Java Code Examples for org.keycloak.models.ClientModel#addRole()

The following examples show how to use org.keycloak.models.ClientModel#addRole() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: MigrateTo1_2_0.java    From keycloak with Apache License 2.0 6 votes vote down vote up 
public void setupBrokerService(RealmModel realm) {
    ClientModel client = realm.getClientByClientId(Constants.BROKER_SERVICE_CLIENT_ID);
    if (client == null) {
        client = KeycloakModelUtils.createClient(realm, Constants.BROKER_SERVICE_CLIENT_ID);
        client.setEnabled(true);
        client.setName("${client_" + Constants.BROKER_SERVICE_CLIENT_ID + "}");
        client.setFullScopeAllowed(false);

        for (String role : Constants.BROKER_SERVICE_ROLES) {
            RoleModel roleModel = client.getRole(role);
            if (roleModel != null) continue;
            roleModel = client.addRole(role);
            roleModel.setDescription("${role_" + role.toLowerCase().replaceAll("_", "-") + "}");
        }
    }
}
Example 2
Source File: RealmManager.java    From keycloak with Apache License 2.0 6 votes vote down vote up 
public void setupBrokerService(RealmModel realm) {
    ClientModel client = realm.getClientByClientId(Constants.BROKER_SERVICE_CLIENT_ID);
    if (client == null) {
        client = KeycloakModelUtils.createClient(realm, Constants.BROKER_SERVICE_CLIENT_ID);
        client.setEnabled(true);
        client.setAlwaysDisplayInConsole(false);
        client.setName("${client_" + Constants.BROKER_SERVICE_CLIENT_ID + "}");
        client.setFullScopeAllowed(false);
        client.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);

        for (String role : Constants.BROKER_SERVICE_ROLES) {
            RoleModel roleModel = client.addRole(role);
            roleModel.setDescription("${role_"+ role.toLowerCase().replaceAll("_", "-") +"}");
        }
    }
}
Example 3
Source File: RealmManager.java    From keycloak with Apache License 2.0 6 votes vote down vote up 
private void checkRealmAdminManagementRoles(RealmModel realm) {
    if (realm.getName().equals(Config.getAdminRealm())) { return; } // don't need to do this for master realm

    String realmAdminClientId = getRealmAdminClientId(realm);
    ClientModel realmAdminClient = realm.getClientByClientId(realmAdminClientId);
    RoleModel adminRole = realmAdminClient.getRole(AdminRoles.REALM_ADMIN);

    // if realm-admin role isn't in the realm model, create it
    if (adminRole == null) {
        adminRole = realmAdminClient.addRole(AdminRoles.REALM_ADMIN);
        adminRole.setDescription("${role_" + AdminRoles.REALM_ADMIN + "}");
    }

    for (String r : AdminRoles.ALL_REALM_ROLES) {
        RoleModel found = realmAdminClient.getRole(r);
        if (found == null) {
            addAndSetAdminRole(r, realmAdminClient, adminRole);
        }
    }
    addQueryCompositeRoles(realmAdminClient);
}
Example 4
Source File: RealmManager.java    From keycloak with Apache License 2.0 6 votes vote down vote up 
private void setupRealmAdminManagement(RealmModel realm) {
    if (realm.getName().equals(Config.getAdminRealm())) { return; } // don't need to do this for master realm

    String realmAdminClientId = getRealmAdminClientId(realm);
    ClientModel realmAdminClient = realm.getClientByClientId(realmAdminClientId);
    if (realmAdminClient == null) {
        realmAdminClient = KeycloakModelUtils.createClient(realm, realmAdminClientId);
        realmAdminClient.setName("${client_" + realmAdminClientId + "}");
    }
    RoleModel adminRole = realmAdminClient.addRole(AdminRoles.REALM_ADMIN);
    adminRole.setDescription("${role_" + AdminRoles.REALM_ADMIN + "}");
    realmAdminClient.setBearerOnly(true);
    realmAdminClient.setFullScopeAllowed(false);
    realmAdminClient.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);

    for (String r : AdminRoles.ALL_REALM_ROLES) {
        addAndSetAdminRole(r, realmAdminClient, adminRole);
    }
    addQueryCompositeRoles(realmAdminClient);
}
Example 5
Source File: PolicyEvaluationCompositeRoleTest.java    From keycloak with Apache License 2.0 6 votes vote down vote up 
public static void setup(KeycloakSession session) {
    RealmModel realm = session.realms().getRealmByName(TEST);

    session.getContext().setRealm(realm);

