org.keycloak.authorization.AuthorizationProvider クラス

org.keycloak.authorization.AuthorizationProvider の継承関係図

org.keycloak.authorization.AuthorizationProvider 連携図

公開メンバ関数
	AuthorizationProvider (KeycloakSession session, RealmModel realm, Map< String, PolicyProviderFactory > policyProviderFactories, PolicyEvaluator policyEvaluator)
Evaluators	evaluators ()
StoreFactory	getStoreFactory ()
StoreFactory	getLocalStoreFactory ()
Collection< PolicyProviderFactory >	getProviderFactories ()
KeycloakSession	getKeycloakSession ()
RealmModel	getRealm ()
PolicyEvaluator	getPolicyEvaluator ()
void	close ()

関数
public< F extends PolicyProviderFactory > F	getProviderFactory (String type)
public< P extends PolicyProvider > P	getProvider (String type)

非公開メンバ関数
StoreFactory	createStoreFactory (StoreFactory storeFactory)
ScopeStore	createScopeWrapper (StoreFactory storeFactory)
PolicyStore	createPolicyWrapper (StoreFactory storeFactory)
ResourceStore	createResourceStoreWrapper (StoreFactory storeFactory)

非公開変数類
final PolicyEvaluator	policyEvaluator
StoreFactory	storeFactory
StoreFactory	storeFactoryDelegate
final Map< String, PolicyProviderFactory >	policyProviderFactories
final KeycloakSession	keycloakSession
final RealmModel	realm

詳解

The main contract here is the creation of org.keycloak.authorization.permission.evaluator.PermissionEvaluator instances. Usually an application has a single AuthorizationProvider instance and threads servicing client requests obtain org.keycloak.authorization.permission.evaluator.PermissionEvaluator from the evaluators() method.

The internal state of a AuthorizationProvider is immutable. This internal state includes all of the metadata used during the evaluation of policies.

Once created, org.keycloak.authorization.permission.evaluator.PermissionEvaluator instances can be obtained from the evaluators() method:

    List<ResourcePermission> permissionsToEvaluate = getPermissions(); // the permissions to evaluate
    EvaluationContext evaluationContext = createEvaluationContext(); // the context with runtime environment information
    PermissionEvaluator evaluator = authorization.evaluators().from(permissionsToEvaluate, context);

    evaluator.evaluate(new Decision() {

        public void onDecision(Evaluation evaluation) {
             // do something on grant
        }

    });

著者

Pedro Igor

構築子と解体子

AuthorizationProvider()

org.keycloak.authorization.AuthorizationProvider.AuthorizationProvider ( KeycloakSession  session, RealmModel  realm, Map< String, PolicyProviderFactory >  policyProviderFactories, PolicyEvaluator  policyEvaluator  )

inline

                                                                                                                                                                         {
        this.keycloakSession = session;
        this.realm = realm;
        this.policyProviderFactories = policyProviderFactories;
        this.policyEvaluator = policyEvaluator;
    }

関数詳解

close()

void org.keycloak.authorization.AuthorizationProvider.close ( )

inline

org.keycloak.provider.Providerを実装しています。

                        {

    }

createPolicyWrapper()

PolicyStore org.keycloak.authorization.AuthorizationProvider.createPolicyWrapper ( StoreFactory  storeFactory )

inlineprivate

                                                                       {
        return new PolicyStore() {

            PolicyStore policyStore = storeFactory.getPolicyStore();

            @Override
            public Policy create(AbstractPolicyRepresentation representation, ResourceServer resourceServer) {
                Set<String> resources = representation.getResources();

                if (resources != null) {
                    representation.setResources(resources.stream().map(id -> {
                        Resource resource = storeFactory.getResourceStore().findById(id, resourceServer.getId());

                        if (resource == null) {
                            resource = storeFactory.getResourceStore().findByName(id, resourceServer.getId());
                        }

                        if (resource == null) {
                            throw new RuntimeException("Resource [" + id + "] does not exist or is not owned by the resource server.");
                        }

                        return resource.getId();
                    }).collect(Collectors.toSet()));
                }

                Set<String> scopes = representation.getScopes();

                if (scopes != null) {
                    representation.setScopes(scopes.stream().map(id -> {
                        Scope scope = storeFactory.getScopeStore().findById(id, resourceServer.getId());

                        if (scope == null) {
                            scope = storeFactory.getScopeStore().findByName(id, resourceServer.getId());
                        }

                        if (scope == null) {
                            throw new RuntimeException("Scope [" + id + "] does not exist");
                        }

