From b1c0c9d40edcf1877698afb865f46c7f498ce7d7 Mon Sep 17 00:00:00 2001
From: Jacek Kowalski <Jacek@jacekk.info>
Date: Thu, 27 Apr 2023 20:49:29 +0000
Subject: [PATCH] GitHub Actions: limit permissions of GITHUB_TOKEN
---
src/main/java/org/keycloak/protocol/cas/mappers/GroupMembershipMapper.java | 43 ++++++++++++++++++-------------------------
1 files changed, 18 insertions(+), 25 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/mappers/GroupMembershipMapper.java b/src/main/java/org/keycloak/protocol/cas/mappers/GroupMembershipMapper.java
index 6d9c8ac..80870f0 100644
--- a/src/main/java/org/keycloak/protocol/cas/mappers/GroupMembershipMapper.java
+++ b/src/main/java/org/keycloak/protocol/cas/mappers/GroupMembershipMapper.java
@@ -1,22 +1,25 @@
package org.keycloak.protocol.cas.mappers;
-import org.keycloak.models.GroupModel;
-import org.keycloak.models.ProtocolMapperModel;
-import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.*;
import org.keycloak.models.utils.ModelToRepresentation;
-import org.keycloak.protocol.cas.CASLoginProtocol;
import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
import org.keycloak.provider.ProviderConfigProperty;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
public class GroupMembershipMapper extends AbstractCASProtocolMapper {
private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+ private static final String FULL_PATH = "full.path";
+
static {
OIDCAttributeMapperHelper.addTokenClaimNameConfig(configProperties);
ProviderConfigProperty property1 = new ProviderConfigProperty();
- property1.setName("full.path");
+ property1.setName(FULL_PATH);
property1.setLabel("Full group path");
property1.setType(ProviderConfigProperty.BOOLEAN_TYPE);
property1.setDefaultValue("true");
@@ -48,38 +51,28 @@
}
@Override
- public void setAttribute(Map<String, Object> attributes, ProtocolMapperModel mappingModel, UserSessionModel userSession) {
+ public void setAttribute(Map<String, Object> attributes, ProtocolMapperModel mappingModel, UserSessionModel userSession,
+ KeycloakSession session, ClientSessionContext clientSessionCt) {
List<String> membership = new LinkedList<>();
boolean fullPath = useFullPath(mappingModel);
- for (GroupModel group : userSession.getUser().getGroups()) {
+ for (GroupModel group : userSession.getUser().getGroupsStream().collect(Collectors.toSet())) {
if (fullPath) {
membership.add(ModelToRepresentation.buildGroupPath(group));
} else {
membership.add(group.getName());
}
}
- String protocolClaim = mappingModel.getConfig().get(OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME);
-
- attributes.put(protocolClaim, membership);
+ setPlainAttribute(attributes, mappingModel, membership);
}
public static boolean useFullPath(ProtocolMapperModel mappingModel) {
- return "true".equals(mappingModel.getConfig().get("full.path"));
+ return "true".equals(mappingModel.getConfig().get(FULL_PATH));
}
- public static ProtocolMapperModel create(String name, String tokenClaimName,
- boolean consentRequired, String consentText, boolean fullPath) {
- ProtocolMapperModel mapper = new ProtocolMapperModel();
- mapper.setName(name);
- mapper.setProtocolMapper(PROVIDER_ID);
- mapper.setProtocol(CASLoginProtocol.LOGIN_PROTOCOL);
- mapper.setConsentRequired(consentRequired);
- mapper.setConsentText(consentText);
- Map<String, String> config = new HashMap<String, String>();
- config.put(OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME, tokenClaimName);
- config.put("full.path", Boolean.toString(fullPath));
- mapper.setConfig(config);
-
+ public static ProtocolMapperModel create(String name, String tokenClaimName, boolean fullPath) {
+ ProtocolMapperModel mapper = CASAttributeMapperHelper.createClaimMapper(name, tokenClaimName,
+ "String", PROVIDER_ID);
+ mapper.getConfig().put(FULL_PATH, Boolean.toString(fullPath));
return mapper;
}
}
--
Gitblit v1.9.1