    ClientModel client = session.realms().addClient(realm, "myclient");
    RoleModel role1 = client.addRole("client-role1");


    AuthorizationProviderFactory factory = (AuthorizationProviderFactory)session.getKeycloakSessionFactory().getProviderFactory(AuthorizationProvider.class);
    AuthorizationProvider authz = factory.create(session, realm);
    ResourceServer resourceServer = authz.getStoreFactory().getResourceServerStore().create(client.getId());
    Policy policy = createRolePolicy(authz, resourceServer, role1);

    Scope scope = authz.getStoreFactory().getScopeStore().create("myscope", resourceServer);
    Resource resource = authz.getStoreFactory().getResourceStore().create("myresource", resourceServer, resourceServer.getId());
    addScopePermission(authz, resourceServer, "mypermission", resource, scope, policy);

    RoleModel composite = realm.addRole("composite");
    composite.addCompositeRole(role1);

    UserModel user = session.users().addUser(realm, "user");
    user.grantRole(composite);
}
Example 6
Source File: ClientModelTest.java    From keycloak with Apache License 2.0 6 votes vote down vote up 
private ClientModel setUpClient(RealmModel realm) {
    ClientModel client = realm.addClient("application");
    client.setName("Application");
    client.setDescription("Description");
    client.setBaseUrl("http://base");
    client.setManagementUrl("http://management");
    client.setClientId("app-name");
    client.setProtocol("openid-connect");
    client.addRole("role-1");
    client.addRole("role-2");
    client.addRole("role-3");
    client.addDefaultRole("role-1");
    client.addDefaultRole("role-2");
    client.addRedirectUri("redirect-1");
    client.addRedirectUri("redirect-2");
    client.addWebOrigin("origin-1");
    client.addWebOrigin("origin-2");
    client.registerNode("node1", 10);
    client.registerNode("10.20.30.40", 50);
    client.addProtocolMapper(AddressMapper.createAddressMapper());
    client.updateClient();
    return client;
}
Example 7
Source File: FineGrainAdminUnitTest.java    From keycloak with Apache License 2.0 6 votes vote down vote up 
public static void setupDemo(KeycloakSession session) {
    RealmModel realm = session.realms().getRealmByName(TEST);
    realm.addRole("realm-role");
    ClientModel client = realm.addClient("sales-application");
    RoleModel clientAdmin = client.addRole("admin");
    client.addRole("leader-creator");
    client.addRole("viewLeads");
    GroupModel sales = realm.createGroup("sales");


    UserModel admin = session.users().addUser(realm, "salesManager");
    admin.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, admin, UserCredentialModel.password("password"));

    admin = session.users().addUser(realm, "sales-admin");
    admin.setEnabled(true);
    session.userCredentialManager().updateCredential(realm, admin, UserCredentialModel.password("password"));

    UserModel user = session.users().addUser(realm, "salesman");
    user.setEnabled(true);
    user.joinGroup(sales);

    user = session.users().addUser(realm, "saleswoman");
    user.setEnabled(true);

}
Example 8
Source File: MigrateTo3_2_0.java    From keycloak with Apache License 2.0 6 votes vote down vote up 
public void addRoles(ClientModel realmAccess) {
    RoleModel queryClients = realmAccess.getRole(AdminRoles.QUERY_CLIENTS);
    if (queryClients == null) {
        queryClients = realmAccess.addRole(AdminRoles.QUERY_CLIENTS);
        RoleModel viewClients = realmAccess.getRole(AdminRoles.VIEW_CLIENTS);
        if (viewClients != null) {
            viewClients.addCompositeRole(queryClients);
        }
    }
    RoleModel queryUsers = realmAccess.getRole(AdminRoles.QUERY_USERS);
    if (queryUsers == null) queryUsers = realmAccess.addRole(AdminRoles.QUERY_USERS);
    RoleModel queryGroups = realmAccess.getRole(AdminRoles.QUERY_GROUPS);
    if (queryGroups == null) queryGroups = realmAccess.addRole(AdminRoles.QUERY_GROUPS);