                        return scope.getId();
                    }).collect(Collectors.toSet()));
                }


                Set<String> policies = representation.getPolicies();

                if (policies != null) {
                    representation.setPolicies(policies.stream().map(id -> {
                        Policy policy = storeFactory.getPolicyStore().findById(id, resourceServer.getId());

                        if (policy == null) {
                            policy = storeFactory.getPolicyStore().findByName(id, resourceServer.getId());
                        }

                        if (policy == null) {
                            throw new RuntimeException("Policy [" + id + "] does not exist");
                        }

                        return policy.getId();
                    }).collect(Collectors.toSet()));
                }

                return RepresentationToModel.toModel(representation, AuthorizationProvider.this, policyStore.create(representation, resourceServer));
            }

            @Override
            public void delete(String id) {
                Policy policy = findById(id, null);

                if (policy != null) {
                    ResourceServer resourceServer = policy.getResourceServer();

                    findDependentPolicies(policy.getId(), resourceServer.getId()).forEach(dependentPolicy -> {
                        dependentPolicy.removeAssociatedPolicy(policy);
                        if (dependentPolicy.getAssociatedPolicies().isEmpty()) {
                            delete(dependentPolicy.getId());
                        }
                    });

                    policyStore.delete(id);
                }
            }

            @Override
            public Policy findById(String id, String resourceServerId) {
                return policyStore.findById(id, resourceServerId);
            }

            @Override
            public Policy findByName(String name, String resourceServerId) {
                return policyStore.findByName(name, resourceServerId);
            }

            @Override
            public List<Policy> findByResourceServer(String resourceServerId) {
                return policyStore.findByResourceServer(resourceServerId);
            }

            @Override
            public List<Policy> findByResourceServer(Map<String, String[]> attributes, String resourceServerId, int firstResult, int maxResult) {
                return policyStore.findByResourceServer(attributes, resourceServerId, firstResult, maxResult);
            }

            @Override
            public List<Policy> findByResource(String resourceId, String resourceServerId) {
                return policyStore.findByResource(resourceId, resourceServerId);
            }

            @Override
            public void findByResource(String resourceId, String resourceServerId, Consumer<Policy> consumer) {
                policyStore.findByResource(resourceId, resourceServerId, consumer);
            }

            @Override
            public List<Policy> findByResourceType(String resourceType, String resourceServerId) {
                return policyStore.findByResourceType(resourceType, resourceServerId);
            }

            @Override
            public List<Policy> findByScopeIds(List<String> scopeIds, String resourceServerId) {
                return policyStore.findByScopeIds(scopeIds, resourceServerId);
            }

            @Override
            public List<Policy> findByScopeIds(List<String> scopeIds, String resourceId, String resourceServerId) {
                return policyStore.findByScopeIds(scopeIds, resourceId, resourceServerId);
            }

            @Override
            public void findByScopeIds(List<String> scopeIds, String resourceId, String resourceServerId, Consumer<Policy> consumer) {
                policyStore.findByScopeIds(scopeIds, resourceId, resourceServerId, consumer);
            }

            @Override
            public List<Policy> findByType(String type, String resourceServerId) {
                return policyStore.findByType(type, resourceServerId);
            }

            @Override
            public List<Policy> findDependentPolicies(String id, String resourceServerId) {
                return policyStore.findDependentPolicies(id, resourceServerId);
            }

            @Override
            public void findByResourceType(String type, String id, Consumer<Policy> policyConsumer) {
                policyStore.findByResourceType(type, id, policyConsumer);
            }
        };
    }

createResourceStoreWrapper()

ResourceStore org.keycloak.authorization.AuthorizationProvider.createResourceStoreWrapper ( StoreFactory  storeFactory )

inlineprivate

                                                                                {
        return new ResourceStore() {
            ResourceStore delegate = storeFactory.getResourceStore();

            @Override
            public Resource create(String name, ResourceServer resourceServer, String owner) {
                return delegate.create(name, resourceServer, owner);
            }

            @Override
            public Resource create(String id, String name, ResourceServer resourceServer, String owner) {
                return delegate.create(id, name, resourceServer, owner);
            }

            @Override
            public void delete(String id) {
                Resource resource = findById(id, null);
                StoreFactory storeFactory = AuthorizationProvider.this.getStoreFactory();
                PermissionTicketStore ticketStore = storeFactory.getPermissionTicketStore();
                List<PermissionTicket> permissions = ticketStore.findByResource(id, resource.getResourceServer().getId());

                for (PermissionTicket permission : permissions) {
                    ticketStore.delete(permission.getId());
                }

