modules/keycloak-protocol-cas

Jacek Kowalski

2023-11-24 f3460d82f87591ebf1260e02ef7565f5e8eb00f3

commit \| author \| age
0ad1a9	1	package org.keycloak.protocol.cas.mappers;
MP	2
	3	import org.keycloak.models.*;
	4	import org.keycloak.protocol.ProtocolMapperUtils;
	5	import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
	6	import org.keycloak.provider.ProviderConfigProperty;
89e3d7	7	import org.keycloak.representations.AccessToken;
MP	8	import org.keycloak.utils.RoleResolveUtil;
0ad1a9	9
MP	10	import java.util.*;
89e3d7	11	import java.util.stream.Collectors;
0ad1a9	12
MP	13	public class UserClientRoleMappingMapper extends AbstractUserRoleMappingMapper {
	14
	15	public static final String PROVIDER_ID = "cas-usermodel-client-role-mapper";
	16
	17	private static final List<ProviderConfigProperty> CONFIG_PROPERTIES = new ArrayList<>();
	18
	19	static {
	20
	21	ProviderConfigProperty clientId = new ProviderConfigProperty();
	22	clientId.setName(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_CLIENT_ID);
	23	clientId.setLabel(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_CLIENT_ID_LABEL);
	24	clientId.setHelpText(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_CLIENT_ID_HELP_TEXT);
	25	clientId.setType(ProviderConfigProperty.CLIENT_LIST_TYPE);
	26	CONFIG_PROPERTIES.add(clientId);
	27
	28	ProviderConfigProperty clientRolePrefix = new ProviderConfigProperty();
	29	clientRolePrefix.setName(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_ROLE_PREFIX);
	30	clientRolePrefix.setLabel(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_ROLE_PREFIX_LABEL);
	31	clientRolePrefix.setHelpText(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_ROLE_PREFIX_HELP_TEXT);
	32	clientRolePrefix.setType(ProviderConfigProperty.STRING_TYPE);
	33	CONFIG_PROPERTIES.add(clientRolePrefix);
	34
	35	OIDCAttributeMapperHelper.addTokenClaimNameConfig(CONFIG_PROPERTIES);
	36	}
	37
	38	@Override
	39	public List<ProviderConfigProperty> getConfigProperties() {
	40	return CONFIG_PROPERTIES;
	41	}
	42
	43	@Override
	44	public String getId() {
	45	return PROVIDER_ID;
	46	}
	47
	48	@Override
	49	public String getDisplayType() {
	50	return "User Client Role";
	51	}
	52
	53	@Override
	54	public String getDisplayCategory() {
	55	return TOKEN_MAPPER_CATEGORY;
	56	}
	57
	58	@Override
	59	public String getHelpText() {
	60	return "Map a user client role to a token claim.";
	61	}
	62
	63	@Override
89e3d7	64	public void setAttribute(Map<String, Object> attributes, ProtocolMapperModel mappingModel, UserSessionModel userSession,
MP	65	KeycloakSession session, ClientSessionContext clientSessionCtx) {
0ad1a9	66	String clientId = mappingModel.getConfig().get(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_CLIENT_ID);
MP	67	String rolePrefix = mappingModel.getConfig().get(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_ROLE_PREFIX);
	68
89e3d7	69	if (clientId != null && !clientId.isEmpty()) {
MP	70	AccessToken.Access access = RoleResolveUtil.getResolvedClientRoles(session, clientSessionCtx, clientId, false);
	71	if (access == null) {
	72	return;
	73	}
	74	setAttribute(attributes, mappingModel, access.getRoles(), rolePrefix);
	75	} else {
	76	// If clientId is not specified, we consider all clients
	77	Map<String, AccessToken.Access> allAccess = RoleResolveUtil.getAllResolvedClientRoles(session, clientSessionCtx);
	78	Set<String> allRoles = allAccess.values().stream().filter(Objects::nonNull)
	79	.flatMap(access -> access.getRoles().stream())
	80	.collect(Collectors.toSet());
	81	setAttribute(attributes, mappingModel, allRoles, rolePrefix);
0ad1a9	82	}
MP	83	}
	84
	85	public static ProtocolMapperModel create(String clientId, String clientRolePrefix,
	86	String name, String tokenClaimName) {
	87	ProtocolMapperModel mapper = CASAttributeMapperHelper.createClaimMapper(name, tokenClaimName,
b8d686	88	"String", PROVIDER_ID);
0ad1a9	89	mapper.getConfig().put(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_CLIENT_ID, clientId);
MP	90	mapper.getConfig().put(ProtocolMapperUtils.USER_MODEL_CLIENT_ROLE_MAPPING_ROLE_PREFIX, clientRolePrefix);
	91	return mapper;
	92	}
	93	}