Package org.keycloak.services.resources.admin.fgap

Interface ClientPermissionEvaluator

public interface ClientPermissionEvaluator
Version:
$Revision: 1 $
Author:
Bill Burke

  • Method Details

    • isPermissionsEnabled

      boolean isPermissionsEnabled(org.keycloak.models.ClientModel client)

    • setPermissionsEnabled

      void setPermissionsEnabled(org.keycloak.models.ClientModel client, boolean enable)

    • requireListClientScopes

      void requireListClientScopes()
      Throws ForbiddenException if canListClientScopes() returns false.

    • canManage

      boolean canManage()
      Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.

      For V2 only: Also if it has permission to AdminPermissionsSchema.MANAGE.

    • requireManage

      void requireManage()
      Throws ForbiddenException if canManage() returns false.

    • canManageClientScopes

      boolean canManageClientScopes()
      Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.

      For V2 only: Also if it has permission to AdminPermissionsSchema.MANAGE.

    • requireManageClientScopes

      void requireManageClientScopes()
      Throws ForbiddenException if canManageClientScopes() returns false.

    • canView

      boolean canView()
      Returns true if the caller has at least one of the AdminRoles.MANAGE_CLIENTS or AdminRoles.VIEW_CLIENTS roles.

      For V2 only: Also if it has permission to AdminPermissionsSchema.VIEW.

    • canList

      boolean canList()
      Returns true if canView() returns true.

      Or if the caller has at least one of the AdminRoles.QUERY_CLIENTS role.

      V1: or AdminRoles.QUERY_USERS roles.

    • canViewClientScopes

      boolean canViewClientScopes()
      Returns true if canView() returns true.

    • requireList

      void requireList()
      Throws ForbiddenException if canList() returns false.

    • canListClientScopes

      boolean canListClientScopes()
      Returns true if canView() returns true.

      Or if the caller has AdminRoles.QUERY_CLIENTS role.

    • requireView

      void requireView()
      Returns true if canView() returns true.

    • requireViewClientScopes

      void requireViewClientScopes()
      Returns true if canViewClientScopes() returns true.

    • canManage

      boolean canManage(org.keycloak.models.ClientModel client)
      Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.

      Or if the caller has a permission to AdminPermissionManagement.MANAGE_SCOPE the client.

      For V2 only: Also if the caller has a permission to AdminPermissionsSchema.MANAGE all clients.

    • canConfigure

      boolean canConfigure(org.keycloak.models.ClientModel client)
      Returns true if canManage(ClientModel) returns true.

      Or if the caller has a permission to ClientPermissionManagement.CONFIGURE_SCOPE the client.

      For V2 only: the call is redirected to canManage(ClientModel).

    • requireConfigure

      void requireConfigure(org.keycloak.models.ClientModel client)
      Throws ForbiddenException if canConfigure(ClientModel) returns false.

      For V2 only: the call is redirected to requireManage(ClientModel).

    • requireManage

      void requireManage(org.keycloak.models.ClientModel client)
      Throws ForbiddenException if canManage(ClientModel) returns false.

    • canView

      boolean canView(org.keycloak.models.ClientModel client)
      Returns true if canView() or canConfigure(ClientModel) returns true.

      Or if the caller has a permission to AdminPermissionManagement.VIEW_SCOPE the client.

      For V2 only: Also if the caller has a permission to AdminPermissionsSchema.VIEW all clients.

    • requireView

      void requireView(org.keycloak.models.ClientModel client)
      Throws ForbiddenException if canView(ClientModel) returns false.

    • canManage

      boolean canManage(org.keycloak.models.ClientScopeModel clientScope)
      Returns true if the caller has AdminRoles.MANAGE_CLIENTS role.

      For V2 only: Also if it has permission to AdminPermissionsSchema.MANAGE.

    • requireManage

      void requireManage(org.keycloak.models.ClientScopeModel clientScope)
      Throws ForbiddenException if canManage(ClientScopeModel) returns false.

    • canView

      boolean canView(org.keycloak.models.ClientScopeModel clientScope)
      Returns true if the caller has at least one of the AdminRoles.VIEW_CLIENTS or AdminRoles.MANAGE_CLIENTS roles.

      For V2 only: Also if it has permission to AdminPermissionsSchema.VIEW.

    • requireView

      void requireView(org.keycloak.models.ClientScopeModel clientScope)
      Throws ForbiddenException if canView(ClientScopeModel) returns false.

    • canMapRoles

      boolean canMapRoles(org.keycloak.models.ClientModel client)
      Returns true if the caller has a permission to ClientPermissionManagement.MAP_ROLES_SCOPE for the client.

      For V2 only: Also if the caller has a permission to AdminPermissionsSchema.MAP_ROLES for all clients.

    • canMapCompositeRoles

      boolean canMapCompositeRoles(org.keycloak.models.ClientModel client)
      Returns true if the caller has a permission to ClientPermissionManagement.MAP_ROLES_COMPOSITE_SCOPE for the client.

      For V2 only: Also if the caller has a permission to AdminPermissionsSchema.MAP_ROLES_COMPOSITE for all clients.

    • canMapClientScopeRoles

      boolean canMapClientScopeRoles(org.keycloak.models.ClientModel client)
      Returns true if the caller has a permission to ClientPermissionManagement.MAP_ROLES_CLIENT_SCOPE for the client.

      For V2 only: Also if the caller has a permission to AdminPermissionsSchema.MAP_ROLES_CLIENT_SCOPE for all clients.

    • getAccess

      Map<String,Boolean> getAccess(org.keycloak.models.ClientModel client)

    • getClientIdsByScope

      Set<String> getClientIdsByScope(String scope)
      Returns the IDs of the clients that the current user can perform based on scope.
      Returns:
      Stream of IDs of clients with scope permission.