                PolicyStore policyStore = storeFactory.getPolicyStore();
                List<Policy> policies = policyStore.findByResource(id, resource.getResourceServer().getId());

                for (Policy policyModel : policies) {
                    if (policyModel.getResources().size() == 1) {
                        policyStore.delete(policyModel.getId());
                    } else {
                        policyModel.removeResource(resource);
                    }
                }

                delegate.delete(id);
            }

            @Override
            public Resource findById(String id, String resourceServerId) {
                return delegate.findById(id, resourceServerId);
            }

            @Override
            public List<Resource> findByOwner(String ownerId, String resourceServerId) {
                return delegate.findByOwner(ownerId, resourceServerId);
            }

            @Override
            public void findByOwner(String ownerId, String resourceServerId, Consumer<Resource> consumer) {
                delegate.findByOwner(ownerId, resourceServerId, consumer);
            }

            @Override
            public List<Resource> findByUri(String uri, String resourceServerId) {
                return delegate.findByUri(uri, resourceServerId);
            }

            @Override
            public List<Resource> findByResourceServer(String resourceServerId) {
                return delegate.findByResourceServer(resourceServerId);
            }

            @Override
            public List<Resource> findByResourceServer(Map<String, String[]> attributes, String resourceServerId, int firstResult, int maxResult) {
                return delegate.findByResourceServer(attributes, resourceServerId, firstResult, maxResult);
            }

            @Override
            public List<Resource> findByScope(List<String> id, String resourceServerId) {
                return delegate.findByScope(id, resourceServerId);
            }

            @Override
            public void findByScope(List<String> scopes, String resourceServerId, Consumer<Resource> consumer) {
                delegate.findByScope(scopes, resourceServerId, consumer);
            }

            @Override
            public Resource findByName(String name, String resourceServerId) {
                return delegate.findByName(name, resourceServerId);
            }

            @Override
            public Resource findByName(String name, String ownerId, String resourceServerId) {
                return delegate.findByName(name, ownerId, resourceServerId);
            }

            @Override
            public List<Resource> findByType(String type, String resourceServerId) {
                return delegate.findByType(type, resourceServerId);
            }

            @Override
            public void findByType(String type, String resourceServerId, Consumer<Resource> consumer) {
                delegate.findByType(type, resourceServerId, consumer);
            }
        };
    }

createScopeWrapper()

ScopeStore org.keycloak.authorization.AuthorizationProvider.createScopeWrapper ( StoreFactory  storeFactory )

inlineprivate

                                                                     {
        return new ScopeStore() {

            ScopeStore delegate = storeFactory.getScopeStore();

            @Override
            public Scope create(String name, ResourceServer resourceServer) {
                return delegate.create(name, resourceServer);
            }

            @Override
            public Scope create(String id, String name, ResourceServer resourceServer) {
                return delegate.create(id, name, resourceServer);
            }

            @Override
            public void delete(String id) {
                Scope scope = findById(id, null);
                PermissionTicketStore ticketStore = AuthorizationProvider.this.getStoreFactory().getPermissionTicketStore();
                List<PermissionTicket> permissions = ticketStore.findByScope(id, scope.getResourceServer().getId());

                for (PermissionTicket permission : permissions) {
                    ticketStore.delete(permission.getId());
                }

                delegate.delete(id);
            }

            @Override
            public Scope findById(String id, String resourceServerId) {
                return delegate.findById(id, resourceServerId);
            }

            @Override
            public Scope findByName(String name, String resourceServerId) {
                return delegate.findByName(name, resourceServerId);
            }

            @Override
            public List<Scope> findByResourceServer(String id) {
                return delegate.findByResourceServer(id);
            }

            @Override
            public List<Scope> findByResourceServer(Map<String, String[]> attributes, String resourceServerId, int firstResult, int maxResult) {
                return delegate.findByResourceServer(attributes, resourceServerId, firstResult, maxResult);
            }
        };
    }

createStoreFactory()

StoreFactory org.keycloak.authorization.AuthorizationProvider.createStoreFactory ( StoreFactory  storeFactory )

inlineprivate

                                                                       {
        return new StoreFactory() {

            ResourceStore resourceStore;
            ScopeStore scopeStore;
            PolicyStore policyStore;

            @Override
            public ResourceStore getResourceStore() {
                if (resourceStore == null) {
                    resourceStore = createResourceStoreWrapper(storeFactory);
                }
                return resourceStore;
            }