    RoleModel viewUsers = realmAccess.getRole(AdminRoles.VIEW_USERS);
    if (viewUsers != null) {
        if (!viewUsers.hasRole(queryUsers)) viewUsers.addCompositeRole(queryUsers);
        if (!viewUsers.hasRole(queryGroups)) viewUsers.addCompositeRole(queryGroups);
    }
}
Example 9
Source File: MigrateTo3_0_0.java    From keycloak with Apache License 2.0 6 votes vote down vote up 
protected void migrateRealm(RealmModel realm) {
    realm.getClients().stream()
            .filter(clientModel -> defaultClients.contains(clientModel.getId()))
            .filter(clientModel -> Objects.isNull(clientModel.getProtocol()))
            .forEach(clientModel -> clientModel.setProtocol("openid-connect"));

    ClientModel client = realm.getClientByClientId(ACCOUNT_MANAGEMENT_CLIENT_ID);
    if (client == null) return;
    RoleModel linkRole = client.getRole(MANAGE_ACCOUNT_LINKS);
    if (linkRole == null) {
        client.addRole(MANAGE_ACCOUNT_LINKS);
    }
    RoleModel manageAccount = client.getRole(MANAGE_ACCOUNT);
    if (manageAccount == null) return;
    RoleModel manageAccountLinks = client.getRole(MANAGE_ACCOUNT_LINKS);
    manageAccount.addCompositeRole(manageAccountLinks);
}
Example 10
Source File: RepresentationToModel.java    From keycloak with Apache License 2.0 5 votes vote down vote up 
public static ResourceServer createResourceServer(ClientModel client, KeycloakSession session, boolean addDefaultRoles) {
    if ((client.isBearerOnly() || client.isPublicClient())
            && !(client.getClientId().equals(Config.getAdminRealm() + "-realm") || client.getClientId().equals(Constants.REALM_MANAGEMENT_CLIENT_ID))) {
        throw new RuntimeException("Only confidential clients are allowed to set authorization settings");
    }
    AuthorizationProvider authorization = session.getProvider(AuthorizationProvider.class);
    UserModel serviceAccount = session.users().getServiceAccount(client);

    if (serviceAccount == null) {
        client.setServiceAccountsEnabled(true);
    }

    if (addDefaultRoles) {
        RoleModel umaProtectionRole = client.getRole(Constants.AUTHZ_UMA_PROTECTION);

        if (umaProtectionRole == null) {
            umaProtectionRole = client.addRole(Constants.AUTHZ_UMA_PROTECTION);
        }

        if (serviceAccount != null) {
            serviceAccount.grantRole(umaProtectionRole);
        }
    }

    ResourceServerRepresentation representation = new ResourceServerRepresentation();

    representation.setAllowRemoteResourceManagement(true);
    representation.setClientId(client.getId());

    return toModel(representation, authorization);
}
Example 11
Source File: RepresentationToModel.java    From keycloak with Apache License 2.0 5 votes vote down vote up 
public static void createFederatedClientRoleMappings(UserFederatedStorageProvider federatedStorage, RealmModel realm, ClientModel clientModel, UserRepresentation userRep, List<String> roleNames) {
    if (userRep == null) {
        throw new RuntimeException("User not found");
    }

    for (String roleName : roleNames) {
        RoleModel role = clientModel.getRole(roleName.trim());
        if (role == null) {
            role = clientModel.addRole(roleName.trim());
        }
        federatedStorage.grantRole(realm, userRep.getId(), role);

    }
}
Example 12
Source File: FineGrainAdminUnitTest.java    From keycloak with Apache License 2.0 5 votes vote down vote up 
public static void setupDeleteTest(KeycloakSession session )  {
    RealmModel realm = session.realms().getRealmByName(TEST);
    RoleModel removedRole = realm.addRole("removedRole");
    ClientModel client = realm.addClient("removedClient");
    RoleModel removedClientRole = client.addRole("removedClientRole");
    GroupModel removedGroup = realm.createGroup("removedGroup");
    AdminPermissionManagement management = AdminPermissions.management(session, realm);
    management.roles().setPermissionsEnabled(removedRole, true);
    management.roles().setPermissionsEnabled(removedClientRole, true);
    management.groups().setPermissionsEnabled(removedGroup, true);
    management.clients().setPermissionsEnabled(client, true);
    management.users().setPermissionsEnabled(true);
}
Example 13
Source File: RepresentationToModel.java    From keycloak with Apache License 2.0 5 votes vote down vote up 
public static void createClientRoleMappings(ClientModel clientModel, UserModel user, List<String> roleNames) {
    if (user == null) {
        throw new RuntimeException("User not found");
    }

    for (String roleName : roleNames) {
        RoleModel role = clientModel.getRole(roleName.trim());
        if (role == null) {
            role = clientModel.addRole(roleName.trim());
        }
        user.grantRole(role);

