect(Collectors.toSet());

                if (roleMappings.isEmpty()) {
                    return false;
                }

                RoleModel role = realm.getClientById(ClientModel.class.cast(roleMappings.iterator().next().getContainer()).getId()).getRole(roleName);

                if (Objects.isNull(role)) {
                    return false;
                }

                return RoleUtils.hasRole(roleMappings, role);
            }

            @Override
            public boolean isGroupInRole(String id, String role) {
                KeycloakSession session = authorizationProvider.getKeycloakSession();
                RealmModel realm = session.getContext().getRealm();
                GroupModel group = KeycloakModelUtils.findGroupByPath(realm, id);

                return RoleUtils.hasRoleFromGroup(group, realm.getRole(role), false);
            }

            @Override
            public List<String> getUserRealmRoles(String id) {
                return getUser(id, authorizationProvider.getKeycloakSession()).getRoleMappings().stream()
                        .filter(role -> !role.isClientRole())
                        .map(RoleModel::getName)
                        .collect(Collectors.toList());
            }

            @Override
            public List<String> getUserClientRoles(String id, String clientId) {
                return getUser(id, authorizationProvider.getKeycloakSession()).getRoleMappings().stream()
                        .filter(role -> role.isClientRole())
                        .map(RoleModel::getName)
                        .collect(Collectors.toList());
            }

            @Override
            public List<String> getUserGroups(String id) {
                return getUser(id, authorizationProvider.getKeycloakSession()).getGroups().stream()
                        .map(ModelToRepresentation::buildGroupPath)
                        .collect(Collectors.toList());
            }

            @Override
            public Map<String, List<String>> getUserAttributes(String id) {
                Map<String, List<String>> attributes = getUser(id, authorizationProvider.getKeycloakSession()).getAttributes();
                return attributes;
            }
        };
    }

deny()

void org.keycloak.authorization.policy.evaluation.DefaultEvaluation.deny ( )

inline

org.keycloak.authorization.policy.evaluation.Evaluationを実装しています。

                       {
        if (policy != null && Logic.NEGATIVE.equals(policy.getLogic())) {
            this.effect = Effect.PERMIT;
        } else {
            this.effect = Effect.DENY;
        }

        this.decision.onDecision(this);
    }

denyIfNoEffect()

void org.keycloak.authorization.policy.evaluation.DefaultEvaluation.denyIfNoEffect ( )

inline

org.keycloak.authorization.policy.evaluation.Evaluationを実装しています。

                                 {
        if (this.effect == null) {
            deny();
        }
    }

getAuthorizationProvider()

AuthorizationProvider org.keycloak.authorization.policy.evaluation.DefaultEvaluation.getAuthorizationProvider ( )

inline

org.keycloak.authorization.policy.evaluation.Evaluationを実装しています。

                                                            {
        return authorizationProvider;
    }

getContext()

EvaluationContext org.keycloak.authorization.policy.evaluation.DefaultEvaluation.getContext ( )

inline

org.keycloak.authorization.policy.evaluation.Evaluationを実装しています。

                                          {
        return this.executionContext;
    }

getDecisionCache()

Map<Policy, Map<Object, Effect> > org.keycloak.authorization.policy.evaluation.DefaultEvaluation.getDecisionCache ( )

inline

                                                               {
        return decisionCache;
    }

getEffect()

Effect org.keycloak.authorization.policy.evaluation.DefaultEvaluation.getEffect ( )

inline

                              {
        return effect;
    }

getParentPolicy()

Policy org.keycloak.authorization.policy.evaluation.DefaultEvaluation.getParentPolicy ( )

inline

                                    {
        return this.parentPolicy;
    }

getPermission()

ResourcePermission org.keycloak.authorization.policy.evaluation.DefaultEvaluation.getPermission ( )

inline

org.keycloak.authorization.policy.evaluation.Evaluationを実装しています。

                                              {
        return this.permission;
    }

getPolicy()

Policy org.keycloak.authorization.policy.evaluation.DefaultEvaluation.getPolicy ( )

inline

org.keycloak.authorization.policy.evaluation.Evaluationを実装しています。

                              {
        if (policy == null) {
            return parentPolicy;
        }
        return this.policy;
    }

getRealm()

Realm org.keycloak.authorization.policy.evaluation.DefaultEvaluation.getRealm ( )

inline

org.keycloak.authorization.policy.evaluation.Evaluationを実装しています。

                            {
        return realm;
    }

grant()

void org.keycloak.authorization.policy.evaluation.DefaultEvaluation.grant ( )

inline

org.keycloak.authorization.policy.evaluation.Evaluationを実装しています。

                        {
        if (policy != null && Logic.NEGATIVE.equals(policy.getLogic())) {
            this.effect = Effect.DENY;
        } else {
            this.effect = Effect.PERMIT;
        }

        this.decision.onDecision(this);
    }

setEffect()

void org.keycloak.authorization.policy.evaluation.DefaultEvaluation.setEffect ( Effect  effect )

inline

                                         {
        if (Effect.PERMIT.equals(effect)) {
            grant();
        } else {
            deny();
        }
    }

setPolicy()

void org.keycloak.authorization.policy.evaluation.DefaultEvaluation.setPolicy ( Policy  policy )

inline

                                         {
        this.policy = policy;
        this.effect = null;
    }

メンバ詳解

authorizationProvider

final AuthorizationProvider org.keycloak.authorization.policy.evaluation.DefaultEvaluation.authorizationProvider

private

decision

final Decision org.keycloak.authorization.policy.evaluation.DefaultEvaluation.decision

private

decisionCache

Map<Policy, Map<Object, Effect> > org.keycloak.authorization.policy.evaluation.DefaultEvaluation.decisionCache

private

effect

Effect org.keycloak.authorization.policy.evaluation.DefaultEvaluation.effect

private

executionContext

final EvaluationContext org.keycloak.authorization.policy.evaluation.DefaultEvaluation.executionContext

private

parentPolicy

final Policy org.keycloak.authorization.policy.evaluation.DefaultEvaluation.parentPolicy

private

permission

final ResourcePermission org.keycloak.authorization.policy.evaluation.DefaultEvaluation.permission

private

policy

Policy org.keycloak.authorization.policy.evaluation.DefaultEvaluation.policy

private

realm

final Realm org.keycloak.authorization.policy.evaluation.DefaultEvaluation.realm

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/src/keycloak/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultEvaluation.java