            @Override
            public ResourceServerStore getResourceServerStore() {
                return storeFactory.getResourceServerStore();
            }

            @Override
            public ScopeStore getScopeStore() {
                if (scopeStore == null) {
                    scopeStore = createScopeWrapper(storeFactory);
                }
                return scopeStore;
            }

            @Override
            public PolicyStore getPolicyStore() {
                if (policyStore == null) {
                    policyStore = createPolicyWrapper(storeFactory);
                }
                return policyStore;
            }

            @Override
            public PermissionTicketStore getPermissionTicketStore() {
                return storeFactory.getPermissionTicketStore();
            }

            @Override
            public void close() {
                storeFactory.close();
            }
        };
    }

evaluators()

Evaluators org.keycloak.authorization.AuthorizationProvider.evaluators ( )

inline

Returns a Evaluators instance from where org.keycloak.authorization.policy.evaluation.PolicyEvaluator instances can be obtained.

戻り値

a Evaluators instance

                                   {
        return new Evaluators(this);
    }

getKeycloakSession()

KeycloakSession org.keycloak.authorization.AuthorizationProvider.getKeycloakSession ( )

inline

                                                {
        return this.keycloakSession;
    }

getLocalStoreFactory()

StoreFactory org.keycloak.authorization.AuthorizationProvider.getLocalStoreFactory ( )

inline

No cache sits in front of this

戻り値

                                               {
        if (storeFactoryDelegate != null) return storeFactoryDelegate;
        storeFactoryDelegate = keycloakSession.getProvider(StoreFactory.class);
        return storeFactoryDelegate;
    }

getPolicyEvaluator()

PolicyEvaluator org.keycloak.authorization.AuthorizationProvider.getPolicyEvaluator ( )

inline

                                                {
        return policyEvaluator;
    }

getProvider()

public<P extends PolicyProvider> P org.keycloak.authorization.AuthorizationProvider.getProvider ( String  type )

inlinepackage

Returns a PolicyProviderFactory given a type.

引数

type	the type of the policy provider
<P>	the expected type of the provider

戻り値

a PolicyProvider with the given type

                                                                 {
        PolicyProviderFactory policyProviderFactory = policyProviderFactories.get(type);

        if (policyProviderFactory == null) {
            return null;
        }

        return (P) policyProviderFactory.create(this);
    }

getProviderFactories()

Collection<PolicyProviderFactory> org.keycloak.authorization.AuthorizationProvider.getProviderFactories ( )

inline

Returns the registered PolicyProviderFactory.

戻り値

a List containing all registered PolicyProviderFactory

                                                                    {
        return this.policyProviderFactories.values();
    }

getProviderFactory()

public<F extends PolicyProviderFactory> F org.keycloak.authorization.AuthorizationProvider.getProviderFactory ( String  type )

inlinepackage

Returns a PolicyProviderFactory given a type.

引数

type	the type of the policy provider
<F>	the expected type of the provider

戻り値

a PolicyProviderFactory with the given type

                                                                               {
        return (F) policyProviderFactories.get(type);
    }

getRealm()

RealmModel org.keycloak.authorization.AuthorizationProvider.getRealm ( )

inline

                                 {
        return realm;
    }

getStoreFactory()

StoreFactory org.keycloak.authorization.AuthorizationProvider.getStoreFactory ( )

inline

Cache sits in front of this

Returns a StoreFactory.

戻り値

the StoreFactory

                                          {
        if (storeFactory != null) return storeFactory;
        storeFactory = keycloakSession.getProvider(CachedStoreFactoryProvider.class);
        if (storeFactory == null) storeFactory = getLocalStoreFactory();
        storeFactory = createStoreFactory(storeFactory);
        return storeFactory;
    }

メンバ詳解

keycloakSession

final KeycloakSession org.keycloak.authorization.AuthorizationProvider.keycloakSession

private

policyEvaluator

final PolicyEvaluator org.keycloak.authorization.AuthorizationProvider.policyEvaluator

private

policyProviderFactories

final Map<String, PolicyProviderFactory> org.keycloak.authorization.AuthorizationProvider.policyProviderFactories

private

realm

final RealmModel org.keycloak.authorization.AuthorizationProvider.realm

private

storeFactory

StoreFactory org.keycloak.authorization.AuthorizationProvider.storeFactory

private

storeFactoryDelegate

StoreFactory org.keycloak.authorization.AuthorizationProvider.storeFactoryDelegate

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/oidc-service/src/main/java/org/keycloak/authorization/AuthorizationProvider.java