    }
}
Example 14
Source File: MultipleRealmsTest.java    From keycloak with Apache License 2.0 5 votes vote down vote up 
public static void createObjects(KeycloakSession session, RealmModel realm) {
    ClientModel app1 = realm.addClient("app1");
    realm.addClient("app2");

    session.users().addUser(realm, "user1");
    session.users().addUser(realm, "user2");

    realm.addRole("role1");
    realm.addRole("role2");

    app1.addRole("app1Role1");
    app1.addScopeMapping(realm.getRole("role1"));

    realm.addClient("cl1");
}
Example 15
Source File: RepresentationToModel.java    From keycloak with Apache License 2.0 5 votes vote down vote up 
public static void createClientScopeMappings(RealmModel realm, ClientModel clientModel, List<ScopeMappingRepresentation> mappings) {
    for (ScopeMappingRepresentation mapping : mappings) {
        ScopeContainerModel scopeContainer = getScopeContainerHavingScope(realm, mapping);

        for (String roleString : mapping.getRoles()) {
            RoleModel role = clientModel.getRole(roleString.trim());
            if (role == null) {
                role = clientModel.addRole(roleString.trim());
            }
            scopeContainer.addScopeMapping(role);
        }
    }
}
Example 16
Source File: RealmManager.java    From keycloak with Apache License 2.0 5 votes vote down vote up 
private void createMasterAdminManagement(RealmModel realm) {
    RealmModel adminRealm;
    RoleModel adminRole;

    if (realm.getName().equals(Config.getAdminRealm())) {
        adminRealm = realm;

        adminRole = realm.addRole(AdminRoles.ADMIN);

        RoleModel createRealmRole = realm.addRole(AdminRoles.CREATE_REALM);
        adminRole.addCompositeRole(createRealmRole);
        createRealmRole.setDescription("${role_" + AdminRoles.CREATE_REALM + "}");
    } else {
        adminRealm = model.getRealm(Config.getAdminRealm());
        adminRole = adminRealm.getRole(AdminRoles.ADMIN);
    }
    adminRole.setDescription("${role_"+AdminRoles.ADMIN+"}");

    ClientModel realmAdminApp = KeycloakModelUtils.createClient(adminRealm, KeycloakModelUtils.getMasterRealmAdminApplicationClientId(realm.getName()));
    // No localized name for now
    realmAdminApp.setName(realm.getName() + " Realm");
    realmAdminApp.setBearerOnly(true);
    realm.setMasterAdminClient(realmAdminApp);

    for (String r : AdminRoles.ALL_REALM_ROLES) {
        RoleModel role = realmAdminApp.addRole(r);
        role.setDescription("${role_"+r+"}");
        adminRole.addCompositeRole(role);
    }
    addQueryCompositeRoles(realmAdminApp);
}
Example 17
Source File: MigrateTo9_0_0.java    From keycloak with Apache License 2.0 5 votes vote down vote up 
private void addAccountApiRoles(RealmModel realm) {
    ClientModel accountClient = realm.getClientByClientId(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID);
    RoleModel viewAppRole = accountClient.addRole(AccountRoles.VIEW_APPLICATIONS);
    viewAppRole.setDescription("${role_" + AccountRoles.VIEW_APPLICATIONS + "}");
    LOG.debugf("Added the role %s to the '%s' client.", AccountRoles.VIEW_APPLICATIONS, Constants.ACCOUNT_MANAGEMENT_CLIENT_ID);
    RoleModel viewConsentRole = accountClient.addRole(AccountRoles.VIEW_CONSENT);
    viewConsentRole.setDescription("${role_" + AccountRoles.VIEW_CONSENT + "}");
    LOG.debugf("Added the role %s to the '%s' client.", AccountRoles.VIEW_CONSENT, Constants.ACCOUNT_MANAGEMENT_CLIENT_ID);
    RoleModel manageConsentRole = accountClient.addRole(AccountRoles.MANAGE_CONSENT);
    manageConsentRole.setDescription("${role_" + AccountRoles.MANAGE_CONSENT + "}");
    LOG.debugf("Added the role %s to the '%s' client.", AccountRoles.MANAGE_CONSENT, Constants.ACCOUNT_MANAGEMENT_CLIENT_ID);
    manageConsentRole.addCompositeRole(viewConsentRole);
    LOG.debugf("Added the %s role as a composite role to %s", AccountRoles.VIEW_CONSENT, AccountRoles.MANAGE_CONSENT);
}
Example 18
Source File: RealmManager.java    From keycloak with Apache License 2.0 4 votes vote down vote up 
private void addAndSetAdminRole(String roleName, ClientModel parentClient, RoleModel parentRole) {
    RoleModel role = parentClient.addRole(roleName);
    role.setDescription("${role_" + roleName + "}");
    parentRole.addCompositeRole(role);
}
Example 19
Source File: RealmManager.java    From keycloak with Apache License 2.0 4 votes vote down vote up 
private void setupAccountManagement(RealmModel realm) {
    ClientModel accountClient = realm.getClientByClientId(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID);
    if (accountClient == null) {
        accountClient = KeycloakModelUtils.createClient(realm, Constants.ACCOUNT_MANAGEMENT_CLIENT_ID);
        accountClient.setName("${client_" + Constants.ACCOUNT_MANAGEMENT_CLIENT_ID + "}");
        accountClient.setEnabled(true);
        accountClient.setAlwaysDisplayInConsole(false);
        accountClient.setFullScopeAllowed(false);

