mirror of https://github.com/jacekkow/keycloak-protocol-cas
| commit | author | age | ||
| 0ad1a9 | 1 | package org.keycloak.protocol.cas.mappers; |
| MP | 2 | |
| 3 | import org.keycloak.models.*; | |
| 4 | import org.keycloak.protocol.ProtocolMapperUtils; | |
| 5 | import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper; | |
| 6 | import org.keycloak.provider.ProviderConfigProperty; | |
| 89e3d7 | 7 | import org.keycloak.representations.AccessToken; |
| MP | 8 | import org.keycloak.utils.RoleResolveUtil; |
| 0ad1a9 | 9 | |
| MP | 10 | import java.util.*; |
| 89e3d7 | 11 | import java.util.stream.Collectors; |
| 0ad1a9 | 12 | |
| MP | 13 | public class UserClientRoleMappingMapper extends AbstractUserRoleMappingMapper { |
| 14 | ||
| 15 | public static final String PROVIDER_ID = "cas-usermodel-client-role-mapper"; | |
| 16 | ||
| 17 | private static final List<ProviderConfigProperty> CONFIG_PROPERTIES = new ArrayList<>(); | |
| 18 | ||
| 19 | static { | |
| 20 | ||
| 21 | ProviderConfigProperty clientId = new ProviderConfigProperty(); | |
| 22 | clientId.setName(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_CLIENT_ID); | |
| 23 | clientId.setLabel(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_CLIENT_ID_LABEL); | |
| 24 | clientId.setHelpText(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_CLIENT_ID_HELP_TEXT); | |
| 25 | clientId.setType(ProviderConfigProperty.CLIENT_LIST_TYPE); | |
| 26 | CONFIG_PROPERTIES.add(clientId); | |
| 27 | ||
| 28 | ProviderConfigProperty clientRolePrefix = new ProviderConfigProperty(); | |
| 29 | clientRolePrefix.setName(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_ROLE_PREFIX); | |
| 30 | clientRolePrefix.setLabel(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_ROLE_PREFIX_LABEL); | |
| 31 | clientRolePrefix.setHelpText(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_ROLE_PREFIX_HELP_TEXT); | |
| 32 | clientRolePrefix.setType(ProviderConfigProperty.STRING_TYPE); | |
| 33 | CONFIG_PROPERTIES.add(clientRolePrefix); | |
| 34 | ||
| 35 | OIDCAttributeMapperHelper.addTokenClaimNameConfig(CONFIG_PROPERTIES); | |
| 36 | } | |
| 37 | ||
| 38 | @Override | |
| 39 | public List<ProviderConfigProperty> getConfigProperties() { | |
| 40 | return CONFIG_PROPERTIES; | |
| 41 | } | |
| 42 | ||
| 43 | @Override | |
| 44 | public String getId() { | |
| 45 | return PROVIDER_ID; | |
| 46 | } | |
| 47 | ||
| 48 | @Override | |
| 49 | public String getDisplayType() { | |
| 50 | return "User Client Role"; | |
| 51 | } | |
| 52 | ||
| 53 | @Override | |
| 54 | public String getDisplayCategory() { | |
| 55 | return TOKEN_MAPPER_CATEGORY; | |
| 56 | } | |
| 57 | ||
| 58 | @Override | |
| 59 | public String getHelpText() { | |
| 60 | return "Map a user client role to a token claim."; | |
| 61 | } | |
| 62 | ||
| 63 | @Override | |
| 89e3d7 | 64 | public void setAttribute(Map<String, Object> attributes, ProtocolMapperModel mappingModel, UserSessionModel userSession, |
| MP | 65 | KeycloakSession session, ClientSessionContext clientSessionCtx) { |
| 0ad1a9 | 66 | String clientId = mappingModel.getConfig().get(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_CLIENT_ID); |
| MP | 67 | String rolePrefix = mappingModel.getConfig().get(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_ROLE_PREFIX); |
| 68 | ||
| 89e3d7 | 69 | if (clientId != null && !clientId.isEmpty()) { |
| MP | 70 | AccessToken.Access access = RoleResolveUtil.getResolvedClientRoles(session, clientSessionCtx, clientId, false); |
| 71 | if (access == null) { | |
| 72 | return; | |
| 73 | } | |
| 74 | setAttribute(attributes, mappingModel, access.getRoles(), rolePrefix); | |
| 75 | } else { | |
| 76 | // If clientId is not specified, we consider all clients | |
| 77 | Map<String, AccessToken.Access> allAccess = RoleResolveUtil.getAllResolvedClientRoles(session, clientSessionCtx); | |
| 78 | Set<String> allRoles = allAccess.values().stream().filter(Objects::nonNull) | |
| 79 | .flatMap(access -> access.getRoles().stream()) | |
| 80 | .collect(Collectors.toSet()); | |
| 81 | setAttribute(attributes, mappingModel, allRoles, rolePrefix); | |
| 0ad1a9 | 82 | } |
| MP | 83 | } |
| 84 | ||
| 85 | public static ProtocolMapperModel create(String clientId, String clientRolePrefix, | |
| 86 | String name, String tokenClaimName) { | |
| 87 | ProtocolMapperModel mapper = CASAttributeMapperHelper.createClaimMapper(name, tokenClaimName, | |
| b8d686 | 88 | "String", PROVIDER_ID); |
| 0ad1a9 | 89 | mapper.getConfig().put(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_CLIENT_ID, clientId); |
| MP | 90 | mapper.getConfig().put(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_ROLE_PREFIX, clientRolePrefix); |
| 91 | return mapper; | |
| 92 | } | |
| 93 | } | |
