Package org.keycloak.services.resources.admin.fgap

Interface GroupPermissionEvaluator

public interface GroupPermissionEvaluator
Version:
$Revision: 1 $
Author:
Bill Burke

  • Method Details

    • canList

      boolean canList()
      Returns true if the caller has at least one of AdminRoles.QUERY_GROUPS, AdminRoles.MANAGE_USERS or AdminRoles.VIEW_USERS roles.

      For V2 only: Also if it has a permission to AdminPermissionsSchema.VIEW or AdminPermissionsSchema.MANAGE groups.

    • requireList

      void requireList()
      Throws ForbiddenException if canList() returns false.

    • canManage

      boolean canManage(org.keycloak.models.GroupModel group)
      Returns true if the caller has AdminRoles.MANAGE_USERS role.

      Or if it has a permission to AdminPermissionsSchema.MANAGE the group.

    • requireManage

      void requireManage(org.keycloak.models.GroupModel group)
      Throws ForbiddenException if canManage(GroupModel) returns false.

    • canView

      boolean canView(org.keycloak.models.GroupModel group)
      Returns true if the caller has one of AdminRoles.MANAGE_USERS or AdminRoles.VIEW_USERS roles.

      Or if it has a permission to AdminPermissionsSchema.VIEW the group.

    • requireView

      void requireView(org.keycloak.models.GroupModel group)
      Throws ForbiddenException if canView(GroupModel) returns false.

    • canManage

      boolean canManage()
      Returns true if the caller has AdminRoles.MANAGE_USERS role.

      For V2 only: Also if it has permission to AdminPermissionsSchema.MANAGE groups.

    • requireManage

      void requireManage()
      Throws ForbiddenException if canManage() returns false.

    • canView

      boolean canView()
      Returns true if the caller has one of AdminRoles.MANAGE_USERS or AdminRoles.VIEW_USERS roles.

      Or if it has a permission to AdminPermissionsSchema.VIEW groups.

    • requireView

      void requireView()
      Throws ForbiddenException if canView() returns false.

    • requireViewMembers

      void requireViewMembers(org.keycloak.models.GroupModel group)
      Throws ForbiddenException if canViewMembers(GroupModel) returns false.

    • canManageMembers

      boolean canManageMembers(org.keycloak.models.GroupModel group)
      Returns true if the caller has AdminRoles.MANAGE_USERS role.

      Or if it has a permission to AdminPermissionsSchema.MANAGE_MEMBERS of the group.

    • canManageMembership

      boolean canManageMembership(org.keycloak.models.GroupModel group)
      Returns true if the caller has AdminRoles.MANAGE_USERS role.

      Or if it has a permission to AdminPermissionsSchema.MANAGE_MEMBERSHIP of the group.

    • canViewMembers

      boolean canViewMembers(org.keycloak.models.GroupModel group)
      Returns true if the caller has one of AdminRoles.MANAGE_USERS or AdminRoles.VIEW_USERS roles.

      Or if it has a permission to AdminPermissionsSchema.VIEW_MEMBERS of the group.

    • requireManageMembership

      void requireManageMembership(org.keycloak.models.GroupModel group)
      Throws ForbiddenException if canManageMembership(GroupModel) returns false.

    • requireManageMembers

      void requireManageMembers(org.keycloak.models.GroupModel group)
      Throws ForbiddenException if canManageMembership(GroupModel) returns false.

    • getAccess

      Map<String,Boolean> getAccess(org.keycloak.models.GroupModel group)
      Returns Map with information what access the caller for the provided group has.

    • getGroupIdsWithViewPermission

      Set<String> getGroupIdsWithViewPermission()
      If UserPermissionEvaluator.canView() evaluates to true, returns empty set.
      Returns:
      Stream of IDs of groups with view permission.