        accountClient.setRootUrl(Constants.AUTH_BASE_URL_PROP);
        String baseUrl = "/realms/" + realm.getName() + "/account/";
        accountClient.setBaseUrl(baseUrl);
        accountClient.addRedirectUri(baseUrl + "*");

        accountClient.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);

        for (String role : AccountRoles.ALL) {
            accountClient.addDefaultRole(role);
            RoleModel roleModel = accountClient.getRole(role);
            roleModel.setDescription("${role_" + role + "}");
        }
        RoleModel manageAccountLinks = accountClient.addRole(AccountRoles.MANAGE_ACCOUNT_LINKS);
        manageAccountLinks.setDescription("${role_" + AccountRoles.MANAGE_ACCOUNT_LINKS + "}");
        RoleModel manageAccount = accountClient.getRole(AccountRoles.MANAGE_ACCOUNT);
        manageAccount.addCompositeRole(manageAccountLinks);
        RoleModel viewAppRole = accountClient.addRole(AccountRoles.VIEW_APPLICATIONS);
        viewAppRole.setDescription("${role_" + AccountRoles.VIEW_APPLICATIONS + "}");
        RoleModel viewConsentRole = accountClient.addRole(AccountRoles.VIEW_CONSENT);
        viewConsentRole.setDescription("${role_" + AccountRoles.VIEW_CONSENT + "}");
        RoleModel manageConsentRole = accountClient.addRole(AccountRoles.MANAGE_CONSENT);
        manageConsentRole.setDescription("${role_" + AccountRoles.MANAGE_CONSENT + "}");
        manageConsentRole.addCompositeRole(viewConsentRole);

        ClientModel accountConsoleClient = realm.getClientByClientId(Constants.ACCOUNT_CONSOLE_CLIENT_ID);
        if (accountConsoleClient == null) {
            accountConsoleClient = KeycloakModelUtils.createClient(realm, Constants.ACCOUNT_CONSOLE_CLIENT_ID);
            accountConsoleClient.setName("${client_" + Constants.ACCOUNT_CONSOLE_CLIENT_ID + "}");
            accountConsoleClient.setEnabled(true);
            accountConsoleClient.setAlwaysDisplayInConsole(false);
            accountConsoleClient.setFullScopeAllowed(false);
            accountConsoleClient.setPublicClient(true);
            accountConsoleClient.setDirectAccessGrantsEnabled(false);

            accountConsoleClient.setRootUrl(Constants.AUTH_BASE_URL_PROP);
            accountConsoleClient.setBaseUrl(baseUrl);
            accountConsoleClient.addRedirectUri(baseUrl + "*");

            accountConsoleClient.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);

            accountConsoleClient.addScopeMapping(accountClient.getRole(AccountRoles.MANAGE_ACCOUNT));

            ProtocolMapperModel audienceMapper = new ProtocolMapperModel();
            audienceMapper.setName(OIDCLoginProtocolFactory.AUDIENCE_RESOLVE);
            audienceMapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
            audienceMapper.setProtocolMapper(AudienceResolveProtocolMapper.PROVIDER_ID);

            accountConsoleClient.addProtocolMapper(audienceMapper);

            accountConsoleClient.setAttribute(OIDCConfigAttributes.PKCE_CODE_CHALLENGE_METHOD, "S256");
        }
    }
}